lekoala /
silverstripe-encrypt
| Total Complexity | 56 |
| Total Lines | 410 |
| Duplicated Lines | 0 % |
| Changes | 3 | ||
| Bugs | 0 | Features | 1 |
Complex classes like EncryptHelper often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use EncryptHelper, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 26 | class EncryptHelper |
||
| 27 | { |
||
| 28 | const BORING = "brng"; |
||
| 29 | const MODERN = "nacl"; |
||
| 30 | const FIPS = "fips"; |
||
| 31 | |||
| 32 | /** |
||
| 33 | * @var CipherSweet |
||
| 34 | */ |
||
| 35 | protected static $ciphersweet; |
||
| 36 | |||
| 37 | /** |
||
| 38 | * @var array |
||
| 39 | */ |
||
| 40 | protected static $field_cache = []; |
||
| 41 | |||
| 42 | /** |
||
| 43 | * @var string |
||
| 44 | */ |
||
| 45 | protected static $forcedEncryption = null; |
||
| 46 | |||
| 47 | /** |
||
| 48 | * @var bool |
||
| 49 | */ |
||
| 50 | protected static $automaticRotation = true; |
||
| 51 | |||
| 52 | /** |
||
| 53 | * @return string |
||
| 54 | */ |
||
| 55 | public static function getForcedEncryption() |
||
| 56 | { |
||
| 57 | return self::$forcedEncryption; |
||
| 58 | } |
||
| 59 | |||
| 60 | /** |
||
| 61 | * @param string $forcedEncryption brng|nacl|fips |
||
| 62 | * @return void |
||
| 63 | */ |
||
| 64 | public static function setForcedEncryption($forcedEncryption) |
||
| 70 | } |
||
| 71 | |||
| 72 | /** |
||
| 73 | * This would only work if you changed from algorithm |
||
| 74 | * @return bool |
||
| 75 | */ |
||
| 76 | public static function getAutomaticRotation() |
||
| 77 | { |
||
| 78 | return self::$automaticRotation; |
||
| 79 | } |
||
| 80 | |||
| 81 | /** |
||
| 82 | * @param bool $setAutomaticRotation |
||
| 83 | * @return void |
||
| 84 | */ |
||
| 85 | public static function setAutomaticRotation($automaticRotation) |
||
| 86 | { |
||
| 87 | self::$automaticRotation = $automaticRotation; |
||
| 88 | } |
||
| 89 | |||
| 90 | /** |
||
| 91 | * @link https://github.com/paragonie/ciphersweet/issues/62 |
||
| 92 | * @param array $ciphertext |
||
| 93 | * @return array |
||
| 94 | */ |
||
| 95 | public static function removeNulls($ciphertext) |
||
| 96 | { |
||
| 97 | foreach ($ciphertext as $k => $v) { |
||
| 98 | if ($v === null) { |
||
| 99 | $ciphertext[$k] = ''; |
||
| 100 | } |
||
| 101 | } |
||
| 102 | return $ciphertext; |
||
| 103 | } |
||
| 104 | |||
| 105 | /** |
||
| 106 | * Attempting to pass a key of an invalid size (i.e. not 256-bit) will result in a CryptoOperationException being thrown. |
||
| 107 | * The recommended way to generate a key is to use this method |
||
| 108 | * |
||
| 109 | * @return string Something like 4e1c44f87b4cdf21808762970b356891db180a9dd9850e7baf2a79ff3ab8a2fc |
||
| 110 | */ |
||
| 111 | public static function generateKey() |
||
| 114 | } |
||
| 115 | |||
| 116 | /** |
||
| 117 | * Get app encryption key |
||
| 118 | * Encryption key should be provided in your $_ENV or .env file |
||
| 119 | * |
||
| 120 | * @return string |
||
| 121 | */ |
||
| 122 | public static function getKey() |
||
| 123 | { |
||
| 124 | $key = Environment::getEnv('ENCRYPTION_KEY'); |
||
| 125 | if (!$key) { |
||
| 126 | $key = self::generateKey(); |
||
| 127 | throw new Exception("Please define an ENCRYPTION_KEY in your environment. You can use this one: $key"); |
||
| 128 | } |
||
| 129 | return $key; |
||
| 130 | } |
||
| 131 | |||
| 132 | /** |
||
| 133 | * @return string |
||
| 134 | */ |
||
| 135 | public static function getOldKey() |
||
| 136 | { |
||
| 137 | return Environment::getEnv('OLD_ENCRYPTION_KEY'); |
||
| 138 | } |
||
| 139 | |||
| 140 | /** |
||
| 141 | * @param string $key |
||
| 142 | * @return StringProvider |
||
| 143 | */ |
||
| 144 | public static function getProviderWithKey($key = null) |
||
| 145 | { |
||
| 146 | if ($key === null) { |
||
| 147 | $key = self::getKey(); |
||
| 148 | } |
||
| 149 | return new StringProvider($key); |
||
| 150 | } |
||
| 151 | |||
| 152 | /** |
||
| 153 | * @return BackendInterface |
||
| 154 | */ |
||
| 155 | public static function getRecommendedBackend() |
||
| 156 | { |
||
| 157 | if (version_compare(phpversion(), '7.2', '<')) { |
||
| 158 | return new FIPSCrypto(); |
||
| 159 | } |
||
| 160 | return new BoringCrypto(); |
||
| 161 | } |
||
| 162 | |||
| 163 | /** |
||
| 164 | * @param string $encryption |
||
| 165 | * @return BackendInterface |
||
| 166 | */ |
||
| 167 | public static function getBackendForEncryption($encryption = null) |
||
| 168 | { |
||
| 169 | if (!$encryption) { |
||
| 170 | return self::getRecommendedBackend(); |
||
| 171 | } |
||
| 172 | switch ($encryption) { |
||
| 173 | case self::BORING: |
||
| 174 | return new BoringCrypto(); |
||
| 175 | case self::MODERN: |
||
| 176 | return new ModernCrypto(); |
||
| 177 | case self::FIPS: |
||
| 178 | return new FIPSCrypto(); |
||
| 179 | } |
||
| 180 | throw new Exception("Unsupported encryption $encryption"); |
||
| 181 | } |
||
| 182 | |||
| 183 | /** |
||
| 184 | * @param BackendInterface $backend |
||
| 185 | * @param string $key |
||
| 186 | * @return CipherSweet |
||
| 187 | */ |
||
| 188 | public static function getEngineForEncryption($encryption = null, $key = null) |
||
| 191 | } |
||
| 192 | |||
| 193 | /** |
||
| 194 | * @param BackendInterface $backend |
||
| 195 | * @param string $key |
||
| 196 | * @return CipherSweet |
||
| 197 | */ |
||
| 198 | public static function getEngine(BackendInterface $backend, $key = null) |
||
| 199 | { |
||
| 200 | $provider = self::getProviderWithKey($key); |
||
| 201 | return new CipherSweet($provider, $backend); |
||
| 202 | } |
||
| 203 | |||
| 204 | /** |
||
| 205 | * @return CipherSweet |
||
| 206 | */ |
||
| 207 | public static function getCipherSweet() |
||
| 208 | { |
||
| 209 | if (self::$ciphersweet) { |
||
| 210 | return self::$ciphersweet; |
||
| 211 | } |
||
| 212 | $provider = self::getProviderWithKey(); |
||
| 213 | if (self::$forcedEncryption) { |
||
| 214 | $backend = self::getBackendForEncryption(self::$forcedEncryption); |
||
| 215 | } else { |
||
| 216 | $backend = self::getRecommendedBackend(); |
||
| 217 | } |
||
| 218 | self::$ciphersweet = new CipherSweet($provider, $backend); |
||
| 219 | return self::$ciphersweet; |
||
| 220 | } |
||
| 221 | |||
| 222 | /** |
||
| 223 | * @return void |
||
| 224 | */ |
||
| 225 | public static function clearCipherSweet() |
||
| 226 | { |
||
| 227 | self::$ciphersweet = null; |
||
| 228 | } |
||
| 229 | |||
| 230 | /** |
||
| 231 | * @return BackendInterface |
||
| 232 | */ |
||
| 233 | public static function getCipherSweetBackend() |
||
| 234 | { |
||
| 235 | return self::getCipherSweet()->getBackend(); |
||
| 236 | } |
||
| 237 | |||
| 238 | /** |
||
| 239 | * Check if a value is encrypted |
||
| 240 | * |
||
| 241 | * @param string $value |
||
| 242 | * @return boolean |
||
| 243 | */ |
||
| 244 | public static function isEncrypted($value) |
||
| 245 | { |
||
| 246 | $prefix = substr($value, 0, 5); |
||
| 247 | return in_array($prefix, ["brng:", "nacl:", "fips:"]); |
||
| 248 | } |
||
| 249 | |||
| 250 | /** |
||
| 251 | * @param string $value |
||
| 252 | * @return boolean |
||
| 253 | */ |
||
| 254 | public static function isFips($value) |
||
| 255 | { |
||
| 256 | if (strpos($value, 'fips:') === 0) { |
||
| 257 | return true; |
||
| 258 | } |
||
| 259 | return false; |
||
| 260 | } |
||
| 261 | |||
| 262 | /** |
||
| 263 | * @param string $value |
||
| 264 | * @return boolean |
||
| 265 | */ |
||
| 266 | public static function isNacl($value) |
||
| 272 | } |
||
| 273 | |||
| 274 | /** |
||
| 275 | * @param string $value |
||
| 276 | * @return boolean |
||
| 277 | */ |
||
| 278 | public static function isBoring($value) |
||
| 279 | { |
||
| 280 | if (strpos($value, 'brng:') === 0) { |
||
| 281 | return true; |
||
| 282 | } |
||
| 283 | return false; |
||
| 284 | } |
||
| 285 | |||
| 286 | /** |
||
| 287 | * @param string $value |
||
| 288 | * @return string |
||
| 289 | */ |
||
| 290 | public static function getEncryption($value) |
||
| 291 | { |
||
| 292 | if (self::isBoring($value)) { |
||
| 293 | return self::BORING; |
||
| 294 | } |
||
| 295 | if (self::isNacl($value)) { |
||
| 296 | return self::MODERN; |
||
| 297 | } |
||
| 298 | if (self::isFips($value)) { |
||
| 299 | return self::FIPS; |
||
| 300 | } |
||
| 301 | return false; |
||
|
Bug
Best Practice
introduced
by
|
|||
| 302 | } |
||
| 303 | |||
| 304 | /** |
||
| 305 | * Check if a field is encrypted on a class |
||
| 306 | * This relies on a field class starting with Encrypted |
||
| 307 | * |
||
| 308 | * @param string $class |
||
| 309 | * @param string $field |
||
| 310 | * @return boolean |
||
| 311 | */ |
||
| 312 | public static function isEncryptedField($class, $field) |
||
| 313 | { |
||
| 314 | $key = $class . '_' . $field; |
||
| 315 | if (isset(self::$field_cache[$key])) { |
||
| 316 | return self::$field_cache[$key]; |
||
| 317 | } |
||
| 318 | |||
| 319 | $fields = $class::config()->db; |
||
| 320 | |||
| 321 | if (isset($fields[$field])) { |
||
| 322 | $dbClass = $fields[$field]; |
||
| 323 | self::$field_cache[$key] = strpos($dbClass, 'Encrypted') !== false; |
||
| 324 | } else { |
||
| 325 | self::$field_cache[$key] = false; |
||
| 326 | } |
||
| 327 | return self::$field_cache[$key]; |
||
| 328 | } |
||
| 329 | |||
| 330 | /** |
||
| 331 | * @param string $class |
||
| 332 | * @param bool $dbFields |
||
| 333 | * @return array |
||
| 334 | */ |
||
| 335 | public static function getEncryptedFields($class, $dbFields = false) |
||
| 355 | } |
||
| 356 | |||
| 357 | /** |
||
| 358 | * A simple encryption |
||
| 359 | * @param string $value |
||
| 360 | * @return string |
||
| 361 | */ |
||
| 362 | public static function encrypt($value) |
||
| 363 | { |
||
| 364 | // Do not encrypt twice |
||
| 365 | $encryption = self::getEncryption($value); |
||
| 366 | if ($encryption) { |
||
| 367 | return $value; |
||
| 368 | } |
||
| 369 | $provider = self::getProviderWithKey(); |
||
| 370 | $backend = self::getBackendForEncryption($encryption); |
||
| 371 | return $backend->encrypt($value, $provider->getSymmetricKey()); |
||
| 372 | } |
||
| 373 | |||
| 374 | /** |
||
| 375 | * A simple decryption |
||
| 376 | * @param string $value |
||
| 377 | * @return string |
||
| 378 | */ |
||
| 379 | public static function decrypt($value) |
||
| 389 | } |
||
| 390 | |||
| 391 | /** |
||
| 392 | * Return a map of fields with their encrypted counterpart |
||
| 393 | * |
||
| 394 | * @return array |
||
| 395 | */ |
||
| 396 | public static function mapEncryptionDBField() |
||
| 397 | { |
||
| 398 | return [ |
||
| 399 | DBHTMLText::class => EncryptedDBHTMLText::class, |
||
| 400 | DBText::class => EncryptedDBText::class, |
||
| 401 | DBVarchar::class => EncryptedDBVarchar::class, |
||
| 402 | ]; |
||
| 403 | } |
||
| 404 | |||
| 405 | /** |
||
| 406 | * Compute Blind Index Information Leaks |
||
| 407 | * |
||
| 408 | * @link https://ciphersweet.paragonie.com/security |
||
| 409 | * @param array $indexes |
||
| 410 | * @param int $R |
||
| 411 | * @return float |
||
| 412 | */ |
||
| 413 | public static function coincidenceCount(array $indexes, $R) |
||
| 421 | } |
||
| 422 | |||
| 423 | /** |
||
| 424 | * Send a decrypted file |
||
| 425 | * |
||
| 426 | * @param File $file |
||
| 427 | * @return void |
||
| 428 | */ |
||
| 429 | public static function sendEncryptedFile(File $file) |
||
| 436 | } |
||
| 437 | } |
||
| 438 |
Loading history...