EncryptionTokenProvider::__construct() - Code Metrics - Inspection of "Exception system updated" - linna/csrf-guard - Measure and Improve Code Quality continuously with Scrutinizer

Passed
Push — b2.0.0 ( 59ba4e...bb1327 )

by Sebastian
created 2020-12-09 21:59 UTC
EncryptionTokenProvider::__construct() A

↳ Parent: EncryptionTokenProvider
Complexity

Conditions	1
Paths	1
Size

Total Lines	15
Code Lines	7
Duplication

Lines	0
Ratio	0 %
Code Coverage

Tests	8
CRAP Score	1
Importance

Changes	1
Bugs	0	Features	0
Metric	Value
eloc	7
c	1
b	0
f	0
dl	0
loc	15
ccs	8
cts	8
cp	1
rs	10
cc	1
nc	1
nop	3
crap	1
<?php

/**
 * Linna Cross-site Request Forgery Guard
 *
 * @author Sebastian Rapetti <[email protected]>
 * @copyright (c) 2020, Sebastian Rapetti
 * @license http://opensource.org/licenses/MIT MIT License
 */
declare(strict_types=1);

namespace Linna\CsrfGuard\Provider;

use Linna\CsrfGuard\Exception\BadExpireException;
use Linna\CsrfGuard\Exception\BadStorageSizeException;
use Linna\CsrfGuard\Exception\BadExpireTrait;
use Linna\CsrfGuard\Exception\BadStorageSizeTrait;

/**
 * Csrf Encryption Based Token Pattern Provider.
 *
 * It use sodium_crypto_aead_xchacha20poly1305_ietf_encrypt fuction to encrypt
 * the token. Key change every session, nonce change for every token.
 */
class EncryptionTokenProvider implements TokenProviderInterface
{
    use BadExpireTrait, BadStorageSizeTrait;

    /**
     * @var string CSRF_ENCRYPTION_KEY Encryption key name in session array
     */
    private const CSRF_ENCRYPTION_KEY = 'csrf_encryption_key';

    /**
     * @var string CSRF_ENCRYPTION_NONCE Encryption nonce name in session array
     */
    private const CSRF_ENCRYPTION_NONCE = 'csrf_encryption_nonce';

    /**
     * @var string $sessionId Session id of the current session
     */
    private string $sessionId = '';

    /**
     * @var int $sessionIdLen Session id lenght
     */
    private int $sessionIdLen = 0;

    /**
     * @var int $expire Token validity in seconds, default 600 -> 10 minutes
     */
    private int $expire = 0;

    /**
     * @var int $storageSize Maximum token nonces stored in session
     */
    private int $storageSize = 0;

    /**
     * Class constructor.
     *
     * @param string $sessionId   Session id of the current session
     * @param int    $expire      Token validity in seconds, default 600 -> 10 minutes
     * @param int    $storageSize Maximum token nonces stored in session
     *
     * @throws BadExpireException      If $expire is less than 0 and greater than 86400
     * @throws BadStorageSizeException If $storageSize is less than 2 and greater than 64
     */
    public function __construct(string $sessionId, int $expire = 600, int $storageSize = 10)
    {
        // from BadExpireTrait, BadStorageSizeTrait
        /** @throws BadExpireException */
        $this->checkBadExpire($expire);
        /** @throws BadStorageSizeException */
        $this->checkBadStorageSize($storageSize);

        $this->sessionId = $sessionId;
        $this->sessionIdLen = \strlen($sessionId);
        $this->expire = $expire;
        $this->storageSize = $storageSize;

        //if no nonce stored, initialize the session storage
        $_SESSION[static::CSRF_ENCRYPTION_NONCE] ??= [];
    }

    /**
     * Return new Encryption based Token.
     *
     * @return string A hex token
     */
    public function getToken(): string
    {
        //get the key for encryption
        $key = $this->getKey(); //random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES);
        //get a new nonce for encryption
        $nonce = $this->getNonce(); //random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);

        //get current time
        $time = \base_convert((string) \time(), 10, 16);
        //build message
        $message = $this->sessionId.$time;

        //create ciphertext
        //https://www.php.net/manual/en/function.sodium-crypto-aead-xchacha20poly1305-ietf-encrypt.php
        //https://libsodium.gitbook.io/doc/secret-key_cryptography/aead/chacha20-poly1305/ietf_chacha20-poly1305_construction
        $ciphertext = \sodium_crypto_aead_xchacha20poly1305_ietf_encrypt($message, '', $nonce, $key);
        $ciphertext = /** @scrutinizer ignore-call */ \sodium_crypto_aead_xchacha20poly1305_ietf_encrypt($message, '', $nonce, $key);

        return \sodium_bin2hex($ciphertext);
    }

    /**
     * Validate Encryption based Token.
     *
     * @param string $token Token must be validated, hex format
     *
     * @return bool
     */
    public function validate(string $token): bool
    {
        //convert hex token to raw bytes
        $hex_token = \sodium_hex2bin($token);

        // plain text returned from check encryption
        $plainText = '';

        //plainText variable is passed as reference,
        //if checkEncrption method end without errors then checkTime method
        //receive a filled plainText variable as argument else
        //short circuiting make the if block skipped
        if ($this->checkEncryption($hex_token, $plainText) && $this->checkTime($plainText)) {
            return true;
        }

        return false;
    }

    /**
     * Check if token is expired.
     *
     * @param string $token Token after decryption
     *
     * @return bool
     */
    private function checkTime(string $token): bool
    {
        $time = \substr($token, $this->sessionIdLen);

        //timestamp from token time
        $timestamp = (int) \base_convert($time, 16, 10);

        //token expiration check
        if ($timestamp + $this->expire < \time()) {
            return false;
        }

        return true;
    }

    /**
     * Try to decrypt a token.
     *
     * @param string $encryptedToken Encrypted token
     * @param string $plainText      Variable passed as reference to store the result
     *
     * @return bool
     */
    private function checkEncryption(string $encryptedToken, string &$plainText): bool
    {
        //get the key for encryption
        $key = $this->getKey();
        //reference to nonce storage in session
        $nonces = &$_SESSION[static::CSRF_ENCRYPTION_NONCE];
        //get current size of nonce storage in session
        $size = \count($nonces);

        //try to decrypt starting from last stored nonce
        for ($i = $size -1; $i > -1; $i--) {
            //for successful decryption return true
            if (($tmpPlainText = \sodium_crypto_aead_xchacha20poly1305_ietf_decrypt($encryptedToken, '', $nonces[$i], $key))) {
            if (($tmpPlainText = /** @scrutinizer ignore-call */ \sodium_crypto_aead_xchacha20poly1305_ietf_decrypt($encryptedToken, '', $nonces[$i], $key))) {
                //plainText will remain string if sodium_crypto return false
                //todo, check in php source code if sodium_crypto
                //return false if fail
                $plainText = $tmpPlainText;
                return true;
            }
        }

        return false;
    }

    /**
     * Return the encryption key for the currente session.
     * Generate a different key for every session.
     *
     * @return string
     */
    private function getKey(): string
    {
        //if key is already stored, return it
        if (isset($_SESSION[static::CSRF_ENCRYPTION_KEY])) {
            return $_SESSION[static::CSRF_ENCRYPTION_KEY];
        }

        //generate new key
        $key = \random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES);


        //store new key
        $_SESSION[static::CSRF_ENCRYPTION_KEY] = $key;

        return $key;
    }

    /**
     * Generate a new nonce for encrypt the token.
     *
     * @return string
     */
    private function getNonce(): string
    {
        //generate new nonce
        $nonce = \random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);


        //store new nonce
        $_SESSION[static::CSRF_ENCRYPTION_NONCE][] = $nonce;

        //check if the storage is growt beyond the maximun size
        if (\count($_SESSION[static::CSRF_ENCRYPTION_NONCE]) > $this->storageSize) {
            //remove the oldest stores nonce
            \array_shift($_SESSION[static::CSRF_ENCRYPTION_NONCE]);
        }

        return $nonce;
    }
}

linna / csrf-guard

Push — b2.0.0 ( 59ba4e...bb1327 )

EncryptionTokenProvider::__construct() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like
