XmlSignatureValidator::loadPublicKey() - Code Metrics - Inspection of "Sign and validate XML from memory #5" - selective-php/xmldsig - Measure and Improve Code Quality continuously with Scrutinizer

Passed
Push — master ( c7dd0a...05e73b )

by Daniel
created 2021-02-13 12:31 UTC
XmlSignatureValidator::loadPublicKey() A

↳ Parent: XmlSignatureValidator
Complexity

Conditions	2
Paths	2
Size

Total Lines	6
Code Lines	3
Duplication

Lines	0
Ratio	0 %
Code Coverage

Tests	3
CRAP Score	2.0625
Importance

Changes
Metric	Value
eloc	3
c	0
b	0
f	0
dl	0
loc	6
ccs	3
cts	4
cp	0.75
rs	10
cc	2
nc	2
nop	1
crap	2.0625
<?php

namespace Selective\XmlDSig;

use DOMDocument;
use DOMElement;
use DOMXPath;
use Selective\XmlDSig\Exception\XmlSignatureValidatorException;

/**
 * Verify the Digital Signatures of XML Documents.
 */
final class XmlSignatureValidator
{
    //
    // RSA (PKCS#1 v1.5) Identifier
    // https://www.w3.org/TR/xmldsig-core/#sec-PKCS1
    //
    private const SHA1_URL = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1';
    private const SHA224_URL = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224';
    private const SHA256_URL = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
    private const SHA384_URL = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384';
    private const SHA512_URL = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512';

    /**
     * @var resource|false
     */
    private $publicKeyId;

    /**
     * @var XmlReader
     */
    private $xmlReader;

    /**
     * The constructor.
     */
    public function __construct()
    {
        $this->xmlReader = new XmlReader();
    }

    /**
     * Read and load the pfx file.
     *
     * @param string $filename PFX filename
     * @param string $password PFX password
     *
     * @throws XmlSignatureValidatorException
     *
     * @return void
     */
    public function loadPfxFile(string $filename, string $password)
    {
        if (!file_exists($filename)) {
            throw new XmlSignatureValidatorException(sprintf('File not found: %s', $filename));
        }

        $pkcs12 = file_get_contents($filename);

        if (!$pkcs12) {
            throw new XmlSignatureValidatorException(sprintf('File could not be read: %s', $filename));
        }

        $this->loadPfx($pkcs12, $password);
    }

    /**
     * Read and load the pfx file.
     *
     * @param string $pkcs12 The certificate store data
     * @param string $password encryption password for unlocking the PKCS12 file
     *
     * @throws XmlSignatureValidatorException
     *
     * @return void
     */
    public function loadPfx(string $pkcs12, string $password): void
    {
        $status = openssl_pkcs12_read($pkcs12, $certificates, $password);

        if (!$status) {
            throw new XmlSignatureValidatorException('Invalid PFX password');
        }

        $this->publicKeyId = openssl_get_publickey($certificates['cert']);


        if (!$this->publicKeyId) {
            throw new XmlSignatureValidatorException('Invalid public key');
        }
    }

    /**
     * Read and load the public key file.
     *
     * @param string $filename The public key file
     *
     * @throws XmlSignatureValidatorException
     *
     * @return void
     */
    public function loadPublicKeyFile(string $filename): void
    {
        if (!file_exists($filename)) {
            throw new XmlSignatureValidatorException(sprintf('File not found: %s', $filename));
        }

        $publicKey = file_get_contents($filename);

        if (!$publicKey) {
            throw new XmlSignatureValidatorException(sprintf('File could not be read: %s', $filename));
        }

        $this->loadPublicKey($publicKey);
    }

    /**
     * Load the public key content.
     *
     * @param string $publicKey The public key data
     *
     * @throws XmlSignatureValidatorException
     *
     * @return void
     */
    public function loadPublicKey(string $publicKey): void
    {
        $this->publicKeyId = openssl_get_publickey($publicKey);


        if (!$this->publicKeyId) {
            throw new XmlSignatureValidatorException('Invalid public key');
        }
    }

    /**
     * Sign an XML file and save the signature in a new file.
     * This method does not save the public key within the XML file.
     *
     * https://www.xml.com/pub/a/2001/08/08/xmldsig.html#verify
     *
     * @param string $filename Input file
     *
     * @throws XmlSignatureValidatorException
     *
     * @return bool Success
     */
    public function verifyXmlFile(string $filename): bool
    {
        if (!file_exists($filename)) {
            throw new XmlSignatureValidatorException(sprintf('File not found: %s', $filename));
        }

        if (!$this->publicKeyId) {
            throw new XmlSignatureValidatorException('No public key provided');
        }

        $xmlContent = file_get_contents($filename);

        if (!$xmlContent) {
            throw new XmlSignatureValidatorException(sprintf('File could not be read: %s', $filename));
        }

        return $this->verifyXml($xmlContent);
    }

    /**
     * Sign an XML string.
     *
     * https://www.xml.com/pub/a/2001/08/08/xmldsig.html#verify
     *
     * @param string $xmlContent The xml content
     *
     * @throws XmlSignatureValidatorException
     *
     * @return bool Success
     */
    public function verifyXml(string $xmlContent): bool
    {
        // Read the xml file content
        $xml = new DOMDocument();
        $xml->preserveWhiteSpace = true;
        $xml->formatOutput = false;
        $isValid = $xml->loadXML($xmlContent);

        if (!$isValid || !$xml->documentElement) {
            throw new XmlSignatureValidatorException('Invalid XML content');
        }

        $digestAlgorithm = $this->getDigestAlgorithm($xml);
        $signatureValue = $this->getSignatureValue($xml);
        $xpath = new DOMXPath($xml);
        $xpath->registerNamespace('xmlns', 'http://www.w3.org/2000/09/xmldsig#');

        /** @var DOMElement $signedInfoNode */
        foreach ($xpath->evaluate('//xmlns:Signature/xmlns:SignedInfo') as $signedInfoNode) {
            // Remove SignatureValue value
            $signatureValueElement = $this->xmlReader->queryDomNode($xpath, '//xmlns:SignatureValue', $signedInfoNode);
            $signatureValueElement->nodeValue = '';

            $canonicalData = $signedInfoNode->C14N(true, false);

            $xml2 = new DOMDocument();
            $xml2->preserveWhiteSpace = true;
            $xml2->formatOutput = true;
            $xml2->loadXML($canonicalData);
            $canonicalData = $xml2->C14N(true, false);

            $status = openssl_verify($canonicalData, $signatureValue, $this->publicKeyId, $digestAlgorithm);

            if ($status === 1) {
                // The XML signature is valid
                return true;
            }

            if ($status === 0) {
                // The XML signature is not valid
                return false;
            }

            throw new XmlSignatureValidatorException('Error checking signature');
        }

        // @todo check digest value
        //$digestValue = $this->getDigestValue($xml);
        //$signatureNodes = $xpath->query('//xmlns:Signature');

        // Canonicalize the content, exclusive and without comments
        //$canonicalData = $xml->documentElement->C14N(true, false);

        //foreach ($xpath->evaluate('//xmlns:Signature/xmlns:SignedInfo') as $signedInfoNode) {
        // $signedInfoNode->parentNode->removeChild($signedInfoNode);
        // }

        return false;
    }

    /**
     * Detect digest algorithm.
     *
     * @param DOMDocument $xml The xml document
     *
     * @throws XmlSignatureValidatorException
     *
     * @return int The algorithm code
     */
    private function getDigestAlgorithm(DOMDocument $xml): int
    {
        $xpath = new DOMXPath($xml);
        $xpath->registerNamespace('xmlns', 'http://www.w3.org/2000/09/xmldsig#');
        $xpath->registerNamespace('Algorithm', 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315');

        $signatureMethodNodes = $xpath->query('//xmlns:Signature/xmlns:SignedInfo/xmlns:SignatureMethod');

        // Throw an exception if no signature was found.
        if (!$signatureMethodNodes || $signatureMethodNodes->length < 1) {

            throw new XmlSignatureValidatorException('Verification failed: No Signature was found in the document.');
        }

        // We only support one signature for the entire XML document.
        // Throw an exception if more than one signature was found.
        if ($signatureMethodNodes->length > 1) {
            throw new XmlSignatureValidatorException(
                'Verification failed: More that one signature was found for the document.'
            );
        }

        /** @var DOMElement $element */
        $element = $signatureMethodNodes->item(0);
        if (!$element instanceof DOMElement) {

            throw new XmlSignatureValidatorException(
                'Verification failed: Signature algorithm was found for the document.'
            );
        }

        $algorithm = $element->getAttribute('Algorithm');

        switch ($algorithm) {
            case self::SHA1_URL:
                return OPENSSL_ALGO_SHA1;
            case self::SHA224_URL:
                return OPENSSL_ALGO_SHA224;
            case self::SHA256_URL:
                return OPENSSL_ALGO_SHA256;
            case self::SHA384_URL:
                return OPENSSL_ALGO_SHA384;
            case self::SHA512_URL:
                return OPENSSL_ALGO_SHA512;
            default:
                throw new XmlSignatureValidatorException("Cannot verify: Unsupported Algorithm <$algorithm>");
        }
    }

    /**
     * Get signature value.
     *
     * @param DOMDocument $xml The xml document
     *
     * @throws XmlSignatureValidatorException
     *
     * @return string The signature value
     */
    private function getSignatureValue(DOMDocument $xml): string
    {
        $xpath = new DOMXPath($xml);
        $xpath->registerNamespace('xmlns', 'http://www.w3.org/2000/09/xmldsig#');

        // Find the SignatureValue node
        $signatureNodes = $xpath->query('//xmlns:Signature/xmlns:SignatureValue');

        // Throw an exception if no signature was found.
        if (!$signatureNodes || $signatureNodes->length < 1) {

            throw new XmlSignatureValidatorException('Verification failed: No Signature was found in the document.');
        }

        // We only support one signature for the entire XML document.
        // Throw an exception if more than one signature was found.
        if ($signatureNodes->length > 1) {
            throw new XmlSignatureValidatorException(
                'Verification failed: More that one signature was found for the document.'
            );
        }

        $domNode = $signatureNodes->item(0);
        if (!$domNode) {
            throw new XmlSignatureValidatorException(
                'Verification failed: No Signature item was found in the document.'
            );
        }

        $result = base64_decode($domNode->nodeValue, true);

        if ($result === false) {
            throw new XmlSignatureValidatorException('Verification failed: Invalid base64 data.');
        }

        return (string)$result;
    }

    /**
     * Destructor.
     */
    public function __destruct()
    {
        // Free the key from memory
        // PHP 8 deprecates openssl_free_key and automatically destroys the key instance when it goes out of scope.
        if ($this->publicKeyId && version_compare(PHP_VERSION, '8.0.0', '<')) {
            openssl_free_key($this->publicKeyId);
            openssl_free_key(/** @scrutinizer ignore-type */ $this->publicKeyId);
        }
    }

    /**
     * Get the digest value.
     *
     * @param DOMDocument $xml The xml document
     *
     * @throws XmlSignatureValidatorException
     *
     * @return string The signature value
     */
    private function getDigestValue(DOMDocument $xml): string

    {
        $xpath = new DOMXPath($xml);
        $xpath->registerNamespace('xmlns', 'http://www.w3.org/2000/09/xmldsig#');

        // Find the DigestValue node
        $signatureNodes = $xpath->query('//xmlns:Signature/xmlns:SignedInfo/xmlns:Reference/xmlns:DigestValue');

        // Throw an exception if no signature was found.
        if (!$signatureNodes || $signatureNodes->length < 1) {

            throw new XmlSignatureValidatorException('Verification failed: No Signature was found in the document.');
        }

        // We only support one signature for the entire XML document.
        // Throw an exception if more than one signature was found.
        if ($signatureNodes->length > 1) {
            throw new XmlSignatureValidatorException(
                'Verification failed: More that one signature was found for the document.'
            );
        }

        $domNode = $signatureNodes->item(0);
        if (!$domNode) {
            throw new XmlSignatureValidatorException(
                'Verification failed: No Signature item was found in the document.'
            );
        }

        $result = base64_decode($domNode->nodeValue, true);

        if ($result === false) {
            throw new XmlSignatureValidatorException('Verification failed: Invalid base64 data.');
        }

        return (string)$result;
    }
}

selective-php / xmldsig

Push — master ( c7dd0a...05e73b )

XmlSignatureValidator::loadPublicKey() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like
