Skip to content

Commit bc68eb6

Browse files
tvdijentvdijen
committed
Rationalize algorithm blacklist code
1 parent ad6282d commit bc68eb6

10 files changed

+37
-64
lines changed

‎src/Alg/Encryption/EncryptionAlgorithmFactory.php

+7-6
Original file line numberDiff line numberDiff line change
@@ -60,16 +60,16 @@ final class EncryptionAlgorithmFactory
6060
/**
6161
* Build a factory that creates algorithms.
6262
*
63-
* @param string[]|null $blacklist A list of algorithms forbidden for their use.
63+
* @param string[] $blacklist A list of algorithms forbidden for their use.
6464
*/
6565
public function __construct(
66-
protected ?array $blacklist = self::DEFAULT_BLACKLIST,
66+
protected array $blacklist = self::DEFAULT_BLACKLIST,
6767
) {
6868
// initialize the cache for supported algorithms per known implementation
69-
if (!self::$initialized && $blacklist !== null) {
69+
if (!self::$initialized) {
7070
foreach (self::SUPPORTED_DEFAULTS as $algorithm) {
7171
foreach ($algorithm::getSupportedAlgorithms() as $algId) {
72-
if (array_key_exists($algId, self::$cache)) {
72+
if (array_key_exists($algId, self::$cache) && !array_key_exists($algId, $this->blacklist)) {
7373
/*
7474
* If the key existed before initialization, that means someone registered a handler for this
7575
* algorithm, so we should respect that and skip registering the default here.
@@ -101,8 +101,9 @@ public function getAlgorithm(
101101
#[\SensitiveParameter]
102102
KeyInterface $key,
103103
): EncryptionAlgorithmInterface {
104-
Assert::false(
105-
($this->blacklist !== null) && in_array($algId, $this->blacklist, true),
104+
Assert::notInArray(
105+
$algId,
106+
$this->blacklist,
106107
sprintf('Blacklisted algorithm: \'%s\'.', $algId),
107108
BlacklistedAlgorithmException::class,
108109
);

‎src/Alg/KeyTransport/KeyTransportAlgorithmFactory.php

+6-5
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,13 @@ class KeyTransportAlgorithmFactory
5858
/**
5959
* Build a factory that creates algorithms.
6060
*
61-
* @param string[]|null $blacklist A list of algorithms forbidden for their use.
61+
* @param string[] $blacklist A list of algorithms forbidden for their use.
6262
*/
6363
public function __construct(
64-
protected ?array $blacklist = self::DEFAULT_BLACKLIST,
64+
protected array $blacklist = self::DEFAULT_BLACKLIST,
6565
) {
6666
// initialize the cache for supported algorithms per known implementation
67-
if (!self::$initialized && $blacklist !== null) {
67+
if (!self::$initialized) {
6868
foreach (self::SUPPORTED_DEFAULTS as $algorithm) {
6969
foreach ($algorithm::getSupportedAlgorithms() as $algId) {
7070
if (array_key_exists($algId, self::$cache)) {
@@ -99,8 +99,9 @@ public function getAlgorithm(
9999
#[\SensitiveParameter]
100100
KeyInterface $key,
101101
): KeyTransportAlgorithmInterface {
102-
Assert::false(
103-
($this->blacklist !== null) && in_array($algId, $this->blacklist, true),
102+
Assert::notInArray(
103+
$algId,
104+
$this->blacklist,
104105
sprintf('Blacklisted algorithm: \'%s\'.', $algId),
105106
BlacklistedAlgorithmException::class,
106107
);

‎src/Alg/Signature/SignatureAlgorithmFactory.php

+5-4
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,10 @@ final class SignatureAlgorithmFactory
6565
* @param string[]|null $blacklist A list of algorithms forbidden for their use.
6666
*/
6767
public function __construct(
68-
protected ?array $blacklist = self::DEFAULT_BLACKLIST,
68+
protected array $blacklist = self::DEFAULT_BLACKLIST,
6969
) {
7070
// initialize the cache for supported algorithms per known implementation
71-
if (!self::$initialized && $blacklist !== null) {
71+
if (!self::$initialized) {
7272
foreach (self::SUPPORTED_DEFAULTS as $algorithm) {
7373
foreach ($algorithm::getSupportedAlgorithms() as $algId) {
7474
if (array_key_exists($algId, self::$cache)) {
@@ -103,8 +103,9 @@ public function getAlgorithm(
103103
#[\SensitiveParameter]
104104
KeyInterface $key,
105105
): SignatureAlgorithmInterface {
106-
Assert::false(
107-
($this->blacklist !== null) && in_array($algId, $this->blacklist, true),
106+
Assert::notInArray(
107+
$algId,
108+
$this->blacklist,
108109
sprintf('Blacklisted algorithm: \'%s\'.', $algId),
109110
BlacklistedAlgorithmException::class,
110111
);

‎src/XML/EncryptableElementTrait.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public function encrypt(EncryptionAlgorithmInterface $encryptor): EncryptedData
6666

6767
$keyInfo = new KeyInfo([$encryptedKey]);
6868

69-
$factory = new EncryptionAlgorithmFactory($this->getBlacklistedAlgorithms());
69+
$factory = new EncryptionAlgorithmFactory($this->getBlacklistedAlgorithms() ?? EncryptionAlgorithmFactory::DEFAULT_BLACKLIST);
7070
$encryptor = $factory->getAlgorithm($this->blockCipherAlgId, $sessionKey);
7171
$encryptor->setBackend($this->getEncryptionBackend());
7272
}
@@ -99,8 +99,8 @@ abstract public function getEncryptionBackend(): ?EncryptionBackend;
9999
/**
100100
* Get the list of algorithms that are blacklisted for any encryption operation.
101101
*
102-
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null if we want to use the
103-
* defaults.
102+
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null to use this
103+
* libraries default.
104104
*/
105105
abstract public function getBlacklistedAlgorithms(): ?array;
106106

‎src/XML/EncryptedElementTrait.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ protected function decryptData(EncryptionAlgorithmInterface $decryptor): string
131131
$encryptedKey = $this->getEncryptedKey();
132132
$decryptionKey = $encryptedKey->decrypt($decryptor);
133133

134-
$factory = new EncryptionAlgorithmFactory($this->getBlacklistedAlgorithms());
134+
$factory = new EncryptionAlgorithmFactory($this->getBlacklistedAlgorithms() ?? EncryptionAlgorithmFactory::DEFAULT_BLACKLIST);
135135
$decryptor = $factory->getAlgorithm($encMethod->getAlgorithm(), new SymmetricKey($decryptionKey));
136136
$decryptor->setBackend($this->getEncryptionBackend());
137137
}
@@ -209,8 +209,8 @@ abstract public function getEncryptionBackend(): ?EncryptionBackend;
209209
/**
210210
* Get the list of algorithms that are blacklisted for any encryption operation.
211211
*
212-
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null if we want to use the
213-
* defaults.
212+
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null to use this
213+
* libraries default.
214214
*/
215215
abstract public function getBlacklistedAlgorithms(): ?array;
216216
}

‎src/XML/SignableElementTrait.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -189,8 +189,8 @@ protected function doSign(DOMElement $xml): DOMElement
189189
/**
190190
* Get the list of algorithms that are blacklisted for any signing operation.
191191
*
192-
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null if we want to use the
193-
* defaults.
192+
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null to use this
193+
* libraries default.
194194
*/
195195
abstract public function getBlacklistedAlgorithms(): ?array;
196196
}

‎src/XML/SignedElementTrait.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -310,8 +310,8 @@ abstract public function getId(): ?string;
310310
/**
311311
* Get the list of algorithms that are blacklisted for any signing operation.
312312
*
313-
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null if we want to use the
314-
* defaults.
313+
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null to use this
314+
* libraries default.
315315
*/
316316
abstract public function getBlacklistedAlgorithms(): ?array;
317317
}

‎tests/Alg/Encryption/EncryptionAlgorithmFactoryTest.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ public static function setUpBeforeClass(): void
3535
*/
3636
public function testGetUnknownAlgorithm(): void
3737
{
38-
$factory = new EncryptionAlgorithmFactory([]);
38+
$factory = new EncryptionAlgorithmFactory();
3939
$this->expectException(UnsupportedAlgorithmException::class);
4040
$factory->getAlgorithm('Unsupported algorithm identifier', self::$skey);
4141
}
@@ -47,6 +47,7 @@ public function testGetUnknownAlgorithm(): void
4747
public function testDefaultBlacklistedAlgorithms(): void
4848
{
4949
$factory = new EncryptionAlgorithmFactory();
50+
5051
$algorithm = $factory->getAlgorithm(C::BLOCK_ENC_AES128, self::$skey);
5152
$this->assertInstanceOf(AES::class, $algorithm);
5253
$this->assertEquals(C::BLOCK_ENC_AES128, $algorithm->getAlgorithmId());
@@ -83,6 +84,7 @@ public function testDefaultBlacklistedAlgorithms(): void
8384
public function testBlacklistedAlgorithm(): void
8485
{
8586
$factory = new EncryptionAlgorithmFactory([C::BLOCK_ENC_AES256_GCM]);
87+
8688
$algorithm = $factory->getAlgorithm(C::BLOCK_ENC_3DES, self::$skey);
8789
$this->assertInstanceOf(TripleDES::class, $algorithm);
8890
$this->assertEquals(C::BLOCK_ENC_3DES, $algorithm->getAlgorithmId());

‎tests/XML/CustomSignable.php

+3-19
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,6 @@ class CustomSignable extends AbstractElement implements
4747
/** @var \SimpleSAML\XMLSecurity\Backend\EncryptionBackend|null */
4848
private ?EncryptionBackend $backend = null;
4949

50-
/** @var string[] */
51-
private array $blacklistedAlgs = [];
52-
5350
/**
5451
* Constructor
5552
*
@@ -143,25 +140,12 @@ public function setEncryptionBackend(?EncryptionBackend $backend): void
143140
* Implement a method like this if your encrypted object needs to instantiate a new decryptor, for example, to
144141
* decrypt a session key. This method is required by \SimpleSAML\XMLSecurity\XML\EncryptedElementTrait.
145142
*
146-
* @return string[]|null An array with all algorithm identifiers that we want to blacklist, or null if we want to
147-
* use the defaults.
143+
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null to use this
144+
* libraries default.
148145
*/
149146
public function getBlacklistedAlgorithms(): ?array
150147
{
151-
return $this->blacklistedAlgs;
152-
}
153-
154-
155-
/**
156-
* Implement a method like this if your encrypted object needs to instantiate a new decryptor, for example, to
157-
* decrypt a session key. This method is required by \SimpleSAML\XMLSecurity\XML\EncryptedElementTrait.
158-
*
159-
* @param string[]|null $algIds An array with the identifiers of the algorithms we want to blacklist, or null if we
160-
* want to use the defaults.
161-
*/
162-
public function setBlacklistedAlgorithms(?array $algIds): void
163-
{
164-
$this->blacklistedAlgs = $algIds;
148+
return [];
165149
}
166150

167151

‎tests/XML/EncryptedCustom.php

+3-19
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,6 @@ final class EncryptedCustom extends AbstractElement implements EncryptedElementI
4545
/** @var EncryptionBackend|null $backend */
4646
private ?EncryptionBackend $backend = null;
4747

48-
/** @var string[] $blacklistedAlgs */
49-
private array $blacklistedAlgs = [];
50-
5148

5249
/**
5350
* Construct an encrypted object.
@@ -91,25 +88,12 @@ public function setEncryptionBackend(?EncryptionBackend $backend): void
9188
* Implement a method like this if your encrypted object needs to instantiate a new decryptor, for example, to
9289
* decrypt a session key. This method is required by \SimpleSAML\XMLSecurity\XML\EncryptedElementTrait.
9390
*
94-
* @return string[]|null An array with all algorithm identifiers that we want to blacklist, or null if we want to
95-
* use the defaults.
91+
* @return string[]|null An array with all algorithm identifiers that are blacklisted, or null to use this
92+
* libraries default.
9693
*/
9794
public function getBlacklistedAlgorithms(): ?array
9895
{
99-
return $this->blacklistedAlgs;
100-
}
101-
102-
103-
/**
104-
* Implement a method like this if your encrypted object needs to instantiate a new decryptor, for example, to
105-
* decrypt a session key. This method is required by \SimpleSAML\XMLSecurity\XML\EncryptedElementTrait.
106-
*
107-
* @param string[]|null $algIds An array with the identifiers of the algorithms we want to blacklist, or null if we
108-
* want to use the defaults.
109-
*/
110-
public function setBlacklistedAlgorithms(?array $algIds): void
111-
{
112-
$this->blacklistedAlgs = $algIds;
96+
return [];
11397
}
11498

11599

0 commit comments

Comments
 (0)