Remove unnecessary utility-class

simplesamlphp · May 10, 2024 · f590142 · f590142
1 parent aa26c50
commit f590142
Show file tree

Hide file tree

Showing 5 changed files with 16 additions and 102 deletions.
diff --git a/src/Backend/HMAC.php b/src/Backend/HMAC.php
@@ -8,8 +8,8 @@
 use SimpleSAML\XMLSecurity\Constants as C;
 use SimpleSAML\XMLSecurity\Exception\InvalidArgumentException;
 use SimpleSAML\XMLSecurity\Key\KeyInterface;
-use SimpleSAML\XMLSecurity\Utils\Security;
 
+use function hash_equals;
 use function hash_hmac;
 
 /**
@@ -77,6 +77,6 @@ public function sign(KeyInterface $key, string $plaintext): string
      */
     public function verify(KeyInterface $key, string $plaintext, string $signature): bool
     {
-        return Security::compareStrings(hash_hmac($this->digest, $plaintext, $key->getMaterial(), true), $signature);
+        return hash_equals(hash_hmac($this->digest, $plaintext, $key->getMaterial(), true), $signature);
     }
 }
diff --git a/src/Utils/Security.php b/src/Utils/Security.php
diff --git a/src/XML/SignableElementTrait.php b/src/XML/SignableElementTrait.php
@@ -11,7 +11,6 @@
 use SimpleSAML\XMLSecurity\Constants as C;
 use SimpleSAML\XMLSecurity\Exception\RuntimeException;
 use SimpleSAML\XMLSecurity\Exception\UnsupportedAlgorithmException;
-use SimpleSAML\XMLSecurity\Utils\Security;
 use SimpleSAML\XMLSecurity\Utils\XML;
 use SimpleSAML\XMLSecurity\XML\ds\CanonicalizationMethod;
 use SimpleSAML\XMLSecurity\XML\ds\DigestMethod;
@@ -25,6 +24,8 @@
 use SimpleSAML\XMLSecurity\XML\ds\Transform;
 use SimpleSAML\XMLSecurity\XML\ds\Transforms;
 
+use function base64_encode;
+use function hash;
 use function in_array;
 
 /**
@@ -129,7 +130,7 @@ private function getReference(
 
         return new Reference(
             new DigestMethod($digestAlg),
-            new DigestValue(Security::hash($digestAlg, $canonicalDocument)),
+            new DigestValue(base64_encode(hash(C::$DIGEST_ALGORITHMS[$digestAlg], $canonicalDocument, true))),
             $transforms,
             null,
             null,

diff --git a/src/XML/SignedElementTrait.php b/src/XML/SignedElementTrait.php
@@ -19,7 +19,6 @@
 use SimpleSAML\XMLSecurity\Exception\SignatureVerificationFailedException;
 use SimpleSAML\XMLSecurity\Key;
 use SimpleSAML\XMLSecurity\Key\KeyInterface;
-use SimpleSAML\XMLSecurity\Utils\Security;
 use SimpleSAML\XMLSecurity\Utils\XML;
 use SimpleSAML\XMLSecurity\Utils\XPath;
 use SimpleSAML\XMLSecurity\XML\ds\Reference;
@@ -30,6 +29,8 @@
 
 use function array_pop;
 use function base64_decode;
+use function hash;
+use function hash_equals;
 use function in_array;
 
 /**
@@ -149,9 +150,16 @@ private function validateReference(SignedInfo $signedInfo): SignedElementInterfa
         $xml->removeChild($sigNode[0]);
 
         $data = XML::processTransforms($reference->getTransforms(), $xml);
-        $digest = Security::hash($reference->getDigestMethod()->getAlgorithm(), $data, false);
+        $algo = $reference->getDigestMethod()->getAlgorithm();
+        Assert::keyExists(
+            C::$DIGEST_ALGORITHMS,
+            $algo,
+            'Unsupported digest method "' . $algo . '"',
+            InvalidArgumentException::class,
+        );
 
-        if (Security::compareStrings($digest, base64_decode($reference->getDigestValue()->getRawContent(), true)) !== true) {
+        $digest = hash(C::$DIGEST_ALGORITHMS[$algo], $data, true);
+        if (hash_equals($digest, base64_decode($reference->getDigestValue()->getRawContent(), true)) !== true) {
             throw new SignatureVerificationFailedException('Failed to verify signature.');
         }
 

diff --git a/tests/Utils/SecurityTest.php b/tests/Utils/SecurityTest.php