Skip to content

Commit 3b736dc

Browse files
SpomkySpomky
committed
On the way the PHPStan level "max"
1 parent 4108695 commit 3b736dc

18 files changed

+240
-163
lines changed

‎phpstan.neon

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
parameters:
2-
level: 8
2+
level: max
33
paths:
44
- src
55
checkMissingIterableValueType: false

‎src/Component/Encryption/Serializer/CompactSerializer.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
use function count;
88
use InvalidArgumentException;
9+
use function is_array;
910
use Jose\Component\Core\Util\JsonConverter;
1011
use Jose\Component\Encryption\JWE;
1112
use Jose\Component\Encryption\Recipient;
@@ -58,6 +59,9 @@ public function unserialize(string $input): JWE
5859
try {
5960
$encodedSharedProtectedHeader = $parts[0];
6061
$sharedProtectedHeader = JsonConverter::decode(Base64UrlSafe::decode($encodedSharedProtectedHeader));
62+
if (! is_array($sharedProtectedHeader)) {
63+
throw new InvalidArgumentException('Unsupported input.');
64+
}
6165
$encryptedKey = $parts[1] === '' ? null : Base64UrlSafe::decode($parts[1]);
6266
$iv = Base64UrlSafe::decode($parts[2]);
6367
$ciphertext = Base64UrlSafe::decode($parts[3]);

‎src/Component/Encryption/Serializer/JSONFlattenedSerializer.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
use function array_key_exists;
88
use function count;
99
use InvalidArgumentException;
10+
use function is_array;
1011
use Jose\Component\Core\Util\JsonConverter;
1112
use Jose\Component\Encryption\JWE;
1213
use Jose\Component\Encryption\Recipient;
@@ -59,6 +60,9 @@ public function serialize(JWE $jwe, ?int $recipientIndex = null): string
5960
public function unserialize(string $input): JWE
6061
{
6162
$data = JsonConverter::decode($input);
63+
if (! is_array($data)) {
64+
throw new InvalidArgumentException('Unsupported input.');
65+
}
6266
$this->checkData($data);
6367

6468
$ciphertext = Base64UrlSafe::decode($data['ciphertext']);

‎src/Component/Encryption/Serializer/JSONGeneralSerializer.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
use function array_key_exists;
88
use function count;
99
use InvalidArgumentException;
10+
use function is_array;
1011
use Jose\Component\Core\Util\JsonConverter;
1112
use Jose\Component\Encryption\JWE;
1213
use Jose\Component\Encryption\Recipient;
@@ -65,6 +66,9 @@ public function serialize(JWE $jwe, ?int $recipientIndex = null): string
6566
public function unserialize(string $input): JWE
6667
{
6768
$data = JsonConverter::decode($input);
69+
if (! is_array($data)) {
70+
throw new InvalidArgumentException('Unsupported input.');
71+
}
6872
$this->checkData($data);
6973

7074
$ciphertext = Base64UrlSafe::decode($data['ciphertext']);

‎src/Component/KeyManagement/Analyzer/ES256KeyAnalyzer.php

Lines changed: 9 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -4,46 +4,20 @@
44

55
namespace Jose\Component\KeyManagement\Analyzer;
66

7-
use Brick\Math\BigInteger;
8-
use Jose\Component\Core\JWK;
9-
use Jose\Component\Core\Util\Ecc\NistCurve;
10-
use ParagonIE\ConstantTime\Base64UrlSafe;
11-
use RuntimeException;
12-
13-
final class ES256KeyAnalyzer implements KeyAnalyzer
7+
final class ES256KeyAnalyzer extends ESKeyAnalyzer
148
{
15-
public function __construct()
9+
protected function getAlgorithmName(): string
1610
{
17-
if (! class_exists(NistCurve::class)) {
18-
throw new RuntimeException('Please install web-token/jwt-util-ecc to use this key analyzer');
19-
}
11+
return 'ES256';
2012
}
2113

22-
public function analyze(JWK $jwk, MessageBag $bag): void
14+
protected function getCurveName(): string
2315
{
24-
if ($jwk->get('kty') !== 'EC') {
25-
return;
26-
}
27-
if (! $jwk->has('crv')) {
28-
$bag->add(Message::high('Invalid key. The components "crv" is missing.'));
16+
return 'P-256';
17+
}
2918

30-
return;
31-
}
32-
if ($jwk->get('crv') !== 'P-256') {
33-
return;
34-
}
35-
$x = Base64UrlSafe::decode($jwk->get('x'));
36-
$xLength = 8 * mb_strlen($x, '8bit');
37-
$y = Base64UrlSafe::decode($jwk->get('y'));
38-
$yLength = 8 * mb_strlen($y, '8bit');
39-
if ($yLength !== $xLength || $yLength !== 256) {
40-
$bag->add(Message::high('Invalid key. The components "x" and "y" size shall be 256 bits.'));
41-
}
42-
$xBI = BigInteger::fromBase(bin2hex($x), 16);
43-
$yBI = BigInteger::fromBase(bin2hex($y), 16);
44-
$curve = NistCurve::curve256();
45-
if (! $curve->contains($xBI, $yBI)) {
46-
$bag->add(Message::high('Invalid key. The point is not on the curve.'));
47-
}
19+
protected function getKeySize(): int
20+
{
21+
return 256;
4822
}
4923
}

‎src/Component/KeyManagement/Analyzer/ES384KeyAnalyzer.php

Lines changed: 9 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -4,46 +4,20 @@
44

55
namespace Jose\Component\KeyManagement\Analyzer;
66

7-
use Brick\Math\BigInteger;
8-
use Jose\Component\Core\JWK;
9-
use Jose\Component\Core\Util\Ecc\NistCurve;
10-
use ParagonIE\ConstantTime\Base64UrlSafe;
11-
use RuntimeException;
12-
13-
final class ES384KeyAnalyzer implements KeyAnalyzer
7+
final class ES384KeyAnalyzer extends ESKeyAnalyzer
148
{
15-
public function __construct()
9+
protected function getAlgorithmName(): string
1610
{
17-
if (! class_exists(NistCurve::class)) {
18-
throw new RuntimeException('Please install web-token/jwt-util-ecc to use this key analyzer');
19-
}
11+
return 'ES384';
2012
}
2113

22-
public function analyze(JWK $jwk, MessageBag $bag): void
14+
protected function getCurveName(): string
2315
{
24-
if ($jwk->get('kty') !== 'EC') {
25-
return;
26-
}
27-
if (! $jwk->has('crv')) {
28-
$bag->add(Message::high('Invalid key. The components "crv" is missing.'));
16+
return 'P-384';
17+
}
2918

30-
return;
31-
}
32-
if ($jwk->get('crv') !== 'P-384') {
33-
return;
34-
}
35-
$x = Base64UrlSafe::decode($jwk->get('x'));
36-
$xLength = 8 * mb_strlen($x, '8bit');
37-
$y = Base64UrlSafe::decode($jwk->get('y'));
38-
$yLength = 8 * mb_strlen($y, '8bit');
39-
if ($yLength !== $xLength || $yLength !== 384) {
40-
$bag->add(Message::high('Invalid key. The components "x" and "y" size shall be 384 bits.'));
41-
}
42-
$xBI = BigInteger::fromBase(bin2hex($x), 16);
43-
$yBI = BigInteger::fromBase(bin2hex($y), 16);
44-
$curve = NistCurve::curve384();
45-
if (! $curve->contains($xBI, $yBI)) {
46-
$bag->add(Message::high('Invalid key. The point is not on the curve.'));
47-
}
19+
protected function getKeySize(): int
20+
{
21+
return 384;
4822
}
4923
}

‎src/Component/KeyManagement/Analyzer/ES512KeyAnalyzer.php

Lines changed: 9 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -4,46 +4,20 @@
44

55
namespace Jose\Component\KeyManagement\Analyzer;
66

7-
use Brick\Math\BigInteger;
8-
use Jose\Component\Core\JWK;
9-
use Jose\Component\Core\Util\Ecc\NistCurve;
10-
use ParagonIE\ConstantTime\Base64UrlSafe;
11-
use RuntimeException;
12-
13-
final class ES512KeyAnalyzer implements KeyAnalyzer
7+
final class ES512KeyAnalyzer extends ESKeyAnalyzer
148
{
15-
public function __construct()
9+
protected function getAlgorithmName(): string
1610
{
17-
if (! class_exists(NistCurve::class)) {
18-
throw new RuntimeException('Please install web-token/jwt-util-ecc to use this key analyzer');
19-
}
11+
return 'ES512';
2012
}
2113

22-
public function analyze(JWK $jwk, MessageBag $bag): void
14+
protected function getCurveName(): string
2315
{
24-
if ($jwk->get('kty') !== 'EC') {
25-
return;
26-
}
27-
if (! $jwk->has('crv')) {
28-
$bag->add(Message::high('Invalid key. The components "crv" is missing.'));
16+
return 'P-521';
17+
}
2918

30-
return;
31-
}
32-
if ($jwk->get('crv') !== 'P-521') {
33-
return;
34-
}
35-
$x = Base64UrlSafe::decode($jwk->get('x'));
36-
$xLength = 8 * mb_strlen($x, '8bit');
37-
$y = Base64UrlSafe::decode($jwk->get('y'));
38-
$yLength = 8 * mb_strlen($y, '8bit');
39-
if ($yLength !== $xLength || $yLength !== 528) {
40-
$bag->add(Message::high('Invalid key. The components "x" and "y" size shall be 528 bits.'));
41-
}
42-
$xBI = BigInteger::fromBase(bin2hex($x), 16);
43-
$yBI = BigInteger::fromBase(bin2hex($y), 16);
44-
$curve = NistCurve::curve521();
45-
if (! $curve->contains($xBI, $yBI)) {
46-
$bag->add(Message::high('Invalid key. The point is not on the curve.'));
47-
}
19+
protected function getKeySize(): int
20+
{
21+
return 512; //528
4822
}
4923
}

‎src/Component/KeyManagement/Analyzer/ESKeyAnalyzer.php

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Jose\Component\KeyManagement\Analyzer;
6+
7+
use Brick\Math\BigInteger;
8+
use function is_string;
9+
use Jose\Component\Core\JWK;
10+
use Jose\Component\Core\Util\Ecc\NistCurve;
11+
use ParagonIE\ConstantTime\Base64UrlSafe;
12+
use RuntimeException;
13+
14+
abstract class ESKeyAnalyzer implements KeyAnalyzer
15+
{
16+
public function __construct()
17+
{
18+
if (! class_exists(NistCurve::class)) {
19+
throw new RuntimeException('Please install web-token/jwt-util-ecc to use this key analyzer');
20+
}
21+
}
22+
23+
public function analyze(JWK $jwk, MessageBag $bag): void
24+
{
25+
if (! $jwk->has('alg') || $jwk->get('alg') !== $this->getAlgorithmName()) {
26+
return;
27+
}
28+
if ($jwk->get('kty') !== 'EC') {
29+
return;
30+
}
31+
if (! $jwk->has('crv')) {
32+
$bag->add(Message::high('Invalid key. The components "crv" is missing.'));
33+
34+
return;
35+
}
36+
if ($jwk->get('crv') !== $this->getCurveName()) {
37+
return;
38+
}
39+
$x = $jwk->get('x');
40+
if (! is_string($x)) {
41+
$bag->add(Message::high('Invalid key. The components "x" shall be a string.'));
42+
43+
return;
44+
}
45+
$x = Base64UrlSafe::decode($x);
46+
$xLength = 8 * mb_strlen($x, '8bit');
47+
$y = $jwk->get('y');
48+
if (! is_string($y)) {
49+
$bag->add(Message::high('Invalid key. The components "y" shall be a string.'));
50+
51+
return;
52+
}
53+
$y = Base64UrlSafe::decode($y);
54+
$yLength = 8 * mb_strlen($y, '8bit');
55+
if ($yLength !== $xLength || $yLength !== $this->getKeySize()) {
56+
$bag->add(
57+
Message::high(sprintf(
58+
'Invalid key. The components "x" and "y" size shall be %d bits.',
59+
$this->getKeySize()
60+
))
61+
);
62+
}
63+
$xBI = BigInteger::fromBase(bin2hex($x), 16);
64+
$yBI = BigInteger::fromBase(bin2hex($y), 16);
65+
$curve = NistCurve::curve256();
66+
if (! $curve->contains($xBI, $yBI)) {
67+
$bag->add(Message::high('Invalid key. The point is not on the curve.'));
68+
}
69+
}
70+
71+
abstract protected function getAlgorithmName(): string;
72+
73+
abstract protected function getCurveName(): string;
74+
75+
abstract protected function getKeySize(): int;
76+
}

‎src/Component/KeyManagement/Analyzer/HS256KeyAnalyzer.php

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,15 @@
44

55
namespace Jose\Component\KeyManagement\Analyzer;
66

7-
use Jose\Component\Core\JWK;
8-
use ParagonIE\ConstantTime\Base64UrlSafe;
9-
10-
final class HS256KeyAnalyzer implements KeyAnalyzer
7+
final class HS256KeyAnalyzer extends HSKeyAnalyzer
118
{
12-
public function analyze(JWK $jwk, MessageBag $bag): void
9+
protected function getAlgorithmName(): string
10+
{
11+
return 'HS256';
12+
}
13+
14+
protected function getMinimumKeySize(): int
1315
{
14-
if ($jwk->get('kty') !== 'oct') {
15-
return;
16-
}
17-
if (! $jwk->has('alg') || $jwk->get('alg') !== 'HS256') {
18-
return;
19-
}
20-
$k = Base64UrlSafe::decode($jwk->get('k'));
21-
$kLength = 8 * mb_strlen($k, '8bit');
22-
if ($kLength < 256) {
23-
$bag->add(Message::high('HS256 algorithm requires at least 256 bits key length.'));
24-
}
16+
return 256;
2517
}
2618
}

‎src/Component/KeyManagement/Analyzer/HS384KeyAnalyzer.php

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,15 @@
44

55
namespace Jose\Component\KeyManagement\Analyzer;
66

7-
use Jose\Component\Core\JWK;
8-
use ParagonIE\ConstantTime\Base64UrlSafe;
9-
10-
final class HS384KeyAnalyzer implements KeyAnalyzer
7+
final class HS384KeyAnalyzer extends HSKeyAnalyzer
118
{
12-
public function analyze(JWK $jwk, MessageBag $bag): void
9+
protected function getAlgorithmName(): string
10+
{
11+
return 'HS384';
12+
}
13+
14+
protected function getMinimumKeySize(): int
1315
{
14-
if ($jwk->get('kty') !== 'oct') {
15-
return;
16-
}
17-
if (! $jwk->has('alg') || $jwk->get('alg') !== 'HS384') {
18-
return;
19-
}
20-
$k = Base64UrlSafe::decode($jwk->get('k'));
21-
$kLength = 8 * mb_strlen($k, '8bit');
22-
if ($kLength < 384) {
23-
$bag->add(Message::high('HS384 algorithm requires at least 384 bits key length.'));
24-
}
16+
return 384;
2517
}
2618
}

0 commit comments

Comments
 (0)