Changeset 3562098 for sg-ai-studio/trunk/core/Helper/HelperAuth.php

Timestamp:

06/05/2026 08:55:56 AM (5 months ago)

Author:

sstoqnov

Message:

Bump to 1.2.2

File:

• sg-ai-studio/trunk/core/Helper/HelperAuth.php (modified) (5 diffs)

sg-ai-studio/trunk/core/Helper/HelperAuth.php

@@ -103 +103 @@
         private ?string $token = null;
         private ?float $token_expiry = null;
+
+        /**
+         * Minimum RSA modulus size (bits) accepted for RSA-based keys (RS and PS families).
+         */
+        private const MIN_RSA_BITS = 2048;
+
+        /**
+         * Minimum secret length (bytes) per HMAC algorithm, matching the hash output size.
+         * Mirrors the key-length validation added upstream in firebase/php-jwt v7 (CVE-2025-45769),
+         * backported here so we stay on the PHP 7.4-compatible 6.x line.
+         */
+        private const HMAC_MIN_KEY_BYTES = array(
+                'HS256' => 32,
+                'HS384' => 48,
+                'HS512' => 64,
+        );
 
         public function __construct(
@@ -172 +188 @@
         }
 
+        /**
+         * Reject signing/verification keys that are too weak for the given algorithm.
+         *
+         * @param string $key        The key material (HMAC secret, or PEM private/public key).
+         * @param string $algorithm  The JWT algorithm the key will be used with.
+         * @param bool   $is_private Whether $key is a private key (true) or public key (false).
+         *
+         * @throws SignApiAuthException When the key does not meet the minimum strength.
+         */
+        private function validate_key_strength( string $key, string $algorithm, bool $is_private ): void {
+                // HMAC: the symmetric secret must be at least as long as the hash output.
+                if ( isset( self::HMAC_MIN_KEY_BYTES[ $algorithm ] ) ) {
+                        $min = self::HMAC_MIN_KEY_BYTES[ $algorithm ];
+                        if ( strlen( $key ) < $min ) {
+                                throw new SignApiAuthException(
+                                        sprintf( 'Insecure HMAC key for %s: %d bytes provided, %d required', $algorithm, strlen( $key ), $min )
+                                );
+                        }
+                        return;
+                }
+
+                // Asymmetric (RS, PS, ES families): inspect the key material via OpenSSL.
+                $pkey = $is_private ? openssl_pkey_get_private( $key ) : openssl_pkey_get_public( $key );
+                if ( false === $pkey ) {
+                        throw new SignApiAuthException( 'Invalid key supplied for ' . esc_html( $algorithm ) );
+                }
+
+                $details = openssl_pkey_get_details( $pkey );
+                if ( false === $details ) {
+                        throw new SignApiAuthException( 'Unable to read key details for ' . esc_html( $algorithm ) );
+                }
+
+                if (
+                        ( $details['type'] ?? null ) === OPENSSL_KEYTYPE_RSA
+                        && ( $details['bits'] ?? 0 ) < self::MIN_RSA_BITS
+                ) {
+                        throw new SignApiAuthException(
+                                sprintf( 'Insecure RSA key for %s: %d bits, minimum %d required', $algorithm, $details['bits'] ?? 0, self::MIN_RSA_BITS )
+                        );
+                }
+        }
+
         private function generate_token( array $key_data, int $retries = 5, ?array $extra_payload = null ): string
         {
@@ -187 +245 @@
                 }
 
+                $this->validate_key_strength( $private_key, $this->algorithm, true );
                 $token         = JWT::encode( $payload, $private_key, $this->algorithm );
                 $token_request = new TokenRequest( $token, $service, $client, $client_key );
@@ -323 +382 @@
                 foreach ( $algorithms as $algorithm ) {
                         try {
+                                $this->validate_key_strength( trim( $service_key['key_pub'] ), $algorithm, false );
                                 $decoded_data = JWT::decode( $token, new Key( trim( $service_key['key_pub'] ), $algorithm ) );
                                 $decoded_data = (array) $decoded_data;
@@ -372 +432 @@
                         $key_value = trim( $public_key['key_pub'] );
 
+                        $this->validate_key_strength( $key_value, $this->algorithm, false );
                         $decoded_data = JWT::decode( $token, new Key( $key_value, $this->algorithm ) );
                         $decoded_data = (array) $decoded_data;