Merge pull request #65 from PrivateBin/prng

Use better random number generator
This commit is contained in:
El RIDO 2016-08-16 08:38:43 +02:00 committed by GitHub
commit d12ddd2efc
9 changed files with 188 additions and 85 deletions

View File

@ -12,7 +12,7 @@ the options and adjust them as you see fit.
- PHP version 5.3 or above - PHP version 5.3 or above
- GD extension - GD extension
- mcrypt extension (optional, but strongly recommended) - [Libsodium](https://download.libsodium.org) or mcrypt extension (optional, but strongly recommended)
- some disk space or (optional) a database supported by PDO - some disk space or (optional) a database supported by PDO
- ability to create files and folders in the installation directory and the PATH - ability to create files and folders in the installation directory and the PATH
- A web browser with javascript support - A web browser with javascript support

View File

@ -18,7 +18,8 @@
} }
], ],
"require": { "require": {
"php": "^5.3 || ^7.0", "php": "^5.2.6 || ^7.0",
"paragonie/random_compat": "^2.0",
"yzalis/identicon": "^1.1" "yzalis/identicon": "^1.1"
}, },
"require-dev": { "require-dev": {

144
composer.lock generated
View File

@ -4,9 +4,57 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file", "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
"This file is @generated automatically" "This file is @generated automatically"
], ],
"hash": "e3520dc72004bd92b2bd0b0febf71c7f", "hash": "42c2efb0f05581e3d3f5dd3874c2b1ed",
"content-hash": "ac3ea1f44998ea42345107fd21d6a2e0", "content-hash": "21164495228478cc6cb92e5c78bb490c",
"packages": [ "packages": [
{
"name": "paragonie/random_compat",
"version": "v2.0.2",
"source": {
"type": "git",
"url": "https://github.com/paragonie/random_compat.git",
"reference": "088c04e2f261c33bed6ca5245491cfca69195ccf"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/paragonie/random_compat/zipball/088c04e2f261c33bed6ca5245491cfca69195ccf",
"reference": "088c04e2f261c33bed6ca5245491cfca69195ccf",
"shasum": ""
},
"require": {
"php": ">=5.2.0"
},
"require-dev": {
"phpunit/phpunit": "4.*|5.*"
},
"suggest": {
"ext-libsodium": "Provides a modern crypto API that can be used to generate random bytes."
},
"type": "library",
"autoload": {
"files": [
"lib/random.php"
]
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"authors": [
{
"name": "Paragon Initiative Enterprises",
"email": "security@paragonie.com",
"homepage": "https://paragonie.com"
}
],
"description": "PHP 5.x polyfill for random_bytes() and random_int() from PHP 7",
"keywords": [
"csprng",
"pseudorandom",
"random"
],
"time": "2016-04-03 06:00:07"
},
{ {
"name": "yzalis/identicon", "name": "yzalis/identicon",
"version": "1.1.0", "version": "1.1.0",
@ -416,21 +464,21 @@
}, },
{ {
"name": "symfony/config", "name": "symfony/config",
"version": "v3.1.3", "version": "v2.8.9",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/symfony/config.git", "url": "https://github.com/symfony/config.git",
"reference": "a7630397b91be09cdd2fe57fd13612e258700598" "reference": "4275ef5b59f18959df0eee3991e9ca0cc208ffd4"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/symfony/config/zipball/a7630397b91be09cdd2fe57fd13612e258700598", "url": "https://api.github.com/repos/symfony/config/zipball/4275ef5b59f18959df0eee3991e9ca0cc208ffd4",
"reference": "a7630397b91be09cdd2fe57fd13612e258700598", "reference": "4275ef5b59f18959df0eee3991e9ca0cc208ffd4",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"php": ">=5.5.9", "php": ">=5.3.9",
"symfony/filesystem": "~2.8|~3.0" "symfony/filesystem": "~2.3|~3.0.0"
}, },
"suggest": { "suggest": {
"symfony/yaml": "To use the yaml reference dumper" "symfony/yaml": "To use the yaml reference dumper"
@ -438,7 +486,7 @@
"type": "library", "type": "library",
"extra": { "extra": {
"branch-alias": { "branch-alias": {
"dev-master": "3.1-dev" "dev-master": "2.8-dev"
} }
}, },
"autoload": { "autoload": {
@ -465,30 +513,30 @@
], ],
"description": "Symfony Config Component", "description": "Symfony Config Component",
"homepage": "https://symfony.com", "homepage": "https://symfony.com",
"time": "2016-07-26 08:04:17" "time": "2016-07-26 08:02:44"
}, },
{ {
"name": "symfony/console", "name": "symfony/console",
"version": "v3.1.3", "version": "v2.8.9",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/symfony/console.git", "url": "https://github.com/symfony/console.git",
"reference": "f9e638e8149e9e41b570ff092f8007c477ef0ce5" "reference": "36e62335caca8a6e909c5c5bac4a8128149911c9"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/symfony/console/zipball/f9e638e8149e9e41b570ff092f8007c477ef0ce5", "url": "https://api.github.com/repos/symfony/console/zipball/36e62335caca8a6e909c5c5bac4a8128149911c9",
"reference": "f9e638e8149e9e41b570ff092f8007c477ef0ce5", "reference": "36e62335caca8a6e909c5c5bac4a8128149911c9",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"php": ">=5.5.9", "php": ">=5.3.9",
"symfony/polyfill-mbstring": "~1.0" "symfony/polyfill-mbstring": "~1.0"
}, },
"require-dev": { "require-dev": {
"psr/log": "~1.0", "psr/log": "~1.0",
"symfony/event-dispatcher": "~2.8|~3.0", "symfony/event-dispatcher": "~2.1|~3.0.0",
"symfony/process": "~2.8|~3.0" "symfony/process": "~2.1|~3.0.0"
}, },
"suggest": { "suggest": {
"psr/log": "For using the console logger", "psr/log": "For using the console logger",
@ -498,7 +546,7 @@
"type": "library", "type": "library",
"extra": { "extra": {
"branch-alias": { "branch-alias": {
"dev-master": "3.1-dev" "dev-master": "2.8-dev"
} }
}, },
"autoload": { "autoload": {
@ -525,7 +573,7 @@
], ],
"description": "Symfony Console Component", "description": "Symfony Console Component",
"homepage": "https://symfony.com", "homepage": "https://symfony.com",
"time": "2016-07-26 08:04:17" "time": "2016-07-30 07:20:35"
}, },
{ {
"name": "symfony/event-dispatcher", "name": "symfony/event-dispatcher",
@ -589,25 +637,25 @@
}, },
{ {
"name": "symfony/filesystem", "name": "symfony/filesystem",
"version": "v3.1.3", "version": "v2.8.9",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/symfony/filesystem.git", "url": "https://github.com/symfony/filesystem.git",
"reference": "bb29adceb552d202b6416ede373529338136e84f" "reference": "ab4c3f085c8f5a56536845bf985c4cef30bf75fd"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/symfony/filesystem/zipball/bb29adceb552d202b6416ede373529338136e84f", "url": "https://api.github.com/repos/symfony/filesystem/zipball/ab4c3f085c8f5a56536845bf985c4cef30bf75fd",
"reference": "bb29adceb552d202b6416ede373529338136e84f", "reference": "ab4c3f085c8f5a56536845bf985c4cef30bf75fd",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"php": ">=5.5.9" "php": ">=5.3.9"
}, },
"type": "library", "type": "library",
"extra": { "extra": {
"branch-alias": { "branch-alias": {
"dev-master": "3.1-dev" "dev-master": "2.8-dev"
} }
}, },
"autoload": { "autoload": {
@ -634,7 +682,7 @@
], ],
"description": "Symfony Filesystem Component", "description": "Symfony Filesystem Component",
"homepage": "https://symfony.com", "homepage": "https://symfony.com",
"time": "2016-07-20 05:44:26" "time": "2016-07-20 05:41:28"
}, },
{ {
"name": "symfony/polyfill-mbstring", "name": "symfony/polyfill-mbstring",
@ -697,25 +745,25 @@
}, },
{ {
"name": "symfony/process", "name": "symfony/process",
"version": "v3.1.3", "version": "v2.8.9",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/symfony/process.git", "url": "https://github.com/symfony/process.git",
"reference": "04c2dfaae4ec56a5c677b0c69fac34637d815758" "reference": "d20332e43e8774ff8870b394f3dd6020cc7f8e0c"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/symfony/process/zipball/04c2dfaae4ec56a5c677b0c69fac34637d815758", "url": "https://api.github.com/repos/symfony/process/zipball/d20332e43e8774ff8870b394f3dd6020cc7f8e0c",
"reference": "04c2dfaae4ec56a5c677b0c69fac34637d815758", "reference": "d20332e43e8774ff8870b394f3dd6020cc7f8e0c",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"php": ">=5.5.9" "php": ">=5.3.9"
}, },
"type": "library", "type": "library",
"extra": { "extra": {
"branch-alias": { "branch-alias": {
"dev-master": "3.1-dev" "dev-master": "2.8-dev"
} }
}, },
"autoload": { "autoload": {
@ -742,29 +790,29 @@
], ],
"description": "Symfony Process Component", "description": "Symfony Process Component",
"homepage": "https://symfony.com", "homepage": "https://symfony.com",
"time": "2016-07-28 11:13:48" "time": "2016-07-28 11:13:19"
}, },
{ {
"name": "symfony/stopwatch", "name": "symfony/stopwatch",
"version": "v3.1.3", "version": "v2.8.9",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/symfony/stopwatch.git", "url": "https://github.com/symfony/stopwatch.git",
"reference": "bb42806b12c5f89db4ebf64af6741afe6d8457e1" "reference": "35bae476693150728b0eb51647faac82faf9aaca"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/symfony/stopwatch/zipball/bb42806b12c5f89db4ebf64af6741afe6d8457e1", "url": "https://api.github.com/repos/symfony/stopwatch/zipball/35bae476693150728b0eb51647faac82faf9aaca",
"reference": "bb42806b12c5f89db4ebf64af6741afe6d8457e1", "reference": "35bae476693150728b0eb51647faac82faf9aaca",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"php": ">=5.5.9" "php": ">=5.3.9"
}, },
"type": "library", "type": "library",
"extra": { "extra": {
"branch-alias": { "branch-alias": {
"dev-master": "3.1-dev" "dev-master": "2.8-dev"
} }
}, },
"autoload": { "autoload": {
@ -791,29 +839,29 @@
], ],
"description": "Symfony Stopwatch Component", "description": "Symfony Stopwatch Component",
"homepage": "https://symfony.com", "homepage": "https://symfony.com",
"time": "2016-06-29 05:41:56" "time": "2016-06-29 05:29:29"
}, },
{ {
"name": "symfony/yaml", "name": "symfony/yaml",
"version": "v3.1.3", "version": "v2.8.9",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/symfony/yaml.git", "url": "https://github.com/symfony/yaml.git",
"reference": "1819adf2066880c7967df7180f4f662b6f0567ac" "reference": "0ceab136f43ed9d3e97b3eea32a7855dc50c121d"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/symfony/yaml/zipball/1819adf2066880c7967df7180f4f662b6f0567ac", "url": "https://api.github.com/repos/symfony/yaml/zipball/0ceab136f43ed9d3e97b3eea32a7855dc50c121d",
"reference": "1819adf2066880c7967df7180f4f662b6f0567ac", "reference": "0ceab136f43ed9d3e97b3eea32a7855dc50c121d",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"php": ">=5.5.9" "php": ">=5.3.9"
}, },
"type": "library", "type": "library",
"extra": { "extra": {
"branch-alias": { "branch-alias": {
"dev-master": "3.1-dev" "dev-master": "2.8-dev"
} }
}, },
"autoload": { "autoload": {
@ -840,7 +888,7 @@
], ],
"description": "Symfony Yaml Component", "description": "Symfony Yaml Component",
"homepage": "https://symfony.com", "homepage": "https://symfony.com",
"time": "2016-07-17 14:02:08" "time": "2016-07-17 09:06:15"
} }
], ],
"aliases": [], "aliases": [],
@ -852,7 +900,7 @@
"prefer-stable": false, "prefer-stable": false,
"prefer-lowest": false, "prefer-lowest": false,
"platform": { "platform": {
"php": "^5.3 || ^7.0" "php": "^5.2.6 || ^7.0"
}, },
"platform-dev": [] "platform-dev": []
} }

View File

@ -26,6 +26,15 @@ use Exception;
*/ */
class ServerSalt extends AbstractPersistence class ServerSalt extends AbstractPersistence
{ {
/**
* file where salt is saved to
*
* @access private
* @static
* @var string
*/
private static $_file = 'salt.php';
/** /**
* generated salt * generated salt
* *
@ -44,15 +53,7 @@ class ServerSalt extends AbstractPersistence
*/ */
public static function generate() public static function generate()
{ {
$randomSalt = ''; $randomSalt = bin2hex(random_bytes(256));
if (function_exists('mcrypt_create_iv')) {
$randomSalt = bin2hex(mcrypt_create_iv(256, MCRYPT_DEV_URANDOM));
} else {
// fallback to mt_rand()
for ($i = 0; $i < 256; ++$i) {
$randomSalt .= base_convert(mt_rand(), 10, 16);
}
}
return $randomSalt; return $randomSalt;
} }
@ -70,19 +71,18 @@ class ServerSalt extends AbstractPersistence
return self::$_salt; return self::$_salt;
} }
$file = 'salt.php'; if (self::_exists(self::$_file)) {
if (self::_exists($file)) { if (is_readable(self::getPath(self::$_file))) {
if (is_readable(self::getPath($file))) { $items = explode('|', file_get_contents(self::getPath(self::$_file)));
$items = explode('|', file_get_contents(self::getPath($file)));
} }
if (!isset($items) || !is_array($items) || count($items) != 3) { if (!isset($items) || !is_array($items) || count($items) != 3) {
throw new Exception('unable to read file ' . self::getPath($file), 20); throw new Exception('unable to read file ' . self::getPath(self::$_file), 20);
} }
self::$_salt = $items[1]; self::$_salt = $items[1];
} else { } else {
self::$_salt = self::generate(); self::$_salt = self::generate();
self::_store( self::_store(
$file, self::$_file,
'<?php /* |' . self::$_salt . '| */ ?>' '<?php /* |' . self::$_salt . '| */ ?>'
); );
} }

View File

@ -43,26 +43,6 @@ class ServerSaltTest extends PHPUnit_Framework_TestCase
ServerSalt::setPath($this->_path); ServerSalt::setPath($this->_path);
$salt = ServerSalt::get(); $salt = ServerSalt::get();
// mcrypt mock
if (!function_exists('mcrypt_create_iv')) {
if (!defined('MCRYPT_DEV_URANDOM')) {
define('MCRYPT_DEV_URANDOM', 1);
}
function mcrypt_create_iv($int, $flag)
{
$randomSalt = '';
for ($i = 0; $i < $int; ++$i) {
$randomSalt .= base_convert(mt_rand(), 10, 16);
}
// hex2bin requires an even length, pad if necessary
if (strlen($randomSalt) % 2) {
$randomSalt = '0' . $randomSalt;
}
return hex2bin($randomSalt);
}
$this->assertNotEquals($salt, ServerSalt::generate());
}
// try setting a different path and resetting it // try setting a different path and resetting it
ServerSalt::setPath($this->_otherPath); ServerSalt::setPath($this->_otherPath);
$this->assertNotEquals($salt, ServerSalt::get()); $this->assertNotEquals($salt, ServerSalt::get());

View File

@ -17,6 +17,7 @@ return array(
'PrivateBin\\Data\\Filesystem' => $baseDir . '/lib/Data/Filesystem.php', 'PrivateBin\\Data\\Filesystem' => $baseDir . '/lib/Data/Filesystem.php',
'PrivateBin\\Filter' => $baseDir . '/lib/Filter.php', 'PrivateBin\\Filter' => $baseDir . '/lib/Filter.php',
'PrivateBin\\I18n' => $baseDir . '/lib/I18n.php', 'PrivateBin\\I18n' => $baseDir . '/lib/I18n.php',
'PrivateBin\\Json' => $baseDir . '/lib/Json.php',
'PrivateBin\\Model' => $baseDir . '/lib/Model.php', 'PrivateBin\\Model' => $baseDir . '/lib/Model.php',
'PrivateBin\\Model\\AbstractModel' => $baseDir . '/lib/Model/AbstractModel.php', 'PrivateBin\\Model\\AbstractModel' => $baseDir . '/lib/Model/AbstractModel.php',
'PrivateBin\\Model\\Comment' => $baseDir . '/lib/Model/Comment.php', 'PrivateBin\\Model\\Comment' => $baseDir . '/lib/Model/Comment.php',

View File

@ -47,6 +47,24 @@ class ComposerAutoloaderInitDontChange
$loader->register(true); $loader->register(true);
if ($useStaticLoader) {
$includeFiles = Composer\Autoload\ComposerStaticInitDontChange::$files;
} else {
$includeFiles = require __DIR__ . '/autoload_files.php';
}
foreach ($includeFiles as $fileIdentifier => $file) {
composerRequireDontChange($fileIdentifier, $file);
}
return $loader; return $loader;
} }
} }
function composerRequireDontChange($fileIdentifier, $file)
{
if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
require $file;
$GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
}
}

View File

@ -6,6 +6,10 @@ namespace Composer\Autoload;
class ComposerStaticInitDontChange class ComposerStaticInitDontChange
{ {
public static $files = array (
'5255c38a0faeba867671b61dfda6d864' => __DIR__ . '/..' . '/paragonie/random_compat/lib/random.php',
);
public static $prefixLengthsPsr4 = array ( public static $prefixLengthsPsr4 = array (
'P' => 'P' =>
array ( array (
@ -42,6 +46,7 @@ class ComposerStaticInitDontChange
'PrivateBin\\Data\\Filesystem' => __DIR__ . '/../..' . '/lib/Data/Filesystem.php', 'PrivateBin\\Data\\Filesystem' => __DIR__ . '/../..' . '/lib/Data/Filesystem.php',
'PrivateBin\\Filter' => __DIR__ . '/../..' . '/lib/Filter.php', 'PrivateBin\\Filter' => __DIR__ . '/../..' . '/lib/Filter.php',
'PrivateBin\\I18n' => __DIR__ . '/../..' . '/lib/I18n.php', 'PrivateBin\\I18n' => __DIR__ . '/../..' . '/lib/I18n.php',
'PrivateBin\\Json' => __DIR__ . '/../..' . '/lib/Json.php',
'PrivateBin\\Model' => __DIR__ . '/../..' . '/lib/Model.php', 'PrivateBin\\Model' => __DIR__ . '/../..' . '/lib/Model.php',
'PrivateBin\\Model\\AbstractModel' => __DIR__ . '/../..' . '/lib/Model/AbstractModel.php', 'PrivateBin\\Model\\AbstractModel' => __DIR__ . '/../..' . '/lib/Model/AbstractModel.php',
'PrivateBin\\Model\\Comment' => __DIR__ . '/../..' . '/lib/Model/Comment.php', 'PrivateBin\\Model\\Comment' => __DIR__ . '/../..' . '/lib/Model/Comment.php',

View File

@ -50,5 +50,55 @@
"identicon", "identicon",
"image" "image"
] ]
},
{
"name": "paragonie/random_compat",
"version": "v2.0.2",
"version_normalized": "2.0.2.0",
"source": {
"type": "git",
"url": "https://github.com/paragonie/random_compat.git",
"reference": "088c04e2f261c33bed6ca5245491cfca69195ccf"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/paragonie/random_compat/zipball/088c04e2f261c33bed6ca5245491cfca69195ccf",
"reference": "088c04e2f261c33bed6ca5245491cfca69195ccf",
"shasum": ""
},
"require": {
"php": ">=5.2.0"
},
"require-dev": {
"phpunit/phpunit": "4.*|5.*"
},
"suggest": {
"ext-libsodium": "Provides a modern crypto API that can be used to generate random bytes."
},
"time": "2016-04-03 06:00:07",
"type": "library",
"installation-source": "dist",
"autoload": {
"files": [
"lib/random.php"
]
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"authors": [
{
"name": "Paragon Initiative Enterprises",
"email": "security@paragonie.com",
"homepage": "https://paragonie.com"
}
],
"description": "PHP 5.x polyfill for random_bytes() and random_int() from PHP 7",
"keywords": [
"csprng",
"pseudorandom",
"random"
]
} }
] ]