From 76f420e6b261eb08eda08f0ab73ba0c8de81afe4 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Mon, 15 Apr 2024 21:40:19 +0200 Subject: [PATCH] add SensitiveParameter to sensitive arguments This change adds the PHP attribute SensitiveParameter to the secret holding variables. See: https://www.php.net/manual/en/class.sensitiveparameter This feature is only available in PHP 8.2, so the minimum php version required has been updated. Github Actions now use PHP 8.2 and 8.3 for the tests. The checkout action has been updated to v4, too. Fix issue #118 --- .github/workflows/test-bacon.yml | 4 ++-- .github/workflows/test-endroid.yml | 4 ++-- .github/workflows/test.yml | 4 ++-- CHANGELOG.md | 12 ++++++++++++ README.md | 2 +- TwoFactorAuth.phpproj | 2 +- composer.json | 2 +- lib/TwoFactorAuth.php | 6 +++--- 8 files changed, 24 insertions(+), 12 deletions(-) diff --git a/.github/workflows/test-bacon.yml b/.github/workflows/test-bacon.yml index a4903ad..82faaaf 100644 --- a/.github/workflows/test-bacon.yml +++ b/.github/workflows/test-bacon.yml @@ -10,10 +10,10 @@ jobs: strategy: matrix: - php-version: ['8.1', '8.2'] + php-version: ['8.2', '8.3'] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - uses: shivammathur/setup-php@v2 with: diff --git a/.github/workflows/test-endroid.yml b/.github/workflows/test-endroid.yml index 23b3867..7312acb 100644 --- a/.github/workflows/test-endroid.yml +++ b/.github/workflows/test-endroid.yml @@ -10,11 +10,11 @@ jobs: strategy: matrix: - php-version: ['8.1', '8.2'] + php-version: ['8.2', '8.3'] endroid-version: ["^3","^4","^5"] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - uses: shivammathur/setup-php@v2 with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a51e67e..e9564dc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -10,10 +10,10 @@ jobs: strategy: matrix: - php-version: ['8.1', '8.2'] + php-version: ['8.2', '8.3'] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - uses: shivammathur/setup-php@v2 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 11c01b5..86aa156 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,17 @@ # RobThree\TwoFactorAuth changelog +# Version 3.x + +## Breaking changes + +### PHP Version + +Version 3.x requires at least PHP 8.2. + +### Add SensitiveParameter + +The new attribute SensitiveParameter was added to the code, to prevent accidental leak of secrets in stack traces. + # Version 2.x ## Breaking changes diff --git a/README.md b/README.md index 96f566d..4c8ecd8 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ You can make use of the included [Endroid](https://robthree.github.io/TwoFactorA ## Requirements -* Requires PHP version >=8.1 +* Requires PHP version >=8.2 * [cURL](http://php.net/manual/en/book.curl.php) when using the provided `QRServerProvider` (default), `ImageChartsQRCodeProvider` or `QRicketProvider` but you can also provide your own QR-code provider. * [random_bytes()](http://php.net/manual/en/function.random-bytes.php), [OpenSSL](http://php.net/manual/en/book.openssl.php) or [Hash](http://php.net/manual/en/book.hash.php) depending on which built-in RNG you use (TwoFactorAuth will try to 'autodetect' and use the best available); however: feel free to provide your own (CS)RNG. diff --git a/TwoFactorAuth.phpproj b/TwoFactorAuth.phpproj index 2a55b72..2ed68af 100644 --- a/TwoFactorAuth.phpproj +++ b/TwoFactorAuth.phpproj @@ -15,7 +15,7 @@ localhost http://localhost:41315/ PHP - 8.1 + 8.2 true diff --git a/composer.json b/composer.json index a3264a0..52884a0 100644 --- a/composer.json +++ b/composer.json @@ -27,7 +27,7 @@ "source": "https://github.com/RobThree/TwoFactorAuth" }, "require": { - "php": ">=8.1.0" + "php": ">=8.2.0" }, "require-dev": { "phpunit/phpunit": "^9", diff --git a/lib/TwoFactorAuth.php b/lib/TwoFactorAuth.php index f3f867e..af917e3 100644 --- a/lib/TwoFactorAuth.php +++ b/lib/TwoFactorAuth.php @@ -69,7 +69,7 @@ class TwoFactorAuth /** * Calculate the code with given secret and point in time */ - public function getCode(string $secret, ?int $time = null): string + public function getCode(#[\SensitiveParameter] string $secret, ?int $time = null): string { $secretkey = $this->base32Decode($secret); @@ -107,7 +107,7 @@ class TwoFactorAuth /** * Get data-uri of QRCode */ - public function getQRCodeImageAsDataUri(string $label, string $secret, int $size = 200): string + public function getQRCodeImageAsDataUri(string $label, #[\SensitiveParameter] string $secret, int $size = 200): string { if ($size <= 0) { throw new TwoFactorAuthException('Size must be > 0'); @@ -153,7 +153,7 @@ class TwoFactorAuth /** * Builds a string to be encoded in a QR code */ - public function getQRText(string $label, string $secret): string + public function getQRText(string $label, #[\SensitiveParameter] string $secret): string { return 'otpauth://totp/' . rawurlencode($label) . '?secret=' . rawurlencode($secret)