8000 Merge pull request #12780 from laravel/revert-12764-5.0-rand · laravel/framework@262b813 · GitHub
[go: up one dir, main page]
Skip to content

Commit 262b813

Browse files
taylorotwelltaylorotwell
committed
Merge pull request #12780 from laravel/revert-12764-5.0-rand
Revert "[5.0] Ensure openssl's vulnerable random generation is not used"
2 parents 2193408 + 665e02f commit 262b813

File tree

6 files changed

+28
-7
lines changed

6 files changed

+28
-7
lines changed

‎composer.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
"monolog/monolog": "~1.11",
2929
"mtdowling/cron-expression": "~1.0",
3030
"nesbot/carbon": "~1.0",
31-
"paragonie/random_compat": "~1.3",
3231
"psy/psysh": "0.4.*",
3332
"swiftmailer/swiftmailer": "~5.1",
3433
"symfony/console": "2.6.*",

‎src/Illuminate/Encryption/Encrypter.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<?php namespace Illuminate\Encryption;
22

33
use Exception;
4-
use Illuminate\Support\Str;
54
use Illuminate\Contracts\Encryption\DecryptException;
65
use Symfony\Component\Security\Core\Util\StringUtils;
6+
use Symfony\Component\Security\Core\Util\SecureRandom;
77
use Illuminate\Contracts\Encryption\Encrypter as EncrypterContract;
88

99
class Encrypter implements EncrypterContract {
@@ -160,7 +160,7 @@ protected function getJsonPayload($payload)
160160
*/
161161
protected function validMac(array $payload)
162162
{
163-
$bytes = Str::randomBytes(16);
163+
$bytes = (new SecureRandom)->nextBytes(16);
164164

165165
$calcMac = hash_hmac('sha256', $this->hash($payload['iv'], $payload['value']), $bytes, true);
166166

‎src/Illuminate/Encryption/composer.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
"ext-openssl": "*",
1919
"illuminate/contracts": "5.0.*",
2020
"illuminate/support": "5.0.*",
21-
"paragonie/random_compat": "~1.3",
2221
"symfony/security-core": "2.6.*"
2322
},
2423
"autoload": {

‎src/Illuminate/Foundation/Console/Optimize/config.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,8 @@
187187
$basePath.'/vendor/symfony/http-foundation/Symfony/Component/HttpFoundation/ResponseHeaderBag.php',
188188
$basePath.'/vendor/symfony/http-foundation/Symfony/Component/HttpFoundation/Cookie.php',
189189
$basePath.'/vendor/symfony/security-core/Symfony/Component/Security/Core/Util/StringUtils.php',
190+
$basePath.'/vendor/symfony/security-core/Symfony/Component/Security/Core/Util/SecureRandomInterface.php',
191+
$basePath.'/vendor/symfony/security-core/Symfony/Component/Security/Core/Util/SecureRandom.php',
190192
$basePath.'/vendor/symfony/finder/Symfony/Component/Finder/SplFileInfo.php',
191193
$basePath.'/vendor/symfony/finder/Symfony/Component/Finder/Expression/Regex.php',
192194
$basePath.'/vendor/symfony/finder/Symfony/Component/Finder/Expression/ValueInterface.php',

‎src/Illuminate/Support/Str.php

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?php namespace Illuminate\Support;
22

3+
use RuntimeException;
34
use Stringy\StaticStringy;
45
use Illuminate\Support\Traits\Macroable;
56

@@ -207,6 +208,8 @@ public static function plural($value, $count = 2)
207208
*
208209
* @param int $length
209210
* @return string
211+
*
212+
* @throws \RuntimeException
210213
*/
211214
public static function random($length = 16)
212215
{
@@ -227,10 +230,29 @@ public static function random($length = 16)
227230
*
228231
* @param int $length
229232
* @return string
233+
*
234+
* @throws \RuntimeException
230235
*/
231236
public static function randomBytes($length = 16)
232237
{
233-
return random_bytes($length);
238+
if (function_exists('random_bytes'))
239+
{
240+
$bytes = random_bytes($length);
241+
}
242+
elseif (function_exists('openssl_random_pseudo_bytes'))
243+
{
244+
$bytes = openssl_random_pseudo_bytes($length, $strong);
245+
if ($bytes === false || $strong === false)
246+
{
247+
throw new RuntimeException('Unable to generate random string.');
248+
}
249+
}
250+
else
251+
{
252+
throw new RuntimeException('OpenSSL extension is required for PHP 5 users.');
253+
}
254+
255+
return $bytes;
234256
}
235257

236258
/**

‎src/Illuminate/Support/composer.json

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@
1818
"ext-mbstring": "*",
1919
"illuminate/contracts": "5.0.*",
2020
"doctrine/inflector": "~1.0",
21-
"danielstjules/stringy": "~1.8",
22-
"paragonie/random_compat": "~1.3"
21+
"danielstjules/stringy": "~1.8"
2322
},
2423
"autoload": {
2524
"psr-4": {

0 commit comments

Comments
 (0)
0