ElyBy-Mirror/oauth2-server
1
0
Fork 0
mirror of https://github.com/elyby/oauth2-server.git synced 2024-11-01 16:33:07 +05:30
Code Issues Packages Projects Releases Wiki Activity

Update DefaultAlgorithm.php

Browse Source 
Prevent edge-case whereby, if the majority of `base64_encode($bytes)` consists of `/` or `+` characters, the resulting key will be shorter and less unpredictable (due to a smaller keyspace) than anticipated.

As a result, the `$len * 2` hack has been removed. Although it is highly probable that `$len * 2` will stop most edge cases from occurring, it does not actually guarantee the end result will be at least 40 characters long.
This commit is contained in:
Scott Arciszewski 2014-12-08 18:40:31 -05:00
parent edaccab04b
commit 7a63f42462
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/Util/KeyAlgorithm/DefaultAlgorithm.php
View File

@ -18,18 +18,18 @@ class DefaultAlgorithm implements KeyAlgorithmInterface
*/ */
public function generate($len = 40) public function generate($len = 40)
{ {
// We generate twice as many bytes here because we want to ensure we have $stripped = '';
// enough after we base64 encode it to get the length we need because we do {
// take out the "/", "+", and "=" characters. $bytes = openssl_random_pseudo_bytes($len, $strong);
$bytes = openssl_random_pseudo_bytes($len * 2, $strong);
// We want to stop execution if the key fails because, well, that is bad.
// We want to stop execution if the key fails because, well, that is bad. if ($bytes === false || $strong === false) {
if ($bytes === false || $strong === false) { // @codeCoverageIgnoreStart
// @codeCoverageIgnoreStart throw new \Exception('Error Generating Key');
throw new \Exception('Error Generating Key'); // @codeCoverageIgnoreEnd
// @codeCoverageIgnoreEnd }
} $stripped .= str_replace(['/', '+', '='], '', base64_encode($bytes));
} while (strlen($stripped) < $len);
return substr(str_replace(['/', '+', '='], '', base64_encode($bytes)), 0, $len); return substr($stripped, 0, $len);
} }
} }