ElyBy-Mirror/oauth2-server
1
0
Fork 0
mirror of https://github.com/elyby/oauth2-server.git synced 2024-12-02 11:40:47 +05:30
Code Issues Packages Projects Releases Wiki Activity

Update DefaultAlgorithm.php

Browse Source 
Prevent edge-case whereby, if the majority of `base64_encode($bytes)` consists of `/` or `+` characters, the resulting key will be shorter and less unpredictable (due to a smaller keyspace) than anticipated.

As a result, the `$len * 2` hack has been removed. Although it is highly probable that `$len * 2` will stop most edge cases from occurring, it does not actually guarantee the end result will be at least 40 characters long.
This commit is contained in:
Scott Arciszewski 2014-12-08 18:40:31 -05:00
parent edaccab04b
commit 7a63f42462
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/Util/KeyAlgorithm/DefaultAlgorithm.php
View File

@ -18,10 +18,9 @@ class DefaultAlgorithm implements KeyAlgorithmInterface
*/
public function generate($len = 40)
{
// We generate twice as many bytes here because we want to ensure we have
// enough after we base64 encode it to get the length we need because we
// take out the "/", "+", and "=" characters.
$bytes = openssl_random_pseudo_bytes($len * 2, $strong);
$stripped = '';
do {
$bytes = openssl_random_pseudo_bytes($len, $strong);
// We want to stop execution if the key fails because, well, that is bad.
if ($bytes === false || $strong === false) {
@ -29,7 +28,8 @@ class DefaultAlgorithm implements KeyAlgorithmInterface
throw new \Exception('Error Generating Key');
// @codeCoverageIgnoreEnd
}
return substr(str_replace(['/', '+', '='], '', base64_encode($bytes)), 0, $len);
$stripped .= str_replace(['/', '+', '='], '', base64_encode($bytes));
} while (strlen($stripped) < $len);
return substr($stripped, 0, $len);
}
}