Merge pull request #1359 from jeffhuys/fix-snyk-vulnerability

Sephster · web-flow · commit cb9ae7905885 · 2023-08-02T23:53:00.000+01:00
Remove Key Leak 8.4.x
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [8.4.2] - released 2023-07-xx
+### Security
+- If a key string is provided to the CryptKey constructor with an invalid
+  passphrase, the LogicException message generated will contain the given key.
+  The key is no longer leaked via this exception (PR #1353)
+
 ## [8.4.1] - released 2023-03-22
 ### Fixed
 - Fix deprecation notices for PHP 8.x (PR #1329)
diff --git a/src/CryptKey.php b/src/CryptKey.php
@@ -64,7 +64,7 @@ public function __construct($keyPath, $passPhrase = null, $keyPermissionsCheck =
                 throw new LogicException('Unable to read key from file ' . $keyPath);
             }
         } else {
-            throw new LogicException('Unable to read key from file ' . $keyPath);
+            throw new LogicException('Invalid key supplied');
         }
 
         if ($keyPermissionsCheck === true) {
diff --git a/tests/Utils/CryptKeyTest.php b/tests/Utils/CryptKeyTest.php
@@ -55,7 +55,7 @@ public function testKeyString()
     public function testUnsupportedKeyType()
     {
         $this->expectException(\LogicException::class);
-        $this->expectExceptionMessage('Unable to read key');
+        $this->expectExceptionMessage('Invalid key supplied');
 
         try {
             // Create the keypair

Original file line number	Diff line number	Diff line change
`@@ -64,7 +64,7 @@ public function __construct($keyPath, $passPhrase = null, $keyPermissionsCheck =`
`64`	`64`	`throw new LogicException('Unable to read key from file ' . $keyPath);`
`65`	`65`	`}`
`66`	`66`	`} else {`
`67`		`- throw new LogicException('Unable to read key from file ' . $keyPath);`
	`67`	`+ throw new LogicException('Invalid key supplied');`
`68`	`68`	`}`
`69`	`69`
`70`	`70`	`if ($keyPermissionsCheck === true) {`
Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ public function testKeyString()`
`55`	`55`	`public function testUnsupportedKeyType()`
`56`	`56`	`{`
`57`	`57`	`$this->expectException(\LogicException::class);`
`58`		`- $this->expectExceptionMessage('Unable to read key');`
	`58`	`+ $this->expectExceptionMessage('Invalid key supplied');`
`59`	`59`
`60`	`60`	`try {`
`61`	`61`	`// Create the keypair`