Skip to content

Commit 766f08e

Browse files
pawan-adobe-securitypawan-adobe-security
authored
Merge pull request #8393 from magento-cia/cia-2.4.7-beta2-develop-bugfix-07112023
cia-2.4.7-beta2-develop-bugfix-07112023
2 parents 7c7461a + bf93767 commit 766f08e

File tree

15 files changed

+184
-84
lines changed

15 files changed

+184
-84
lines changed

‎app/code/Magento/Customer/Plugin/Webapi/Controller/Rest/ValidateCustomerData.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ class ValidateCustomerData
2828
*/
2929
public function beforeOverride(ParamsOverrider $subject, array $inputData, array $parameters): array
3030
{
31-
if (isset($inputData[self:: CUSTOMER_KEY])) {
32-
$inputData[self:: CUSTOMER_KEY] = $this->validateInputData($inputData[self:: CUSTOMER_KEY]);
31+
if (isset($inputData[self::CUSTOMER_KEY])) {
32+
$inputData[self::CUSTOMER_KEY] = $this->validateInputData($inputData[self::CUSTOMER_KEY]);
3333
}
3434
return [$inputData, $parameters];
3535
}
@@ -45,7 +45,7 @@ private function validateInputData(array $inputData): array
4545
$result = [];
4646

4747
$data = array_filter($inputData, function ($k) use (&$result) {
48-
$key = is_string($k) ? strtolower($k) : $k;
48+
$key = is_string($k) ? strtolower(str_replace('_', "", $k)) : $k;
4949
return !isset($result[$key]) && ($result[$key] = true);
5050
}, ARRAY_FILTER_USE_KEY);
5151

‎app/code/Magento/Customer/Test/Unit/Plugin/Webapi/Controller/Rest/ValidateCustomerDataTest.php

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
namespace Magento\Customer\Test\Unit\Plugin\Webapi\Controller\Rest;
99

1010
use Exception;
11-
use Magento\Framework\App\ObjectManager;
1211
use Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData;
12+
use Magento\Framework\App\ObjectManager;
1313
use PHPUnit\Framework\TestCase;
1414
use ReflectionClass;
1515

@@ -75,40 +75,48 @@ public function dataProviderInputData(): array
7575
{
7676
return [
7777
[
78-
['customer' =>
79-
[
78+
['customer' => [
8079
'id' => -1,
8180
'Id' => 1,
82-
'name' =>
83-
[
81+
'name' => [
8482
'firstName' => 'Test',
8583
'LastName' => 'user'
8684
],
8785
'isHavingOwnHouse' => 1,
88-
'address' =>
89-
[
86+
'address' => [
9087
'street' => '1st Street',
9188
'Street' => '3rd Street',
9289
'city' => 'London'
9390
],
9491
]
9592
],
96-
['customer' =>
97-
[
93+
['customer' => [
9894
'id' => -1,
99-
'name' =>
100-
[
95+
'name' => [
10196
'firstName' => 'Test',
10297
'LastName' => 'user'
10398
],
10499
'isHavingOwnHouse' => 1,
105-
'address' =>
106-
[
100+
'address' => [
107101
'street' => '1st Street',
108102
'city' => 'London'
109103
],
110104
]
111105
],
106+
['customer' => [
107+
'id' => -1,
108+
'_Id' => 1,
109+
'name' => [
110+
'firstName' => 'Test',
111+
'LastName' => 'user'
112+
],
113+
'isHavingOwnHouse' => 1,
114+
'address' => [
115+
'street' => '1st Street',
116+
'city' => 'London'
117+
],
118+
]
119+
],
112120
]
113121
];
114122
}

‎app/code/Magento/EncryptionKey/Model/ResourceModel/Key/Change.php

Lines changed: 38 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,22 @@
55
*/
66
namespace Magento\EncryptionKey\Model\ResourceModel\Key;
77

8+
use \Exception;
9+
use Magento\Config\Model\Config\Backend\Encrypted;
10+
use Magento\Config\Model\Config\Structure;
11+
use Magento\Framework\App\DeploymentConfig\Writer;
812
use Magento\Framework\App\Filesystem\DirectoryList;
913
use Magento\Framework\Config\ConfigOptionsListConstants;
1014
use Magento\Framework\Config\Data\ConfigData;
1115
use Magento\Framework\Config\File\ConfigFilePool;
16+
use Magento\Framework\Encryption\EncryptorInterface;
17+
use Magento\Framework\Exception\FileSystemException;
18+
use Magento\Framework\Exception\LocalizedException;
19+
use Magento\Framework\Filesystem;
20+
use Magento\Framework\Filesystem\Directory\WriteInterface;
21+
use Magento\Framework\Math\Random;
22+
use Magento\Framework\Model\ResourceModel\Db\AbstractDb;
23+
use Magento\Framework\Model\ResourceModel\Db\Context;
1224

1325
/**
1426
* Encryption key changer resource model
@@ -19,60 +31,60 @@
1931
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
2032
* @since 100.0.2
2133
*/
22-
class Change extends \Magento\Framework\Model\ResourceModel\Db\AbstractDb
34+
class Change extends AbstractDb
2335
{
2436
/**
2537
* Encryptor interface
2638
*
27-
* @var \Magento\Framework\Encryption\EncryptorInterface
39+
* @var EncryptorInterface
2840
*/
2941
protected $encryptor;
3042

3143
/**
3244
* Filesystem directory write interface
3345
*
34-
* @var \Magento\Framework\Filesystem\Directory\WriteInterface
46+
* @var WriteInterface
3547
*/
3648
protected $directory;
3749

3850
/**
3951
* System configuration structure
4052
*
41-
* @var \Magento\Config\Model\Config\Structure
53+
* @var Structure
4254
*/
4355
protected $structure;
4456

4557
/**
4658
* Configuration writer
4759
*
48-
* @var \Magento\Framework\App\DeploymentConfig\Writer
60+
* @var Writer
4961
*/
5062
protected $writer;
5163

5264
/**
53-
* Random
65+
* Random string generator
5466
*
55-
* @var \Magento\Framework\Math\Random
67+
* @var Random
5668
* @since 100.0.4
5769
*/
5870
protected $random;
5971

6072
/**
61-
* @param \Magento\Framework\Model\ResourceModel\Db\Context $context
62-
* @param \Magento\Framework\Filesystem $filesystem
63-
* @param \Magento\Config\Model\Config\Structure $structure
64-
* @param \Magento\Framework\Encryption\EncryptorInterface $encryptor
65-
* @param \Magento\Framework\App\DeploymentConfig\Writer $writer
66-
* @param \Magento\Framework\Math\Random $random
73+
* @param Context $context
74+
* @param Filesystem $filesystem
75+
* @param Structure $structure
76+
* @param EncryptorInterface $encryptor
77+
* @param Writer $writer
78+
* @param Random $random
6779
* @param string $connectionName
6880
*/
6981
public function __construct(
70-
\Magento\Framework\Model\ResourceModel\Db\Context $context,
71-
\Magento\Framework\Filesystem $filesystem,
72-
\Magento\Config\Model\Config\Structure $structure,
73-
\Magento\Framework\Encryption\EncryptorInterface $encryptor,
74-
\Magento\Framework\App\DeploymentConfig\Writer $writer,
75-
\Magento\Framework\Math\Random $random,
82+
Context $context,
83+
Filesystem $filesystem,
84+
Structure $structure,
85+
EncryptorInterface $encryptor,
86+
Writer $writer,
87+
Random $random,
7688
$connectionName = null
7789
) {
7890
$this->encryptor = clone $encryptor;
@@ -98,20 +110,18 @@ protected function _construct()
98110
*
99111
* @param string|null $key
100112
* @return null|string
101-
* @throws \Exception
113+
* @throws FileSystemException|LocalizedException|Exception
102114
*/
103115
public function changeEncryptionKey($key = null)
104116
{
105117
// prepare new key, encryptor and new configuration segment
106118
if (!$this->writer->checkIfWritable()) {
107-
throw new \Exception(__('Deployment configuration file is not writable.'));
119+
throw new FileSystemException(__('Deployment configuration file is not writable.'));
108120
}
109121

110122
if (null === $key) {
111-
// md5() here is not for cryptographic use. It used for generate encryption key itself
112-
// and do not encrypt any passwords
113-
// phpcs:ignore Magento2.Security.InsecureFunction
114-
$key = md5($this->random->getRandomString(ConfigOptionsListConstants::STORE_KEY_RANDOM_STRING_SIZE));
123+
$key = ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX .
124+
$this->random->getRandomBytes(ConfigOptionsListConstants::STORE_KEY_RANDOM_STRING_SIZE);
115125
}
116126
$this->encryptor->setNewKey($key);
117127

@@ -128,7 +138,7 @@ public function changeEncryptionKey($key = null)
128138
$this->writer->saveConfig($configData);
129139
$this->commit();
130140
return $key;
131-
} catch (\Exception $e) {
141+
} catch (LocalizedException $e) {
132142
$this->rollBack();
133143
throw $e;
134144
}
@@ -142,11 +152,11 @@ public function changeEncryptionKey($key = null)
142152
protected function _reEncryptSystemConfigurationValues()
143153
{
144154
// look for encrypted node entries in all system.xml files
145-
/** @var \Magento\Config\Model\Config\Structure $configStructure */
155+
/** @var Structure $configStructure */
146156
$configStructure = $this->structure;
147157
$paths = $configStructure->getFieldPathsByAttribute(
148158
'backend_model',
149-
\Magento\Config\Model\Config\Backend\Encrypted::class
159+
Encrypted::class
150160
);
151161

152162
// walk through found data and re-encrypt it

‎app/code/Magento/EncryptionKey/Test/Unit/Model/ResourceModel/Key/ChangeTest.php

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
use Magento\EncryptionKey\Model\ResourceModel\Key\Change;
1212
use Magento\Framework\App\DeploymentConfig\Writer;
1313
use Magento\Framework\App\ResourceConnection;
14+
use Magento\Framework\Config\ConfigOptionsListConstants;
1415
use Magento\Framework\DB\Adapter\AdapterInterface;
1516
use Magento\Framework\DB\Select;
1617
use Magento\Framework\Encryption\EncryptorInterface;
@@ -148,16 +149,19 @@ private function setUpChangeEncryptionKey()
148149
public function testChangeEncryptionKey()
149150
{
150151
$this->setUpChangeEncryptionKey();
151-
$this->randomMock->expects($this->never())->method('getRandomString');
152+
$this->randomMock->expects($this->never())->method('getRandomBytes');
152153
$key = 'key';
153154
$this->assertEquals($key, $this->model->changeEncryptionKey($key));
154155
}
155156

156157
public function testChangeEncryptionKeyAutogenerate()
157158
{
158159
$this->setUpChangeEncryptionKey();
159-
$this->randomMock->expects($this->once())->method('getRandomString')->willReturn('abc');
160-
$this->assertEquals(hash('md5', 'abc'), $this->model->changeEncryptionKey());
160+
$this->randomMock->expects($this->once())->method('getRandomBytes')->willReturn('abc');
161+
$this->assertEquals(
162+
ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX . 'abc',
163+
$this->model->changeEncryptionKey()
164+
);
161165
}
162166

163167
public function testChangeEncryptionKeyThrowsException()

‎dev/tests/integration/testsuite/Magento/EncryptionKey/Setup/Patch/Data/SodiumChachaPatchTest.php

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,17 @@
88

99
namespace Magento\EncryptionKey\Setup\Patch\Data;
1010

11+
use Magento\Framework\Config\ConfigOptionsListConstants;
1112
use Magento\Framework\ObjectManagerInterface;
1213
use Magento\Framework\App\DeploymentConfig;
1314
use Magento\Framework\Encryption\Encryptor;
1415

16+
/**
17+
* Class SodiumChachaPatch library test
18+
*/
1519
class SodiumChachaPatchTest extends \PHPUnit\Framework\TestCase
1620
{
17-
const PATH_KEY = 'crypt/key';
21+
private const PATH_KEY = 'crypt/key';
1822

1923
/**
2024
* @var ObjectManagerInterface
@@ -37,7 +41,10 @@ public function testChangeEncryptionKey()
3741
$testPath = 'test/config';
3842
$testValue = 'test';
3943

40-
$structureMock = $this->createMock(\Magento\Config\Model\Config\Structure\Proxy::class);
44+
$structureMock = $this->createMock(
45+
// phpstan:ignore "Class Magento\Config\Model\Config\Structure\Proxy not found."
46+
\Magento\Config\Model\Config\Structure\Proxy::class
47+
);
4148
$structureMock->expects($this->once())
4249
->method('getFieldPathsByAttribute')
4350
->willReturn([$testPath]);
@@ -88,7 +95,7 @@ private function legacyEncrypt(string $data): string
8895
$handle = @mcrypt_module_open(MCRYPT_RIJNDAEL_256, '', MCRYPT_MODE_CBC, '');
8996
$initVectorSize = @mcrypt_enc_get_iv_size($handle);
9097
$initVector = str_repeat("\0", $initVectorSize);
91-
@mcrypt_generic_init($handle, $this->deployConfig->get(static::PATH_KEY), $initVector);
98+
@mcrypt_generic_init($handle, $this->getEncryptionKey(), $initVector);
9299

93100
$encrpted = @mcrypt_generic($handle, $data);
94101

@@ -98,4 +105,19 @@ private function legacyEncrypt(string $data): string
98105

99106
return '0:' . Encryptor::CIPHER_RIJNDAEL_256 . ':' . base64_encode($encrpted);
100107
}
108+
109+
/**
110+
* Get Encryption key
111+
*
112+
* @return string
113+
* @throws \Magento\Framework\Exception\FileSystemException
114+
* @throws \Magento\Framework\Exception\RuntimeException
115+
*/
116+
private function getEncryptionKey(): string
117+
{
118+
$key = $this->deployConfig->get(static::PATH_KEY);
119+
return (str_starts_with($key, ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX)) ?
120+
base64_decode(substr($key, strlen(ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX))) :
121+
$key;
122+
}
101123
}

‎dev/tests/integration/testsuite/Magento/Sales/_files/payment_enc_cc.php

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88

99
use Magento\Framework\Api\SearchCriteriaBuilder;
1010
use Magento\Framework\Api\SearchCriteria;
11+
use Magento\Framework\Config\ConfigOptionsListConstants;
1112
use Magento\Sales\Api\OrderRepositoryInterface;
1213
use Magento\Sales\Model\ResourceModel\Order\Payment\EncryptionUpdateTest;
1314
use Magento\Framework\App\DeploymentConfig;
@@ -30,7 +31,14 @@
3031
$handle = @mcrypt_module_open(MCRYPT_RIJNDAEL_256, '', MCRYPT_MODE_CBC, '');
3132
$initVectorSize = @mcrypt_enc_get_iv_size($handle);
3233
$initVector = str_repeat("\0", $initVectorSize);
33-
@mcrypt_generic_init($handle, $deployConfig->get('crypt/key'), $initVector);
34+
35+
// Key is also encrypted to support 256-key
36+
$key = $deployConfig->get('crypt/key');
37+
$originalKey = (str_starts_with($key, ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX)) ?
38+
base64_decode(substr($key, strlen(ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX))) :
39+
$key;
40+
41+
@mcrypt_generic_init($handle, $originalKey, $initVector);
3442

3543
$encCcNumber = @mcrypt_generic($handle, EncryptionUpdateTest::TEST_CC_NUMBER);
3644

‎lib/internal/Magento/Framework/Config/ConfigOptionsListConstants.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,4 +167,9 @@ class ConfigOptionsListConstants
167167
*/
168168
public const STORE_KEY_RANDOM_STRING_SIZE = SODIUM_CRYPTO_AEAD_CHACHA20POLY1305_KEYBYTES;
169169
//phpcs:enable
170+
171+
/**
172+
* Prefix of encoded random string
173+
*/
174+
public const STORE_KEY_ENCODED_RANDOM_STRING_PREFIX = 'base64';
170175
}

0 commit comments

Comments
 (0)