bug #34275 [FrameworkBundle] allow using secrets when the sodium ext is missing (nicolas-grekas)

nicolas-grekas · nicolas-grekas · commit 9a2043769ed4 · 2019-11-07T13:04:15.000+01:00
This PR was merged into the 4.4 branch. Discussion ---------- [FrameworkBundle] allow using secrets when the sodium ext is missing | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | - | License | MIT | Doc PR | - When all secrets are defined as env vars, there is no need for the sodium vault, yet it chokes on instantiation currently. Commits ------- 326284a [FrameworkBundle] allow using secrets when the sodium ext is missing
diff --git a/src/Symfony/Bundle/FrameworkBundle/Secrets/SodiumVault.php b/src/Symfony/Bundle/FrameworkBundle/Secrets/SodiumVault.php
@@ -30,10 +30,6 @@ class SodiumVault extends AbstractVault
      */
     public function __construct(string $secretsDir, $decryptionKey = null)
     {
-        if (!\function_exists('sodium_crypto_box_seal')) {
-            throw new \LogicException('The "sodium" PHP extension is required to deal with secrets. Alternatively, try running "composer require paragonie/sodium_compat" if you cannot enable the extension."');
-        }
-
         if (null !== $decryptionKey && !\is_string($decryptionKey) && !(\is_object($decryptionKey) && method_exists($decryptionKey, '__toString'))) {
             throw new \TypeError(sprintf('Decryption key should be a string or an object that implements the __toString() method, %s given.', \gettype($decryptionKey)));
         }
@@ -107,16 +103,22 @@ public function reveal(string $name): ?string
             return null;
         }
 
+        if (!\function_exists('sodium_crypto_box_seal')) {
+            $this->lastMessage = sprintf('Secret "%s" cannot be revealed as the "sodium" PHP extension missing. Try running "composer require paragonie/sodium_compat" if you cannot enable the extension."', $name);
+
+            return null;
+        }
+
         $this->loadKeys();
 
         if ('' === $this->decryptionKey) {
-            $this->lastMessage = sprintf('Secrets cannot be revealed as no decryption key was found in "%s".', $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));
+            $this->lastMessage = sprintf('Secret "%s" cannot be revealed as no decryption key was found in "%s".', $name, $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));
 
             return null;
         }
 
         if (false === $value = sodium_crypto_box_seal_open(include $file, $this->decryptionKey)) {
-            $this->lastMessage = sprintf('Secrets cannot be revealed as the wrong decryption key was provided for "%s".', $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));
+            $this->lastMessage = sprintf('Secret "%s" cannot be revealed as the wrong decryption key was provided for "%s".', $name, $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));
 
             return null;
         }
@@ -167,6 +169,10 @@ public function list(bool $reveal = false): array
 
     private function loadKeys(): void
     {
+        if (!\function_exists('sodium_crypto_box_seal')) {
+            throw new \LogicException('The "sodium" PHP extension is required to deal with secrets. Alternatively, try running "composer require paragonie/sodium_compat" if you cannot enable the extension."');
+        }
+
         if (null !== $this->encryptionKey || '' !== $this->decryptionKey = (string) $this->decryptionKey) {
             return;
         }

Original file line number	Diff line number	Diff line change
`@@ -30,10 +30,6 @@ class SodiumVault extends AbstractVault`
`30`	`30`	`*/`
`31`	`31`	`public function __construct(string $secretsDir, $decryptionKey = null)`
`32`	`32`	`{`
`33`		`- if (!\function_exists('sodium_crypto_box_seal')) {`
`34`		`- throw new \LogicException('The "sodium" PHP extension is required to deal with secrets. Alternatively, try running "composer require paragonie/sodium_compat" if you cannot enable the extension."');`
`35`		`- }`
`36`		`-`
`37`	`33`	`if (null !== $decryptionKey && !\is_string($decryptionKey) && !(\is_object($decryptionKey) && method_exists($decryptionKey, '__toString'))) {`
`38`	`34`	`throw new \TypeError(sprintf('Decryption key should be a string or an object that implements the __toString() method, %s given.', \gettype($decryptionKey)));`
`39`	`35`	`}`
`@@ -107,16 +103,22 @@ public function reveal(string $name): ?string`
`107`	`103`	`return null;`
`108`	`104`	`}`
`109`	`105`
	`106`	`+ if (!\function_exists('sodium_crypto_box_seal')) {`
	`107`	`+ $this->lastMessage = sprintf('Secret "%s" cannot be revealed as the "sodium" PHP extension missing. Try running "composer require paragonie/sodium_compat" if you cannot enable the extension."', $name);`
	`108`	`+`
	`109`	`+ return null;`
	`110`	`+ }`
	`111`	`+`
`110`	`112`	`$this->loadKeys();`
`111`	`113`
`112`	`114`	`if ('' === $this->decryptionKey) {`
`113`		`- $this->lastMessage = sprintf('Secrets cannot be revealed as no decryption key was found in "%s".', $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));`
	`115`	`+ $this->lastMessage = sprintf('Secret "%s" cannot be revealed as no decryption key was found in "%s".', $name, $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));`
`114`	`116`
`115`	`117`	`return null;`
`116`	`118`	`}`
`117`	`119`
`118`	`120`	`if (false === $value = sodium_crypto_box_seal_open(include $file, $this->decryptionKey)) {`
`119`		`- $this->lastMessage = sprintf('Secrets cannot be revealed as the wrong decryption key was provided for "%s".', $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));`
	`121`	`+ $this->lastMessage = sprintf('Secret "%s" cannot be revealed as the wrong decryption key was provided for "%s".', $name, $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));`
`120`	`122`
`121`	`123`	`return null;`
`122`	`124`	`}`
`@@ -167,6 +169,10 @@ public function list(bool $reveal = false): array`
`167`	`169`
`168`	`170`	`private function loadKeys(): void`
`169`	`171`	`{`
	`172`	`+ if (!\function_exists('sodium_crypto_box_seal')) {`
	`173`	`+ throw new \LogicException('The "sodium" PHP extension is required to deal with secrets. Alternatively, try running "composer require paragonie/sodium_compat" if you cannot enable the extension."');`
	`174`	`+ }`
	`175`	`+`
`170`	`176`	`if (null !== $this->encryptionKey \|\| '' !== $this->decryptionKey = (string) $this->decryptionKey) {`
`171`	`177`	`return;`
`172`	`178`	`}`