Skip to content

Commit b527c03

Browse files
pierreduppierredup
committed
Deprecate the SecureRandom class
1 parent d1ae400 commit b527c03

File tree

15 files changed

+36
-36
lines changed

15 files changed

+36
-36
lines changed

‎composer.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@
2020
"doctrine/common": "~2.4",
2121
"twig/twig": "~1.20|~2.0",
2222
"psr/log": "~1.0",
23-
"symfony/security-acl": "~2.7"
23+
"symfony/security-acl": "~2.7",
24+
"paragonie/random_compat": "~1.0"
2425
},
2526
"replace": {
2627
"symfony/asset": "self.version",

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/security_csrf.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212

1313
<services>
1414
<service id="security.csrf.token_generator" class="%security.csrf.token_generator.class%" public="false">
15-
<argument type="service" id="security.secure_random" />
1615
</service>
1716

1817
<service id="security.csrf.token_storage" class="%security.csrf.token_storage.class%" public="false">

‎src/Symfony/Bundle/SecurityBundle/Command/UserPasswordEncoderCommand.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,6 @@ private function createPasswordQuestion()
164164

165165
private function generateSalt()
166166
{
167-
return base64_encode($this->getContainer()->get('security.secure_random')->nextBytes(30));
167+
return base64_encode(random_bytes(30));
168168
}
169169
}

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_rememberme.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,6 @@
4646
class="%security.authentication.rememberme.services.persistent.class%"
4747
parent="security.authentication.rememberme.services.abstract"
4848
abstract="true">
49-
<argument type="service" id="security.secure_random" />
5049
</service>
5150

5251
<service id="security.authentication.rememberme.services.simplehash"

‎src/Symfony/Component/Security/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ CHANGELOG
1212
`Symfony\Component\Security\Http\Authentication\SimpleFormAuthenticatorInterface` instead
1313
* deprecated `Symfony\Component\Security\Core\Util\ClassUtils`, use
1414
`Symfony\Component\Security\Acl\Util\ClassUtils` instead
15+
* deprecated `Symfony\Component\Security\Core\Util\SecureRandom` class in favour of the `random_bytes` function
1516

1617
2.7.0
1718
-----

‎src/Symfony/Component/Security/Core/Tests/Util/SecureRandomTest.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
use Symfony\Component\Security\Core\Util\SecureRandom;
1515

16+
/**
17+
* @group legacy
18+
*/
1619
class SecureRandomTest extends \PHPUnit_Framework_TestCase
1720
{
1821
/**

‎src/Symfony/Component/Security/Core/Util/SecureRandom.php

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,17 @@
1111

1212
namespace Symfony\Component\Security\Core\Util;
1313

14+
@trigger_error('The '.__NAMESPACE__.'\SecureRandom class is deprecated since version 2.8 and will be removed in 3.0. Use the random_bytes function instead.', E_USER_DEPRECATED);
15+
1416
use Psr\Log\LoggerInterface;
1517

1618
/**
1719
* A secure random number generator implementation.
1820
*
1921
* @author Fabien Potencier <fabien@symfony.com>
2022
* @author Johannes M. Schmitt <schmittjoh@gmail.com>
23+
*
24+
* @deprecated since version 2.8, to be removed in 3.0. Use the random_bytes function instead
2125
*/
2226
final class SecureRandom implements SecureRandomInterface
2327
{
@@ -43,9 +47,9 @@ public function __construct($seedFile = null, LoggerInterface $logger = null)
4347
$this->logger = $logger;
4448

4549
// determine whether to use OpenSSL
46-
if (!function_exists('openssl_random_pseudo_bytes')) {
50+
if (!function_exists('random_bytes') || !function_exists('openssl_random_pseudo_bytes')) {
4751
if (null !== $this->logger) {
48-
$this->logger->notice('It is recommended that you enable the "openssl" extension for random number generation.');
52+
$this->logger->notice('It is recommended that you install the "paragonie/random_compat" library or enable the "openssl" extension for random number generation.');
4953
}
5054
$this->useOpenSsl = false;
5155
} else {
@@ -58,6 +62,10 @@ public function __construct($seedFile = null, LoggerInterface $logger = null)
5862
*/
5963
public function nextBytes($nbBytes)
6064
{
65+
if (function_exists('random_bytes')) {
66+
return random_bytes($nbBytes);
67+
}
68+
6169
// try OpenSSL
6270
if ($this->useOpenSsl) {
6371
$bytes = openssl_random_pseudo_bytes($nbBytes, $strong);

‎src/Symfony/Component/Security/Core/composer.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@
3333
"symfony/http-foundation": "",
3434
"symfony/validator": "For using the user password constraint",
3535
"symfony/expression-language": "For using the expression voter",
36-
"ircmaxell/password-compat": "For using the BCrypt password encoder in PHP <5.5"
36+
"ircmaxell/password-compat": "For using the BCrypt password encoder in PHP <5.5",
37+
"paragonie/random_compat": "For secure random number generation in PHP 5.x"
3738
},
3839
"autoload": {
3940
"psr-4": { "Symfony\\Component\\Security\\Core\\": "" }

‎src/Symfony/Component/Security/Csrf/Tests/TokenGenerator/UriSafeTokenGeneratorTest.php

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,7 @@ public static function setUpBeforeClass()
4444

4545
protected function setUp()
4646
{
47-
$this->random = $this->getMock('Symfony\Component\Security\Core\Util\SecureRandomInterface');
48-
$this->generator = new UriSafeTokenGenerator($this->random, self::ENTROPY);
47+
$this->generator = new UriSafeTokenGenerator(null, self::ENTROPY);
4948
}
5049

5150
protected function tearDown()
@@ -56,11 +55,6 @@ protected function tearDown()
5655

5756
public function testGenerateToken()
5857
{
59-
$this->random->expects($this->once())
60-
->method('nextBytes')
61-
->with(self::ENTROPY / 8)
62-
->will($this->returnValue(self::$bytes));
63-
6458
$token = $this->generator->generateToken();
6559

6660
$this->assertTrue(ctype_print($token), 'is printable');

‎src/Symfony/Component/Security/Csrf/TokenGenerator/UriSafeTokenGenerator.php

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
namespace Symfony\Component\Security\Csrf\TokenGenerator;
1313

1414
use Symfony\Component\Security\Core\Util\SecureRandomInterface;
15-
use Symfony\Component\Security\Core\Util\SecureRandom;
1615

1716
/**
1817
* Generates CSRF tokens.
@@ -23,13 +22,6 @@
2322
*/
2423
class UriSafeTokenGenerator implements TokenGeneratorInterface
2524
{
26-
/**
27-
* The generator for random values.
28-
*
29-
* @var SecureRandomInterface
30-
*/
31-
private $random;
32-
3325
/**
3426
* The amount of entropy collected for each token (in bits).
3527
*
@@ -40,14 +32,15 @@ class UriSafeTokenGenerator implements TokenGeneratorInterface
4032
/**
4133
* Generates URI-safe CSRF tokens.
4234
*
35+
* Note: The $random parameter is deprecated since version 2.8 and will be removed in 3.0.
36+
*
4337
* @param SecureRandomInterface|null $random The random value generator used for
4438
* generating entropy
4539
* @param int $entropy The amount of entropy collected for
4640
* each token (in bits)
4741
*/
4842
public function __construct(SecureRandomInterface $random = null, $entropy = 256)
4943
{
50-
$this->random = $random ?: new SecureRandom();
5144
$this->entropy = $entropy;
5245
}
5346

@@ -59,7 +52,7 @@ public function generateToken()
5952
// Generate an URI safe base64 encoded string that does not contain "+",
6053
// "/" or "=" which need to be URL encoded and make URLs unnecessarily
6154
// longer.
62-
$bytes = $this->random->nextBytes($this->entropy / 8);
55+
$bytes = random_bytes($this->entropy / 8);
6356

6457
return rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
6558
}

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy