Skip to content

Commit c2fedca

Browse files
stevebaumanstevebauman
authored
Merge pull request #778 from DirectoryTree/task-777
Redact password arguments from exception traces
2 parents 6ce1dcf + 441e20e commit c2fedca

12 files changed

Lines changed: 70 additions & 58 deletions

File tree

‎src/Auth/Events/Event.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace LdapRecord\Auth\Events;
44

55
use LdapRecord\LdapInterface;
6+
use SensitiveParameter;
67

78
abstract class Event
89
{
@@ -24,7 +25,7 @@ abstract class Event
2425
/**
2526
* Constructor.
2627
*/
27-
public function __construct(LdapInterface $connection, ?string $username = null, ?string $password = null)
28+
public function __construct(LdapInterface $connection, ?string $username = null, #[SensitiveParameter] ?string $password = null)
2829
{
2930
$this->connection = $connection;
3031
$this->username = $username;

‎src/Auth/Events/Failed.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
use Exception;
66
use LdapRecord\Auth\BindException;
77
use LdapRecord\LdapInterface;
8+
use SensitiveParameter;
89

910
class Failed extends Event
1011
{
@@ -16,7 +17,7 @@ class Failed extends Event
1617
/**
1718
* Constructor.
1819
*/
19-
public function __construct(LdapInterface $connection, ?string $username, ?string $password, BindException $exception)
20+
public function __construct(LdapInterface $connection, ?string $username, #[SensitiveParameter] ?string $password, BindException $exception)
2021
{
2122
parent::__construct($connection, $username, $password);
2223

‎src/Auth/Guard.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use LdapRecord\ConnectionException;
99
use LdapRecord\Events\DispatcherInterface;
1010
use LdapRecord\LdapInterface;
11+
use SensitiveParameter;
1112

1213
class Guard
1314
{
@@ -41,7 +42,7 @@ public function __construct(LdapInterface $connection, DomainConfiguration $conf
4142
* @throws UsernameRequiredException
4243
* @throws PasswordRequiredException
4344
*/
44-
public function attempt(string $username, string $password, bool $stayBound = false): bool
45+
public function attempt(string $username, #[SensitiveParameter] string $password, bool $stayBound = false): bool
4546
{
4647
switch (true) {
4748
case $username === '':
@@ -75,7 +76,7 @@ public function attempt(string $username, string $password, bool $stayBound = fa
7576
* @throws BindException
7677
* @throws ConnectionException
7778
*/
78-
public function bind(?string $username = null, ?string $password = null): void
79+
public function bind(?string $username = null, #[SensitiveParameter] ?string $password = null): void
7980
{
8081
$this->fireAuthEvent('binding', $username, $password);
8182

@@ -106,7 +107,7 @@ public function bind(?string $username = null, ?string $password = null): void
106107
*
107108
* @throws ConnectionException
108109
*/
109-
protected function authenticate(?string $username = null, ?string $password = null): bool
110+
protected function authenticate(?string $username = null, #[SensitiveParameter] ?string $password = null): bool
110111
{
111112
if ($this->configuration->get('use_sasl') ?? false) {
112113
return $this->connection->saslBind(
@@ -151,7 +152,7 @@ public function setDispatcher(?DispatcherInterface $dispatcher = null): void
151152
/**
152153
* Fire an authentication event.
153154
*/
154-
protected function fireAuthEvent(string $name, ?string $username = null, ?string $password = null, ...$args): void
155+
protected function fireAuthEvent(string $name, ?string $username = null, #[SensitiveParameter] ?string $password = null, ...$args): void
155156
{
156157
if (isset($this->events)) {
157158
$event = implode('\\', [Events::class, ucfirst($name)]);

‎src/Connection.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
use LdapRecord\Query\Builder;
1212
use LdapRecord\Query\Cache;
1313
use Psr\SimpleCache\CacheInterface;
14+
use SensitiveParameter;
1415

1516
class Connection
1617
{
@@ -208,7 +209,7 @@ public function setGuardResolver(Closure $callback): void
208209
* @throws Auth\BindException
209210
* @throws LdapRecordException
210211
*/
211-
public function connect(?string $username = null, ?string $password = null): void
212+
public function connect(?string $username = null, #[SensitiveParameter] ?string $password = null): void
212213
{
213214
$attempt = function () use ($username, $password) {
214215
$this->dispatch(new Events\Connecting($this));
@@ -334,7 +335,7 @@ public function isolate(Closure $operation): mixed
334335
*
335336
* @throws LdapRecordException
336337
*/
337-
public function changePassword(string $dn, string $oldPassword, string $newPassword): bool|string
338+
public function changePassword(string $dn, #[SensitiveParameter] string $oldPassword, #[SensitiveParameter] string $newPassword): bool|string
338339
{
339340
return $this->isolate(function (Connection $connection) use ($dn, $oldPassword, $newPassword) {
340341
$connection->connect($dn, $oldPassword);

‎src/Ldap.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
use LDAP\Connection as RawLdapConnection;
66
use Ldap\Result;
77
use Ldap\ResultEntry;
8+
use SensitiveParameter;
89

910
class Ldap implements LdapInterface
1011
{
@@ -272,7 +273,7 @@ public function parseResult(mixed $result, int &$errorCode = 0, ?string &$dn = n
272273
/**
273274
* {@inheritdoc}
274275
*/
275-
public function bind(?string $dn = null, ?string $password = null, ?array $controls = null): LdapResultResponse
276+
public function bind(?string $dn = null, #[SensitiveParameter] ?string $password = null, ?array $controls = null): LdapResultResponse
276277
{
277278
/** @var \LDAP\Result $result */
278279
$result = $this->executeFailableOperation(function () use ($dn, $password, $controls) {
@@ -289,7 +290,7 @@ public function bind(?string $dn = null, ?string $password = null, ?array $contr
289290
/**
290291
* {@inheritdoc}
291292
*/
292-
public function saslBind(?string $dn = null, ?string $password = null, array $options = []): bool
293+
public function saslBind(?string $dn = null, #[SensitiveParameter] ?string $password = null, array $options = []): bool
293294
{
294295
return $this->executeFailableOperation(function () use ($dn, $password, $options) {
295296
$options = array_merge([
@@ -371,7 +372,7 @@ public function modifyBatch(string $dn, array $values): bool
371372
/**
372373
* {@inheritdoc}
373374
*/
374-
public function exopPasswd(string $user = '', string $oldPassword = '', string $newPassword = '', ?array &$controls = null): bool|string
375+
public function exopPasswd(string $user = '', #[SensitiveParameter] string $oldPassword = '', #[SensitiveParameter] string $newPassword = '', ?array &$controls = null): bool|string
375376
{
376377
if (! function_exists('ldap_exop_passwd')) {
377378
throw new LdapRecordException(

‎src/LdapInterface.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
use LDAP\Connection;
66
use LDAP\Result;
7+
use SensitiveParameter;
78

89
/**
910
* @see https://ldap.com/ldap-oid-reference-guide
@@ -502,7 +503,7 @@ public function parseResult(mixed $result, int &$errorCode = 0, ?string &$dn = n
502503
*
503504
* @throws LdapRecordException
504505
*/
505-
public function bind(?string $dn = null, ?string $password = null, ?array $controls = null): LdapResultResponse;
506+
public function bind(?string $dn = null, #[SensitiveParameter] ?string $password = null, ?array $controls = null): LdapResultResponse;
506507

507508
/**
508509
* Bind to the LDAP directory using SASL.
@@ -517,7 +518,7 @@ public function bind(?string $dn = null, ?string $password = null, ?array $contr
517518
* @see https://php.net/manual/en/function.ldap-sasl-bind.php
518519
* @see https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml
519520
*/
520-
public function saslBind(?string $dn = null, ?string $password = null, array $options = []): bool;
521+
public function saslBind(?string $dn = null, #[SensitiveParameter] ?string $password = null, array $options = []): bool;
521522

522523
/**
523524
* Adds an entry to the current connection.
@@ -575,7 +576,7 @@ public function modifyBatch(string $dn, array $values): bool;
575576
*
576577
* @throws LdapRecordException
577578
*/
578-
public function exopPasswd(string $user = '', string $oldPassword = '', string $newPassword = '', ?array &$controls = null): bool|string;
579+
public function exopPasswd(string $user = '', #[SensitiveParameter] string $oldPassword = '', #[SensitiveParameter] string $newPassword = '', ?array &$controls = null): bool|string;
579580

580581
/**
581582
* Add attribute values to current attributes.

‎src/Models/Attributes/Password.php‎

Lines changed: 23 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
use InvalidArgumentException;
66
use LdapRecord\LdapRecordException;
77
use ReflectionMethod;
8+
use SensitiveParameter;
89

910
class Password
1011
{
@@ -17,87 +18,87 @@ class Password
1718
/**
1819
* Make an encoded password for transmission over LDAP.
1920
*/
20-
public static function encode(string $password): string
21+
public static function encode(#[SensitiveParameter] string $password): string
2122
{
2223
return iconv('UTF-8', 'UTF-16LE', '"'.$password.'"');
2324
}
2425

2526
/**
2627
* Make a salted md5 password.
2728
*/
28-
public static function smd5(string $password, ?string $salt = null): string
29+
public static function smd5(#[SensitiveParameter] string $password, ?string $salt = null): string
2930
{
3031
return '{SMD5}'.static::makeHash($password, 'md5', null, $salt ?? random_bytes(4));
3132
}
3233

3334
/**
3435
* Make a salted SHA password.
3536
*/
36-
public static function ssha(string $password, ?string $salt = null): string
37+
public static function ssha(#[SensitiveParameter] string $password, ?string $salt = null): string
3738
{
3839
return '{SSHA}'.static::makeHash($password, 'sha1', null, $salt ?? random_bytes(4));
3940
}
4041

4142
/**
4243
* Make a salted SSHA256 password.
4344
*/
44-
public static function ssha256(string $password, ?string $salt = null): string
45+
public static function ssha256(#[SensitiveParameter] string $password, ?string $salt = null): string
4546
{
4647
return '{SSHA256}'.static::makeHash($password, 'hash', 'sha256', $salt ?? random_bytes(4));
4748
}
4849

4950
/**
5051
* Make a salted SSHA384 password.
5152
*/
52-
public static function ssha384(string $password, ?string $salt = null): string
53+
public static function ssha384(#[SensitiveParameter] string $password, ?string $salt = null): string
5354
{
5455
return '{SSHA384}'.static::makeHash($password, 'hash', 'sha384', $salt ?? random_bytes(4));
5556
}
5657

5758
/**
5859
* Make a salted SSHA512 password.
5960
*/
60-
public static function ssha512(string $password, ?string $salt = null): string
61+
public static function ssha512(#[SensitiveParameter] string $password, ?string $salt = null): string
6162
{
6263
return '{SSHA512}'.static::makeHash($password, 'hash', 'sha512', $salt ?? random_bytes(4));
6364
}
6465

6566
/**
6667
* Make a non-salted SHA password.
6768
*/
68-
public static function sha(string $password): string
69+
public static function sha(#[SensitiveParameter] string $password): string
6970
{
7071
return '{SHA}'.static::makeHash($password, 'sha1');
7172
}
7273

7374
/**
7475
* Make a non-salted SHA256 password.
7576
*/
76-
public static function sha256(string $password): string
77+
public static function sha256(#[SensitiveParameter] string $password): string
7778
{
7879
return '{SHA256}'.static::makeHash($password, 'hash', 'sha256');
7980
}
8081

8182
/**
8283
* Make a non-salted SHA384 password.
8384
*/
84-
public static function sha384(string $password): string
85+
public static function sha384(#[SensitiveParameter] string $password): string
8586
{
8687
return '{SHA384}'.static::makeHash($password, 'hash', 'sha384');
8788
}
8889

8990
/**
9091
* Make a non-salted SHA512 password.
9192
*/
92-
public static function sha512(string $password): string
93+
public static function sha512(#[SensitiveParameter] string $password): string
9394
{
9495
return '{SHA512}'.static::makeHash($password, 'hash', 'sha512');
9596
}
9697

9798
/**
9899
* Make a non-salted md5 password.
99100
*/
100-
public static function md5(string $password): string
101+
public static function md5(#[SensitiveParameter] string $password): string
101102
{
102103
return '{MD5}'.static::makeHash($password, 'md5');
103104
}
@@ -110,7 +111,7 @@ public static function md5(string $password): string
110111
*
111112
* @throws LdapRecordException
112113
*/
113-
public static function argon2i(string $password): string
114+
public static function argon2i(#[SensitiveParameter] string $password): string
114115
{
115116
if (! defined('PASSWORD_ARGON2I')) {
116117
throw new LdapRecordException('Argon2i hashing is not supported by this PHP build.');
@@ -127,7 +128,7 @@ public static function argon2i(string $password): string
127128
*
128129
* @throws LdapRecordException
129130
*/
130-
public static function argon2id(string $password): string
131+
public static function argon2id(#[SensitiveParameter] string $password): string
131132
{
132133
if (! defined('PASSWORD_ARGON2ID')) {
133134
throw new LdapRecordException('Argon2id hashing is not supported by this PHP build.');
@@ -139,39 +140,39 @@ public static function argon2id(string $password): string
139140
/**
140141
* Make a non-salted NThash password.
141142
*/
142-
public static function nthash(string $password): string
143+
public static function nthash(#[SensitiveParameter] string $password): string
143144
{
144145
return '{NTHASH}'.strtoupper(hash('md4', iconv('UTF-8', 'UTF-16LE', $password)));
145146
}
146147

147148
/**
148149
* Crypt password with an MD5 salt.
149150
*/
150-
public static function md5Crypt(string $password, ?string $salt = null): string
151+
public static function md5Crypt(#[SensitiveParameter] string $password, ?string $salt = null): string
151152
{
152153
return '{CRYPT}'.static::makeCrypt($password, static::CRYPT_SALT_TYPE_MD5, $salt);
153154
}
154155

155156
/**
156157
* Crypt password with a SHA256 salt.
157158
*/
158-
public static function sha256Crypt(string $password, ?string $salt = null): string
159+
public static function sha256Crypt(#[SensitiveParameter] string $password, ?string $salt = null): string
159160
{
160161
return '{CRYPT}'.static::makeCrypt($password, static::CRYPT_SALT_TYPE_SHA256, $salt);
161162
}
162163

163164
/**
164165
* Crypt a password with a SHA512 salt.
165166
*/
166-
public static function sha512Crypt(string $password, ?string $salt = null): string
167+
public static function sha512Crypt(#[SensitiveParameter] string $password, ?string $salt = null): string
167168
{
168169
return '{CRYPT}'.static::makeCrypt($password, static::CRYPT_SALT_TYPE_SHA512, $salt);
169170
}
170171

171172
/**
172173
* Make a new password hash.
173174
*/
174-
protected static function makeHash(string $password, string $method, ?string $algo = null, ?string $salt = null): string
175+
protected static function makeHash(#[SensitiveParameter] string $password, string $method, ?string $algo = null, ?string $salt = null): string
175176
{
176177
$params = $algo ? [$algo, $password.$salt] : [$password.$salt];
177178

@@ -181,7 +182,7 @@ protected static function makeHash(string $password, string $method, ?string $al
181182
/**
182183
* Make a hashed password.
183184
*/
184-
protected static function makeCrypt(string $password, int $type, ?string $salt = null): string
185+
protected static function makeCrypt(#[SensitiveParameter] string $password, int $type, ?string $salt = null): string
185186
{
186187
return crypt($password, $salt ?? static::makeCryptSalt($type));
187188
}
@@ -221,7 +222,7 @@ protected static function makeCryptPrefixAndLength(int $type): array
221222
/**
222223
* Attempt to retrieve the hash method used for the password.
223224
*/
224-
public static function getHashMethod(string $password): ?string
225+
public static function getHashMethod(#[SensitiveParameter] string $password): ?string
225226
{
226227
if (! preg_match('/^\{(\w+)\}/', $password, $matches)) {
227228
return null;
@@ -233,7 +234,7 @@ public static function getHashMethod(string $password): ?string
233234
/**
234235
* Attempt to retrieve the hash method and algorithm used for the password.
235236
*/
236-
public static function getHashMethodAndAlgo(string $password): ?array
237+
public static function getHashMethodAndAlgo(#[SensitiveParameter] string $password): ?array
237238
{
238239
if (! preg_match('/^\{(\w+)\}\$([0-9a-z]{1})\$/', $password, $matches)) {
239240
return null;
@@ -247,7 +248,7 @@ public static function getHashMethodAndAlgo(string $password): ?array
247248
*
248249
* @throws LdapRecordException
249250
*/
250-
public static function getSalt(string $encryptedPassword): string
251+
public static function getSalt(#[SensitiveParameter] string $encryptedPassword): string
251252
{
252253
// crypt() methods.
253254
if (preg_match('/^\{(\w+)\}(\$.*\$).*$/', $encryptedPassword, $matches)) {

0 commit comments

Comments
 (0)