From 761495e90ba7771faf219003b9e840e1656b401a Mon Sep 17 00:00:00 2001 From: ildyria Date: Sat, 18 Jul 2026 16:03:15 +0200 Subject: [PATCH 1/2] Add proper parameters --- composer.json | 7 ++++--- config/verify.php | 2 +- phpstan.neon | 1 + src/Contract/RotationResult.php | 3 ++- src/Contract/TokenExtensionResult.php | 3 ++- src/Rotation.php | 3 ++- src/Verify.php | 22 ++++++++++++---------- tests/TestVerifyFactory.php | 11 ++++++++--- tests/Verify/RotationTest.php | 2 +- 9 files changed, 33 insertions(+), 21 deletions(-) diff --git a/composer.json b/composer.json index 97b90ed..355f9fd 100644 --- a/composer.json +++ b/composer.json @@ -9,11 +9,12 @@ "thecodingmachine/safe": "^3.3" }, "require-dev": { - "nunomaduro/collision": "^8.8", - "larastan/larastan": "^3.6", - "orchestra/testbench": "^11.0.0||^10.0.0||^9.0.0||^8.22.0", "friendsofphp/php-cs-fixer": "^3.3", + "larastan/larastan": "^3.6", "lychee-org/phpstan-lychee": "^v2.0.2", + "lychee-org/phpstan-sensitive-parameter-values": "^1.0", + "nunomaduro/collision": "^8.8", + "orchestra/testbench": "^11.0.0||^10.0.0||^9.0.0||^8.22.0", "php-parallel-lint/php-parallel-lint": "^1.4", "phpunit/phpunit": "^10.0||^11.0" }, diff --git a/config/verify.php b/config/verify.php index 261dafa..596b158 100644 --- a/config/verify.php +++ b/config/verify.php @@ -17,7 +17,7 @@ ValidateSupporter::class => 'a12d601f9f22a6f326901f0c4deb3cdeb5d6cc47', ValidatePro::class => '50a93c3e54cbd8ec502cb574ac236bc4e99194be', ValidateSignature::class => '5a8a855d4b59c44c298daa66801c79f2aba20492', - Verify::class => '1026070973fa233fc087ed706aa4b9b50bd37843', + Verify::class => 'fc00671e09f27a6dc59e9390f8467872ccafae20', VerifySupporterStatus::class => '6358c45ed0414c1e2697e0881238659fa6221bed', VerifyProStatus::class => '212e6ada794587ee8e2b81cf76e243d134a7e823', VerifyServiceProvider::class => '923b63b15d25e69b95ed1d5ec1c82ba57f1a7d74', diff --git a/phpstan.neon b/phpstan.neon index 99e1b13..3a680c9 100644 --- a/phpstan.neon +++ b/phpstan.neon @@ -1,6 +1,7 @@ includes: - vendor/larastan/larastan/extension.neon - vendor/lychee-org/phpstan-lychee/phpstan.neon + - vendor/lychee-org/phpstan-sensitive-parameter-values/extension.neon parameters: level: 9 diff --git a/src/Contract/RotationResult.php b/src/Contract/RotationResult.php index 53b08b7..c467311 100644 --- a/src/Contract/RotationResult.php +++ b/src/Contract/RotationResult.php @@ -7,7 +7,8 @@ class RotationResult private function __construct( public readonly bool $success, public readonly ?string $message, - ) {} + ) { + } public static function ok(): self { diff --git a/src/Contract/TokenExtensionResult.php b/src/Contract/TokenExtensionResult.php index 8798e3c..f02671f 100644 --- a/src/Contract/TokenExtensionResult.php +++ b/src/Contract/TokenExtensionResult.php @@ -14,7 +14,8 @@ private function __construct( /** @var string[]|null */ public readonly ?array $scopes, public readonly ?Carbon $expires_at, - ) {} + ) { + } /** * @param string[] $scopes diff --git a/src/Rotation.php b/src/Rotation.php index 3e9be04..b80d5a4 100644 --- a/src/Rotation.php +++ b/src/Rotation.php @@ -16,7 +16,8 @@ class Rotation public function __construct( private VerifyFactory $verifyFactory, - ) {} + ) { + } public function rotate(): RotationResult { diff --git a/src/Verify.php b/src/Verify.php index b90e22a..330e5ab 100755 --- a/src/Verify.php +++ b/src/Verify.php @@ -16,8 +16,10 @@ class Verify implements VerifyInterface { use VerifyTrait; - private string $config_email; - private string $license_key; + /** @var \SensitiveParameterValue */ + private \SensitiveParameterValue $config_email; + /** @var \SensitiveParameterValue */ + private \SensitiveParameterValue $license_key; private ValidateSignature $validateSignature; private ValidateSupporter $validateSupporter; private ValidatePro $validatePro; @@ -54,8 +56,8 @@ private function init( ): bool { if ($config_email !== null || $license_key !== null) { // If both values are provided, no need to check the database - $this->config_email = $config_email ?? ''; - $this->license_key = $license_key ?? ''; + $this->config_email = new \SensitiveParameterValue($config_email ?? ''); + $this->license_key = new \SensitiveParameterValue($license_key ?? ''); $this->initialized = true; return true; @@ -67,8 +69,8 @@ private function init( } // Load the necessary config entries - $this->config_email = DB::table('configs')->where('key', 'email')->first()?->value ?? ''; // @phpstan-ignore-line - $this->license_key = DB::table('configs')->where('key', 'license_key')->first()?->value ?? ''; // @phpstan-ignore-line + $this->config_email = new \SensitiveParameterValue(DB::table('configs')->where('key', 'email')->first()?->value ?? ''); // @phpstan-ignore-line + $this->license_key = new \SensitiveParameterValue(DB::table('configs')->where('key', 'license_key')->first()?->value ?? ''); // @phpstan-ignore-line $this->initialized = true; return true; @@ -95,17 +97,17 @@ public function get_status(): Status */ private function resolve_status(): Status { - $base = json_encode(['url' => config('app.url'), 'email' => $this->config_email]); + $base = json_encode(['url' => config('app.url'), 'email' => $this->config_email->getValue()]); - if ($this->validateSupporter->validate($base, $this->license_key)) { + if ($this->validateSupporter->validate($base, $this->license_key->getValue())) { return $this->validateSupporter->grant(); } - if ($this->validatePro->validate($base, $this->license_key)) { + if ($this->validatePro->validate($base, $this->license_key->getValue())) { return $this->validatePro->grant(); } - if ($this->config_email !== '' && $this->validateSignature->validate($base, $this->license_key)) { + if ($this->config_email->getValue() !== '' && $this->validateSignature->validate($base, $this->license_key->getValue())) { return $this->validateSignature->grant(); } diff --git a/tests/TestVerifyFactory.php b/tests/TestVerifyFactory.php index 5c6f5c9..22e3f26 100644 --- a/tests/TestVerifyFactory.php +++ b/tests/TestVerifyFactory.php @@ -8,12 +8,17 @@ class TestVerifyFactory implements VerifyFactory { + /** @var \SensitiveParameterValue */ + private \SensitiveParameterValue $hash_supporter; + public function __construct( - #[\SensitiveParameter] private ?string $hash_supporter = null, - ) {} + #[\SensitiveParameter] ?string $hash_supporter = null, + ) { + $this->hash_supporter = new \SensitiveParameterValue($hash_supporter); + } public function make(#[\SensitiveParameter] string $license_key): VerifyInterface { - return new Verify(license_key: $license_key, hash_supporter: $this->hash_supporter); + return new Verify(license_key: $license_key, hash_supporter: $this->hash_supporter->getValue()); } } diff --git a/tests/Verify/RotationTest.php b/tests/Verify/RotationTest.php index 19af186..3dd761a 100644 --- a/tests/Verify/RotationTest.php +++ b/tests/Verify/RotationTest.php @@ -15,7 +15,7 @@ class RotationTest extends TestCase { private const KEYGEN_URL = 'https://keygen.lycheeorg.dev/api'; - private function makeRotation(?string $hash_supporter = null): Rotation + private function makeRotation(#[\SensitiveParameter] ?string $hash_supporter = null): Rotation { $factory = $hash_supporter !== null ? new TestVerifyFactory($hash_supporter) From 867f55dd0127e330a25c74251ae1c6372527caa3 Mon Sep 17 00:00:00 2001 From: ildyria Date: Sat, 18 Jul 2026 16:13:40 +0200 Subject: [PATCH 2/2] avoid unwrapping --- config/verify.php | 8 ++++---- src/Contract/ValidatorInterface.php | 8 ++++---- src/Validators/ValidatePro.php | 6 +++++- src/Validators/ValidateSignature.php | 6 +++++- src/Validators/ValidateSupporter.php | 6 +++++- src/Verify.php | 6 +++--- 6 files changed, 26 insertions(+), 14 deletions(-) diff --git a/config/verify.php b/config/verify.php index 596b158..246fcfe 100644 --- a/config/verify.php +++ b/config/verify.php @@ -14,10 +14,10 @@ 'keygen_url' => env('KEYGEN_URL', 'https://keygen.lycheeorg.dev/api'), 'validation' => [ - ValidateSupporter::class => 'a12d601f9f22a6f326901f0c4deb3cdeb5d6cc47', - ValidatePro::class => '50a93c3e54cbd8ec502cb574ac236bc4e99194be', - ValidateSignature::class => '5a8a855d4b59c44c298daa66801c79f2aba20492', - Verify::class => 'fc00671e09f27a6dc59e9390f8467872ccafae20', + ValidateSupporter::class => 'bcd0281afd7a8c4e19be3ea3a16860f4fe81556b', + ValidatePro::class => '26e178bcb4264101281ff4adb51d05a821b021f6', + ValidateSignature::class => '8c1c664c1ed9a98452f5af10b1a2a69c03b81d66', + Verify::class => '4ae4a13beb075b695536d91478f8e55f5226e51a', VerifySupporterStatus::class => '6358c45ed0414c1e2697e0881238659fa6221bed', VerifyProStatus::class => '212e6ada794587ee8e2b81cf76e243d134a7e823', VerifyServiceProvider::class => '923b63b15d25e69b95ed1d5ec1c82ba57f1a7d74', diff --git a/src/Contract/ValidatorInterface.php b/src/Contract/ValidatorInterface.php index 3301d2c..672d02c 100644 --- a/src/Contract/ValidatorInterface.php +++ b/src/Contract/ValidatorInterface.php @@ -10,12 +10,12 @@ interface ValidatorInterface /** * Given a license key and a verifiable string, check whether the license key is valid or not. * - * @param string $verifiable - * @param string $license + * @param string $verifiable + * @param string|\SensitiveParameterValue $license * * @return bool */ - public function validate(string $verifiable, string $license): bool; + public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool; /** * Defines the status granted by the Validator in case of success. @@ -23,4 +23,4 @@ public function validate(string $verifiable, string $license): bool; * @return Status */ public function grant(): Status; -} \ No newline at end of file +} diff --git a/src/Validators/ValidatePro.php b/src/Validators/ValidatePro.php index 06203ab..996ae75 100644 --- a/src/Validators/ValidatePro.php +++ b/src/Validators/ValidatePro.php @@ -20,8 +20,12 @@ public function __construct(#[\SensitiveParameter] ?string $hash = null) /** * Validate whether the static license key provided matches with the hash. */ - public function validate(string $verifiable, string $license): bool + public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool { + if ($license instanceof \SensitiveParameterValue) { + $license = $license->getValue(); + } + if ($license === '') { return false; } diff --git a/src/Validators/ValidateSignature.php b/src/Validators/ValidateSignature.php index 778619e..31bd21b 100644 --- a/src/Validators/ValidateSignature.php +++ b/src/Validators/ValidateSignature.php @@ -25,8 +25,12 @@ public function __construct(#[\SensitiveParameter] ?string $public_key = null) /** * Validate whether the cryptographic signature (license) is valid with the hard coded public key. */ - public function validate(string $verifiable, string $license): bool + public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool { + if ($license instanceof \SensitiveParameterValue) { + $license = $license->getValue(); + } + if ($license === '' || $verifiable === '') { return false; } diff --git a/src/Validators/ValidateSupporter.php b/src/Validators/ValidateSupporter.php index ea1d6af..80a5027 100644 --- a/src/Validators/ValidateSupporter.php +++ b/src/Validators/ValidateSupporter.php @@ -20,8 +20,12 @@ public function __construct(#[\SensitiveParameter] ?string $hash = null) /** * Validate whether the static license key provided matches with the hash. */ - public function validate(string $verifiable, string $license): bool + public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool { + if ($license instanceof \SensitiveParameterValue) { + $license = $license->getValue(); + } + if ($license === '') { return false; } diff --git a/src/Verify.php b/src/Verify.php index 330e5ab..38be650 100755 --- a/src/Verify.php +++ b/src/Verify.php @@ -99,15 +99,15 @@ private function resolve_status(): Status { $base = json_encode(['url' => config('app.url'), 'email' => $this->config_email->getValue()]); - if ($this->validateSupporter->validate($base, $this->license_key->getValue())) { + if ($this->validateSupporter->validate($base, $this->license_key)) { return $this->validateSupporter->grant(); } - if ($this->validatePro->validate($base, $this->license_key->getValue())) { + if ($this->validatePro->validate($base, $this->license_key)) { return $this->validatePro->grant(); } - if ($this->config_email->getValue() !== '' && $this->validateSignature->validate($base, $this->license_key->getValue())) { + if ($this->config_email->getValue() !== '' && $this->validateSignature->validate($base, $this->license_key)) { return $this->validateSignature->grant(); }