Commit graph

20 commits

Author SHA1 Message Date
Anna
d45d1d6bff
Merge pull request #60735 from nextcloud/fix/noid/crypto-decrypt-fallback-valueerror
fix(security): don't propagate ValueError from Crypto::decrypt() fallback
2026-06-09 15:14:44 +02:00
Côme Chilliet
1ab09ec753
chore: Apply new coding standard to all files
The diff can be checked using: git diff --ignore-all-space --ignore-blank-lines
To see only the changes not related to blank lines.

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2026-06-01 13:46:39 +02:00
Anna Larch
29f43d8e7a fix(security): don't propagate ValueError from Crypto::decrypt() fallback
When decrypting a v3 ciphertext with a mismatched secret, the first
attempt throws an Exception (HMAC mismatch). The fallback then calls
decryptWithoutSecret() with an empty string, which causes hash_hkdf()
to throw a ValueError. Since ValueError extends \Error rather than
\Exception, it bypassed the catch block and propagated as an unhandled
error, crashing the whole request.

Wrap the fallback in its own try/catch(\Throwable) and rethrow the
original Exception so callers get a meaningful HMAC mismatch error.

Signed-off-by: Anna Larch <anna@nextcloud.com>
AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 21:20:41 +02:00
Ferdinand Thiessen
e5b1799079
chore: add missing Override attribute to test files
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
2026-04-28 21:29:28 +02:00
Robin Appelman
aa15f9d16d
chore: run rector
Signed-off-by: Robin Appelman <robin@icewind.nl>
2025-07-01 22:45:52 +02:00
Robin Appelman
29e39c0a2e
chore: run rector on tests
Signed-off-by: Robin Appelman <robin@icewind.nl>
2025-06-12 18:31:58 +02:00
Joas Schilling
f474b5b3a9
test: Fix tests/lib/Security/
Signed-off-by: Joas Schilling <coding@schilljs.com>
2025-05-15 08:24:59 +02:00
Christoph Wurst
1323e5bcb1
fix(migration): Decrypt ownCloud secrets v2
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2024-11-28 09:00:33 +01:00
Christoph Wurst
49dd79eabb
refactor: Add void return type to PHPUnit test methods
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2024-09-15 22:32:31 +02:00
Andy Scherzinger
1f7e2ba599
chore: Add SPDX header
Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
2024-05-13 17:41:36 +02:00
J0WI
ca7b37ce5a Make Security module strict
Signed-off-by: J0WI <J0WI@users.noreply.github.com>
2021-04-19 17:31:12 +02:00
lynn-stephenson
a3bdb0c4cb
Implement unit tests for versions 1 and 2.
Signed-off-by: lynn-stephenson <lynn.stephenson@protonmail.com>
2020-10-15 21:23:24 -08:00
Roeland Jago Douma
35ff4aa1c6
Use random_bytes
Since we don't care if it is human readbale.
The code is backwards compatible with the old format.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-05-11 12:46:59 +02:00
Christoph Wurst
1584c9ae9c
Add visibility to all methods and position of static keyword
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 16:51:06 +02:00
Christoph Wurst
caff1023ea
Format control structures, classes, methods and function
To continue this formatting madness, here's a tiny patch that adds
unified formatting for control structures like if and loops as well as
classes, their methods and anonymous functions. This basically forces
the constructs to start on the same line. This is not exactly what PSR2
wants, but I think we can have a few exceptions with "our" style. The
starting of braces on the same line is pracrically standard for our
code.

This also removes and empty lines from method/function bodies at the
beginning and end.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 14:19:56 +02:00
Christoph Wurst
b80ebc9674
Use the short array syntax, everywhere
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-26 16:34:56 +01:00
Roeland Jago Douma
3a7cf40aaa
Mode to modern phpunit
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-27 15:27:18 +01:00
Roeland Jago Douma
c007ca624f
Make phpunit8 compatible
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-27 13:34:41 +01:00
Roeland Jago Douma
68748d4f85
Some php-cs fixes
* Order the imports
* No leading slash on imports
* Empty line before namespace
* One line per import
* Empty after imports
* Emmpty line at bottom of file

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-22 20:52:10 +01:00
Joas Schilling
94ad54ec9b Move tests/ to PSR-4 (#24731)
* Move a-b to PSR-4

* Move c-d to PSR-4

* Move e+g to PSR-4

* Move h-l to PSR-4

* Move m-r to PSR-4

* Move s-u to PSR-4

* Move files/ to PSR-4

* Move remaining tests to PSR-4

* Remove Test\ from old autoloader
2016-05-20 15:38:20 +02:00
Renamed from tests/lib/security/CryptoTest.php (Browse further)