aboutsummaryrefslogtreecommitdiffstats
path: root/lib/private/Security/CSRF
diff options
context:
space:
mode:
Diffstat (limited to 'lib/private/Security/CSRF')
-rw-r--r--lib/private/Security/CSRF/CsrfToken.php39
-rw-r--r--lib/private/Security/CSRF/CsrfTokenGenerator.php35
-rw-r--r--lib/private/Security/CSRF/CsrfTokenManager.php52
-rw-r--r--lib/private/Security/CSRF/TokenStorage/SessionStorage.php51
4 files changed, 33 insertions, 144 deletions
diff --git a/lib/private/Security/CSRF/CsrfToken.php b/lib/private/Security/CSRF/CsrfToken.php
index a76e169e5b9..6aad0cd5944 100644
--- a/lib/private/Security/CSRF/CsrfToken.php
+++ b/lib/private/Security/CSRF/CsrfToken.php
@@ -1,29 +1,10 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Leon Klingele <git@leonklingele.de>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Security\CSRF;
@@ -36,23 +17,19 @@ namespace OC\Security\CSRF;
* @package OC\Security\CSRF
*/
class CsrfToken {
- /** @var string */
- private $value;
- /** @var string */
- private $encryptedValue = '';
+ private string $encryptedValue = '';
/**
* @param string $value Value of the token. Can be encrypted or not encrypted.
*/
- public function __construct(string $value) {
- $this->value = $value;
+ public function __construct(
+ private string $value,
+ ) {
}
/**
* Encrypted value of the token. This is used to mitigate BREACH alike
* vulnerabilities. For display measures do use this functionality.
- *
- * @return string
*/
public function getEncryptedValue(): string {
if ($this->encryptedValue === '') {
@@ -66,8 +43,6 @@ class CsrfToken {
/**
* The unencrypted value of the token. Used for decrypting an already
* encrypted token.
- *
- * @return string
*/
public function getDecryptedValue(): string {
$token = explode(':', $this->value);
diff --git a/lib/private/Security/CSRF/CsrfTokenGenerator.php b/lib/private/Security/CSRF/CsrfTokenGenerator.php
index 0576fda9e06..9e3f15c63d2 100644
--- a/lib/private/Security/CSRF/CsrfTokenGenerator.php
+++ b/lib/private/Security/CSRF/CsrfTokenGenerator.php
@@ -1,27 +1,10 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Security\CSRF;
@@ -34,21 +17,15 @@ use OCP\Security\ISecureRandom;
* @package OC\Security\CSRF
*/
class CsrfTokenGenerator {
- /** @var ISecureRandom */
- private $random;
-
- /**
- * @param ISecureRandom $random
- */
- public function __construct(ISecureRandom $random) {
- $this->random = $random;
+ public function __construct(
+ private ISecureRandom $random,
+ ) {
}
/**
* Generate a new CSRF token.
*
* @param int $length Length of the token in characters.
- * @return string
*/
public function generateToken(int $length = 32): string {
return $this->random->generate($length);
diff --git a/lib/private/Security/CSRF/CsrfTokenManager.php b/lib/private/Security/CSRF/CsrfTokenManager.php
index 2c6dd45866d..00e1be5bedf 100644
--- a/lib/private/Security/CSRF/CsrfTokenManager.php
+++ b/lib/private/Security/CSRF/CsrfTokenManager.php
@@ -1,28 +1,10 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Security\CSRF;
@@ -34,27 +16,18 @@ use OC\Security\CSRF\TokenStorage\SessionStorage;
* @package OC\Security\CSRF
*/
class CsrfTokenManager {
- /** @var CsrfTokenGenerator */
- private $tokenGenerator;
- /** @var SessionStorage */
- private $sessionStorage;
- /** @var CsrfToken|null */
- private $csrfToken = null;
+ private SessionStorage $sessionStorage;
+ private ?CsrfToken $csrfToken = null;
- /**
- * @param CsrfTokenGenerator $tokenGenerator
- * @param SessionStorage $storageInterface
- */
- public function __construct(CsrfTokenGenerator $tokenGenerator,
- SessionStorage $storageInterface) {
- $this->tokenGenerator = $tokenGenerator;
+ public function __construct(
+ private CsrfTokenGenerator $tokenGenerator,
+ SessionStorage $storageInterface,
+ ) {
$this->sessionStorage = $storageInterface;
}
/**
* Returns the current CSRF token, if none set it will create a new one.
- *
- * @return CsrfToken
*/
public function getToken(): CsrfToken {
if (!\is_null($this->csrfToken)) {
@@ -74,8 +47,6 @@ class CsrfTokenManager {
/**
* Invalidates any current token and sets a new one.
- *
- * @return CsrfToken
*/
public function refreshToken(): CsrfToken {
$value = $this->tokenGenerator->generateToken();
@@ -87,16 +58,13 @@ class CsrfTokenManager {
/**
* Remove the current token from the storage.
*/
- public function removeToken() {
+ public function removeToken(): void {
$this->csrfToken = null;
$this->sessionStorage->removeToken();
}
/**
* Verifies whether the provided token is valid.
- *
- * @param CsrfToken $token
- * @return bool
*/
public function isTokenValid(CsrfToken $token): bool {
if (!$this->sessionStorage->hasToken()) {
diff --git a/lib/private/Security/CSRF/TokenStorage/SessionStorage.php b/lib/private/Security/CSRF/TokenStorage/SessionStorage.php
index ab05d5b1493..1f0f8bcaa0a 100644
--- a/lib/private/Security/CSRF/TokenStorage/SessionStorage.php
+++ b/lib/private/Security/CSRF/TokenStorage/SessionStorage.php
@@ -1,29 +1,10 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Security\CSRF\TokenStorage;
@@ -35,27 +16,18 @@ use OCP\ISession;
* @package OC\Security\CSRF\TokenStorage
*/
class SessionStorage {
- /** @var ISession */
- private $session;
-
- /**
- * @param ISession $session
- */
- public function __construct(ISession $session) {
- $this->session = $session;
+ public function __construct(
+ private ISession $session,
+ ) {
}
- /**
- * @param ISession $session
- */
- public function setSession(ISession $session) {
+ public function setSession(ISession $session): void {
$this->session = $session;
}
/**
* Returns the current token or throws an exception if none is found.
*
- * @return string
* @throws \Exception
*/
public function getToken(): string {
@@ -69,23 +41,20 @@ class SessionStorage {
/**
* Set the valid current token to $value.
- *
- * @param string $value
*/
- public function setToken(string $value) {
+ public function setToken(string $value): void {
$this->session->set('requesttoken', $value);
}
/**
* Removes the current token.
*/
- public function removeToken() {
+ public function removeToken(): void {
$this->session->remove('requesttoken');
}
+
/**
* Whether the storage has a storage.
- *
- * @return bool
*/
public function hasToken(): bool {
return $this->session->exists('requesttoken');
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-16 10:09:53 +0000