Skip to content

remove insecure rng providers#122

Merged
willpower232 merged 9 commits intoRobThree:masterfrom
NicolasCARPi:nico-slim
Apr 16, 2024
Merged

remove insecure rng providers#122
willpower232 merged 9 commits intoRobThree:masterfrom
NicolasCARPi:nico-slim

Conversation

@NicolasCARPi
Copy link
Collaborator

and remove the openssl provider. We now rely exclusively on random_bytes(), as there are no reasons not to. Fix #121

and remove the openssl provider. We now rely exclusively on
random_bytes(), as there are no reasons not to. Fix #121
Copy link
Owner

@RobThree RobThree left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

we were testing a test class, which didn't make a lot of sense.
@NicolasCARPi
Copy link
Collaborator Author

I cleaned up the tests, too. The TestRngProvider class inside test was tested, but there is no point to test a class that we have in tests. Tests should test the prod code, here it was doing nothing of the sort.

@NicolasCARPi
Copy link
Collaborator Author

Maybe the last commit was a bit too hasteful. Reverted for now.

@RobThree
Copy link
Owner

RobThree commented Apr 15, 2024

Isn't (or wasn't) it used to test if the 2FA class checked correctly for the isCryptographicallySecure property (or something along those lines).

@RobThree RobThree self-requested a review April 15, 2024 22:09
@NicolasCARPi
Copy link
Collaborator Author

Yeah, looking at it again, and given that getRandomBytes() is simply an alias to random_bytes(), it's a bit pointless to test if f(x) == f(x). We call it once in the test suite, that's enough. Should I reverse the reverse commit then?

@NicolasCARPi NicolasCARPi marked this pull request as ready for review April 15, 2024 22:17
@RobThree
Copy link
Owner

I think it's safe to throw it out, since the isCryptographicallySecure check is no longer performed by the TwoFactorAuth class and it has no use anymore.

@NicolasCARPi
Copy link
Collaborator Author

Done.

* Create a new secret
*/
public function createSecret(int $bits = 80, bool $requirecryptosecure = true): string
public function createSecret(int $bits = 80): string
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mental note to document in the changelog

* master:
  Exclude useless files from dist archive #103
Copy link
Owner

@RobThree RobThree left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ignore my previous comment. LGTM.

* master:
  delete files specific to code editors (#120)
this also aligns with other providers
@willpower232 willpower232 merged commit 194ecc2 into RobThree:master Apr 16, 2024
@NicolasCARPi NicolasCARPi deleted the nico-slim branch April 16, 2024 15:53
@NicolasCARPi NicolasCARPi mentioned this pull request May 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Slimming down the lib further

3 participants