Commit Graph

20 Commits

Author SHA1 Message Date
Anna d45d1d6bff Merge pull request #60735 from nextcloud/fix/noid/crypto-decrypt-fallback-valueerror
fix(security): don't propagate ValueError from Crypto::decrypt() fallback
2026-06-09 15:14:44 +02:00
Côme Chilliet 1ab09ec753 chore: Apply new coding standard to all files
The diff can be checked using: git diff --ignore-all-space --ignore-blank-lines
To see only the changes not related to blank lines.

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2026-06-01 13:46:39 +02:00
Anna Larch 29f43d8e7a fix(security): don't propagate ValueError from Crypto::decrypt() fallback
When decrypting a v3 ciphertext with a mismatched secret, the first
attempt throws an Exception (HMAC mismatch). The fallback then calls
decryptWithoutSecret() with an empty string, which causes hash_hkdf()
to throw a ValueError. Since ValueError extends \Error rather than
\Exception, it bypassed the catch block and propagated as an unhandled
error, crashing the whole request.

Wrap the fallback in its own try/catch(\Throwable) and rethrow the
original Exception so callers get a meaningful HMAC mismatch error.

Signed-off-by: Anna Larch <anna@nextcloud.com>
AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 21:20:41 +02:00
Ferdinand Thiessen e5b1799079 chore: add missing Override attribute to test files
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
2026-04-28 21:29:28 +02:00
Robin Appelman aa15f9d16d chore: run rector
Signed-off-by: Robin Appelman <robin@icewind.nl>
2025-07-01 22:45:52 +02:00
Robin Appelman 29e39c0a2e chore: run rector on tests
Signed-off-by: Robin Appelman <robin@icewind.nl>
2025-06-12 18:31:58 +02:00
Joas Schilling f474b5b3a9 test: Fix tests/lib/Security/
Signed-off-by: Joas Schilling <coding@schilljs.com>
2025-05-15 08:24:59 +02:00
Christoph Wurst 1323e5bcb1 fix(migration): Decrypt ownCloud secrets v2
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2024-11-28 09:00:33 +01:00
Christoph Wurst 49dd79eabb refactor: Add void return type to PHPUnit test methods
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2024-09-15 22:32:31 +02:00
Andy Scherzinger 1f7e2ba599 chore: Add SPDX header
Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
2024-05-13 17:41:36 +02:00
J0WI ca7b37ce5a Make Security module strict
Signed-off-by: J0WI <J0WI@users.noreply.github.com>
2021-04-19 17:31:12 +02:00
lynn-stephenson a3bdb0c4cb Implement unit tests for versions 1 and 2.
Signed-off-by: lynn-stephenson <lynn.stephenson@protonmail.com>
2020-10-15 21:23:24 -08:00
Roeland Jago Douma 35ff4aa1c6 Use random_bytes
Since we don't care if it is human readbale.
The code is backwards compatible with the old format.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-05-11 12:46:59 +02:00
Christoph Wurst 1584c9ae9c Add visibility to all methods and position of static keyword
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 16:51:06 +02:00
Christoph Wurst caff1023ea Format control structures, classes, methods and function
To continue this formatting madness, here's a tiny patch that adds
unified formatting for control structures like if and loops as well as
classes, their methods and anonymous functions. This basically forces
the constructs to start on the same line. This is not exactly what PSR2
wants, but I think we can have a few exceptions with "our" style. The
starting of braces on the same line is pracrically standard for our
code.

This also removes and empty lines from method/function bodies at the
beginning and end.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 14:19:56 +02:00
Christoph Wurst b80ebc9674 Use the short array syntax, everywhere
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-26 16:34:56 +01:00
Roeland Jago Douma 3a7cf40aaa Mode to modern phpunit
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-27 15:27:18 +01:00
Roeland Jago Douma c007ca624f Make phpunit8 compatible
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-27 13:34:41 +01:00
Roeland Jago Douma 68748d4f85 Some php-cs fixes
* Order the imports
* No leading slash on imports
* Empty line before namespace
* One line per import
* Empty after imports
* Emmpty line at bottom of file

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-22 20:52:10 +01:00
Joas Schilling 94ad54ec9b Move tests/ to PSR-4 (#24731)
* Move a-b to PSR-4

* Move c-d to PSR-4

* Move e+g to PSR-4

* Move h-l to PSR-4

* Move m-r to PSR-4

* Move s-u to PSR-4

* Move files/ to PSR-4

* Move remaining tests to PSR-4

* Remove Test\ from old autoloader
2016-05-20 15:38:20 +02:00