ParagonIE\ConstantTime required PHP7, going to v1.x branch

extlib/ParagonIE/ConstantTime/Base32.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -39,9 +38,9 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function decode(string $src, bool $strictPadding = false): string
+    public static function decode($src)
     {
-        return static::doDecode($src, false, $strictPadding);
+        return static::doDecode($src, false);
     }
 
     /**
@@ -50,9 +49,9 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function decodeUpper(string $src, bool $strictPadding = false): string
+    public static function decodeUpper($src)
     {
-        return static::doDecode($src, true, $strictPadding);
+        return static::doDecode($src, true);
     }
 
     /**
@@ -61,7 +60,7 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function encode(string $src): string
+    public static function encode($src)
     {
         return static::doEncode($src, false);
     }
@@ -72,7 +71,7 @@ abstract class Base32 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function encodeUpper(string $src): string
+    public static function encodeUpper($src)
     {
         return static::doEncode($src, true);
     }
@@ -84,7 +83,7 @@ abstract class Base32 implements EncoderInterface
      * @param int $src
      * @return int
      */
-    protected static function decode5Bits(int $src): int
+    protected static function decode5Bits($src)
     {
         $ret = -1;
 
@@ -106,7 +105,7 @@ abstract class Base32 implements EncoderInterface
      * @param int $src
      * @return int
      */
-    protected static function decode5BitsUpper(int $src): int
+    protected static function decode5BitsUpper($src)
     {
         $ret = -1;
 
@@ -126,7 +125,7 @@ abstract class Base32 implements EncoderInterface
      * @param $src
      * @return string
      */
-    protected static function encode5Bits(int $src): string
+    protected static function encode5Bits($src)
     {
         $diff = 0x61;
 
@@ -145,7 +144,7 @@ abstract class Base32 implements EncoderInterface
      * @param $src
      * @return string
      */
-    protected static function encode5BitsUpper(int $src): string
+    protected static function encode5BitsUpper($src)
     {
         $diff = 0x41;
 
@@ -159,12 +158,11 @@ abstract class Base32 implements EncoderInterface
     /**
      * Base32 decoding
      *
-     * @param string $src
+     * @param $src
      * @param bool $upper
-     * @param bool $strictPadding
      * @return string
      */
-    protected static function doDecode(string $src, bool $upper = false, bool $strictPadding = false): string
+    protected static function doDecode($src, $upper = false)
     {
         // We do this to reduce code duplication:
         $method = $upper
@@ -176,7 +174,6 @@ abstract class Base32 implements EncoderInterface
         if ($srcLen === 0) {
             return '';
         }
-        if ($strictPadding) {
         if (($srcLen & 7) === 0) {
             for ($j = 0; $j < 7; ++$j) {
                 if ($src[$srcLen - 1] === '=') {
@@ -191,10 +188,6 @@ abstract class Base32 implements EncoderInterface
                 'Incorrect padding'
             );
         }
-        } else {
-            $src = \rtrim($src, '=');
-            $srcLen = Binary::safeStrlen($src);
-        }
 
         $err = 0;
         $dest = '';
@@ -321,7 +314,7 @@ abstract class Base32 implements EncoderInterface
      * @param bool $upper
      * @return string
      */
-    protected static function doEncode(string $src, bool $upper = false): string
+    protected static function doEncode($src, $upper = false)
     {
         // We do this to reduce code duplication:
         $method = $upper

extlib/ParagonIE/ConstantTime/Base32Hex.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -40,7 +39,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return int
      */
-    protected static function decode5Bits(int $src): int
+    protected static function decode5Bits($src)
     {
         $ret = -1;
 
@@ -60,7 +59,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return int
      */
-    protected static function decode5BitsUpper(int $src): int
+    protected static function decode5BitsUpper($src)
     {
         $ret = -1;
 
@@ -80,7 +79,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return string
      */
-    protected static function encode5Bits(int $src): string
+    protected static function encode5Bits($src)
     {
         $src += 0x30;
 
@@ -99,7 +98,7 @@ abstract class Base32Hex extends Base32
      * @param int $src
      * @return string
      */
-    protected static function encode5BitsUpper(int $src): string
+    protected static function encode5BitsUpper($src)
     {
         $src += 0x30;
 

extlib/ParagonIE/ConstantTime/Base64.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -41,7 +40,7 @@ abstract class Base64 implements EncoderInterface
      * @param string $src
      * @return string
      */
-    public static function encode(string $src): string
+    public static function encode($src)
     {
         $dest = '';
         $srcLen = Binary::safeStrlen($src);
@@ -83,18 +82,16 @@ abstract class Base64 implements EncoderInterface
      * Base64 character set "./[A-Z][a-z][0-9]"
      *
      * @param string $src
-     * @param bool $strictPadding
      * @return string|bool
      * @throws \RangeException
      */
-    public static function decode(string $src, bool $strictPadding = false): string
+    public static function decode($src, $strictPadding = false)
     {
         // Remove padding
         $srcLen = Binary::safeStrlen($src);
         if ($srcLen === 0) {
             return '';
         }
-
         if ($strictPadding) {
             if (($srcLen & 3) === 0) {
                 if ($src[$srcLen - 1] === '=') {
@@ -109,11 +106,6 @@ abstract class Base64 implements EncoderInterface
                     'Incorrect padding'
                 );
             }
-            if ($src[$srcLen - 1] === '=') {
-                throw new \RangeException(
-                    'Incorrect padding'
-                );
-            }
         } else {
             $src = \rtrim($src, '=');
             $srcLen = Binary::safeStrlen($src);
@@ -141,7 +133,6 @@ abstract class Base64 implements EncoderInterface
         if ($i < $srcLen) {
             $chunk = \unpack('C*', Binary::safeSubstr($src, $i, $srcLen - $i));
             $c0 = static::decode6Bits($chunk[1]);
-
             if ($i + 2 < $srcLen) {
                 $c1 = static::decode6Bits($chunk[2]);
                 $c2 = static::decode6Bits($chunk[3]);
@@ -151,7 +142,7 @@ abstract class Base64 implements EncoderInterface
                     ((($c1 << 4) | ($c2 >> 2)) & 0xff)
                 );
                 $err |= ($c0 | $c1 | $c2) >> 8;
-            } elseif ($i + 1 < $srcLen) {
+            } elseif($i + 1 < $srcLen) {
                 $c1 = static::decode6Bits($chunk[2]);
                 $dest .= \pack(
                     'C',
@@ -179,7 +170,7 @@ abstract class Base64 implements EncoderInterface
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -208,7 +199,7 @@ abstract class Base64 implements EncoderInterface
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $diff = 0x41;
 

extlib/ParagonIE/ConstantTime/Base64DotSlash.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -44,7 +43,7 @@ abstract class Base64DotSlash extends Base64
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -70,7 +69,7 @@ abstract class Base64DotSlash extends Base64
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $src += 0x2e;
 

extlib/ParagonIE/ConstantTime/Base64DotSlashOrdered.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -44,7 +43,7 @@ abstract class Base64DotSlashOrdered extends Base64
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -67,7 +66,7 @@ abstract class Base64DotSlashOrdered extends Base64
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $src += 0x2e;
 

extlib/ParagonIE/ConstantTime/Base64UrlSafe.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -45,7 +44,7 @@ abstract class Base64UrlSafe extends Base64
      * @param int $src
      * @return int
      */
-    protected static function decode6Bits(int $src): int
+    protected static function decode6Bits($src)
     {
         $ret = -1;
 
@@ -74,7 +73,7 @@ abstract class Base64UrlSafe extends Base64
      * @param int $src
      * @return string
      */
-    protected static function encode6Bits(int $src): string
+    protected static function encode6Bits($src)
     {
         $diff = 0x41;
 

extlib/ParagonIE/ConstantTime/Binary.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -43,7 +42,7 @@ abstract class Binary
      * @param string $str
      * @return int
      */
-    public static function safeStrlen(string $str): int
+    public static function safeStrlen($str)
     {
         if (\function_exists('mb_strlen')) {
             return \mb_strlen($str, '8bit');
@@ -65,10 +64,10 @@ abstract class Binary
      * @throws \TypeError
      */
     public static function safeSubstr(
-        string $str,
+        $str,
-        int $start = 0,
+        $start = 0,
         $length = null
-    ): string {
+    ) {
         if (\function_exists('mb_substr')) {
             // mb_substr($str, 0, NULL, '8bit') returns an empty string on PHP
             // 5.3, so we have to find the length ourselves.

extlib/ParagonIE/ConstantTime/EncoderInterface.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -35,18 +34,17 @@ interface EncoderInterface
      * Convert a binary string into a hexadecimal string without cache-timing
      * leaks
      *
-     * @param string $binString (raw binary)
+     * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function encode(string $binString): string;
+    public static function encode($bin_string);
 
     /**
      * Convert a binary string into a hexadecimal string without cache-timing
      * leaks
      *
-     * @param string $encodedString
+     * @param string $encoded_string
-     * @param bool $strictPadding Error on invalid padding
      * @return string (raw binary)
      */
-    public static function decode(string $encodedString, bool $strictPadding = false): string;
+    public static function decode($encoded_string);
 }

extlib/ParagonIE/ConstantTime/Encoding.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -37,7 +36,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32Encode(string $str): string
+    public static function base32Encode($str)
     {
         return Base32::encode($str);
     }
@@ -48,7 +47,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32EncodeUpper(string $str): string
+    public static function base32EncodeUpper($str)
     {
         return Base32::encodeUpper($str);
     }
@@ -59,7 +58,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32Decode(string $str): string
+    public static function base32Decode($str)
     {
         return Base32::decode($str);
     }
@@ -70,7 +69,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32DecodeUpper(string $str): string
+    public static function base32DecodeUpper($str)
     {
         return Base32::decodeUpper($str);
     }
@@ -81,7 +80,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexEncode(string $str): string
+    public static function base32HexEncode($str)
     {
         return Base32Hex::encode($str);
     }
@@ -93,7 +92,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexEncodeUpper(string $str): string
+    public static function base32HexEncodeUpper($str)
     {
         return Base32Hex::encodeUpper($str);
     }
@@ -104,7 +103,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexDecode(string $str): string
+    public static function base32HexDecode($str)
     {
         return Base32Hex::decode($str);
     }
@@ -115,7 +114,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base32HexDecodeUpper(string $str): string
+    public static function base32HexDecodeUpper($str)
     {
         return Base32Hex::decodeUpper($str);
     }
@@ -126,7 +125,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base64Encode(string $str): string
+    public static function base64Encode($str)
     {
         return Base64::encode($str);
     }
@@ -137,7 +136,7 @@ abstract class Encoding
      * @param $str
      * @return string
      */
-    public static function base64Decode(string $str): string
+    public static function base64Decode($str)
     {
         return Base64::decode($str);
     }
@@ -149,9 +148,9 @@ abstract class Encoding
      * @param $src
      * @return string
      */
-    public static function base64EncodeDotSlash(string $str): string
+    public static function base64EncodeDotSlash($src)
     {
-        return Base64DotSlash::encode($str);
+        return Base64DotSlash::encode($src);
     }
 
     /**
@@ -163,9 +162,9 @@ abstract class Encoding
      * @return bool|string
      * @throws \RangeException
      */
-    public static function base64DecodeDotSlash(string $str): string
+    public static function base64DecodeDotSlash($src)
     {
-        return Base64DotSlash::decode($str);
+        return Base64DotSlash::decode($src);
     }
 
     /**
@@ -175,9 +174,9 @@ abstract class Encoding
      * @param $src
      * @return string
      */
-    public static function base64EncodeDotSlashOrdered(string $str): string
+    public static function base64EncodeDotSlashOrdered($src)
     {
-        return Base64DotSlashOrdered::encode($str);
+        return Base64DotSlashOrdered::encode($src);
     }
 
     /**
@@ -189,9 +188,9 @@ abstract class Encoding
      * @return bool|string
      * @throws \RangeException
      */
-    public static function base64DecodeDotSlashOrdered(string $str): string
+    public static function base64DecodeDotSlashOrdered($src)
     {
-        return Base64DotSlashOrdered::decode($str);
+        return Base64DotSlashOrdered::decode($src);
     }
 
     /**
@@ -201,7 +200,7 @@ abstract class Encoding
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function hexEncode(string $bin_string): string
+    public static function hexEncode($bin_string)
     {
         return Hex::encode($bin_string);
     }
@@ -214,7 +213,7 @@ abstract class Encoding
      * @return string (raw binary)
      * @throws \RangeException
      */
-    public static function hexDecode(string $hex_string): string
+    public static function hexDecode($hex_string)
     {
         return Hex::decode($hex_string);
     }
@@ -226,7 +225,7 @@ abstract class Encoding
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function hexEncodeUpper(string $bin_string): string
+    public static function hexEncodeUpper($bin_string)
     {
         return Hex::encodeUpper($bin_string);
     }
@@ -238,7 +237,7 @@ abstract class Encoding
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function hexDecodeUpper(string $bin_string): string
+    public static function hexDecodeUpper($bin_string)
     {
         return Hex::decode($bin_string);
     }

extlib/ParagonIE/ConstantTime/Hex.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -38,7 +37,7 @@ abstract class Hex implements EncoderInterface
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function encode(string $bin_string): string
+    public static function encode($bin_string)
     {
         $hex = '';
         $len = Binary::safeStrlen($bin_string);
@@ -62,7 +61,7 @@ abstract class Hex implements EncoderInterface
      * @param string $bin_string (raw binary)
      * @return string
      */
-    public static function encodeUpper(string $bin_string): string
+    public static function encodeUpper($bin_string)
     {
         $hex = '';
         $len = Binary::safeStrlen($bin_string);
@@ -84,29 +83,23 @@ abstract class Hex implements EncoderInterface
      * leaks
      *
      * @param string $hex_string
-     * @param bool $strictPadding
      * @return string (raw binary)
      * @throws \RangeException
      */
-    public static function decode(string $hexString, bool $strictPadding = false): string
+    public static function decode($hex_string)
     {
         $hex_pos = 0;
         $bin = '';
         $c_acc = 0;
-        $hex_len = Binary::safeStrlen($hexString);
+        $hex_len = Binary::safeStrlen($hex_string);
         $state = 0;
         if (($hex_len & 1) !== 0) {
-            if ($strictPadding) {
             throw new \RangeException(
                 'Expected an even number of hexadecimal characters'
             );
-            } else {
-                $hexString = '0' . $hexString;
-                ++$hex_len;
-            }
         }
 
-        $chunk = \unpack('C*', $hexString);
+        $chunk = \unpack('C*', $hex_string);
         while ($hex_pos < $hex_len) {
             ++$hex_pos;
             $c = $chunk[$hex_pos];

extlib/ParagonIE/ConstantTime/RFC4648.php

@@ -1,5 +1,4 @@
 <?php
-declare(strict_types=1);
 namespace ParagonIE\ConstantTime;
 
 /**
@@ -42,7 +41,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64Encode(string $str): string
+    public function base64Encode($str)
     {
         return Base64::encode($str);
     }
@@ -55,9 +54,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64Decode(string $str): string
+    public function base64Decode($str)
     {
-        return Base64::decode($str, true);
+        return Base64::decode($str);
     }
 
     /**
@@ -68,7 +67,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64UrlSafeEncode(string $str): string
+    public function base64UrlSafeEncode($str)
     {
         return Base64UrlSafe::encode($str);
     }
@@ -81,9 +80,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base64UrlSafeDecode(string $str): string
+    public function base64UrlSafeDecode($str)
     {
-        return Base64UrlSafe::decode($str, true);
+        return Base64UrlSafe::decode($str);
     }
 
     /**
@@ -94,7 +93,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32Encode(string $str): string
+    public function base32Encode($str)
     {
         return Base32::encodeUpper($str);
     }
@@ -107,9 +106,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32Decode(string $str): string
+    public function base32Decode($str)
     {
-        return Base32::decodeUpper($str, true);
+        return Base32::decodeUpper($str);
     }
 
     /**
@@ -120,7 +119,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32HexEncode(string $str): string
+    public function base32HexEncode($str)
     {
         return Base32::encodeUpper($str);
     }
@@ -133,9 +132,9 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base32HexDecode(string $str): string
+    public function base32HexDecode($str)
     {
-        return Base32::decodeUpper($str, true);
+        return Base32::decodeUpper($str);
     }
 
     /**
@@ -146,7 +145,7 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base16Encode(string $str): string
+    public function base16Encode($str)
     {
         return Hex::encodeUpper($str);
     }
@@ -159,8 +158,8 @@ abstract class RFC4648
      * @param string $str
      * @return string
      */
-    public function base16Decode(string $str): string
+    public function base16Decode($str)
     {
-        return Hex::decode($str, true);
+        return Hex::decode($str);
     }
 }

extlib/ParagonIE/README.md

@@ -0,0 +1,74 @@
+# Constant-Time Encoding
+
+[![Build Status](https://travis-ci.org/paragonie/constant_time_encoding.svg?branch=v1.x)](https://travis-ci.org/paragonie/constant_time_encoding)
+
+Based on the [constant-time base64 implementation made by Steve "Sc00bz" Thomas](https://github.com/Sc00bz/ConstTimeEncoding),
+this library aims to offer character encoding functions that do not leak
+information about what you are encoding/decoding via processor cache 
+misses. Further reading on [cache-timing attacks](http://blog.ircmaxell.com/2014/11/its-all-about-time.html).
+
+Our fork offers the following enchancements:
+
+* `mbstring.func_overload` resistance
+* Unit tests
+* Composer- and Packagist-ready
+* Base16 encoding
+* Base32 encoding
+* Uses `pack()` and `unpack()` instead of `chr()` and `ord()`
+
+## PHP Version Requirements
+
+This library should work on any [supported version of PHP](https://secure.php.net/supported-versions.php).
+It *may* work on earlier versions, but we **do not** guarantee it. If it
+doesn't, we **will not** fix it to work on earlier versions of PHP.
+
+## How to Install
+
+```sh
+composer require paragonie/constant_time_encoding
+```
+
+## How to Use
+
+```php
+use \ParagonIE\ConstantTime\Encoding;
+
+// possibly (if applicable): 
+// require 'vendor/autoload.php';
+
+$data = random_bytes(32);
+echo Encoding::base64Encode($data), "\n";
+echo Encoding::base32EncodeUpper($data), "\n";
+echo Encoding::base32Encode($data), "\n";
+echo Encoding::hexEncode($data), "\n";
+echo Encoding::hexEncodeUpper($data), "\n";
+```
+
+Example output:
+ 
+```
+1VilPkeVqirlPifk5scbzcTTbMT2clp+Zkyv9VFFasE=
+2VMKKPSHSWVCVZJ6E7SONRY3ZXCNG3GE6ZZFU7TGJSX7KUKFNLAQ====
+2vmkkpshswvcvzj6e7sonry3zxcng3ge6zzfu7tgjsx7kukfnlaq====
+d558a53e4795aa2ae53e27e4e6c71bcdc4d36cc4f6725a7e664caff551456ac1
+D558A53E4795AA2AE53E27E4E6C71BDCC4D36CC4F6725A7E664CAFF551456AC1
+```
+
+If you only need a particular variant, you can just reference the 
+required class like so:
+
+```php
+use \ParagonIE\ConstantTime\Base64;
+use \ParagonIE\ConstantTime\Base32;
+
+$data = random_bytes(32);
+echo Base64::encode($data), "\n";
+echo Base32::encode($data), "\n";
+```
+
+Example output:
+
+```
+1VilPkeVqirlPifk5scbzcTTbMT2clp+Zkyv9VFFasE=
+2vmkkpshswvcvzj6e7sonry3zxcng3ge6zzfu7tgjsx7kukfnlaq====
+```