Infra-Mirrors/PrivateBin
1
0
Fork 0
mirror of https://github.com/PrivateBin/PrivateBin.git synced 2025-07-31 18:48:35 -04:00
Code Issues Projects Releases Packages Wiki Activity

Updated json checking.

Browse source 
- adapted to SJCL changed
- added entropy checking (from
f2ee2e8ba2)

(cherry picked from commit 57e6274c64e2c99c754b63586af6b34c374fbc2b)

Conflicts:
	index.php
This commit is contained in:
Sebastien SAUVAGE 2013-02-23 22:44:46 +01:00 • committed by El RIDO
parent 315c45ed0c
commit 7db76d8d71
2 changed files with 28 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/sjcl.php
View file

@ -29,7 +29,7 @@ class sjcl
*/
public static function isValid($encoded)
{
$accepted_keys = array('iv','salt','ct');
$accepted_keys = array('iv','v','iter','ks','ts','mode','adata','cipher','salt','ct');
// Make sure content is valid json
$decoded = json_decode($encoded);
@ -44,16 +44,26 @@ class sjcl
// Make sure required fields are present and contain base64 data.
foreach($accepted_keys as $k)
{
if (!(
array_key_exists($k, $decoded) &&
$ct = base64_decode($decoded[$k], $strict=true)
)) return false;
if (!array_key_exists($k, $decoded)) return false;
}
// Make sure some fields are base64 data.
if (!base64_decode($decoded['iv'], true)) return false;
if (!base64_decode($decoded['salt'], true)) return false;
if (!($ct = base64_decode($decoded['ct'], true))) return false;
// Make sure some fields have a reasonable size.
if (strlen($decoded['iv']) > 24) return false;
if (strlen($decoded['salt']) > 14) return false;
// Make sure some fields contain no unsupported values.
if (!(is_int($decoded['v']) || is_float($decoded['v'])) || (float) $decoded['v'] < 1) return false;
if (!is_int($decoded['iter']) || $decoded['iter'] <= 100) return false;
if (!in_array($decoded['ks'], array(128, 192, 256), true)) return false;
if (!in_array($decoded['ts'], array(64, 96, 128), true)) return false;
if (!in_array($decoded['mode'], array('ccm', 'ocb2', 'gcm'), true)) return false;
if ($decoded['cipher'] !== 'aes') return false;
// Reject data if entropy is too low
if (strlen($ct) > strlen(gzdeflate($ct))) return false;