[FEATURE] Introduce class to generate/validate HMAC hashes
The `GeneralUtility::hmac()` function is used in several places to create HMAC hashes for a given string and optional additional secret. Extbase has the class `HashService`, which also provides the ability to create a HMAC for a given string, but without the possibility to add an additional secret. The missing possibility to use an additional secret is suboptimal in terms of security, since generated HMAC hashes will be equal for the same input in different contexts. This change introduces a new class, which combines the functionality of `GeneralUtility::hmac()` and Extbase `HashService` but with the requirement, that an additional secret is always mandatory. The class will be used in follow up patches, where `GeneralUtility::hmac()` and Extbase `HashService` will be deprecated. Resolves: #102761 Releases: main Signed-off-by:Torben Hansen <derhansen@gmail.com> Change-Id: Ibf0be09f4dffe076ddd0d3a31323ccd05693f7c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80394 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de>
Showing
- Build/phpstan/phpstan-baseline.neon 5 additions, 0 deletionsBuild/phpstan/phpstan-baseline.neon
- typo3/sysext/core/Classes/Crypto/HashService.php 84 additions, 0 deletionstypo3/sysext/core/Classes/Crypto/HashService.php
- typo3/sysext/core/Classes/Exception/Crypto/EmptyAdditionalSecretException.php 25 additions, 0 deletions...asses/Exception/Crypto/EmptyAdditionalSecretException.php
- typo3/sysext/core/Classes/Exception/Crypto/InvalidHashStringException.php 25 additions, 0 deletions...e/Classes/Exception/Crypto/InvalidHashStringException.php
- typo3/sysext/core/Documentation/Changelog/13.0/Feature-102761-IntroduceClassToGeneratevalidateHMACHashes.rst 29 additions, 0 deletions...ure-102761-IntroduceClassToGeneratevalidateHMACHashes.rst
- typo3/sysext/core/Tests/Unit/Crypto/HashServiceTest.php 155 additions, 0 deletionstypo3/sysext/core/Tests/Unit/Crypto/HashServiceTest.php
Please register or sign in to comment