http icon indicating copy to clipboard operation
http copied to clipboard

lib/AuthAWS.php hmacsha1 does not get test coverage

Open phil-davis opened this issue 3 years ago • 0 comments

The method is:

    /**
     * Generates an HMAC-SHA1 signature.
     */
    private function hmacsha1(string $key, string $message): string
    {
        if (function_exists('hash_hmac')) {
            return hash_hmac('sha1', $message, $key, true);
        }

        $blocksize = 64;
        if (strlen($key) > $blocksize) {
            $key = pack('H*', sha1($key));
        }
        $key = str_pad($key, $blocksize, chr(0x00));
        $ipad = str_repeat(chr(0x36), $blocksize);
        $opad = str_repeat(chr(0x5C), $blocksize);
        $hmac = pack('H*', sha1(($key ^ $opad).pack('H*', sha1(($key ^ $ipad).$message))));

        return $hmac;
    }

IMO https://www.php.net/manual/en/function.hash-hmac.php exists in CI, and so it is used, and the subsequent code that has a "manual" implementation of hash_hmac never gets run during the unit tests.

https://www.php.net/manual/en/hash.installation.php

"As of PHP 7.4.0, the Hash extension is a core PHP extension, so it is always enabled."

So, IMO, we can remove the function_exists check, and the "manual" implementation, and just directly call hash_hmac

phil-davis avatar Aug 30 '22 05:08 phil-davis