From 26c381dbb2e2a7709675bfee9aca18414b0a16e6 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Wed, 15 Jul 2026 10:06:21 +0200 Subject: [PATCH 1/2] refactor: Always use hash_hmac We now depends on PHP 8.2 where this method is part of the core. Signed-off-by: Carl Schwan --- lib/Auth/AWS.php | 31 ++++--------------------------- tests/HTTP/Auth/AWSTest.php | 4 +--- 2 files changed, 5 insertions(+), 30 deletions(-) diff --git a/lib/Auth/AWS.php b/lib/Auth/AWS.php index 68c26d2d..c555e427 100644 --- a/lib/Auth/AWS.php +++ b/lib/Auth/AWS.php @@ -107,16 +107,14 @@ public function validate(string $secretKey): bool $amzHeaders = $this->getAmzHeaders(); - $signature = base64_encode( - $this->hmacsha1($secretKey, - $this->request->getMethod()."\n". + $message = $this->request->getMethod()."\n". $contentMD5."\n". $this->request->getHeader('Content-type')."\n". $requestDate."\n". $amzHeaders. - $this->request->getUrl() - ) - ); + $this->request->getUrl(); + + $signature = base64_encode(hash_hmac('sha1', $message, $secretKey, true)); if ($this->signature !== $signature) { $this->errorCode = self::ERR_INVALIDSIGNATURE; @@ -192,25 +190,4 @@ protected function getAmzHeaders(): string return $headerStr; } - - /** - * Generates an HMAC-SHA1 signature. - */ - private function hmacsha1(string $key, string $message): string - { - if (function_exists('hash_hmac')) { - return hash_hmac('sha1', $message, $key, true); - } - - $blocksize = 64; - if (strlen($key) > $blocksize) { - $key = pack('H*', sha1($key)); - } - $key = str_pad($key, $blocksize, chr(0x00)); - $ipad = str_repeat(chr(0x36), $blocksize); - $opad = str_repeat(chr(0x5C), $blocksize); - $hmac = pack('H*', sha1(($key ^ $opad).pack('H*', sha1(($key ^ $ipad).$message)))); - - return $hmac; - } } diff --git a/tests/HTTP/Auth/AWSTest.php b/tests/HTTP/Auth/AWSTest.php index 35d610e8..dbcdd086 100644 --- a/tests/HTTP/Auth/AWSTest.php +++ b/tests/HTTP/Auth/AWSTest.php @@ -175,9 +175,7 @@ public function testValidRequest(): void $date->setTimezone(new \DateTimeZone('GMT')); $date = $date->format('D, d M Y H:i:s \\G\\M\\T'); - $sig = base64_encode($this->hmacsha1($secretKey, - "POST\n$contentMD5\n\n$date\nx-amz-date:$date\n/evert" - )); + $sig = base64_encode(hash_hmac('sha1', "POST\n$contentMD5\n\n$date\nx-amz-date:$date\n/evert", $secretKey, true)); $this->request->setUrl('/evert'); $this->request->setMethod('POST'); From a02414b68784f506a5821e69451b46fdb6bfceef Mon Sep 17 00:00:00 2001 From: Phillip Davis Date: Wed, 15 Jul 2026 18:04:24 +0930 Subject: [PATCH 2/2] test: remove unused hmacsha1 function Signed-off-by: Phillip Davis --- tests/HTTP/Auth/AWSTest.php | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/tests/HTTP/Auth/AWSTest.php b/tests/HTTP/Auth/AWSTest.php index dbcdd086..131c64ce 100644 --- a/tests/HTTP/Auth/AWSTest.php +++ b/tests/HTTP/Auth/AWSTest.php @@ -200,21 +200,4 @@ public function test401(): void $test = preg_match('/^AWS$/', (string) $this->response->getHeader('WWW-Authenticate'), $matches); self::assertTrue(1 === $test, 'The WWW-Authenticate response didn\'t match our pattern'); } - - /** - * Generates an HMAC-SHA1 signature. - */ - private function hmacsha1(string $key, string $message): string - { - $blocksize = 64; - if (strlen($key) > $blocksize) { - $key = pack('H*', sha1($key)); - } - $key = str_pad($key, $blocksize, chr(0x00)); - $ipad = str_repeat(chr(0x36), $blocksize); - $opad = str_repeat(chr(0x5C), $blocksize); - $hmac = pack('H*', sha1(($key ^ $opad).pack('H*', sha1(($key ^ $ipad).$message)))); - - return $hmac; - } }