Skip to content

Commit

Permalink
Provide ability to not use PHP serialization when doing encryption.
Browse files Browse the repository at this point in the history
  • Loading branch information
taylorotwell committed Dec 30, 2016
1 parent 02fe410 commit 9725a8e
Show file tree
Hide file tree
Showing 3 changed files with 41 additions and 6 deletions.
6 changes: 4 additions & 2 deletions src/Illuminate/Contracts/Encryption/Encrypter.php
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,17 @@ interface Encrypter
* Encrypt the given value.
*
* @param string $value
* @param bool $serialize
* @return string
*/
public function encrypt($value);
public function encrypt($value, $serialize = true);

/**
* Decrypt the given value.
*
* @param string $payload
* @param bool $unserialize
* @return string
*/
public function decrypt($payload);
public function decrypt($payload, $unserialize = true);
}
33 changes: 29 additions & 4 deletions src/Illuminate/Encryption/Encrypter.php
Original file line number Diff line number Diff line change
Expand Up @@ -63,19 +63,21 @@ public static function supported($key, $cipher)
* Encrypt the given value.
*
* @param mixed $value
* @param bool $serialize
* @return string
*
* @throws \Illuminate\Contracts\Encryption\EncryptException
*/
public function encrypt($value)
public function encrypt($value, $serialize = true)
{
$iv = random_bytes(16);

// First we will encrypt the value using OpenSSL. After this is encrypted we
// will proceed to calculating a MAC for the encrypted value so that this
// value can be verified later as not having been changed by the users.
$value = \openssl_encrypt(
serialize($value), $this->cipher, $this->key, 0, $iv
$serialize ? serialize($value) : $value,
$this->cipher, $this->key, 0, $iv
);

if ($value === false) {
Expand All @@ -96,15 +98,27 @@ public function encrypt($value)
return base64_encode($json);
}

/**
* Encrypt a string without serialization.
*
* @param string $value
* @return string
*/
public function encryptString($value)
{
return $this->encrypt($value, false);
}

/**
* Decrypt the given value.
*
* @param mixed $payload
* @param bool $unserialize
* @return string
*
* @throws \Illuminate\Contracts\Encryption\DecryptException
*/
public function decrypt($payload)
public function decrypt($payload, $unserialize = true)
{
$payload = $this->getJsonPayload($payload);

Expand All @@ -121,7 +135,18 @@ public function decrypt($payload)
throw new DecryptException('Could not decrypt the data.');
}

return unserialize($decrypted);
return $unserialize ? unserialize($decrypted) : $decrypted;
}

/**
* Decrypt the given string without unserialization.
*
* @param string $payload
* @return string
*/
public function decryptString($payload)
{
return $this->decrypt($payload, false);
}

/**
Expand Down
8 changes: 8 additions & 0 deletions tests/Encryption/EncrypterTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,14 @@ public function testEncryption()
$this->assertEquals('foo', $e->decrypt($encrypted));
}

public function testRawStringEncryption()
{
$e = new Encrypter(str_repeat('a', 16));
$encrypted = $e->encryptString('foo');
$this->assertNotEquals('foo', $encrypted);
$this->assertEquals('foo', $e->decryptString($encrypted));
}

public function testEncryptionUsingBase64EncodedKey()
{
$e = new Encrypter(random_bytes(16));
Expand Down

0 comments on commit 9725a8e

Please sign in to comment.