From: Tim Düsterhus <duesterhus@woltlab.com>
Date: Mon, 9 Nov 2020 13:43:20 +0000 (+0100)
Subject: Use constant time encoding in CryptoUtil
X-Git-Tag: 5.4.0_Alpha_1~617
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=30208f7faf269e74558abfdcb6e125b0e673d1ca;p=GitHub%2FWoltLab%2FWCF.git

Use constant time encoding in CryptoUtil
---

diff --git a/wcfsetup/install/files/lib/util/CryptoUtil.class.php b/wcfsetup/install/files/lib/util/CryptoUtil.class.php
index 9009f91d2b..120bd37223 100644
--- a/wcfsetup/install/files/lib/util/CryptoUtil.class.php
+++ b/wcfsetup/install/files/lib/util/CryptoUtil.class.php
@@ -1,5 +1,6 @@
 <?php
 namespace wcf\util;
+use ParagonIE\ConstantTime\Base64;
 use wcf\util\exception\CryptoException;
 
 /**
@@ -34,7 +35,7 @@ final class CryptoUtil {
 	 * @return	string
 	 */
 	public static function createSignedString($value) {
-		return self::getSignature($value).'-'.base64_encode($value);
+		return self::getSignature($value).'-'.Base64::encode($value);
 	}
 
 	/**
@@ -48,7 +49,13 @@ final class CryptoUtil {
 		$parts = explode('-', $string, 2);
 		if (count($parts) !== 2) return false;
 		list($signature, $value) = $parts;
-		$value = base64_decode($value);
+		
+		try {
+			$value = Base64::decode($value);
+		}
+		catch (\RangeException $e) {
+			return false;
+		}
 		
 		return \hash_equals($signature, self::getSignature($value));
 	}
@@ -67,7 +74,12 @@ final class CryptoUtil {
 		if (!self::validateSignedString($string)) return null;
 		
 		$parts = explode('-', $string, 2);
-		return base64_decode($parts[1]);
+		try {
+			return Base64::decode($parts[1]);
+		}
+		catch (\RangeException $e) {
+			throw new \LogicException('Unreachable', 0, $e);
+		}
 	}
 
 	/**