Skip to content

Commit b40a7e0

Browse files
chalasrchalasr
committed
[Security] Extract password hashing from security-core - using the right naming
1 parent a608793 commit b40a7e0

File tree

127 files changed

+3870
-177
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

127 files changed

+3870
-177
lines changed

‎composer.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@
8686
"symfony/security-csrf": "self.version",
8787
"symfony/security-guard": "self.version",
8888
"symfony/security-http": "self.version",
89+
"symfony/security-password": "self.version",
8990
"symfony/semaphore": "self.version",
9091
"symfony/sendgrid-mailer": "self.version",
9192
"symfony/serializer": "self.version",

‎src/Symfony/Bundle/SecurityBundle/Command/UserPasswordEncoderCommand.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,16 @@
2323
use Symfony\Component\Console\Style\SymfonyStyle;
2424
use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
2525
use Symfony\Component\Security\Core\Encoder\SelfSaltingEncoderInterface;
26+
use Symfony\Component\Security\Password\Command\UserPasswordHashCommand;
2627

2728
/**
2829
* Encode a user's password.
2930
*
3031
* @author Sarah Khalil <mkhalil.sarah@gmail.com>
3132
*
3233
* @final
34+
*
35+
* @deprecated since Symfony 5.3, use {@link UserPasswordHashCommand} instead
3336
*/
3437
class UserPasswordEncoderCommand extends Command
3538
{

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ public function getConfigTreeBuilder()
9494
;
9595

9696
$this->addEncodersSection($rootNode);
97+
$this->addPasswordHashersSection($rootNode);
9798
$this->addProvidersSection($rootNode);
9899
$this->addFirewallsSection($rootNode, $this->factories);
99100
$this->addAccessControlSection($rootNode);
@@ -355,6 +356,7 @@ private function addEncodersSection(ArrayNodeDefinition $rootNode)
355356
->fixXmlConfig('encoder')
356357
->children()
357358
->arrayNode('encoders')
359+
->setDeprecated('symfony/security-bundle', '5.3', 'The child node "%node%" at path "%path%" is deprecated, use "password_hashers" instead.')
358360
->example([
359361
'App\Entity\User1' => 'auto',
360362
'App\Entity\User2' => [
@@ -401,6 +403,57 @@ private function addEncodersSection(ArrayNodeDefinition $rootNode)
401403
;
402404
}
403405

406+
private function addPasswordHashersSection(ArrayNodeDefinition $rootNode)
407+
{
408+
$rootNode
409+
->fixXmlConfig('password_hasher')
410+
->children()
411+
->arrayNode('password_hashers')
412+
->example([
413+
'App\Entity\User1' => 'auto',
414+
'App\Entity\User2' => [
415+
'algorithm' => 'auto',
416+
'time_cost' => 8,
417+
'cost' => 13,
418+
],
419+
])
420+
->requiresAtLeastOneElement()
421+
->useAttributeAsKey('class')
422+
->prototype('array')
423+
->canBeUnset()
424+
->performNoDeepMerging()
425+
->beforeNormalization()->ifString()->then(function ($v) { return ['algorithm' => $v]; })->end()
426+
->children()
427+
->scalarNode('algorithm')
428+
->cannotBeEmpty()
429+
->validate()
430+
->ifTrue(function ($v) { return !\is_string($v); })
431+
->thenInvalid('You must provide a string value.')
432+
->end()
433+
->end()
434+
->arrayNode('migrate_from')
435+
->prototype('scalar')->end()
436+
->beforeNormalization()->castToArray()->end()
437+
->end()
438+
->scalarNode('hash_algorithm')->info('Name of hashing algorithm for PBKDF2 (i.e. sha256, sha512, etc..) See hash_algos() for a list of supported algorithms.')->defaultValue('sha512')->end()
439+
->scalarNode('key_length')->defaultValue(40)->end()
440+
->booleanNode('ignore_case')->defaultFalse()->end()
441+
->booleanNode('encode_as_base64')->defaultTrue()->end()
442+
->scalarNode('iterations')->defaultValue(5000)->end()
443+
->integerNode('cost')
444+
->min(4)
445+
->max(31)
446+
->defaultNull()
447+
->end()
448+
->scalarNode('memory_cost')->defaultNull()->end()
449+
->scalarNode('time_cost')->defaultNull()->end()
450+
->scalarNode('id')->end()
451+
->end()
452+
->end()
453+
->end()
454+
->end();
455+
}
456+
404457
private function getAccessDecisionStrategies()
405458
{
406459
$strategies = [

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php‎

Lines changed: 135 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@
4040
use Symfony\Component\Security\Core\User\UserProviderInterface;
4141
use Symfony\Component\Security\Http\Controller\UserValueResolver;
4242
use Symfony\Component\Security\Http\Event\CheckPassportEvent;
43+
use Symfony\Component\Security\Password\Hasher\NativePasswordHasher;
44+
use Symfony\Component\Security\Password\Hasher\Pbkdf2PasswordHasher;
45+
use Symfony\Component\Security\Password\Hasher\PlaintextPasswordHasher;
46+
use Symfony\Component\Security\Password\Hasher\SodiumPasswordHasher;
4347
use Twig\Extension\AbstractExtension;
4448

4549
/**
@@ -168,13 +172,29 @@ public function load(array $configs, ContainerBuilder $container)
168172
$container->getDefinition('security.authentication.guard_handler')
169173
->replaceArgument(2, $this->statelessFirewallKeys);
170174

175+
// @deprecated since Symfony 5.3
171176
if ($config['encoders']) {
172177
$this->createEncoders($config['encoders'], $container);
178+
} else {
179+
$container->removeAlias('security.encoder_factory');
180+
$container->removeAlias('security.password_encoder');
181+
}
182+
183+
if ($config['password_hashers']) {
184+
$this->createHashers($config['password_hashers'], $container);
173185
}
174186

175187
if (class_exists(Application::class)) {
176188
$loader->load('console.php');
177-
$container->getDefinition('security.command.user_password_encoder')->replaceArgument(1, array_keys($config['encoders']));
189+
190+
// @deprecated since Symfony 5.3
191+
if ($config['encoders']) {
192+
$container->getDefinition('security.command.user_password_encoder')->replaceArgument(1, array_keys($config['encoders']));
193+
$container->removeDefinition('security.command.user_password_hash');
194+
} else {
195+
$container->getDefinition('security.command.user_password_hash')->replaceArgument(1, array_keys($config['password_hashers']));
196+
$container->removeDefinition('security.command.user_password_encoder');
197+
}
178198
}
179199

180200
if (!class_exists(UserValueResolver::class)) {
@@ -723,6 +743,117 @@ private function createEncoder(array $config)
723743
if ('native' === $config['algorithm']) {
724744
return [
725745
'class' => NativePasswordEncoder::class,
746+
'arguments' => [
747+
$config['time_cost'],
748+
(($config['memory_cost'] ?? 0) << 10) ?: null,
749+
$config['cost'],
750+
] + (isset($config['native_algorithm']) ? [3 => $config['native_algorithm']] : []),
751+
];
752+
}
753+
754+
if ('sodium' === $config['algorithm']) {
755+
if (!SodiumPasswordEncoder::isSupported()) {
756+
throw new InvalidConfigurationException('Libsodium is not available. Install the sodium extension or use "auto" instead.');
757+
}
758+
759+
return [
760+
'class' => SodiumPasswordEncoder::class,
761+
'arguments' => [
762+
$config['time_cost'],
763+
(($config['memory_cost'] ?? 0) << 10) ?: null,
764+
],
765+
];
766+
}
767+
768+
// run-time configured encoder
769+
return $config;
770+
}
771+
772+
private function createHashers(array $hashers, ContainerBuilder $container)
773+
{
774+
$hasherMap = [];
775+
foreach ($hashers as $class => $hasher) {
776+
$hasherMap[$class] = $this->createHasher($hasher);
777+
}
778+
779+
$container
780+
->getDefinition('security.hasher_factory.generic')
781+
->setArguments([$hasherMap])
782+
;
783+
}
784+
785+
private function createHasher(array $config)
786+
{
787+
// a custom hasher service
788+
if (isset($config['id'])) {
789+
return new Reference($config['id']);
790+
}
791+
792+
if ($config['migrate_from'] ?? false) {
793+
return $config;
794+
}
795+
796+
// plaintext hasher
797+
if ('plaintext' === $config['algorithm']) {
798+
$arguments = [$config['ignore_case']];
799+
800+
return [
801+
'class' => PlaintextPasswordHasher::class,
802+
'arguments' => $arguments,
803+
];
804+
}
805+
806+
// pbkdf2 hasher
807+
if ('pbkdf2' === $config['algorithm']) {
808+
return [
809+
'class' => Pbkdf2PasswordHasher::class,
810+
'arguments' => [
811+
$config['hash_algorithm'],
812+
$config['encode_as_base64'],
813+
$config['iterations'],
814+
$config['key_length'],
815+
],
816+
];
817+
}
818+
819+
// bcrypt hasher
820+
if ('bcrypt' === $config['algorithm']) {
821+
$config['algorithm'] = 'native';
822+
$config['native_algorithm'] = \PASSWORD_BCRYPT;
823+
824+
return $this->createHasher($config);
825+
}
826+
827+
// Argon2i hasher
828+
if ('argon2i' === $config['algorithm']) {
829+
if (SodiumPasswordHasher::isSupported() && !\defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13')) {
830+
$config['algorithm'] = 'sodium';
831+
} elseif (\defined('PASSWORD_ARGON2I')) {
832+
$config['algorithm'] = 'native';
833+
$config['native_algorithm'] = \PASSWORD_ARGON2I;
834+
} else {
835+
throw new InvalidConfigurationException(sprintf('Algorithm "argon2i" is not available. Either use "%s" or upgrade to PHP 7.2+ instead.', \defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13') ? 'argon2id", "auto' : 'auto'));
836+
}
837+
838+
return $this->createHasher($config);
839+
}
840+
841+
if ('argon2id' === $config['algorithm']) {
842+
if (($hasSodium = SodiumPasswordHasher::isSupported()) && \defined('SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13')) {
843+
$config['algorithm'] = 'sodium';
844+
} elseif (\defined('PASSWORD_ARGON2ID')) {
845+
$config['algorithm'] = 'native';
846+
$config['native_algorithm'] = \PASSWORD_ARGON2ID;
847+
} else {
848+
throw new InvalidConfigurationException(sprintf('Algorithm "argon2id" is not available. Either use "%s", upgrade to PHP 7.3+ or use libsodium 1.0.15+ instead.', \defined('PASSWORD_ARGON2I') || $hasSodium ? 'argon2i", "auto' : 'auto'));
849+
}
850+
851+
return $this->createHasher($config);
852+
}
853+
854+
if ('native' === $config['algorithm']) {
855+
return [
856+
'class' => NativePasswordHasher::class,
726857
'arguments' => [
727858
$config['time_cost'],
728859
(($config['memory_cost'] ?? 0) << 10) ?: null,
@@ -732,20 +863,20 @@ private function createEncoder(array $config)
732863
}
733864

734865
if ('sodium' === $config['algorithm']) {
735-
if (!SodiumPasswordEncoder::isSupported()) {
866+
if (!SodiumPasswordHasher::isSupported()) {
736867
throw new InvalidConfigurationException('Libsodium is not available. Install the sodium extension or use "auto" instead.');
737868
}
738869

739870
return [
740-
'class' => SodiumPasswordEncoder::class,
871+
'class' => SodiumPasswordHasher::class,
741872
'arguments' => [
742873
$config['time_cost'],
743874
(($config['memory_cost'] ?? 0) << 10) ?: null,
744875
],
745876
];
746877
}
747878

748-
// run-time configured encoder
879+
// run-time configured hasher
749880
return $config;
750881
}
751882

‎src/Symfony/Bundle/SecurityBundle/Resources/config/console.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\DependencyInjection\Loader\Configurator;
1313

1414
use Symfony\Bundle\SecurityBundle\Command\UserPasswordEncoderCommand;
15+
use Symfony\Component\Security\Password\Command\UserPasswordHashCommand;
1516

1617
return static function (ContainerConfigurator $container) {
1718
$container->services()
@@ -21,5 +22,15 @@
2122
abstract_arg('encoders user classes'),
2223
])
2324
->tag('console.command', ['command' => 'security:encode-password'])
25+
->deprecate('symfony/security-bundle', '5.3', 'The "%service_id%" service is deprecated, use "security.command.user_password_hash" instead.')
26+
;
27+
28+
$container->services()
29+
->set('security.command.user_password_hash', UserPasswordHashCommand::class)
30+
->args([
31+
service('security.hasher_factory'),
32+
abstract_arg('hashers user classes'),
33+
])
34+
->tag('console.command', ['command' => 'security:hash-password'])
2435
;
2536
};

‎src/Symfony/Bundle/SecurityBundle/Resources/config/guard.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
abstract_arg('User Provider'),
3535
abstract_arg('Provider-shared Key'),
3636
abstract_arg('User Checker'),
37-
service('security.password_encoder'),
37+
service('security.password_hasher'),
3838
])
3939

4040
->set('security.authentication.listener.guard', GuardAuthenticationListener::class)

‎src/Symfony/Bundle/SecurityBundle/Resources/config/schema/security-1.0.xsd‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
<xsd:element name="access-decision-manager" type="access_decision_manager" minOccurs="0" maxOccurs="1" />
1212
<xsd:element name="encoders" type="encoders" minOccurs="0" maxOccurs="1" />
1313
<xsd:element name="encoder" type="encoder" minOccurs="0" maxOccurs="unbounded" />
14+
<xsd:element name="password_hashers" type="password_hashers" minOccurs="0" maxOccurs="1" />
15+
<xsd:element name="password_hasher" type="password_hasher" minOccurs="0" maxOccurs="unbounded" />
1416
<xsd:element name="providers" type="providers" minOccurs="0" maxOccurs="1" />
1517
<xsd:element name="provider" type="provider" minOccurs="0" maxOccurs="unbounded" />
1618
<xsd:element name="firewalls" type="firewalls" minOccurs="0" maxOccurs="1" />
@@ -31,6 +33,12 @@
3133
</xsd:sequence>
3234
</xsd:complexType>
3335

36+
<xsd:complexType name="password_hashers">
37+
<xsd:sequence>
38+
<xsd:element name="password_hasher" type="password_hasher" minOccurs="1" maxOccurs="unbounded" />
39+
</xsd:sequence>
40+
</xsd:complexType>
41+
3442
<xsd:complexType name="providers">
3543
<xsd:sequence>
3644
<xsd:element name="provider" type="provider" minOccurs="1" maxOccurs="unbounded" />
@@ -84,6 +92,23 @@
8492
<xsd:attribute name="id" type="xsd:string" />
8593
</xsd:complexType>
8694

95+
<xsd:complexType name="password_hasher">
96+
<xsd:sequence>
97+
<xsd:element name="migrate-from" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
98+
</xsd:sequence>
99+
<xsd:attribute name="class" type="xsd:string" use="required" />
100+
<xsd:attribute name="algorithm" type="xsd:string" />
101+
<xsd:attribute name="hash-algorithm" type="xsd:string" />
102+
<xsd:attribute name="key-length" type="xsd:string" />
103+
<xsd:attribute name="ignore-case" type="xsd:boolean" />
104+
<xsd:attribute name="encode-as-base64" type="xsd:boolean" />
105+
<xsd:attribute name="iterations" type="xsd:string" />
106+
<xsd:attribute name="cost" type="xsd:integer" />
107+
<xsd:attribute name="memory-cost" type="xsd:string" />
108+
<xsd:attribute name="time-cost" type="xsd:string" />
109+
<xsd:attribute name="id" type="xsd:string" />
110+
</xsd:complexType>
111+
87112
<xsd:complexType name="provider">
88113
<xsd:choice minOccurs="0" maxOccurs="1">
89114
<xsd:element name="chain" type="chain" />

0 commit comments

Comments
 (0)