Skip to content

Commit e7832cc

Browse files
nickvergessennickvergessen
authored
Merge pull request #2363 from nextcloud/dependabot/composer/stable33/phpseclib/phpseclib-2.0.52
[stable33] build(deps): bump phpseclib/phpseclib from 2.0.47 to 2.0.52
2 parents bdfd429 + 9b3a8db commit e7832cc

17 files changed

Lines changed: 500 additions & 168 deletions

File tree

‎.github/workflows/composer-auto.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
- name: Add reaction on start
4949
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
5050
with:
51-
token: ${{ secrets.COMMAND_BOT_PAT }}
51+
token: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
5252
repository: ${{ github.event.repository.full_name }}
5353
comment-id: ${{ github.event.comment.id }}
5454
reactions: '+1'
@@ -61,7 +61,7 @@ jobs:
6161
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
6262
if: failure()
6363
with:
64-
token: ${{ secrets.COMMAND_BOT_PAT }}
64+
token: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
6565
repository: ${{ github.event.repository.full_name }}
6666
comment-id: ${{ github.event.comment.id }}
6767
reactions: '-1'
@@ -75,7 +75,7 @@ jobs:
7575
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
7676
with:
7777
persist-credentials: true
78-
token: ${{ secrets.COMMAND_BOT_PAT }}
78+
token: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
7979
fetch-depth: 0
8080
ref: ${{ needs.init.outputs.head_ref }}
8181

@@ -115,7 +115,7 @@ jobs:
115115
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
116116
if: failure()
117117
with:
118-
token: ${{ secrets.COMMAND_BOT_PAT }}
118+
token: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
119119
repository: '${{ github.event.repository.full_name }}'
120120
comment-id: '${{ github.event.comment.id }}'
121121
reactions: '-1'

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
"pear/pear-core-minimal": "^1.10",
4545
"php-http/guzzle7-adapter": "^1.1.0",
4646
"php-opencloud/openstack": "^3.14",
47-
"phpseclib/phpseclib": "^2.0.45",
47+
"phpseclib/phpseclib": "^2.0.52",
4848
"pimple/pimple": "^3.6.0",
4949
"psr/clock": "^1.0",
5050
"psr/container": "^2.0.2",

‎composer.lock‎

Lines changed: 8 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎composer/installed.json‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2911,25 +2911,25 @@
29112911
},
29122912
{
29132913
"name": "phpseclib/phpseclib",
2914-
"version": "2.0.47",
2915-
"version_normalized": "2.0.47.0",
2914+
"version": "2.0.52",
2915+
"version_normalized": "2.0.52.0",
29162916
"source": {
29172917
"type": "git",
29182918
"url": "https://github.com/phpseclib/phpseclib.git",
2919-
"reference": "b7d7d90ee7df7f33a664b4aea32d50a305d35adb"
2919+
"reference": "2552c4001631d1cc844332faea6a08a49c964b28"
29202920
},
29212921
"dist": {
29222922
"type": "zip",
2923-
"url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/b7d7d90ee7df7f33a664b4aea32d50a305d35adb",
2924-
"reference": "b7d7d90ee7df7f33a664b4aea32d50a305d35adb",
2923+
"url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/2552c4001631d1cc844332faea6a08a49c964b28",
2924+
"reference": "2552c4001631d1cc844332faea6a08a49c964b28",
29252925
"shasum": ""
29262926
},
29272927
"require": {
29282928
"php": ">=5.3.3"
29292929
},
29302930
"require-dev": {
29312931
"phing/phing": "~2.7",
2932-
"phpunit/phpunit": "^4.8.35|^5.7|^6.0|^9.4",
2932+
"phpunit/phpunit": "^4.8.35|^5.7|^6.0|^8.5|^9.4",
29332933
"squizlabs/php_codesniffer": "~2.0"
29342934
},
29352935
"suggest": {
@@ -2939,7 +2939,7 @@
29392939
"ext-openssl": "Install the OpenSSL extension in order to speed up a wide variety of cryptographic operations.",
29402940
"ext-xml": "Install the XML extension to load XML formatted public keys."
29412941
},
2942-
"time": "2024-02-26T04:55:38+00:00",
2942+
"time": "2026-03-19T02:54:44+00:00",
29432943
"type": "library",
29442944
"installation-source": "dist",
29452945
"autoload": {
@@ -3004,7 +3004,7 @@
30043004
],
30053005
"support": {
30063006
"issues": "https://github.com/phpseclib/phpseclib/issues",
3007-
"source": "https://github.com/phpseclib/phpseclib/tree/2.0.47"
3007+
"source": "https://github.com/phpseclib/phpseclib/tree/2.0.52"
30083008
},
30093009
"funding": [
30103010
{

‎composer/installed.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -410,9 +410,9 @@
410410
'dev_requirement' => false,
411411
),
412412
'phpseclib/phpseclib' => array(
413-
'pretty_version' => '2.0.47',
414-
'version' => '2.0.47.0',
415-
'reference' => 'b7d7d90ee7df7f33a664b4aea32d50a305d35adb',
413+
'pretty_version' => '2.0.52',
414+
'version' => '2.0.52.0',
415+
'reference' => '2552c4001631d1cc844332faea6a08a49c964b28',
416416
'type' => 'library',
417417
'install_path' => __DIR__ . '/../phpseclib/phpseclib',
418418
'aliases' => array(),

‎phpseclib/phpseclib/phpseclib/Crypt/Base.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -512,6 +512,11 @@ function __construct($mode = self::MODE_CBC)
512512

513513
if (!defined('CRYPT_BASE_USE_REG_INTVAL')) {
514514
switch (true) {
515+
// PHP 8.5, per https://www.php.net/manual/en/migration85.incompatible.php, now emits a warning
516+
// "when casting floats (or strings that look like floats) to int if they cannot be represented as one"
517+
case PHP_VERSION_ID >= 80500 && PHP_INT_SIZE == 4:
518+
define('CRYPT_BASE_USE_REG_INTVAL', false);
519+
break;
515520
// PHP_OS & "\xDF\xDF\xDF" == strtoupper(substr(PHP_OS, 0, 3)), but a lot faster
516521
case (PHP_OS & "\xDF\xDF\xDF") === 'WIN':
517522
case !function_exists('php_uname'):
@@ -611,7 +616,6 @@ function getBlockLength()
611616
*
612617
* @access public
613618
* @param string $key
614-
* @internal Could, but not must, extend by the child Crypt_* class
615619
*/
616620
function setKey($key)
617621
{
@@ -2070,7 +2074,7 @@ function _unpad($text)
20702074

20712075
$length = ord($text[strlen($text) - 1]);
20722076

2073-
if (!$length || $length > $this->block_size) {
2077+
if (!$length | ($length > $this->block_size)) {
20742078
return false;
20752079
}
20762080

‎phpseclib/phpseclib/phpseclib/Crypt/Blowfish.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -401,11 +401,11 @@ function __construct($mode = self::MODE_CBC)
401401
{
402402
parent::__construct($mode);
403403

404-
$this->sbox0 = array_map('intval', $this->sbox0);
405-
$this->sbox1 = array_map('intval', $this->sbox1);
406-
$this->sbox2 = array_map('intval', $this->sbox2);
407-
$this->sbox3 = array_map('intval', $this->sbox3);
408-
$this->parray = array_map('intval', $this->parray);
404+
$this->sbox0 = array_map(array($this, 'safe_intval'), $this->sbox0);
405+
$this->sbox1 = array_map(array($this, 'safe_intval'), $this->sbox1);
406+
$this->sbox2 = array_map(array($this, 'safe_intval'), $this->sbox2);
407+
$this->sbox3 = array_map(array($this, 'safe_intval'), $this->sbox3);
408+
$this->parray = array_map(array($this, 'safe_intval'), $this->parray);
409409
}
410410

411411
/**

‎phpseclib/phpseclib/phpseclib/Crypt/DES.php‎

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,14 @@ class DES extends Base
147147
*/
148148
var $keys;
149149

150+
/**
151+
* Key Cache "key"
152+
*
153+
* @see self::setupKey()
154+
* @var array
155+
*/
156+
var $kl;
157+
150158
/**
151159
* Shuffle table.
152160
*
@@ -681,14 +689,14 @@ function _processBlock($block, $mode)
681689
{
682690
static $sbox1, $sbox2, $sbox3, $sbox4, $sbox5, $sbox6, $sbox7, $sbox8, $shuffleip, $shuffleinvip;
683691
if (!$sbox1) {
684-
$sbox1 = array_map("intval", $this->sbox1);
685-
$sbox2 = array_map("intval", $this->sbox2);
686-
$sbox3 = array_map("intval", $this->sbox3);
687-
$sbox4 = array_map("intval", $this->sbox4);
688-
$sbox5 = array_map("intval", $this->sbox5);
689-
$sbox6 = array_map("intval", $this->sbox6);
690-
$sbox7 = array_map("intval", $this->sbox7);
691-
$sbox8 = array_map("intval", $this->sbox8);
692+
$sbox1 = array_map(array($this, 'safe_intval'), $this->sbox1);
693+
$sbox2 = array_map(array($this, 'safe_intval'), $this->sbox2);
694+
$sbox3 = array_map(array($this, 'safe_intval'), $this->sbox3);
695+
$sbox4 = array_map(array($this, 'safe_intval'), $this->sbox4);
696+
$sbox5 = array_map(array($this, 'safe_intval'), $this->sbox5);
697+
$sbox6 = array_map(array($this, 'safe_intval'), $this->sbox6);
698+
$sbox7 = array_map(array($this, 'safe_intval'), $this->sbox7);
699+
$sbox8 = array_map(array($this, 'safe_intval'), $this->sbox8);
692700
/* Merge $shuffle with $[inv]ipmap */
693701
for ($i = 0; $i < 256; ++$i) {
694702
$shuffleip[] = $this->shuffle[$this->ipmap[$i]];
@@ -1252,9 +1260,9 @@ function _setupKey()
12521260
$pc2mapd3[($d >> 8) & 0xFF] | $pc2mapd4[ $d & 0xFF];
12531261

12541262
// Reorder: odd bytes/even bytes. Push the result in key schedule.
1255-
$val1 = ( $cp & intval(0xFF000000)) | (($cp << 8) & 0x00FF0000) |
1263+
$val1 = ( $cp & $this->safe_intval(0xFF000000)) | (($cp << 8) & 0x00FF0000) |
12561264
(($dp >> 16) & 0x0000FF00) | (($dp >> 8) & 0x000000FF);
1257-
$val2 = (($cp << 8) & intval(0xFF000000)) | (($cp << 16) & 0x00FF0000) |
1265+
$val2 = (($cp << 8) & $this->safe_intval(0xFF000000)) | (($cp << 16) & 0x00FF0000) |
12581266
(($dp >> 8) & 0x0000FF00) | ( $dp & 0x000000FF);
12591267
$keys[$des_round][self::ENCRYPT][ ] = $val1;
12601268
$keys[$des_round][self::DECRYPT][$ki - 1] = $val1;
@@ -1324,14 +1332,14 @@ function _setupInlineCrypt()
13241332
// Init code for both, encrypt and decrypt.
13251333
$init_crypt = 'static $sbox1, $sbox2, $sbox3, $sbox4, $sbox5, $sbox6, $sbox7, $sbox8, $shuffleip, $shuffleinvip;
13261334
if (!$sbox1) {
1327-
$sbox1 = array_map("intval", $self->sbox1);
1328-
$sbox2 = array_map("intval", $self->sbox2);
1329-
$sbox3 = array_map("intval", $self->sbox3);
1330-
$sbox4 = array_map("intval", $self->sbox4);
1331-
$sbox5 = array_map("intval", $self->sbox5);
1332-
$sbox6 = array_map("intval", $self->sbox6);
1333-
$sbox7 = array_map("intval", $self->sbox7);
1334-
$sbox8 = array_map("intval", $self->sbox8);'
1335+
$sbox1 = array_map(array($self, "safe_intval"), $self->sbox1);
1336+
$sbox2 = array_map(array($self, "safe_intval"), $self->sbox2);
1337+
$sbox3 = array_map(array($self, "safe_intval"), $self->sbox3);
1338+
$sbox4 = array_map(array($self, "safe_intval"), $self->sbox4);
1339+
$sbox5 = array_map(array($self, "safe_intval"), $self->sbox5);
1340+
$sbox6 = array_map(array($self, "safe_intval"), $self->sbox6);
1341+
$sbox7 = array_map(array($self, "safe_intval"), $self->sbox7);
1342+
$sbox8 = array_map(array($self, "safe_intval"), $self->sbox8);'
13351343
/* Merge $shuffle with $[inv]ipmap */ . '
13361344
for ($i = 0; $i < 256; ++$i) {
13371345
$shuffleip[] = $self->shuffle[$self->ipmap[$i]];

‎phpseclib/phpseclib/phpseclib/Crypt/RSA.php‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1345,7 +1345,7 @@ function. As is, the definitive authority on this encoding scheme isn't the IET
13451345

13461346
return $components;
13471347
case self::PUBLIC_FORMAT_OPENSSH:
1348-
$parts = explode(' ', $key, 3);
1348+
$parts = preg_split("#[\t ]+#", $key);
13491349

13501350
$key = isset($parts[1]) ? base64_decode($parts[1]) : false;
13511351
if ($key === false) {
@@ -1396,17 +1396,26 @@ function. As is, the definitive authority on this encoding scheme isn't the IET
13961396
$this->components = array();
13971397

13981398
$xml = xml_parser_create('UTF-8');
1399-
xml_set_object($xml, $this);
1400-
xml_set_element_handler($xml, '_start_element_handler', '_stop_element_handler');
1401-
xml_set_character_data_handler($xml, '_data_handler');
1399+
if (version_compare(PHP_VERSION, '8.4.0', '>=')) {
1400+
xml_set_element_handler($xml, array($this, '_start_element_handler'), array($this, '_stop_element_handler'));
1401+
xml_set_character_data_handler($xml, array($this, '_data_handler'));
1402+
} else {
1403+
xml_set_object($xml, $this);
1404+
xml_set_element_handler($xml, '_start_element_handler', '_stop_element_handler');
1405+
xml_set_character_data_handler($xml, '_data_handler');
1406+
}
14021407
// add <xml></xml> to account for "dangling" tags like <BitStrength>...</BitStrength> that are sometimes added
14031408
if (!xml_parse($xml, '<xml>' . $key . '</xml>')) {
1404-
xml_parser_free($xml);
1409+
if (PHP_VERSION_ID < 80500 && function_exists('xml_parser_free')) {
1410+
xml_parser_free($xml);
1411+
}
14051412
unset($xml);
14061413
return false;
14071414
}
14081415

1409-
xml_parser_free($xml);
1416+
if (PHP_VERSION_ID < 80500 && function_exists('xml_parser_free')) {
1417+
xml_parser_free($xml);
1418+
}
14101419
unset($xml);
14111420

14121421
return isset($this->components['modulus']) && isset($this->components['publicExponent']) ? $this->components : false;
@@ -2824,7 +2833,7 @@ function _emsa_pss_encode($m, $emBits)
28242833
$db = $ps . chr(1) . $salt;
28252834
$dbMask = $this->_mgf1($h, $emLen - $this->hLen - 1);
28262835
$maskedDB = $db ^ $dbMask;
2827-
$maskedDB[0] = ~chr(0xFF << ($emBits & 7)) & $maskedDB[0];
2836+
$maskedDB[0] = ~chr(256 - (1 << ($emBits & 7))) & $maskedDB[0];
28282837
$em = $maskedDB . $h . chr(0xBC);
28292838

28302839
return $em;
@@ -2860,13 +2869,13 @@ function _emsa_pss_verify($m, $em, $emBits)
28602869

28612870
$maskedDB = substr($em, 0, -$this->hLen - 1);
28622871
$h = substr($em, -$this->hLen - 1, $this->hLen);
2863-
$temp = chr(0xFF << ($emBits & 7));
2872+
$temp = chr(256 - (1 << ($emBits & 7)));
28642873
if ((~$maskedDB[0] & $temp) != $temp) {
28652874
return false;
28662875
}
28672876
$dbMask = $this->_mgf1($h, $emLen - $this->hLen - 1);
28682877
$db = $maskedDB ^ $dbMask;
2869-
$db[0] = ~chr(0xFF << ($emBits & 7)) & $db[0];
2878+
$db[0] = ~chr(256 - (1 << ($emBits & 7))) & $db[0];
28702879
$temp = $emLen - $this->hLen - $sLen - 2;
28712880
if (substr($db, 0, $temp) != str_repeat(chr(0), $temp) || ord($db[$temp]) != 1) {
28722881
return false;

0 commit comments

Comments
 (0)