Skip to content
This repository was archived by the owner on Feb 28, 2024. It is now read-only.

Commit 2f6ad46

Browse files
committed
Made FieldLevelEncryptionConfig immutable
1 parent 0b374b5 commit 2f6ad46

File tree

6 files changed

+173
-100
lines changed

6 files changed

+173
-100
lines changed

src/Developer/Encryption/FieldLevelEncryption.php

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public static function encryptPayload($payload, $config, $params = null) {
3030
$payloadJsonObject = json_decode($payload);
3131

3232
// Perform encryption (if needed)
33-
foreach ($config->encryptionPaths as $jsonPathIn => $jsonPathOut) {
33+
foreach ($config->getEncryptionPaths() as $jsonPathIn => $jsonPathOut) {
3434
self::encryptPayloadPath($payloadJsonObject, $jsonPathIn, $jsonPathOut, $config, $params);
3535
}
3636

@@ -61,7 +61,7 @@ public static function decryptPayload($payload, $config, $params = null) {
6161
$payloadJsonObject = json_decode($payload);
6262

6363
// Perform decryption (if needed)
64-
foreach ($config->decryptionPaths as $jsonPathIn => $jsonPathOut) {
64+
foreach ($config->getDecryptionPaths() as $jsonPathIn => $jsonPathOut) {
6565
self::decryptPayloadPath($payloadJsonObject, $jsonPathIn, $jsonPathOut, $config, $params);
6666
}
6767

@@ -95,7 +95,7 @@ private static function encryptPayloadPath($payloadJsonObject, $jsonPathIn, $jso
9595
// Encrypt data at the given JSON path
9696
$inJsonString = self::sanitizeJson(json_encode($inJsonObject));
9797
$encryptedValueBytes = self::encryptBytes($params->getSecretKeyBytes(), $params->getIvBytes(), $inJsonString);
98-
$encryptedValue = EncodingUtils::encodeBytes($encryptedValueBytes, $config->fieldValueEncoding);
98+
$encryptedValue = EncodingUtils::encodeBytes($encryptedValueBytes, $config->getFieldValueEncoding());
9999

100100
// Delete data in clear
101101
if ('$' !== $jsonPathIn) {
@@ -109,21 +109,21 @@ private static function encryptPayloadPath($payloadJsonObject, $jsonPathIn, $jso
109109

110110
// Add encrypted data and encryption fields at the given JSON path
111111
$outJsonObject = self::checkOrCreateOutObject($payloadJsonObject, $jsonPathOut);
112-
$outJsonObject->{$config->encryptedValueFieldName} = $encryptedValue;
113-
if (!empty($config->ivFieldName)) {
114-
$outJsonObject->{$config->ivFieldName} = $params->getIvValue();
112+
$outJsonObject->{$config->getEncryptedValueFieldName()} = $encryptedValue;
113+
if (!empty($config->getIvFieldName())) {
114+
$outJsonObject->{$config->getIvFieldName()} = $params->getIvValue();
115115
}
116-
if (!empty($config->encryptedKeyFieldName)) {
117-
$outJsonObject->{$config->encryptedKeyFieldName} = $params->getEncryptedKeyValue();
116+
if (!empty($config->getEncryptedKeyFieldName())) {
117+
$outJsonObject->{$config->getEncryptedKeyFieldName()} = $params->getEncryptedKeyValue();
118118
}
119-
if (!empty($config->encryptionCertificateFingerprintFieldName)) {
120-
$outJsonObject->{$config->encryptionCertificateFingerprintFieldName} = $config->encryptionCertificateFingerprint;
119+
if (!empty($config->getEncryptionCertificateFingerprintFieldName())) {
120+
$outJsonObject->{$config->getEncryptionCertificateFingerprintFieldName()} = $config->getEncryptionCertificateFingerprint();
121121
}
122-
if (!empty($config->encryptionKeyFingerprintFieldName)) {
123-
$outJsonObject->{$config->encryptionKeyFingerprintFieldName} = $config->encryptionKeyFingerprint;
122+
if (!empty($config->getEncryptionKeyFingerprintFieldName())) {
123+
$outJsonObject->{$config->getEncryptionKeyFingerprintFieldName()} = $config->getEncryptionKeyFingerprint();
124124
}
125-
if (!empty($config->oaepPaddingDigestAlgorithmFieldName)) {
126-
$outJsonObject->{$config->oaepPaddingDigestAlgorithmFieldName} = $params->getOaepPaddingDigestAlgorithmValue();
125+
if (!empty($config->getOaepPaddingDigestAlgorithmFieldName())) {
126+
$outJsonObject->{$config->getOaepPaddingDigestAlgorithmFieldName()} = $params->getOaepPaddingDigestAlgorithmValue();
127127
}
128128
}
129129

@@ -139,7 +139,7 @@ private static function decryptPayloadPath($payloadJsonObject, $jsonPathIn, $jso
139139
}
140140

141141
// Read and remove encrypted data and encryption fields at the given JSON path
142-
$encryptedValueJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->encryptedValueFieldName);
142+
$encryptedValueJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->getEncryptedValueFieldName());
143143
if (empty($encryptedValueJsonElement)) {
144144
// Nothing to decrypt
145145
return;
@@ -151,17 +151,17 @@ private static function decryptPayloadPath($payloadJsonObject, $jsonPathIn, $jso
151151

152152
if (empty($params)) {
153153
// Read encryption params from the payload
154-
$oaepDigestAlgorithmJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->oaepPaddingDigestAlgorithmFieldName);
155-
$oaepDigestAlgorithm = empty($oaepDigestAlgorithmJsonElement) ? $config->oaepPaddingDigestAlgorithm : $oaepDigestAlgorithmJsonElement;
156-
$encryptedKeyJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->encryptedKeyFieldName);
157-
$ivJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->ivFieldName);
158-
self::readAndDeleteJsonKey($inJsonObject, $config->encryptionCertificateFingerprintFieldName);
159-
self::readAndDeleteJsonKey($inJsonObject, $config->encryptionKeyFingerprintFieldName);
154+
$oaepDigestAlgorithmJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->getOaepPaddingDigestAlgorithmFieldName());
155+
$oaepDigestAlgorithm = empty($oaepDigestAlgorithmJsonElement) ? $config->getOaepPaddingDigestAlgorithm() : $oaepDigestAlgorithmJsonElement;
156+
$encryptedKeyJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->getEncryptedKeyFieldName());
157+
$ivJsonElement = self::readAndDeleteJsonKey($inJsonObject, $config->getIvFieldName());
158+
self::readAndDeleteJsonKey($inJsonObject, $config->getEncryptionCertificateFingerprintFieldName());
159+
self::readAndDeleteJsonKey($inJsonObject, $config->getEncryptionKeyFingerprintFieldName());
160160
$params = new FieldLevelEncryptionParams($config, $ivJsonElement, $encryptedKeyJsonElement, $oaepDigestAlgorithm);
161161
}
162162

163163
// Decrypt data
164-
$encryptedValueBytes = EncodingUtils::decodeValue($encryptedValueJsonElement, $config->fieldValueEncoding);
164+
$encryptedValueBytes = EncodingUtils::decodeValue($encryptedValueJsonElement, $config->getFieldValueEncoding());
165165
$decryptedValueBytes = self::decryptBytes($params->getSecretKeyBytes(), $params->getIvBytes(), $encryptedValueBytes);
166166

167167
// Add decrypted data at the given JSON path

src/Developer/Encryption/FieldLevelEncryptionConfig.php

Lines changed: 98 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,26 @@ class FieldLevelEncryptionConfig {
1111
/**
1212
* A certificate object whose public key will be used for encryption.
1313
*/
14-
public $encryptionCertificate;
14+
private $encryptionCertificate;
1515

1616
/**
1717
* The SHA-256 hex-encoded digest of the certificate used for encryption (optional, the digest will be
1818
* automatically computed if this field is null or empty).
1919
* Example: '4d9d7540be320429ffc8e6506f054525816e2d0e95a85247d5b58be713f28be0'
2020
*/
21-
public $encryptionCertificateFingerprint;
21+
private $encryptionCertificateFingerprint;
2222

2323
/**
2424
* The SHA-256 hex-encoded digest of the key used for encryption (optional, the digest will be
2525
* automatically computed if this field is null or empty).
2626
* Example: 'c3f8ef7053c4fb306f7476e7d1956f0aa992ff9dfdd5244b912a1d377ff3a84f'
2727
*/
28-
public $encryptionKeyFingerprint;
28+
private $encryptionKeyFingerprint;
2929

3030
/**
3131
* A private key object to be used for decryption.
3232
*/
33-
public $decryptionKey;
33+
private $decryptionKey;
3434

3535
/**
3636
* A list of JSON paths to encrypt in request payloads.
@@ -41,7 +41,7 @@ class FieldLevelEncryptionConfig {
4141
* )
4242
* </pre>
4343
*/
44-
public $encryptionPaths = array();
44+
private $encryptionPaths = array();
4545

4646
/**
4747
* A list of JSON paths to decrypt in response payloads.
@@ -52,78 +52,78 @@ class FieldLevelEncryptionConfig {
5252
* )
5353
* </pre>
5454
*/
55-
public $decryptionPaths = array();
55+
private $decryptionPaths = array();
5656

5757
/**
5858
* The digest algorithm to be used for the RSA OAEP padding. Example: 'SHA-512'.
5959
*/
60-
public $oaepPaddingDigestAlgorithm;
60+
private $oaepPaddingDigestAlgorithm;
6161

6262
/**
6363
* The name of the payload field where to write/read the digest algorithm used for
6464
* the RSA OAEP padding (optional, the field won't be set if the name is null or empty).
6565
*/
66-
public $oaepPaddingDigestAlgorithmFieldName;
66+
private $oaepPaddingDigestAlgorithmFieldName;
6767

6868
/**
6969
* The name of the HTTP header where to write/read the digest algorithm used for
7070
* the RSA OAEP padding (optional, the header won't be set if the name is null or empty).
7171
*/
72-
public $oaepPaddingDigestAlgorithmHeaderName;
72+
private $oaepPaddingDigestAlgorithmHeaderName;
7373

7474
/**
7575
* The name of the payload field where to write/read the initialization vector value.
7676
*/
77-
public $ivFieldName;
77+
private $ivFieldName;
7878

7979
/**
8080
* The name of the header where to write/read the initialization vector value.
8181
*/
82-
public $ivHeaderName;
82+
private $ivHeaderName;
8383

8484
/**
8585
* The name of the payload field where to write/read the one-time usage encrypted symmetric key.
8686
*/
87-
public $encryptedKeyFieldName;
87+
private $encryptedKeyFieldName;
8888

8989
/**
9090
* The name of the header where to write/read the one-time usage encrypted symmetric key.
9191
*/
92-
public $encryptedKeyHeaderName;
92+
private $encryptedKeyHeaderName;
9393

9494
/**
9595
* The name of the payload field where to write/read the encrypted data value.
9696
*/
97-
public $encryptedValueFieldName;
97+
private $encryptedValueFieldName;
9898

9999
/**
100100
* The name of the payload field where to write/read the digest of the encryption
101101
* certificate (optional, the field won't be set if the name is null or empty).
102102
*/
103-
public $encryptionCertificateFingerprintFieldName;
103+
private $encryptionCertificateFingerprintFieldName;
104104

105105
/**
106106
* The name of the header where to write/read the digest of the encryption
107107
* certificate (optional, the header won't be set if the name is null or empty).
108108
*/
109-
public $encryptionCertificateFingerprintHeaderName;
109+
private $encryptionCertificateFingerprintHeaderName;
110110

111111
/**
112112
* The name of the payload field where to write/read the digest of the encryption
113113
* key (optional, the field won't be set if the name is null or empty).
114114
*/
115-
public $encryptionKeyFingerprintFieldName;
115+
private $encryptionKeyFingerprintFieldName;
116116

117117
/**
118118
* The name of the header where to write/read the digest of the encryption
119119
* key (optional, the header won't be set if the name is null or empty).
120120
*/
121-
public $encryptionKeyFingerprintHeaderName;
121+
private $encryptionKeyFingerprintHeaderName;
122122

123123
/**
124124
* How the field/header values have to be encoded.
125125
*/
126-
public $fieldValueEncoding;
126+
private $fieldValueEncoding;
127127

128128
/**
129129
* If the encryption parameters must be written to/read from HTTP headers.
@@ -139,31 +139,104 @@ public function useHttpPayloads() {
139139
return !empty($this->encryptedKeyFieldName) && !empty($this->ivFieldName);
140140
}
141141

142+
/**
143+
* FieldLevelEncryptionConfig constructor.
144+
*/
145+
public function __construct($encryptionCertificate, $encryptionCertificateFingerprint, $encryptionKeyFingerprint, $decryptionKey, $encryptionPaths, $decryptionPaths, $oaepPaddingDigestAlgorithm, $oaepPaddingDigestAlgorithmFieldName, $oaepPaddingDigestAlgorithmHeaderName, $ivFieldName, $ivHeaderName, $encryptedKeyFieldName, $encryptedKeyHeaderName, $encryptedValueFieldName, $encryptionCertificateFingerprintFieldName, $encryptionCertificateFingerprintHeaderName, $encryptionKeyFingerprintFieldName, $encryptionKeyFingerprintHeaderName, $fieldValueEncoding) {
146+
$this->encryptionCertificate = $encryptionCertificate;
147+
$this->encryptionCertificateFingerprint = $encryptionCertificateFingerprint;
148+
$this->encryptionKeyFingerprint = $encryptionKeyFingerprint;
149+
$this->decryptionKey = $decryptionKey;
150+
$this->encryptionPaths = $encryptionPaths;
151+
$this->decryptionPaths = $decryptionPaths;
152+
$this->oaepPaddingDigestAlgorithm = $oaepPaddingDigestAlgorithm;
153+
$this->oaepPaddingDigestAlgorithmFieldName = $oaepPaddingDigestAlgorithmFieldName;
154+
$this->oaepPaddingDigestAlgorithmHeaderName = $oaepPaddingDigestAlgorithmHeaderName;
155+
$this->ivFieldName = $ivFieldName;
156+
$this->ivHeaderName = $ivHeaderName;
157+
$this->encryptedKeyFieldName = $encryptedKeyFieldName;
158+
$this->encryptedKeyHeaderName = $encryptedKeyHeaderName;
159+
$this->encryptedValueFieldName = $encryptedValueFieldName;
160+
$this->encryptionCertificateFingerprintFieldName = $encryptionCertificateFingerprintFieldName;
161+
$this->encryptionCertificateFingerprintHeaderName = $encryptionCertificateFingerprintHeaderName;
162+
$this->encryptionKeyFingerprintFieldName = $encryptionKeyFingerprintFieldName;
163+
$this->encryptionKeyFingerprintHeaderName = $encryptionKeyFingerprintHeaderName;
164+
$this->fieldValueEncoding = $fieldValueEncoding;
165+
}
166+
167+
public function getEncryptionCertificate() {
168+
return $this->encryptionCertificate;
169+
}
170+
171+
public function getEncryptionCertificateFingerprint() {
172+
return $this->encryptionCertificateFingerprint;
173+
}
174+
175+
public function getEncryptionKeyFingerprint() {
176+
return $this->encryptionKeyFingerprint;
177+
}
178+
179+
public function getDecryptionKey() {
180+
return $this->decryptionKey;
181+
}
182+
183+
public function getEncryptionPaths() {
184+
return $this->encryptionPaths;
185+
}
186+
187+
public function getDecryptionPaths() {
188+
return $this->decryptionPaths;
189+
}
190+
191+
public function getOaepPaddingDigestAlgorithm() {
192+
return $this->oaepPaddingDigestAlgorithm;
193+
}
194+
195+
public function getOaepPaddingDigestAlgorithmFieldName() {
196+
return $this->oaepPaddingDigestAlgorithmFieldName;
197+
}
198+
142199
public function getOaepPaddingDigestAlgorithmHeaderName() {
143200
return $this->oaepPaddingDigestAlgorithmHeaderName;
144201
}
145202

203+
public function getIvFieldName() {
204+
return $this->ivFieldName;
205+
}
206+
146207
public function getIvHeaderName() {
147208
return $this->ivHeaderName;
148209
}
149210

211+
public function getEncryptedKeyFieldName() {
212+
return $this->encryptedKeyFieldName;
213+
}
214+
150215
public function getEncryptedKeyHeaderName() {
151216
return $this->encryptedKeyHeaderName;
152217
}
153218

219+
public function getEncryptedValueFieldName() {
220+
return $this->encryptedValueFieldName;
221+
}
222+
223+
public function getEncryptionCertificateFingerprintFieldName() {
224+
return $this->encryptionCertificateFingerprintFieldName;
225+
}
226+
154227
public function getEncryptionCertificateFingerprintHeaderName() {
155228
return $this->encryptionCertificateFingerprintHeaderName;
156229
}
157230

158-
public function getEncryptionKeyFingerprintHeaderName() {
159-
return $this->encryptionKeyFingerprintHeaderName;
231+
public function getEncryptionKeyFingerprintFieldName() {
232+
return $this->encryptionKeyFingerprintFieldName;
160233
}
161234

162-
public function getEncryptionCertificateFingerprint() {
163-
return $this->encryptionCertificateFingerprint;
235+
public function getEncryptionKeyFingerprintHeaderName() {
236+
return $this->encryptionKeyFingerprintHeaderName;
164237
}
165238

166-
public function getEncryptionKeyFingerprint() {
167-
return $this->encryptionKeyFingerprint;
239+
public function getFieldValueEncoding() {
240+
return $this->fieldValueEncoding;
168241
}
169242
}

src/Developer/Encryption/FieldLevelEncryptionConfigBuilder.php

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -208,27 +208,27 @@ public function build() {
208208
$this->computeEncryptionCertificateFingerprintWhenNeeded();
209209
$this->computeEncryptionKeyFingerprintWhenNeeded();
210210

211-
$config = new FieldLevelEncryptionConfig();
212-
$config->encryptionCertificateFingerprintFieldName = $this->encryptionCertificateFingerprintFieldName;
213-
$config->encryptionKeyFingerprintFieldName = $this->encryptionKeyFingerprintFieldName;
214-
$config->encryptionCertificateFingerprint = $this->encryptionCertificateFingerprint;
215-
$config->encryptionKeyFingerprint = $this->encryptionKeyFingerprint;
216-
$config->decryptionKey = $this->decryptionKey;
217-
$config->encryptionPaths = $this->encryptionPaths;
218-
$config->encryptionCertificate = $this->encryptionCertificate;
219-
$config->oaepPaddingDigestAlgorithm = $this->oaepPaddingDigestAlgorithm;
220-
$config->ivFieldName = $this->ivFieldName;
221-
$config->oaepPaddingDigestAlgorithmFieldName = $this->oaepPaddingDigestAlgorithmFieldName;
222-
$config->decryptionPaths = $this->decryptionPaths;
223-
$config->encryptedKeyFieldName = $this->encryptedKeyFieldName;
224-
$config->fieldValueEncoding = $this->fieldValueEncoding;
225-
$config->encryptedValueFieldName = $this->encryptedValueFieldName;
226-
$config->ivHeaderName = $this->ivHeaderName;
227-
$config->oaepPaddingDigestAlgorithmHeaderName = $this->oaepPaddingDigestAlgorithmHeaderName;
228-
$config->encryptedKeyHeaderName = $this->encryptedKeyHeaderName;
229-
$config->encryptionCertificateFingerprintHeaderName = $this->encryptionCertificateFingerprintHeaderName;
230-
$config->encryptionKeyFingerprintHeaderName = $this->encryptionKeyFingerprintHeaderName;
231-
return $config;
211+
return new FieldLevelEncryptionConfig(
212+
$this->encryptionCertificate,
213+
$this->encryptionCertificateFingerprint,
214+
$this->encryptionKeyFingerprint,
215+
$this->decryptionKey,
216+
$this->encryptionPaths,
217+
$this->decryptionPaths,
218+
$this->oaepPaddingDigestAlgorithm,
219+
$this->oaepPaddingDigestAlgorithmFieldName,
220+
$this->oaepPaddingDigestAlgorithmHeaderName,
221+
$this->ivFieldName,
222+
$this->ivHeaderName,
223+
$this->encryptedKeyFieldName,
224+
$this->encryptedKeyHeaderName,
225+
$this->encryptedValueFieldName,
226+
$this->encryptionCertificateFingerprintFieldName,
227+
$this->encryptionCertificateFingerprintHeaderName,
228+
$this->encryptionKeyFingerprintFieldName,
229+
$this->encryptionKeyFingerprintHeaderName,
230+
$this->fieldValueEncoding
231+
);
232232
}
233233

234234
private function checkJsonPathParameterValues() {

0 commit comments

Comments
 (0)