Skip to content

feat(deps): Upgrade phpseclib to v3 #48183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
susnux wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

feat(deps): Upgrade phpseclib to v3 #48183

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
25d13a4
feat(deps): Upgrade phpseclib to v3
susnux Apr 9, 2024
9ca9c89
fixup: Fix files_external tests
susnux Nov 5, 2024
7283f27
fix: adjust hash to v2 library default
joshtrichards Sep 7, 2025
b36188e
fix: set PSS padding / options for RSA keys for v2->v3 consistency
joshtrichards Sep 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion 3rdparty
Open in desktop
Submodule 3rdparty updated 358 files
4 changes: 1 addition & 3 deletions apps/encryption/lib/Crypto/Crypt.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
use OCP\IConfig;
use OCP\IL10N;
use OCP\IUserSession;
use phpseclib\Crypt\RC4;
use phpseclib3\Crypt\RC4;
use Psr\Log\LoggerInterface;

/**
Expand Down Expand Up @@ -724,7 +724,6 @@ public function useLegacyBase64Encoding(): bool {
*/
private function rc4Decrypt(string $data, string $secret): string {
$rc4 = new RC4();
/** @psalm-suppress InternalMethod */
$rc4->setKey($secret);

return $rc4->decrypt($data);
Expand All @@ -735,7 +734,6 @@ private function rc4Decrypt(string $data, string $secret): string {
*/
private function rc4Encrypt(string $data, string $secret): string {
$rc4 = new RC4();
/** @psalm-suppress InternalMethod */
$rc4->setKey($secret);

return $rc4->encrypt($data);
Expand Down
18 changes: 10 additions & 8 deletions apps/files_external/lib/Controller/AjaxController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,15 @@ public function __construct(
*/
private function generateSshKeys($keyLength) {
$key = $this->rsaMechanism->createKey($keyLength);
// Replace the placeholder label with a more meaningful one
$key['publickey'] = str_replace('phpseclib-generated-key', gethostname(), $key['publickey']);

return $key;
return [
'private_key' => $key->toString('PKCS1'),
// Replace the placeholder label with a more meaningful one
'public_key' => str_replace(
'phpseclib-generated-key',
gethostname(),
$key->getPublicKey()->toString('OpenSSH'),
),
];
}

/**
Expand All @@ -57,10 +62,7 @@ private function generateSshKeys($keyLength) {
public function getSshKeys($keyLength = 1024) {
$key = $this->generateSshKeys($keyLength);
return new JSONResponse(
['data' => [
'private_key' => $key['privatekey'],
'public_key' => $key['publickey']
],
['data' => $key,
'status' => 'success'
]);
}
Expand Down
28 changes: 14 additions & 14 deletions apps/files_external/lib/Lib/Auth/PublicKey/RSA.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
use OCP\IConfig;
use OCP\IL10N;
use OCP\IUser;
use phpseclib\Crypt\RSA as RSACrypt;
use phpseclib3\Crypt\RSA as RSACrypt;

/**
* RSA public key authentication
Expand Down Expand Up @@ -41,33 +41,33 @@ public function __construct(
* @return void
*/
public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = null) {
$auth = new RSACrypt();
$auth->setPassword($this->config->getSystemValue('secret', ''));
if (!$auth->loadKey($storage->getBackendOption('private_key'))) {
try {
$auth = RSACrypt::loadPrivateKey(
Copy link

@terrafrost terrafrost Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be nice to support EC / DSA keys as well. One can do that thusly:

$auth = \phpseclib3\Crypt\PublicKeyLoader::load(
    $storage->getBackendOption('private_key'),
    $this->config->getSystemValue('secret', '');
);
if (!$auth instanceof \phpseclib3\Crypt\Common\PrivateKey) {
    throw new \Exception('A private key needs to be loaded - not a ' . $auth::class . ' key');
}

I suppose it might also be worthwhile to realize that if no key can be detected (eg. you try to load a PHP file as a key) then a \phpseclib3\Exception\NoKeyLoadedException will be thrown.

That said, if more than just RSA keys are going to be supported then renaming the class would prob be appropriate as well.

$storage->getBackendOption('private_key'),
$this->config->getSystemValue('secret', '')
);
} catch (\Throwable) {
// Add fallback routine for a time where secret was not enforced to be exists
$auth->setPassword('');
if (!$auth->loadKey($storage->getBackendOption('private_key'))) {
throw new \RuntimeException('unable to load private key');
}
$auth = RSACrypt::loadPrivateKey($storage->getBackendOption('private_key'));
}

$storage->setBackendOption('public_key_auth', $auth);
}

/**
* Generate a keypair
*
* @param int $keyLenth
* @return array ['privatekey' => $privateKey, 'publickey' => $publicKey]
*/
public function createKey($keyLength) {
public function createKey($keyLength): RSACrypt\PrivateKey {
$rsa = new RSACrypt();
$rsa->setPublicKeyFormat(RSACrypt::PUBLIC_FORMAT_OPENSSH);
$rsa->setPassword($this->config->getSystemValue('secret', ''));


if ($keyLength !== 1024 && $keyLength !== 2048 && $keyLength !== 4096) {
$keyLength = 1024;
}

return $rsa->createKey($keyLength);
$secret = $this->config->getSystemValue('secret', '');
return $rsa->createKey($keyLength)
->withPassword($secret);
}
}
12 changes: 6 additions & 6 deletions apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
use OCP\IConfig;
use OCP\IL10N;
use OCP\IUser;
use phpseclib\Crypt\RSA as RSACrypt;
use phpseclib3\Crypt\RSA;

/**
* RSA public key authentication
Expand Down Expand Up @@ -39,12 +39,12 @@ public function __construct(
* @return void
*/
public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = null) {
$auth = new RSACrypt();
$auth->setPassword($this->config->getSystemValue('secret', ''));
if (!$auth->loadKey($storage->getBackendOption('private_key'))) {
$auth = new RSA\PrivateKey();
$auth->withPassword($this->config->getSystemValue('secret', ''));
Copy link
Member

@joshtrichards joshtrichards Sep 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
$auth->withPassword($this->config->getSystemValue('secret', ''));
$auth = $auth->withPassword($this->config->getSystemValue('secret', ''));

v3 is immutable

if (!$auth->loadPrivateKey($storage->getBackendOption('private_key'))) {
// Add fallback routine for a time where secret was not enforced to be exists
$auth->setPassword('');
if (!$auth->loadKey($storage->getBackendOption('private_key'))) {
$auth->withPassword('');
Copy link
Member

@joshtrichards joshtrichards Sep 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
$auth->withPassword('');
$auth = $auth->withPassword('');

if (!$auth->loadPrivateKey($storage->getBackendOption('private_key'))) {
throw new \RuntimeException('unable to load private key');
}
}
Expand Down
12 changes: 6 additions & 6 deletions apps/files_external/lib/Lib/Storage/SFTP.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
use OCP\Constants;
use OCP\Files\FileInfo;
use OCP\Files\IMimeTypeDetector;
use phpseclib\Net\SFTP\Stream;
use phpseclib3\Net\SFTP\Stream;

/**
* Uses phpseclib's Net\SFTP class and the Net\SFTP\Stream stream wrapper to
Expand All @@ -29,7 +29,7 @@ class SFTP extends Common {
private $auth = [];

/**
* @var \phpseclib\Net\SFTP
* @var \phpseclib3\Net\SFTP
*/
protected $client;
private IMimeTypeDetector $mimeTypeDetector;
Expand Down Expand Up @@ -93,16 +93,16 @@ public function __construct(array $parameters) {
/**
* Returns the connection.
*
* @return \phpseclib\Net\SFTP connected client instance
* @return \phpseclib3\Net\SFTP connected client instance
* @throws \Exception when the connection failed
*/
public function getConnection(): \phpseclib\Net\SFTP {
public function getConnection(): \phpseclib3\Net\SFTP {
if (!is_null($this->client)) {
return $this->client;
}

$hostKeys = $this->readHostKeys();
$this->client = new \phpseclib\Net\SFTP($this->host, $this->port);
$this->client = new \phpseclib3\Net\SFTP($this->host, $this->port);

// The SSH Host Key MUST be verified before login().
$currentHostKey = $this->client->getServerPublicHostKey();
Expand Down Expand Up @@ -453,7 +453,7 @@ public function copy(string $source, string $target): bool {
return false;
}
/** @psalm-suppress InternalMethod */
if (!$connection->put($absTarget, $chunk, \phpseclib\Net\SFTP::SOURCE_STRING, $i)) {
if (!$connection->put($absTarget, $chunk, \phpseclib3\Net\SFTP::SOURCE_STRING, $i)) {
return false;
}
}
Expand Down
6 changes: 3 additions & 3 deletions apps/files_external/lib/Lib/Storage/SFTPReadStream.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@
namespace OCA\Files_External\Lib\Storage;

use Icewind\Streams\File;
use phpseclib\Net\SSH2;
use phpseclib3\Net\SSH2;

class SFTPReadStream implements File {
/** @var resource */
public $context;

/** @var \phpseclib\Net\SFTP */
/** @var \phpseclib3\Net\SFTP */
private $sftp;

/** @var string */
Expand Down Expand Up @@ -53,7 +53,7 @@ protected function loadContext(string $name) {
} else {
throw new \BadMethodCallException('Invalid context, "' . $name . '" options not set');
}
if (isset($context['session']) and $context['session'] instanceof \phpseclib\Net\SFTP) {
if (isset($context['session']) and $context['session'] instanceof \phpseclib3\Net\SFTP) {
$this->sftp = $context['session'];
} else {
throw new \BadMethodCallException('Invalid context, session not set');
Expand Down
6 changes: 3 additions & 3 deletions apps/files_external/lib/Lib/Storage/SFTPWriteStream.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@
namespace OCA\Files_External\Lib\Storage;

use Icewind\Streams\File;
use phpseclib\Net\SSH2;
use phpseclib3\Net\SSH2;

class SFTPWriteStream implements File {
/** @var resource */
public $context;

/** @var \phpseclib\Net\SFTP */
/** @var \phpseclib3\Net\SFTP */
private $sftp;

/** @var string */
Expand Down Expand Up @@ -51,7 +51,7 @@ protected function loadContext(string $name) {
} else {
throw new \BadMethodCallException('Invalid context, "' . $name . '" options not set');
}
if (isset($context['session']) and $context['session'] instanceof \phpseclib\Net\SFTP) {
if (isset($context['session']) and $context['session'] instanceof \phpseclib3\Net\SFTP) {
$this->sftp = $context['session'];
} else {
throw new \BadMethodCallException('Invalid context, session not set');
Expand Down
2 changes: 1 addition & 1 deletion apps/files_external/lib/MountConfig.php
View file
Open in desktop
Copy link
Member

@joshtrichards joshtrichards Sep 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

L220 for v3

private static function getCipher() {
	$cipher = new AES('cbc');

Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
use OCP\Files\StorageNotAvailableException;
use OCP\IL10N;
use OCP\Util;
use phpseclib\Crypt\AES;
use phpseclib3\Crypt\AES;
use Psr\Log\LoggerInterface;

/**
Expand Down
48 changes: 32 additions & 16 deletions apps/files_external/tests/Controller/AjaxControllerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,28 +13,27 @@
use OCP\IRequest;
use OCP\IUser;
use OCP\IUserSession;
use phpseclib3\Crypt\RSA as CryptRSA;
use phpseclib3\Crypt\RSA\PrivateKey;
use phpseclib3\Crypt\RSA\PublicKey;
use PHPUnit\Framework\MockObject\MockObject;
use Test\TestCase;

class AjaxControllerTest extends TestCase {
/** @var IRequest */
private $request;
/** @var RSA */
private $rsa;
/** @var GlobalAuth */
private $globalAuth;
/** @var IUserSession */
private $userSession;
/** @var IGroupManager */
private $groupManager;
/** @var AjaxController */
private $ajaxController;
private IRequest&MockObject $request;
private RSA&MockObject $rsa;
private GlobalAuth&MockObject $globalAuth;
private IUserSession&MockObject $userSession;
private IGroupManager&MockObject $groupManager;

private AjaxController $ajaxController;

protected function setUp(): void {
$this->request = $this->createMock(IRequest::class);
$this->rsa = $this->getMockBuilder('\\OCA\\Files_External\\Lib\\Auth\\PublicKey\\RSA')
$this->rsa = $this->getMockBuilder(RSA::class)
->disableOriginalConstructor()
->getMock();
$this->globalAuth = $this->getMockBuilder('\\OCA\\Files_External\\Lib\\Auth\\Password\GlobalAuth')
$this->globalAuth = $this->getMockBuilder(GlobalAuth::class)
->disableOriginalConstructor()
->getMock();
$this->userSession = $this->createMock(IUserSession::class);
Expand All @@ -53,12 +52,29 @@ protected function setUp(): void {
}

public function testGetSshKeys(): void {
$keyImpl = $this->createMock(CryptRSA::class);
$keyImpl->expects(self::once())
->method('toString')
->with('OpenSSH')
->willReturn('MyPublicKey');

$publicKey = $this->createMock(PublicKey::class);
$publicKey->expects(self::once())
->method('getPublicKey')
->willReturn($keyImpl);

$privateKey = $this->createMock(PrivateKey::class);
$privateKey->expects(self::once())
->method('toString')
->with('PKCS1')
->willReturn('MyPrivatekey');

$this->rsa
->expects($this->once())
->method('createKey')
->willReturn([
'privatekey' => 'MyPrivateKey',
'publickey' => 'MyPublicKey',
'privatekey' => $privateKey,
'publickey' => $publicKey,
]);

$expected = new JSONResponse(
Expand Down
7 changes: 3 additions & 4 deletions core/Command/Integrity/SignApp.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@
use OC\IntegrityCheck\Checker;
use OC\IntegrityCheck\Helpers\FileAccessHelper;
use OCP\IURLGenerator;
use phpseclib\Crypt\RSA;
use phpseclib\File\X509;
use phpseclib3\Crypt\RSA;
use phpseclib3\File\X509;
use Symfony\Component\Console\Command\Command;
use Symfony\Component\Console\Input\InputInterface;
use Symfony\Component\Console\Input\InputOption;
Expand Down Expand Up @@ -68,8 +68,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
return 1;
}

$rsa = new RSA();
$rsa->loadKey($privateKey);
$rsa = RSA::loadPrivateKey($privateKey);
$x509 = new X509();
$x509->loadX509($keyBundle);
$x509->setPrivateKey($rsa);
Expand Down
7 changes: 3 additions & 4 deletions core/Command/Integrity/SignCore.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@

use OC\IntegrityCheck\Checker;
use OC\IntegrityCheck\Helpers\FileAccessHelper;
use phpseclib\Crypt\RSA;
use phpseclib\File\X509;
use phpseclib3\Crypt\RSA;
use phpseclib3\File\X509;
use Symfony\Component\Console\Command\Command;
use Symfony\Component\Console\Input\InputInterface;
use Symfony\Component\Console\Input\InputOption;
Expand Down Expand Up @@ -63,8 +63,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
return 1;
}

$rsa = new RSA();
$rsa->loadKey($privateKey);
$rsa = RSA::loadPrivateKey($privateKey);
$x509 = new X509();
$x509->loadX509($keyBundle);
$x509->setPrivateKey($rsa);
Expand Down
2 changes: 1 addition & 1 deletion lib/private/Installer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
use OCP\IConfig;
use OCP\ITempManager;
use OCP\Migration\IOutput;
use phpseclib\File\X509;
use phpseclib3\File\X509;
use Psr\Log\LoggerInterface;

/**
Expand Down
Loading