refactor(cryptography): several fixes and improvements (#1764)

Author: xHeaven

packages/cryptography/src/Encryption/EncryptedData.php

@@ -38,10 +38,18 @@ public static function unserialize(string $data): self
             throw EncryptedDataWasInvalid::dueToInvalidFormat();
         }
 
+        $payload = base64_decode($decoded['payload'], strict: true);
+        $iv = base64_decode($decoded['iv'], strict: true);
+        $tag = base64_decode($decoded['tag'], strict: true);
+
+        if ($payload === false || $iv === false || $tag === false) {
+            throw EncryptedDataWasInvalid::dueToInvalidFormat();
+        }
+
         return new self(
-            payload: base64_decode($decoded['payload'], strict: true),
-            iv: base64_decode($decoded['iv'], strict: true),
-            tag: base64_decode($decoded['tag'], strict: true),
+            payload: $payload,
+            iv: $iv,
+            tag: $tag,
             signature: new Signature($decoded['signature']),
             algorithm: EncryptionAlgorithm::from($decoded['algorithm']),
         );

packages/cryptography/src/Encryption/EncryptionKey.php

@@ -33,7 +33,13 @@ public static function generate(EncryptionAlgorithm $algorithm): self
      */
     public static function fromString(?string $key, EncryptionAlgorithm $algorithm): self
     {
-        return new self(base64_decode($key ?: '', strict: true), $algorithm);
+        $decoded = base64_decode($key ?: '', strict: true);
+
+        if ($decoded === false) {
+            $decoded = '';
+        }
+
+        return new self($decoded, $algorithm);
     }
 
     public function toString(): string

packages/cryptography/src/Password/BcryptConfig.php

@@ -2,8 +2,6 @@
 
 namespace Tempest\Cryptography\Password;
 
-use Tempest\Cryptography\Password\HashingAlgorithm;
-
 final class BcryptConfig implements PasswordHashingConfig
 {
     public HashingAlgorithm $algorithm = HashingAlgorithm::BCRYPT;

packages/cryptography/src/Password/Exceptions/HashingFailed.php

@@ -15,4 +15,9 @@ public static function forEmptyPassword(): self
     {
         return new self('Could not hash an empty password.');
     }
+
+    public static function forInvalidHashingAlgorithm(): self
+    {
+        return new self('The specified hashing algorithm is not supported.');
+    }
 }

packages/cryptography/src/Password/GenericPasswordHasher.php

@@ -2,8 +2,9 @@
 
 namespace Tempest\Cryptography\Password;
 
+use Error;
 use Tempest\Cryptography\Password\Exceptions\HashingFailed;
-use Tempest\Cryptography\Password\HashingAlgorithm;
+use ValueError;
 
 final class GenericPasswordHasher implements PasswordHasher
 {
@@ -17,22 +18,24 @@ public function __construct(
 
     public function hash(#[\SensitiveParameter] string $password): string
     {
-        $hash = password_hash($password, $this->algorithm->value, $this->config->options);
-
-        if ($hash === false) {
-            throw HashingFailed::forUnknownReason();
+        if ($password === '') {
+            throw HashingFailed::forEmptyPassword();
         }
 
-        if (mb_strlen($password) === 0) {
-            throw HashingFailed::forEmptyPassword();
+        try {
+            $hash = password_hash($password, $this->algorithm->value, $this->config->options);
+        } catch (ValueError) {
+            throw HashingFailed::forInvalidHashingAlgorithm();
+        } catch (Error) {
+            throw HashingFailed::forUnknownReason();
         }
 
         return $hash;
     }
 
     public function verify(#[\SensitiveParameter] string $password, #[\SensitiveParameter] string $hash): bool
     {
-        if (mb_strlen($hash) === 0) {
+        if ($password === '' || $hash === '') {
             return false;
         }
 
@@ -41,11 +44,19 @@ public function verify(#[\SensitiveParameter] string $password, #[\SensitivePara
 
     public function needsRehash(#[\SensitiveParameter] string $hash): bool
     {
+        if ($hash === '') {
+            return false;
+        }
+
         return password_needs_rehash($hash, $this->algorithm->value, $this->config->options);
     }
 
     public function analyze(#[\SensitiveParameter] string $hash): ?Hash
     {
+        if ($hash === '') {
+            return null;
+        }
+
         $info = password_get_info($hash);
 
         if ($info['algo'] === null) {

packages/cryptography/src/Password/PasswordHasher.php

@@ -2,8 +2,6 @@
 
 namespace Tempest\Cryptography\Password;
 
-use Tempest\Cryptography\Password\HashingAlgorithm;
-
 interface PasswordHasher
 {
     public HashingAlgorithm $algorithm {
@@ -16,7 +14,7 @@ interface PasswordHasher
     public function hash(#[\SensitiveParameter] string $password): string;
 
     /**
-     * Checks if the given pain-text password matches the given hash.
+     * Checks if the given plain-text password matches the given hash.
      */
     public function verify(#[\SensitiveParameter] string $password, string $hash): bool;
 
@@ -27,7 +25,7 @@ public function verify(#[\SensitiveParameter] string $password, string $hash): b
     public function needsRehash(#[\SensitiveParameter] string $hash): bool;
 
     /**
-     * Returns informations about the given hash, such as the algorithm used and its options.
+     * Returns information about the given hash, such as the algorithm used and its options.
      */
     public function analyze(#[\SensitiveParameter] string $hash): ?Hash;
 }