Updates tests for changed test SK OCSP responder certificate

* Marked testWhenCertificateIsRevokedThenOcspCheckWithDesignatedOcspServiceFails test as skipped;
* Marked testWhenValidDesignatedOcspResponderConfigurationThenSucceeds test as skipped;
* Marked testWhenValidOcspNonceDisabledConfigurationThenSucceeds test as skipped;
* Changed PHP tests to use phpseclib/phpseclib version 30.0.19 (CVE-2023-27560);
* Changed PHP tests to use guzzlehttp/psr7 version 2.4.5 (CVE-2023-29197).

Signed-off-by: Erkki Arus <[email protected]>

Author: erkkiarus

composer.json

@@ -32,12 +32,13 @@
         }
     ],
     "require": {
-        "phpseclib/phpseclib": "3.0.14",
-        "guzzlehttp/psr7": "2.4.3",
+        "phpseclib/phpseclib": "3.0.19",
+        "guzzlehttp/psr7": "2.4.5",
         "web-eid/ocsp-php": "1.0.0",
         "psr/log": "^3.0"
     },
     "scripts": {
-        "fix-php": ["prettier src/**/* --write", "prettier examples/src/* --write"]
+        "fix-php": ["prettier src/**/* --write", "prettier examples/src/* --write"],
+        "test": "phpunit"
     }
 }

src/util/AsnUtil.php

@@ -40,8 +40,18 @@ public static function isSignatureInAsn1Format(string $signature): bool
 
         // ASN.1 format: 0x30 b1 0x02 b2 r 0x02 b3 s.
         // Note: unpack() returns an array indexed from 1, not 0.
+        if(!isset($sigByteArray[1]) ||
+            !isset($sigByteArray[2]) ||
+            !isset($sigByteArray[3]) ||
+            !isset($sigByteArray[4])) {
+            return false;
+        }
         $b1 = $sigByteArray[2];
         $b2 = $sigByteArray[4];
+        if(!isset($sigByteArray[5 + $b2]) ||
+            !isset($sigByteArray[6 + $b2])) {
+            return false;
+        }
         $b3 = $sigByteArray[6 + $b2];
 
         return $sigByteArray[1] == 0x30 // Sequence tag

tests/validator/AuthTokenCertificateTest.php

@@ -247,6 +247,7 @@ public function testWhenCertificateIsRevokedThenOcspCheckFails(): void
 
     public function testWhenCertificateIsRevokedThenOcspCheckWithDesignatedOcspServiceFails(): void
     {
+        $this->markTestSkipped("A new designated test OCSP responder certificate was issued whose validity period no longer overlaps with the revoked certificate");
         $this->mockDate("2020-01-01");
 
         $validatorWithOcspCheck = AuthTokenValidators::getAuthTokenValidatorWithDesignatedOcspCheck();

tests/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.php

@@ -66,6 +66,7 @@ public function testWhenValidAiaOcspResponderConfigurationThenSucceeds(): void
 
     public function testWhenValidDesignatedOcspResponderConfigurationThenSucceeds(): void
     {
+        $this->markTestSkipped("As new designated test OCSP responder certificates are issued more frequently now, it is no longer feasible to keep the certificates up to date");
         $this->expectNotToPerformAssertions();
 
         $ocspServiceProvider = OcspServiceMaker::getDesignatedOcspServiceProvider();
@@ -75,6 +76,7 @@ public function testWhenValidDesignatedOcspResponderConfigurationThenSucceeds():
 
     public function testWhenValidOcspNonceDisabledConfigurationThenSucceeds(): void
     {
+        $this->markTestSkipped("As new designated test OCSP responder certificates are issued more frequently now, it is no longer feasible to keep the certificates up to date");
         $this->expectNotToPerformAssertions();
 
         $ocspServiceProvider = OcspServiceMaker::getDesignatedOcspServiceProvider(false);
@@ -156,7 +158,7 @@ public function testWhenOcspResponseHasInvalidResponderCertThenThrows(): void
     public function testWhenOcspResponseHasInvalidTagThenThrows(): void
     {
         $this->expectException(UserCertificateOCSPCheckFailedException::class);
-        $this->expectExceptionMessage("User certificate revocation check has failed: Exception: Could not decode OcspResponse->responseBytes->responseType");
+        $this->expectExceptionMessage("User certificate revocation check has failed: Exception: Could not decode OcspResponse->responseBytes->response");
         $validator = self::getSubjectCertificateNotRevokedValidatorWithAiaOcspUsingResponse(
             pack("c*", ...self::buildOcspResponseBodyWithInvalidTag())
         );