Merge branch 'master' into build/clen-1387/gha-switch-to-large-runners

.github/CODEOWNERS

@@ -1,3 +1,2 @@
-*         @seba-aln @MikeDobrzan @marcin-cebo @mohitpubnub
-.github/* @parfeon @seba-aln @MikeDobrzan @marcin-cebo @mohitpubnub
-README.md @techwritermat @kazydek
+*         @seba-aln @xavrax @marcin-cebo
+README.md @techwritermat @kazydek @seba-aln @xavrax

.github/workflows/run-tests.yml

@@ -20,7 +20,7 @@ jobs:
       max-parallel: 1
       fail-fast: true
       matrix:
-        php: [7.4, 8.0, 8.1, 8.2]
+        php: [8.0, 8.1, 8.2]
     env:
       PUBLISH_KEY: ${{ secrets.PUBLISH_KEY }}
       SUBSCRIBE_KEY: ${{ secrets.SUBSCRIBE_KEY }}

.pubnub.yml

@@ -1,8 +1,15 @@
 name: php
-version: 6.0.1
+version: 6.1.0
 schema: 1
 scm: github.com/pubnub/php
 changelog:
+  - date: 2023-10-16
+    version: v6.1.0
+    changes:
+      - type: feature
+        text: "Add crypto module that allows configure SDK to encrypt and decrypt messages."
+      - type: bug
+        text: "Improved security of crypto implementation by adding enhanced AES-CBC cryptor."
   - date: 2023-05-18
     version: v6.0.1
     changes:
@@ -385,8 +392,8 @@ sdks:
                     - x86-64
           - distribution-type: library
             distribution-repository: GitHub release
-            package-name: php-6.0.1.zip
-            location: https://github.com/pubnub/php/releases/tag/v6.0.1
+            package-name: php-6.1.0.zip
+            location: https://github.com/pubnub/php/releases/tag/v6.1.0
             requires:
               - name: rmccue/requests
                 min-version: 1.0.0

CHANGELOG.md

@@ -1,3 +1,12 @@
+## v6.1.0
+October 16 2023
+
+#### Added
+- Add crypto module that allows configure SDK to encrypt and decrypt messages.
+
+#### Fixed
+- Improved security of crypto implementation by adding enhanced AES-CBC cryptor.
+
 ## v6.0.1
 May 18 2023
 

LICENSE

@@ -1,27 +1,29 @@
-PubNub Real-time Cloud-Hosted Push API and Push Notification Client Frameworks
-Copyright (c) 2013 PubNub Inc.
-http://www.pubnub.com/
-http://www.pubnub.com/terms
+PubNub Software Development Kit License Agreement
+Copyright © 2023 PubNub Inc. All rights reserved.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Subject to the terms and conditions of the license, you are hereby granted
+a non-exclusive, worldwide, royalty-free license to (a) copy and modify
+the software in source code or binary form for use with the software services
+and interfaces provided by PubNub, and (b) redistribute unmodified copies
+of the software to third parties. The software may not be incorporated in
+or used to provide any product or service competitive with the products
+and services of PubNub.
 
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
+The above copyright notice and this license shall be included
+in or with all copies or substantial portions of the software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+This license does not grant you permission to use the trade names, trademarks,
+service marks, or product names of PubNub, except as required for reasonable
+and customary use in describing the origin of the software and reproducing
+the content of this license.
 
-PubNub Real-time Cloud-Hosted Push API and Push Notification Client Frameworks
-Copyright (c) 2013 PubNub Inc.
-http://www.pubnub.com/
-http://www.pubnub.com/terms
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL PUBNUB OR THE AUTHORS OR COPYRIGHT HOLDERS OF THE SOFTWARE BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+https://www.pubnub.com/
+https://www.pubnub.com/terms

README.md

@@ -41,7 +41,7 @@ You will need the publish and subscribe keys to authenticate your app. Get your
          {
              "require": {
                  <!-- include the latest version from the badge at the top -->
-                 "pubnub/pubnub": "6.0.1"
+                 "pubnub/pubnub": "6.1.0"
              }
          }
          ```

composer.json

@@ -5,7 +5,7 @@
   "keywords": ["api", "real-time", "realtime", "real time", "ajax", "push"],
   "homepage": "http://www.pubnub.com/",
   "license": "MIT",
-  "version": "6.0.1",
+  "version": "6.1.0",
   "authors": [
     {
       "name": "PubNub",

examples/Time.php

@@ -3,10 +3,12 @@
 require_once __DIR__ . '/../vendor/autoload.php';
 
 use PubNub\Models\Consumer\PNTimeResult;
+use PubNub\Crypto\Cryptor;
 
 $pnconfig = \PubNub\PNConfiguration::demoKeys();
 $pubnub = new \PubNub\PubNub($pnconfig);
 
 $result = $pubnub->time()->sync();
 
 printf("Server Time is: %s", date("Y-m-d H:i:s", $result->getTimetoken()));
+

src/PubNub/Crypto/AesCbcCryptor.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace PubNub\Crypto;
+
+use PubNub\Crypto\Payload as CryptoPayload;
+use PubNub\Crypto\PaddingTrait;
+
+class AesCbcCryptor extends Cryptor
+{
+    use PaddingTrait;
+
+    public const CRYPTOR_ID = 'ACRH';
+    public const IV_LENGTH = 16;
+    public const BLOCK_SIZE = 16;
+    public const CIPHER_ALGO = 'aes-256-cbc';
+
+    protected string $cipherKey;
+
+    public function __construct(string $cipherKey)
+    {
+        $this->cipherKey = $cipherKey;
+    }
+
+    public function getIV(): string
+    {
+        return random_bytes(self::IV_LENGTH);
+    }
+
+    public function getCipherKey($cipherKey = null): string
+    {
+        return $cipherKey ? $cipherKey : $this->cipherKey;
+    }
+
+    protected function getSecret(string $cipherKey): string
+    {
+        $key = !is_null($cipherKey) ? $cipherKey : $this->cipherKey;
+        return hash("sha256", $key, true);
+    }
+
+    public function encrypt(string $text, ?string $cipherKey = null): CryptoPayload
+    {
+        $secret = $this->getSecret($this->getCipherKey($cipherKey));
+        $iv = $this->getIV();
+        $encrypted = openssl_encrypt($text, self::CIPHER_ALGO, $secret, OPENSSL_RAW_DATA, $iv);
+        return new CryptoPayload($encrypted, $iv, self::CRYPTOR_ID);
+    }
+
+    public function decrypt(CryptoPayload $payload, ?string $cipherKey = null)
+    {
+        $text = $payload->getData();
+        $secret = $this->getSecret($this->getCipherKey($cipherKey));
+        $iv = $payload->getCryptorData();
+        $decrypted = openssl_decrypt($text, self::CIPHER_ALGO, $secret, OPENSSL_RAW_DATA, $iv);
+        $result = json_decode($decrypted);
+
+        if ($result === null) {
+            return $decrypted;
+        } else {
+            return $result;
+        }
+    }
+}

src/PubNub/Crypto/Cryptor.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace PubNub\Crypto;
+
+use PubNub\Crypto\Payload as CryptoPayload;
+
+abstract class Cryptor
+{
+    public const CRYPTOR_ID = null;
+
+    abstract public function encrypt(string $text, ?string $cipherKey = null): CryptoPayload;
+    abstract public function decrypt(CryptoPayload $payload, ?string $cipherKey = null);
+}

src/PubNub/Crypto/Header.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace PubNub\Crypto;
+
+class Header
+{
+    public const HEADER_VERSION = 1;
+    private string $sentinel;
+    private string $cryptorId;
+    private string $cryptorData;
+    private int $length;
+
+    public function __construct(
+        string $sentinel,
+        string $cryptorId,
+        string $cryptorData,
+        int $length
+    ) {
+        $this->sentinel = $sentinel;
+        $this->cryptorId = $cryptorId;
+        $this->cryptorData = $cryptorData;
+        $this->length = $length;
+    }
+
+    public function getSentinel(): string
+    {
+        return $this->sentinel;
+    }
+
+    public function getCryptorId(): string
+    {
+        return $this->cryptorId;
+    }
+
+    public function getCryptorData(): string
+    {
+        return $this->cryptorData;
+    }
+
+    public function getLength(): int
+    {
+        return $this->length;
+    }
+}

src/PubNub/Crypto/LegacyCryptor.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace PubNub\Crypto;
+
+use PubNub\Crypto\Cryptor;
+use PubNub\Exceptions\PubNubResponseParsingException;
+use PubNub\Crypto\PaddingTrait;
+
+class LegacyCryptor extends Cryptor
+{
+    use PaddingTrait;
+
+    public const CRYPTOR_ID = '0000';
+    public const IV_LENGTH = 16;
+    public const BLOCK_SIZE = 16;
+    public const CIPHER_ALGO = 'aes-256-cbc';
+    protected const STATIC_IV = '0123456789012345';
+
+    protected string $cipherKey;
+    protected bool $useRandomIV;
+
+    public function __construct(string $key, bool $useRandomIV)
+    {
+        $this->cipherKey = $key;
+        $this->useRandomIV = $useRandomIV;
+    }
+
+    public function getIV(): string
+    {
+        if (!$this->useRandomIV) {
+            return self::STATIC_IV;
+        }
+        return random_bytes(static::IV_LENGTH);
+    }
+
+    public function getCipherKey(): string
+    {
+        return $this->cipherKey;
+    }
+
+    public function encrypt(string $text, ?string $cipherKey = null): Payload
+    {
+        $iv = $this->getIV();
+        $shaCipherKey = substr(hash("sha256", $this->cipherKey), 0, 32);
+        $padded = $this->pad($text, self::BLOCK_SIZE);
+        $encrypted = openssl_encrypt($text, self::CIPHER_ALGO, $shaCipherKey, OPENSSL_RAW_DATA, $iv);
+        if ($this->useRandomIV) {
+            $encryptedWithIV = $iv . $encrypted;
+        } else {
+            $encryptedWithIV = $encrypted;
+        }
+        return new Payload($encryptedWithIV, '', self::CRYPTOR_ID);
+    }
+
+    public function decrypt(Payload $payload, ?string $cipherKey = null)
+    {
+        $text = $payload->getData();
+        if (strlen($text) === 0) {
+            throw new PubNubResponseParsingException("Decryption error: message is empty");
+        }
+
+        if (is_array($text)) {
+            if (array_key_exists("pn_other", $text)) {
+                $text = $text["pn_other"];
+            } else {
+                if (is_array($text)) {
+                    throw new PubNubResponseParsingException("Decryption error: message is not a string");
+                } else {
+                    throw new PubNubResponseParsingException("Decryption error: pn_other object key missing");
+                }
+            }
+        } elseif (!is_string($text)) {
+            throw new PubNubResponseParsingException("Decryption error: message is not a string or object");
+        }
+
+        $shaCipherKey = substr(hash("sha256", $this->cipherKey), 0, 32);
+
+        if ($this->useRandomIV) {
+            $iv = substr($text, 0, 16);
+            $data = substr($text, 16);
+        } else {
+            $iv = self::STATIC_IV;
+            $data = $text;
+        }
+        $decrypted = openssl_decrypt($data, 'aes-256-cbc', $shaCipherKey, OPENSSL_RAW_DATA, $iv);
+
+        if ($decrypted === false) {
+            throw new PubNubResponseParsingException("Decryption error: " . openssl_error_string());
+        }
+
+        $unPadded = $this->depad($decrypted, self::BLOCK_SIZE);
+
+        $result = json_decode($unPadded);
+
+        if ($result === null) {
+            return $unPadded;
+        } else {
+            return $result;
+        }
+    }
+}