[#2105] Hash session ID in the database (#2106)

mingsong-hu · Mingsong Hu · web-flow · commit cb25ac5ebc21 · 2024-05-28T10:42:14.000+02:00
* [#2105] Hash session ID in the database * Update hash data function for SQLStore --------- Co-authored-by: Mingsong Hu <mingsonghu@osb-macpro-v2nq.lan>
diff --git a/src/SimpleSAML/Store/SQLStore.php b/src/SimpleSAML/Store/SQLStore.php
@@ -8,7 +8,7 @@
 use PDO;
 use PDOException;
 use SimpleSAML\Assert\Assert;
-use SimpleSAML\{Configuration, Logger};
+use SimpleSAML\{Configuration, Logger, Utils};
 
 use function array_keys;
 use function count;
@@ -347,6 +347,10 @@ private function cleanKVStore(): void
      */
     public function get(string $type, string $key): mixed
     {
+        if ($type == 'session') {
+            $key = $this->hashData($key);
+        }
+
         if (strlen($key) > 50) {
             $key = sha1($key);
         }
@@ -393,6 +397,10 @@ public function set(string $type, string $key, mixed $value, ?int $expire = null
             $this->cleanKVStore();
         }
 
+        if ($type == 'session') {
+            $key = $this->hashData($key);
+        }
+
         if (strlen($key) > 50) {
             $key = sha1($key);
         }
@@ -423,6 +431,10 @@ public function set(string $type, string $key, mixed $value, ?int $expire = null
      */
     public function delete(string $type, string $key): void
     {
+        if ($type == 'session') {
+            $key = $this->hashData($key);
+        }
+
         if (strlen($key) > 50) {
             $key = sha1($key);
         }
@@ -436,4 +448,17 @@ public function delete(string $type, string $key): void
         $query = $this->pdo->prepare($query);
         $query->execute($data);
     }
+
+
+    /**
+     * Calculates an URL-safe sha-256 hash.
+     *
+     * @param string $data
+     * @return string The hashed data.
+     */
+    private function hashData(string $data): string
+    {
+        $secretSalt = (new Utils\Config())->getSecretSalt();
+        return hash_hmac('sha256', $data, $secretSalt);
+    }
 }
