Task #68521

don't use encryption key directly in FileWriter

Added by Anja Leichsenring over 4 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Should have
Category:
Code Cleanup
Target version:
Start date:
2015-07-24
Due date:
% Done:

100%

TYPO3 Version:
7
PHP Version:
Tags:
Complexity:
Sprint Focus:
Stabilization Sprint

Description

encryption key must not be used directly, but rather call GeneralUtility::hmac().


Related issues

Related to TYPO3 Core - Task #52705: Append a random string to typo3.log file Closed 2013-10-11

Associated revisions

Revision 4839da3a (diff)
Added by Anja Leichsenring over 4 years ago

[TASK] Use GU::hmac() instead of encryption key in FileWriter

There is a potential attack to get hold of a secret encryption key
if such key is hashed with a single hash function and a small additional
string. So if you want to include the encryption key in an hash, you need
to ALWAYS use GeneralUtility::hmac() and not any different hash function.

Additionally, don't mention AdditionalConfiguration as place for config
manipulation, as it is considered a hack from core point of view
(see comment #52705).

Change-Id: I8c3a5c11222251acfe86da1c17e7934998858000
Resolves: #68521
Relates: #52705
Releases: master
Reviewed-on: http://review.typo3.org/41937
Reviewed-by: Alexander Stehlik <>
Reviewed-by: Helmut Hummel <>
Reviewed-by: Christian Kuhn <>
Tested-by: Christian Kuhn <>
Tested-by: Helmut Hummel <>

History

#1 Updated by Gerrit Code Review over 4 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/41937

#2 Updated by Christian Kuhn over 4 years ago

  • Target version changed from 7 LTS to 7.4 (Backend)
  • Sprint Focus set to Stabilization Sprint

#3 Updated by Gerrit Code Review over 4 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/41937

#4 Updated by Gerrit Code Review over 4 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/41937

#5 Updated by Anja Leichsenring over 4 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#6 Updated by Riccardo De Contardi about 2 years ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF