more fixes for decrypting bad data

Crowdstar · Nov 4, 2021 · b46b6fe · b46b6fe
1 parent e503da3
commit b46b6fe
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 2 deletions.
diff --git a/src/Crypt.php b/src/Crypt.php
@@ -19,6 +19,7 @@
 
 namespace CrowdStar\Crypt;
 
+use LengthException;
 use phpseclib3\Crypt\AES;
 use phpseclib3\Exception\BadDecryptionException;
 
@@ -64,11 +65,16 @@ public function decrypt(string $encodedData, int $ivLength = self::DEFAULT_IV_LE
         $iv         = substr($data, -$ivLength);
         $cipherText = substr($data, 0, -$ivLength);
         $aesCrypt   = $this->getAesCrypt();
-        $aesCrypt->setIV($iv);
+
+        try {
+            $aesCrypt->setIV($iv);
+        } catch (LengthException $e) {
+            return '';
+        }
 
         try {
             return $aesCrypt->decrypt($cipherText);
-        } catch (BadDecryptionException $e) {
+        } catch (BadDecryptionException|LengthException $e) {
             return '';
         }
     }

diff --git a/tests/unit/CryptTest.php b/tests/unit/CryptTest.php
@@ -73,6 +73,31 @@ public function testEncryption(int $expectedLength, string $data, string $key, s
     public function dataDecryption(): array
     {
         return [
+            [
+                '',
+                '',
+                self::TEST_KEY1,
+                'Decrypt an empty string.',
+            ],
+            [
+                '',
+                'invalid-key',
+                self::TEST_KEY1,
+                'Decrypt a invalid base64-encoded string.',
+            ],
+            [
+                '',
+                'YQ==',
+                self::TEST_KEY1,
+                'Decrypt a short string (a bad encrypted string; base64-encoded).',
+            ],
+            [
+                '',
+                'OGs3emdkaTlqd3ltMmh6Y21ubjJqMmp5Y25sMDU1ZHhsOWNod2poZWU3MG8=',
+                self::TEST_KEY1,
+                'Decrypt a long string "8k7zgdi9jwym2hzcmnn2j2jycnl055dxl9chwjhee70o" (a bad encrypted string; base64-encoded).',
+            ],
+
             [
                 self::TEST_DATA,
                 'Btpxr9R00y2/69lseobzCPCv95ru0yvbN2tzGZphmqs=',