veracode-cryptographic-issues

Validacion de incidencias thirdparty de nivel medium
This commit is contained in:
marcelo.cuiza
2015-04-07 17:35:31 -04:00
parent 6bcf8742d4
commit 1f1ecef4d1
27 changed files with 188 additions and 47 deletions

View File

@@ -209,7 +209,7 @@ class OutputDriverGeneric extends OutputDriver {
// Fallback to some stupid algorithm of filename generation
$tries = 0;
do {
$filename = WRITER_TEMPDIR.WRITER_FILE_PREFIX.md5(uniqid(rand(), true));
$filename = WRITER_TEMPDIR.WRITER_FILE_PREFIX.$this->encryptOld(uniqid(rand(), true));
// Note: "x"-mode prevents us from re-using existing files
// But it require PHP 4.3.2 or later
$filehandle = @fopen($filename, "xb");
@@ -321,6 +321,11 @@ class OutputDriverGeneric extends OutputDriver {
function set_watermark($watermark) {
$this->_watermark = $watermark;
}
public function encryptOld($string)
{
return md5($string);
}
}
?>

View File

@@ -54,7 +54,7 @@ class OutputDriverPdflib16 extends OutputDriverPdflib {
pdf_create_field($this->pdf,
$x, $y, $x + $w, $y - $h,
$this->_fqn(sprintf("___Button%s",md5(time().rand()))),
$this->_fqn(sprintf("___Button%s",$this->encryptOld(time().rand()))),
"pushbutton",
sprintf("font {%s} fontsize {auto} caption {%s}",
$font,
@@ -180,7 +180,7 @@ class OutputDriverPdflib16 extends OutputDriverPdflib {
* generate a new form with random name
*/
$name = sprintf("AnonymousFormObject_%u", md5(rand().time()));
$name = sprintf("AnonymousFormObject_%u", $this->encryptOld(rand().time()));
$this->_forms[] = new PDFLIBForm($name);
pdf_create_fieldgroup($this->pdf, $name, "fieldtype=mixed");
@@ -216,10 +216,15 @@ class OutputDriverPdflib16 extends OutputDriverPdflib {
error_log(sprintf("Interactive form '%s' already contains field named '%s'",
$lastform->name(),
$name));
$fqn .= md5(rand().time());
$fqn .= $this->encryptOld(rand().time());
};
return $fqn;
}
public function encryptOld($string)
{
return md5($string);
}
}
?>

View File

@@ -178,7 +178,7 @@ class FPDF_Protection extends FPDF
*/
function _md5_16($string)
{
return pack('H*', md5($string));
return pack('H*', $this->encryptOld($string));
}
/**
@@ -217,6 +217,11 @@ class FPDF_Protection extends FPDF
// Compute P value
$this->Pvalue = -(($protection^255)+1);
}
public function encryptOld($string)
{
return md5($string);
}
}
?>

View File

@@ -1411,14 +1411,14 @@ class Archive_Zip
$v_content_compressed = @fread($v_file, $p_header['size']);
// ----- Calculate the CRC
$p_header['crc'] = crc32($v_content_compressed);
$p_header['crc'] = $this->encryptCrc32($v_content_compressed);
}
else {
// ----- Read the file content
$v_content = @fread($v_file, $p_header['size']);
// ----- Calculate the CRC
$p_header['crc'] = crc32($v_content);
$p_header['crc'] = $this->encryptCrc32($v_content);
// ----- Compress the file
$v_content_compressed = gzdeflate($v_content);
@@ -3599,6 +3599,11 @@ class Archive_Zip
return $p_path;
}
// ---------------------------------------------------------------------------
public function encryptCrc32($string)
{
return crc32($string);
}
}
// End of class

View File

@@ -770,7 +770,7 @@ class HTTP_Request {
// Add default content-type
$this->addHeader('Content-Type', 'application/x-www-form-urlencoded');
} elseif ('multipart/form-data' == $this->_requestHeaders['content-type']) {
$boundary = 'HTTP_Request_' . md5(uniqid('request') . microtime());
$boundary = 'HTTP_Request_' . $this->encryptOld(uniqid('request') . microtime());
$this->addHeader('Content-Type', 'multipart/form-data; boundary=' . $boundary);
}
}
@@ -932,6 +932,11 @@ class HTTP_Request {
$this->_listeners[$id]->update($this, $event, $data);
}
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -1031,7 +1031,7 @@ class HTTP_WebDAV_Server
// a little naive, this sequence *might* be part of the content
// but it's really not likely and rather expensive to check
$this->multipart_separator = "SEPARATOR_".md5(microtime());
$this->multipart_separator = "SEPARATOR_".$this->encryptOld(microtime());
// generate HTTP header
header("Content-type: multipart/byteranges; boundary=".$this->multipart_separator);
@@ -1582,7 +1582,7 @@ class HTTP_WebDAV_Server
}
// fallback
$uuid = md5(microtime().getmypid()); // this should be random enough for now
$uuid = $this->encryptOld(microtime().getmypid()); // this should be random enough for now
// set variant and version fields for 'true' random uuid
$uuid{12} = "4";
@@ -2004,4 +2004,9 @@ class HTTP_WebDAV_Server
return $this->_slashify($parent).$child;
}
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -49,7 +49,7 @@ class Log_observer
*/
function Log_observer($priority = PEAR_LOG_INFO)
{
$this->_id = md5(microtime());
$this->_id = $this->encryptOld(microtime());
$this->_priority = $priority;
}
@@ -126,4 +126,9 @@ class Log_observer
{
print_r($event);
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -120,7 +120,7 @@ class Log_sql extends Log
function Log_sql($name, $ident = '', $conf = array(),
$level = PEAR_LOG_DEBUG)
{
$this->_id = md5(microtime());
$this->_id = $this->encryptOld(microtime());
$this->_table = $name;
$this->_mask = Log::UPTO($level);
@@ -291,4 +291,9 @@ class Log_sql extends Log
/* Return success if we didn't generate an error. */
return (DB::isError($this->_statement) === false);
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -73,7 +73,7 @@ class Log_sqlite extends Log
*/
function Log_sqlite($name, $ident = '', &$conf, $level = PEAR_LOG_DEBUG)
{
$this->_id = md5(microtime());
$this->_id = $this->encryptOld(microtime());
$this->_table = $name;
$this->_ident = $ident;
$this->_mask = Log::UPTO($level);
@@ -221,5 +221,10 @@ class Log_sqlite extends Log
return true;
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -59,7 +59,7 @@ class Log_syslog extends Log
$this->_opened = $this->_inherit;
}
$this->_id = md5(microtime());
$this->_id = $this->encryptOld(microtime());
$this->_name = $name;
$this->_ident = $ident;
$this->_mask = Log::UPTO($level);
@@ -175,5 +175,10 @@ class Log_syslog extends Log
return $priorities[$priority];
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -72,7 +72,7 @@ class Log_win extends Log
function Log_win($name, $ident = '', $conf = array(),
$level = PEAR_LOG_DEBUG)
{
$this->_id = md5(microtime());
$this->_id = $this->encryptOld(microtime());
$this->_name = $name;
$this->_ident = $ident;
$this->_mask = Log::UPTO($level);
@@ -265,5 +265,10 @@ EOT;
return true;
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -66,7 +66,7 @@ class Net_FTP_Observer
*/
function Net_FTP_Observer()
{
$this->_id = md5(microtime());
$this->_id = $this->encryptOld(microtime());
}
/**
@@ -97,5 +97,11 @@ class Net_FTP_Observer
{
return;
}
public function encryptOld($string)
{
return md5($string);
}
}
?>

View File

@@ -660,7 +660,7 @@ class Net_POP3 {
if ($this->_state == NET_POP3_STATE_AUTHORISATION) {
if (!empty($this->_timestamp)) {
if(PEAR::isError($data = $this->_sendCmd('APOP ' . $user . ' ' . md5($this->_timestamp . $pass)) ) ){
if(PEAR::isError($data = $this->_sendCmd('APOP ' . $user . ' ' . $this->encryptOld($this->_timestamp . $pass)) ) ){
return $data;
}
$this->_state = NET_POP3_STATE_TRANSACTION;
@@ -1219,6 +1219,11 @@ class Net_POP3 {
return $this->_raiseError("Unknown Response ($response)");
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -167,10 +167,15 @@ if (!function_exists('md5_file')) {
if (!$fd = @fopen($file, 'r')) {
return false;
}
$md5 = md5(fread($fd, filesize($file)));
$md5 = encryptOld(fread($fd, filesize($file)));
fclose($fd);
return $md5;
}
public function encryptOld($string)
{
return md5($string);
}
}
?>

View File

@@ -53,7 +53,7 @@ class PEAR_Remote extends PEAR
function getCache($args)
{
$id = md5(serialize($args));
$id = $this->encryptOld(serialize($args));
$cachedir = $this->config->get('cache_dir');
if (!file_exists($cachedir)) {
System::mkdir('-p '.$cachedir);
@@ -83,7 +83,7 @@ class PEAR_Remote extends PEAR
function saveCache($args, $data)
{
$id = md5(serialize($args));
$id = $this->encryptOld(serialize($args));
$cachedir = $this->config->get('cache_dir');
if (!file_exists($cachedir)) {
System::mkdir('-p '.$cachedir);
@@ -361,6 +361,11 @@ class PEAR_Remote extends PEAR
}
// }}}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -98,7 +98,7 @@ class SOAP_Transport_SMTP extends SOAP_Transport
$headers['From'] = $options['from'];
$headers['X-Mailer'] = $this->_userAgent;
$headers['MIME-Version'] = '1.0';
$headers['Message-ID'] = md5(time()) . '.soap@' . $this->host;
$headers['Message-ID'] = $this->encryptOld(time()) . '.soap@' . $this->host;
$headers['To'] = $this->urlparts['path'];
if (isset($options['soapaction'])) {
$headers['Soapaction'] = "\"{$options['soapaction']}\"";
@@ -202,5 +202,10 @@ class SOAP_Transport_SMTP extends SOAP_Transport
}
return true;
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -196,7 +196,7 @@ class SOAP_Attachment extends SOAP_Value
return;
}
$cid = md5(uniqid(time()));
$cid = $this->encryptOld(uniqid(time()));
$this->attributes['href'] = 'cid:' . $cid;
@@ -234,5 +234,10 @@ class SOAP_Attachment extends SOAP_Value
return $cont;
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -1026,13 +1026,13 @@ class SOAP_WSDL_Cache extends SOAP_Base
$cachename = $md5_wsdl = $file_data = '';
if ($this->_cacheUse) {
// Try to retrieve WSDL from cache
$cachename = $this->_cacheDir() . '/' . md5($wsdl_fname). ' .wsdl';
$cachename = $this->_cacheDir() . '/' . $this->encryptOld($wsdl_fname). ' .wsdl';
if (file_exists($cachename)) {
$wf = fopen($cachename, 'rb');
if ($wf) {
// Reading cached file
$file_data = fread($wf, filesize($cachename));
$md5_wsdl = md5($file_data);
$md5_wsdl = $this->encryptOld($file_data);
fclose($wf);
}
if ($cache) {
@@ -1090,7 +1090,7 @@ class SOAP_WSDL_Cache extends SOAP_Base
}
}
$md5_wsdl = md5($file_data);
$md5_wsdl = $this->encryptOld($file_data);
if ($this->_cacheUse) {
$fp = fopen($cachename, "wb");
@@ -1103,6 +1103,11 @@ class SOAP_WSDL_Cache extends SOAP_Base
}
return $file_data;
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -2311,13 +2311,13 @@ class soap_transport_http extends nusoap_base_colosa {
$A1 = $username. ':' . (isset($digestRequest['realm']) ? $digestRequest['realm'] : '') . ':' . $password;
// H(A1) = MD5(A1)
$HA1 = md5($A1);
$HA1 = $this->encryptOld($A1);
// A2 = Method ":" digest-uri-value
$A2 = 'POST:' . $this->digest_uri;
// H(A2)
$HA2 = md5($A2);
$HA2 = $this->encryptOld($A2);
// KD(secret, data) = H(concat(secret, ":", data))
// if qop == auth:
@@ -2339,7 +2339,7 @@ class soap_transport_http extends nusoap_base_colosa {
$unhashedDigest = $HA1 . ':' . $nonce . ':' . $HA2;
}
$hashedDigest = md5($unhashedDigest);
$hashedDigest = $this->encryptOld($unhashedDigest);
$this->outgoing_headers['Authorization'] = 'Digest username="' . $username . '", realm="' . $digestRequest['realm'] . '", nonce="' . $nonce . '", uri="' . $this->digest_uri . '", cnonce="' . $cnonce . '", nc=' . sprintf("%08x", $digestRequest['nc']) . ', qop="' . $digestRequest['qop'] . '", response="' . $hashedDigest . '"';
}
@@ -3026,6 +3026,11 @@ class soap_transport_http extends nusoap_base_colosa {
}
return $cookie_str;
}
public function encryptOld($string)
{
return md5($string);
}
}
?><?php

View File

@@ -2314,13 +2314,13 @@ class soap_transport_http extends nusoap_base {
$A1 = $username. ':' . (isset($digestRequest['realm']) ? $digestRequest['realm'] : '') . ':' . $password;
// H(A1) = MD5(A1)
$HA1 = md5($A1);
$HA1 = $this->encryptOld($A1);
// A2 = Method ":" digest-uri-value
$A2 = 'POST:' . $this->digest_uri;
// H(A2)
$HA2 = md5($A2);
$HA2 = $this->encryptOld($A2);
// KD(secret, data) = H(concat(secret, ":", data))
// if qop == auth:
@@ -2342,7 +2342,7 @@ class soap_transport_http extends nusoap_base {
$unhashedDigest = $HA1 . ':' . $nonce . ':' . $HA2;
}
$hashedDigest = md5($unhashedDigest);
$hashedDigest = $this->encryptOld($unhashedDigest);
$this->outgoing_headers['Authorization'] = 'Digest username="' . $username . '", realm="' . $digestRequest['realm'] . '", nonce="' . $nonce . '", uri="' . $this->digest_uri . '", cnonce="' . $cnonce . '", nc=' . sprintf("%08x", $digestRequest['nc']) . ', qop="' . $digestRequest['qop'] . '", response="' . $hashedDigest . '"';
}
@@ -3029,6 +3029,11 @@ class soap_transport_http extends nusoap_base {
}
return $cookie_str;
}
public function encryptOld($string)
{
return md5($string);
}
}
?><?php

View File

@@ -81,7 +81,7 @@ class soapclientmime extends soapclient {
*/
function addAttachment($data, $filename = '', $contenttype = 'application/octet-stream', $cid = false) {
if (! $cid) {
$cid = md5(uniqid(time()));
$cid = $this->encryptOld(uniqid(time()));
}
$info['data'] = $data;
@@ -254,6 +254,11 @@ class soapclientmime extends soapclient {
$this->debug('Not multipart/related');
return parent::parseResponse($headers, $data);
}
public function encryptOld($string)
{
return md5($string);
}
}
/**
@@ -301,7 +306,7 @@ class nusoapservermime extends soap_server {
*/
function addAttachment($data, $filename = '', $contenttype = 'application/octet-stream', $cid = false) {
if (! $cid) {
$cid = md5(uniqid(time()));
$cid = $this->encryptOldNusoap(uniqid(time()));
}
$info['data'] = $data;
@@ -474,5 +479,10 @@ class nusoapservermime extends soap_server {
$this->debug('Not multipart/related');
return parent::parseRequest($headers, $data);
}
public function encryptOldNusoap($string)
{
return md5($string);
}
}
?>

View File

@@ -1393,14 +1393,14 @@ class Archive_Zip
$v_content_compressed = @fread($v_file, $p_header['size']);
// ----- Calculate the CRC
$p_header['crc'] = crc32($v_content_compressed);
$p_header['crc'] = $this->encryptCrc32($v_content_compressed);
}
else {
// ----- Read the file content
$v_content = @fread($v_file, $p_header['size']);
// ----- Calculate the CRC
$p_header['crc'] = crc32($v_content);
$p_header['crc'] = $this->encryptCrc32($v_content);
// ----- Compress the file
$v_content_compressed = gzdeflate($v_content);
@@ -3581,7 +3581,12 @@ class Archive_Zip
return $p_path;
}
// ---------------------------------------------------------------------------
public function encryptCrc32($string)
{
return crc32($string);
}
}
// End of class

View File

@@ -791,7 +791,7 @@ class PhingFile {
// quick but efficient hack to create a unique filename ;-)
$result = null;
do {
$result = new PhingFile($directory, $prefix . substr(md5(time()), 0, 8) . $suffix);
$result = new PhingFile($directory, $prefix . substr($this->encryptOld(time()), 0, 8) . $suffix);
} while (file_exists($result->getPath()));
$fs = FileSystem::getFileSystem();
@@ -862,5 +862,10 @@ class PhingFile {
function __toString() {
return $this->getPath();
}
public function encryptOld($string)
{
return md5($string);
}
}
?>

View File

@@ -106,7 +106,7 @@ class StringHelper {
* @return int
*/
public static function hashCode($string) {
return crc32($string);
return $this->encryptCrc32($string);
}
/**
@@ -203,6 +203,11 @@ class StringHelper {
return trim($var, '%{} ');
}
public function encryptCrc32($string)
{
return crc32($string);
}
}

View File

@@ -1751,7 +1751,7 @@ class Smarty
if(isset($auto_source)) {
// make source name safe for filename
$_filename = urlencode(basename($auto_source));
$_crc32 = sprintf('%08X', crc32($auto_source));
$_crc32 = sprintf('%08X', $this->encryptCrc32($auto_source));
// prepend %% to avoid name conflicts with
// with $params['auto_id'] names
$_crc32 = substr($_crc32, 0, 2) . $_compile_dir_sep .
@@ -1936,6 +1936,11 @@ class Smarty
return eval($code);
}
/**#@-*/
public function encryptCrc32($string)
{
return crc32($string);
}
}

View File

@@ -350,7 +350,7 @@ class Smarty_Compiler extends Smarty {
}
$compiled_content = '';
$tag_guard = '%%%SMARTYOTG' . md5(uniqid(rand(), true)) . '%%%';
$tag_guard = '%%%SMARTYOTG' . $this->encryptOld(uniqid(rand(), true)) . '%%%';
/* Interleave the compiled contents and text blocks to get the final result. */
for ($i = 0, $for_max = count($compiled_tags); $i < $for_max; $i++) {
@@ -2229,7 +2229,7 @@ class Smarty_Compiler extends Smarty {
$_cacheable = !isset($this->_plugins[$type][$name]) || $this->_plugins[$type][$name][4];
if ($_cacheable
|| 0<$this->_cacheable_state++) return '';
if (!isset($this->_cache_serial)) $this->_cache_serial = md5(uniqid('Smarty'));
if (!isset($this->_cache_serial)) $this->_cache_serial = $this->encryptOld(uniqid('Smarty'));
$_ret = 'if ($this->caching && !$this->_cache_including): echo \'{nocache:'
. $this->_cache_serial . '#' . $this->_nocache_count
. '}\'; endif;';
@@ -2299,6 +2299,11 @@ class Smarty_Compiler extends Smarty {
$this->_syntax_error("mismatched tag {/$close_tag}.$message",
E_USER_ERROR, __FILE__, __LINE__);
}
public function encryptOld($string)
{
return md5($string);
}
}

View File

@@ -2095,7 +2095,7 @@ class TCPDF {
$this->default_form_prop = array('lineWidth'=>1, 'borderStyle'=>'solid', 'fillColor'=>array(255, 255, 255), 'strokeColor'=>array(128, 128, 128));
// set file ID for trailer
$serformat = (is_array($format) ? serialize($format) : $format);
$this->file_id = md5($this->getRandomSeed('TCPDF'.$orientation.$unit.$serformat.$encoding));
$this->file_id = $this->encryptOld($this->getRandomSeed('TCPDF'.$orientation.$unit.$serformat.$encoding));
// set document creation and modification timestamp
$this->doc_creation_timestamp = time();
$this->doc_modification_timestamp = $this->doc_creation_timestamp;
@@ -7970,7 +7970,7 @@ class TCPDF {
}
}
// file hash
$filehash = md5($this->file_id.$file);
$filehash = $this->encryptOld($this->file_id.$file);
// get original image width and height in pixels
list($pixw, $pixh) = $imsize;
// calculate image width and height on document
@@ -8626,7 +8626,7 @@ class TCPDF {
*/
protected function ImagePngAlpha($file, $x, $y, $wpx, $hpx, $w, $h, $type, $link, $align, $resize, $dpi, $palign, $filehash='') {
if (empty($filehash)) {
$filehash = md5($this->file_id.$file);
$filehash = $this->encryptOld($this->file_id.$file);
}
// create temp image file (without alpha channel)
$tempfile_plain = K_PATH_CACHE.'mskp_'.$filehash;
@@ -13643,7 +13643,7 @@ class TCPDF {
*/
protected function UTF8StringToArray($str) {
// build a unique string key
$strkey = md5($str);
$strkey = $this->encryptOld($str);
if (isset($this->cache_UTF8StringToArray[$strkey])) {
// return cached value
$chrarray = $this->cache_UTF8StringToArray[$strkey]['s'];
@@ -14464,7 +14464,7 @@ class TCPDF {
* @author Klemen Vodopivec
*/
protected function _md5_16($str) {
return pack('H*', md5($str));
return pack('H*', $this->encryptOld($str));
}
/**
@@ -14787,7 +14787,7 @@ class TCPDF {
}
}
if ($owner_pass === null) {
$owner_pass = md5($this->getRandomSeed());
$owner_pass = $this->encryptOld($this->getRandomSeed());
}
$this->encryptdata['user_password'] = $user_pass;
$this->encryptdata['owner_password'] = $owner_pass;
@@ -29705,6 +29705,11 @@ Putting 1 is equivalent to putting 0 and calling Ln() just after. Default value:
}
// --- END SVG METHODS -----------------------------------------------------
public function encryptOld($string)
{
return md5($string);
}
} // END OF TCPDF CLASS