paragonie / ciphersweet

Fast, searchable field-level encryption for PHP projects
https://ciphersweet.paragonie.com
Other
439 stars 32 forks source link

Binary::safeSubstr() does not support null #62

Closed lekoala closed 3 years ago

lekoala commented 3 years ago

Just ran into this minor issue

I'm passing an array from the database. It contains null values, something like

Array ( [ID] => 3 [Name] => demo3 [MyText] => (null) )

Using the row rotator, I get this error

TypeError: Argument 1 passed to ParagonIE\ConstantTime\Binary::safeSubstr() must be of the type string, null given, called in \vendor\paragonie\ciphersweet\src\Backend\BoringCrypto.php on line 108

\vendor\paragonie\constant_time_encoding\src\Binary.php:67 \vendor\paragonie\ciphersweet\src\Backend\BoringCrypto.php:108 \vendor\paragonie\ciphersweet\src\EncryptedRow.php:342 \vendor\paragonie\ciphersweet\src\KeyRotation\RowRotator.php:44

I'm wondering if this is the desired behavior, because having null values in array doesn't seem that strange. I fixed the issue in the meantime by replacing nulls by empty strings. Either safeSubstr could accept nulls and treat them as empty strings, or maybe a note should be added somewhere in the docs

paragonie-security commented 3 years ago

I'm wondering if this is the desired behavior, because having null values in array doesn't seem that strange.

It is, because Binary::safeSubstr() is a separate library that has no concept of arrays or databases and only deals with strictly typed strings.

That being said, making EncryptedRow handle NULLs more gracefully is worth fixing at the CipherSweet level.

lekoala commented 3 years ago

;-) wow that was fast

paragonie-security commented 3 years ago

Fixed in https://github.com/paragonie/ciphersweet/releases/tag/v3.0.1 :)