From 17c3c203f309f2d3170033708374d04eb77cb36b Mon Sep 17 00:00:00 2001 From: Gunnar Wrobel Date: Wed, 3 Nov 2010 17:32:53 +0100 Subject: [PATCH] Allow to create nonces. --- framework/Nonce/lib/Horde/Nonce.php | 38 ++++++++ framework/Nonce/package.xml | 105 +++++++++++++++++++++ framework/Nonce/test/Horde/Nonce/Autoload.php | 3 + .../test/Horde/Nonce/Integration/NonceTest.php | 47 +++++++++ framework/Nonce/test/Horde/Nonce/StoryTestCase.php | 93 ++++++++++++++++++ 5 files changed, 286 insertions(+) create mode 100644 framework/Nonce/package.xml create mode 100644 framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php create mode 100644 framework/Nonce/test/Horde/Nonce/StoryTestCase.php diff --git a/framework/Nonce/lib/Horde/Nonce.php b/framework/Nonce/lib/Horde/Nonce.php index b3d9bbc7f..836045ac7 100644 --- a/framework/Nonce/lib/Horde/Nonce.php +++ b/framework/Nonce/lib/Horde/Nonce.php @@ -1 +1,39 @@ + * @license http://www.fsf.org/copyleft/lgpl.html LGPL + * @link http://pear.horde.org/index.php?package=Nonce + */ + +/** + * The nonce handler. + * + * Copyright 2010 The Horde Project (http://www.horde.org/) + * + * See the enclosed file COPYING for license information (LGPL). If you + * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. + * + * @category Horde + * @package Nonce + * @author Gunnar Wrobel + * @license http://www.fsf.org/copyleft/lgpl.html LGPL + * @link http://pear.horde.org/index.php?package=Nonce + */ +class Horde_Nonce +{ + /** + * Return a nonce. + * + * @return string The nonce. + */ + public function get() + { + return pack('Nn2', time(), mt_rand(), mt_rand()); + } +} diff --git a/framework/Nonce/package.xml b/framework/Nonce/package.xml new file mode 100644 index 000000000..e4b54a113 --- /dev/null +++ b/framework/Nonce/package.xml @@ -0,0 +1,105 @@ + + + Nonce + pear.horde.org + Provides nonces (numbers used once) + Nonces (numbers used once) protect against reuse. They + can be used to disallow sending forms or using links twice. They can + can also be combined with tokens protecting against XSRF (though they + do not neccesarily provide any additional security in that + context). Generation of nonces is trivial but storage of used nonces + can be complex. This library relies primarily on modified Bloom + filters as suggested by Martin Schönert (who in turn refers to Robert + Floyd as the first one suggesting such an approach). + + Chuck Hagenbuch + chuck + chuck@horde.org + yes + + + Jan Schneider + jan + jan@horde.org + yes + + + Gunnar Wrobel + wrobel + wrobel@pardus.de + yes + + 2010-11-03 + + + 0.0.1 + 0.0.1 + + + alpha + alpha + + LGPL + +* Initial release. + + + + + + + + + + + + + + + + + + + + + + + + + + + 5.2.0 + + + 1.9.0 + + + + + + + + + + + + + + + + + 0.0.1 + 0.0.1 + + + alpha + alpha + + 2010-11-03 + LGPL + +* Initial release. + + + + diff --git a/framework/Nonce/test/Horde/Nonce/Autoload.php b/framework/Nonce/test/Horde/Nonce/Autoload.php index 47545d441..09f45122c 100644 --- a/framework/Nonce/test/Horde/Nonce/Autoload.php +++ b/framework/Nonce/test/Horde/Nonce/Autoload.php @@ -21,3 +21,6 @@ require_once 'Horde/Test/Autoload.php'; /** Catch strict standards */ error_reporting(E_ALL | E_STRICT); + +/** Load the basic test definition */ +require_once dirname(__FILE__) . '/StoryTestCase.php'; diff --git a/framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php b/framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php new file mode 100644 index 000000000..31f385cf7 --- /dev/null +++ b/framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php @@ -0,0 +1,47 @@ + + * @license http://www.fsf.org/copyleft/lgpl.html LGPL + * @link http://pear.horde.org/index.php?package=Nonce + */ + +/** + * Prepare the test setup. + */ +require_once dirname(__FILE__) . '/../Autoload.php'; + +/** + * Test the Nonce system. + * + * Copyright 2010 The Horde Project (http://www.horde.org/) + * + * See the enclosed file COPYING for license information (LGPL). If you + * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. + * + * @category Horde + * @package Nonce + * @subpackage UnitTests + * @author Gunnar Wrobel + * @license http://www.fsf.org/copyleft/lgpl.html LGPL + * @link http://pear.horde.org/index.php?package=Nonce + */ +class Horde_Nonce_Integration_NonceTest +extends Horde_Nonce_StoryTestCase +{ + /** + * @scenario + */ + public function aDefaultNonceHasADefinedLengthOf() + { + $this->given('the default nonce setup') + ->when('retrieving a nonce') + ->then('the nonce has a length of 8 bytes'); + } +} \ No newline at end of file diff --git a/framework/Nonce/test/Horde/Nonce/StoryTestCase.php b/framework/Nonce/test/Horde/Nonce/StoryTestCase.php new file mode 100644 index 000000000..12cb12dc7 --- /dev/null +++ b/framework/Nonce/test/Horde/Nonce/StoryTestCase.php @@ -0,0 +1,93 @@ + + * @license http://www.fsf.org/copyleft/lgpl.html LGPL + * @link http://pear.horde.org/index.php?package=Nonce + */ + +/** + * Base for story based package testing. + * + * Copyright 2010 The Horde Project (http://www.horde.org/) + * + * See the enclosed file COPYING for license information (LGPL). If you + * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. + * + * @category Horde + * @package Nonce + * @subpackage UnitTests + * @author Gunnar Wrobel + * @license http://www.fsf.org/copyleft/lgpl.html LGPL + * @link http://pear.horde.org/index.php?package=Nonce + */ +class Horde_Nonce_StoryTestCase +extends PHPUnit_Extensions_Story_TestCase +{ + /** + * Handle a "given" step. + * + * @param array &$world Joined "world" of variables. + * @param string $action The description of the step. + * @param array $arguments Additional arguments to the step. + * + * @return mixed The outcome of the step. + */ + public function runGiven(&$world, $action, $arguments) + { + switch($action) { + case 'the default nonce setup': + $world['nonce_handler'] = new Horde_Nonce(); + break; + default: + return $this->notImplemented($action); + } + } + + /** + * Handle a "when" step. + * + * @param array &$world Joined "world" of variables. + * @param string $action The description of the step. + * @param array $arguments Additional arguments to the step. + * + * @return mixed The outcome of the step. + */ + public function runWhen(&$world, $action, $arguments) + { + switch($action) { + case 'retrieving a nonce': + $world['nonce'] = $world['nonce_handler']->get(); + break; + default: + return $this->notImplemented($action); + } + } + + /** + * Handle a "then" step. + * + * @param array &$world Joined "world" of variables. + * @param string $action The description of the step. + * @param array $arguments Additional arguments to the step. + * + * @return mixed The outcome of the step. + */ + public function runThen(&$world, $action, $arguments) + { + switch($action) { + case 'the nonce has a length of 8 bytes': + $this->assertEquals(8, strlen($world['nonce'])); + break; + default: + return $this->notImplemented($action); + } + } + +} \ No newline at end of file -- 2.11.0