-
Notifications
You must be signed in to change notification settings - Fork 59
Open
Description
The method is:
/**
* Generates an HMAC-SHA1 signature.
*/
private function hmacsha1(string $key, string $message): string
{
if (function_exists('hash_hmac')) {
return hash_hmac('sha1', $message, $key, true);
}
$blocksize = 64;
if (strlen($key) > $blocksize) {
$key = pack('H*', sha1($key));
}
$key = str_pad($key, $blocksize, chr(0x00));
$ipad = str_repeat(chr(0x36), $blocksize);
$opad = str_repeat(chr(0x5C), $blocksize);
$hmac = pack('H*', sha1(($key ^ $opad).pack('H*', sha1(($key ^ $ipad).$message))));
return $hmac;
}
IMO https://www.php.net/manual/en/function.hash-hmac.php exists in CI, and so it is used, and the subsequent code that has a "manual" implementation of hash_hmac never gets run during the unit tests.
https://www.php.net/manual/en/hash.installation.php
"As of PHP 7.4.0, the Hash extension is a core PHP extension, so it is always enabled."
So, IMO, we can remove the function_exists check, and the "manual" implementation, and just directly call hash_hmac
staabm and DeepDiver1975
Metadata
Metadata
Assignees
Labels
No labels