feat(log): Add support for \SensitiveParameter attribute

apps/encryption/lib/Controller/RecoveryController.php

@@ -29,7 +29,13 @@ public function __construct(
 		parent::__construct($appName, $request);
 	}
 
-	public function adminRecovery(string $recoveryPassword, string $confirmPassword, bool $adminEnableRecovery): DataResponse {
+	public function adminRecovery(
+		#[\SensitiveParameter]
+		string $recoveryPassword,
+		#[\SensitiveParameter]
+		string $confirmPassword,
+		bool $adminEnableRecovery,
+	): DataResponse {
 		// Check if both passwords are the same
 		if (empty($recoveryPassword)) {
 			$errorMessage = $this->l->t('Missing recovery key password');
@@ -70,7 +76,14 @@ public function adminRecovery(string $recoveryPassword, string $confirmPassword,
 		}
 	}
 
-	public function changeRecoveryPassword(string $newPassword, string $oldPassword, string $confirmPassword): DataResponse {
+	public function changeRecoveryPassword(
+		#[\SensitiveParameter]
+		string $newPassword,
+		#[\SensitiveParameter]
+		string $oldPassword,
+		#[\SensitiveParameter]
+		string $confirmPassword,
+	): DataResponse {
 		//check if both passwords are the same
 		if (empty($oldPassword)) {
 			$errorMessage = $this->l->t('Please provide the old recovery password');

apps/encryption/lib/Controller/SettingsController.php

@@ -53,14 +53,14 @@ public function __construct(
 		parent::__construct($appName, $request);
 	}
 
-	/**
-	 * @param string $oldPassword
-	 * @param string $newPassword
-	 * @return DataResponse
-	 */
 	#[NoAdminRequired]
 	#[UseSession]
-	public function updatePrivateKeyPassword($oldPassword, $newPassword) {
+	public function updatePrivateKeyPassword(
+		#[\SensitiveParameter]
+		string $oldPassword,
+		#[\SensitiveParameter]
+		string $newPassword,
+	): DataResponse {
 		$result = false;
 		$uid = $this->userSession->getUser()->getUID();
 		$errorMessage = $this->l->t('Could not update the private key password.');

apps/encryption/lib/Crypto/Crypt.php

@@ -141,7 +141,14 @@ private function getOpenSSLConfig(): array {
 	/**
 	 * @throws EncryptionFailedException
 	 */
-	public function symmetricEncryptFileContent(string $plainContent, string $passPhrase, int $version, string $position): string|false {
+	public function symmetricEncryptFileContent(
+		#[\SensitiveParameter]
+		string $plainContent,
+		#[\SensitiveParameter]
+		string $passPhrase,
+		int $version,
+		string $position,
+	): string|false {
 		if (!$plainContent) {
 			$this->logger->error('Encryption Library, symmetrical encryption failed no content given',
 				['app' => 'encryption']);
@@ -192,7 +199,15 @@ public function generateHeader($keyFormat = self::DEFAULT_KEY_FORMAT) {
 	/**
 	 * @throws EncryptionFailedException
 	 */
-	private function encrypt(string $plainContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER): string {
+	private function encrypt(
+		#[\SensitiveParameter]
+		string $plainContent,
+		#[\SensitiveParameter]
+		string $iv,
+		#[\SensitiveParameter]
+		string $passPhrase = '',
+		string $cipher = self::DEFAULT_CIPHER,
+	): string {
 		$options = $this->useLegacyBase64Encoding ? 0 : OPENSSL_RAW_DATA;
 		$encryptedContent = openssl_encrypt($plainContent,
 			$cipher,
@@ -302,7 +317,14 @@ private function addPadding(string $data): string {
 	 *
 	 * @param string $uid only used for user keys
 	 */
-	protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
+	protected function generatePasswordHash(
+		#[\SensitiveParameter]
+		string $password,
+		#[\SensitiveParameter]
+		string $cipher,
+		string $uid = '',
+		int $iterations = 600000,
+	): string {
 		$instanceId = $this->config->getSystemValue('instanceid');
 		$instanceSecret = $this->config->getSystemValue('secret');
 		$salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
@@ -321,12 +343,15 @@ protected function generatePasswordHash(string $password, string $cipher, string
 	/**
 	 * encrypt private key
 	 *
-	 * @param string $privateKey
-	 * @param string $password
 	 * @param string $uid for regular users, empty for system keys
-	 * @return false|string
 	 */
-	public function encryptPrivateKey($privateKey, $password, $uid = '') {
+	public function encryptPrivateKey(
+		#[\SensitiveParameter]
+		string $privateKey,
+		#[\SensitiveParameter]
+		string $password,
+		string $uid = '',
+	): string|false {
 		$cipher = $this->getCipher();
 		$hash = $this->generatePasswordHash($password, $cipher, $uid);
 		$encryptedKey = $this->symmetricEncryptFileContent(
@@ -340,11 +365,15 @@ public function encryptPrivateKey($privateKey, $password, $uid = '') {
 	}
 
 	/**
-	 * @param string $privateKey
-	 * @param string $password
 	 * @param string $uid for regular users, empty for system keys
 	 */
-	public function decryptPrivateKey($privateKey, $password = '', $uid = '') : string|false {
+	public function decryptPrivateKey(
+		#[\SensitiveParameter]
+		string $privateKey,
+		#[\SensitiveParameter]
+		string $password = '',
+		string $uid = '',
+	) : string|false {
 		$header = $this->parseHeader($privateKey);
 
 		if (isset($header['cipher'])) {
@@ -392,11 +421,11 @@ public function decryptPrivateKey($privateKey, $password = '', $uid = '') : stri
 
 	/**
 	 * check if it is a valid private key
-	 *
-	 * @param string $plainKey
-	 * @return bool
 	 */
-	protected function isValidPrivateKey($plainKey) {
+	protected function isValidPrivateKey(
+		#[\SensitiveParameter]
+		string $plainKey,
+	): bool {
 		$res = openssl_get_privatekey($plainKey);
 		if (is_object($res) && get_class($res) === 'OpenSSLAsymmetricKey') {
 			$sslInfo = openssl_pkey_get_details($res);
@@ -411,7 +440,17 @@ protected function isValidPrivateKey($plainKey) {
 	/**
 	 * @throws DecryptionFailedException
 	 */
-	public function symmetricDecryptFileContent(string $keyFileContents, string $passPhrase, string $cipher = self::DEFAULT_CIPHER, int $version = 0, int|string $position = 0, bool $binaryEncoding = false): string {
+	public function symmetricDecryptFileContent(
+		#[\SensitiveParameter]
+		string $keyFileContents,
+		#[\SensitiveParameter]
+		string $passPhrase,
+		#[\SensitiveParameter]
+		string $cipher = self::DEFAULT_CIPHER,
+		int $version = 0,
+		int|string $position = 0,
+		bool $binaryEncoding = false,
+	): string {
 		if ($keyFileContents === '') {
 			return '';
 		}
@@ -440,7 +479,14 @@ public function symmetricDecryptFileContent(string $keyFileContents, string $pas
 	 *
 	 * @throws GenericEncryptionException
 	 */
-	private function checkSignature(string $data, string $passPhrase, string $expectedSignature): void {
+	private function checkSignature(
+		#[\SensitiveParameter]
+		string $data,
+		#[\SensitiveParameter]
+		string $passPhrase,
+		#[\SensitiveParameter]
+		string $expectedSignature,
+	): void {
 		$enforceSignature = !$this->config->getSystemValueBool('encryption_skip_signature_check', false);
 
 		$signature = $this->createSignature($data, $passPhrase);
@@ -458,7 +504,12 @@ private function checkSignature(string $data, string $passPhrase, string $expect
 	/**
 	 * create signature
 	 */
-	private function createSignature(string $data, string $passPhrase): string {
+	private function createSignature(
+		#[\SensitiveParameter]
+		string $data,
+		#[\SensitiveParameter]
+		string $passPhrase,
+	): string {
 		$passPhrase = hash('sha512', $passPhrase . 'a', true);
 		return hash_hmac('sha256', $data, $passPhrase);
 	}
@@ -529,7 +580,17 @@ private function hasSignature(string $catFile, string $cipher): bool {
 	/**
 	 * @throws DecryptionFailedException
 	 */
-	private function decrypt(string $encryptedContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER, bool $binaryEncoding = false): string {
+	private function decrypt(
+		#[\SensitiveParameter]
+		string $encryptedContent,
+		#[\SensitiveParameter]
+		string $iv,
+		#[\SensitiveParameter]
+		string $passPhrase = '',
+		#[\SensitiveParameter]
+		string $cipher = self::DEFAULT_CIPHER,
+		bool $binaryEncoding = false,
+	): string {
 		$options = $binaryEncoding === true ? OPENSSL_RAW_DATA : 0;
 		$plainContent = openssl_decrypt($encryptedContent,
 			$cipher,
@@ -594,7 +655,12 @@ public function generateFileKey() {
 	 * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $privateKey
 	 * @throws MultiKeyDecryptException
 	 */
-	public function multiKeyDecrypt(string $shareKey, $privateKey): string {
+	public function multiKeyDecrypt(
+		#[\SensitiveParameter]
+		string $shareKey,
+		#[\SensitiveParameter]
+		$privateKey,
+	): string {
 		$plainContent = '';
 
 		// decrypt the intermediate key with RSA
@@ -626,7 +692,12 @@ public function multiKeyDecryptLegacy(string $encKeyFile, string $shareKey, $pri
 	 * @param array<string,\OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string> $keyFiles
 	 * @throws MultiKeyEncryptException
 	 */
-	public function multiKeyEncrypt(string $plainContent, array $keyFiles): array {
+	public function multiKeyEncrypt(
+		#[\SensitiveParameter]
+		string $plainContent,
+		#[\SensitiveParameter]
+		array $keyFiles,
+	): array {
 		if (empty($plainContent)) {
 			throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
 		}

apps/encryption/lib/Crypto/Encryption.php

@@ -262,7 +262,11 @@ public function end($path, $position = '0') {
 	 * @return string encrypted data
 	 */
 	#[\Override]
-	public function encrypt($data, $position = 0) {
+	public function encrypt(
+		#[\SensitiveParameter]
+		$data,
+		$position = 0,
+	): string {
 		// If extra data is left over from the last round, make sure it
 		// is integrated into the next block
 		if ($this->writeCache) {
@@ -321,7 +325,11 @@ public function encrypt($data, $position = 0) {
 	 * @throws DecryptionFailedException
 	 */
 	#[\Override]
-	public function decrypt($data, $position = 0) {
+	public function decrypt(
+		#[\SensitiveParameter]
+		$data,
+		$position = 0,
+	): string {
 		if (empty($this->fileKey)) {
 			$msg = 'Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.';
 			$hint = $this->l->t('Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.');