Skip to content

Commit e59fc23

Browse files
SpomkySpomky
authored
Better data collector (#111)
* Better Data Collector Adds some tables for the list of components. Better messages and warnings for the deprecated algorithms
1 parent 109b5f0 commit e59fc23

File tree

5 files changed

+220
-35
lines changed

5 files changed

+220
-35
lines changed

‎src/Bundle/JoseFramework/DataCollector/AlgorithmCollector.php

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,10 @@ public function __construct(AlgorithmManagerFactory $algorithmManagerFactory)
4444
public function collect(array &$data, Request $request, Response $response, \Exception $exception = null)
4545
{
4646
$algorithms = $this->algorithmManagerFactory->all();
47-
$data['algorithm']['algorithms'] = [];
47+
$data['algorithm'] = [
48+
'messages' => $this->getAlgorithmMessages(),
49+
'algorithms' => [],
50+
];
4851
$signatureAlgorithms = 0;
4952
$keyEncryptionAlgorithms = 0;
5053
$contentEncryptionAlgorithms = 0;
@@ -92,4 +95,37 @@ private function getAlgorithmType(Algorithm $algorithm, int &$signatureAlgorithm
9295
return 'Unknown';
9396
}
9497
}
98+
99+
/**
100+
* @return array
101+
*/
102+
private function getAlgorithmMessages(): array
103+
{
104+
return [
105+
'none' => [
106+
'severity' => 'severity-low',
107+
'message' => 'This algorithm is not secured. Please use with caution.',
108+
],
109+
'RSA1_5' => [
110+
'severity' => 'severity-high',
111+
'message' => 'This algorithm is not secured (known attacks). See <a target="_blank" href="https://tools.ietf.org/html/draft-irtf-cfrg-webcrypto-algorithms-00#section-5">https://tools.ietf.org/html/draft-irtf-cfrg-webcrypto-algorithms-00#section-5</a>.',
112+
],
113+
'ECDH-ES' => [
114+
'severity' => 'severity-medium',
115+
'message' => 'This algorithm is very slow when used with curves P-256, P-384, P-521.',
116+
],
117+
'ECDH-ES+A128KW' => [
118+
'severity' => 'severity-medium',
119+
'message' => 'This algorithm is very slow when used with curves P-256, P-384, P-521.',
120+
],
121+
'ECDH-ES+A192KW' => [
122+
'severity' => 'severity-medium',
123+
'message' => 'This algorithm is very slow when used with curves P-256, P-384, P-521.',
124+
],
125+
'ECDH-ES+A256KW' => [
126+
'severity' => 'severity-medium',
127+
'message' => 'This algorithm is very slow when used with curves P-256, P-384, P-521.',
128+
],
129+
];
130+
}
95131
}

‎src/Bundle/JoseFramework/Resources/views/data_collector/tab/checker.html.twig

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,24 @@
3232
{% if collector.getData().checker.header_checkers is empty %}
3333
No header checker.
3434
{% else %}
35-
<ul>
35+
<table>
36+
<thead>
37+
<tr>
38+
<th>Alias</th>
39+
<th>Checked header</th>
40+
<th>Is protected?</th>
41+
</tr>
42+
</thead>
43+
<tbody>
3644
{% for alias, data in collector.getData().checker.header_checkers %}
37-
<li>Alias: {{ alias }}, checked header: {{ data.header }}{% if data.protected %} (protected header){% endif %}</li>
45+
<tr>
46+
<td>{{ alias }}</td>
47+
<td>{{ data.header }}</td>
48+
<td>{% if data.protected %}Yes{% else %}No{% endif %}</td>
49+
</tr>
3850
{% endfor %}
39-
</ul>
51+
</tbody>
52+
</table>
4053
{% endif %}
4154
<i>Please note that the header "crit" (critical) is always checked.</i>
4255
<h4>Claim Checker Managers</h4>
@@ -70,11 +83,22 @@
7083
{% if collector.getData().checker.claim_checkers is empty %}
7184
No header checker.
7285
{% else %}
73-
<ul>
86+
<table>
87+
<thead>
88+
<tr>
89+
<th>Alias</th>
90+
<th>Checked claim</th>
91+
</tr>
92+
</thead>
93+
<tbody>
7494
{% for alias, data in collector.getData().checker.claim_checkers %}
75-
<li>Alias: {{ alias }}, checked claim: {{ data.claim }}</li>
95+
<tr>
96+
<td>{{ alias }}</td>
97+
<td>{{ data.claim }}</td>
98+
</tr>
7699
{% endfor %}
77-
</ul>
100+
</tbody>
101+
</table>
78102
{% endif %}
79103
</div>
80104
</div>

‎src/Bundle/JoseFramework/Resources/views/data_collector/tab/jwe.html.twig

Lines changed: 94 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,17 +19,27 @@
1919
<ul>
2020
{% for algorithm in data.key_encryption_algorithms %}
2121
<li>
22-
<span{% if algorithm == 'RSA1_5' %} class="severity-high"{% elseif 'ECDH-ES' in algorithm %} class="severity-medium"{% endif %}>
23-
{{ algorithm }}
24-
</span>
22+
<span{% if algorithm in collector.getData().algorithm.messages|keys %}
23+
class="{{ collector.getData().algorithm.messages[algorithm]['severity'] }}"
24+
{% else %}
25+
{% endif %}>
26+
{{ algorithm }}
27+
</span>
2528
</li>
2629
{% endfor %}
2730
</ul>
2831
</td>
2932
<td>
3033
<ul>
3134
{% for algorithm in data.content_encryption_algorithms %}
32-
<li>{{ algorithm }}</li>
35+
<li>
36+
<span{% if algorithm in collector.getData().algorithm.messages|keys %}
37+
class="{{ collector.getData().algorithm.messages[algorithm]['severity'] }}"
38+
{% else %}
39+
{% endif %}>
40+
{{ algorithm }}
41+
</span>
42+
</li>
3343
{% endfor %}
3444
</ul>
3545
</td>
@@ -142,29 +152,97 @@
142152
{% set encryptionAlgorithms = collector.getData().algorithm.algorithms %}
143153
{% if encryptionAlgorithms['Key Encryption'] is defined %}
144154
<h4>Available Key Encryption Algorithms</h4>
145-
<ul>
155+
<table>
156+
<thead>
157+
<tr>
158+
<th>Name</th>
159+
<th>Alias</th>
160+
<th>Message</th>
161+
</tr>
162+
</thead>
163+
<tbody>
146164
{% for alias, alg in encryptionAlgorithms['Key Encryption'] %}
147-
<li><span{% if alg.name == 'RSA1_5' %} class="severity-high"{% elseif 'ECDH-ES' in alg.name %} class="severity-medium"{% endif %}>{{ alg.name }} (alias: <i>{{ alias }})</i>{% if alg.name == 'RSA1_5' %}. This algorithm is not secured (known attacks).{% elseif 'ECDH-ES' in alg.name %}. This algorithm is very slow when used with curves P-256, P-384, P-521.{% endif %}</span></li>
165+
<tr>
166+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
167+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
168+
{% endif %}>{{ alg.name }}</td>
169+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
170+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
171+
{% endif %}>{{ alias }}</td>
172+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
173+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
174+
{% endif %}>
175+
{% if alg.name in collector.getData().algorithm.messages|keys %}
176+
{{ collector.getData().algorithm.messages[alg.name]['message']|raw }}
177+
{% endif %}
178+
</td>
179+
</tr>
148180
{% endfor %}
149-
</ul>
181+
</tbody>
182+
</table>
150183
<h4>Available Content Encryption Algorithms</h4>
151-
<ul>
184+
<table>
185+
<thead>
186+
<tr>
187+
<th>Name</th>
188+
<th>Alias</th>
189+
<th>Message</th>
190+
</tr>
191+
</thead>
192+
<tbody>
152193
{% for alias, alg in encryptionAlgorithms['Content Encryption'] %}
153-
<li>{{ alg.name }} (alias: <i>{{ alias }})</i></li>
194+
<tr>
195+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
196+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
197+
{% endif %}>{{ alg.name }}</td>
198+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
199+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
200+
{% endif %}>{{ alias }}</td>
201+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
202+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
203+
{% endif %}>
204+
{% if alg.name in collector.getData().algorithm.messages|keys %}
205+
{{ collector.getData().algorithm.messages[alg.name]['message']|raw }}
206+
{% endif %}
207+
</td>
208+
</tr>
154209
{% endfor %}
155-
</ul>
210+
</tbody>
211+
</table>
156212
<h4>Compression Methods</h4>
157-
<ul>
213+
<table>
214+
<thead>
215+
<tr>
216+
<th>Name</th>
217+
<th>Alias</th>
218+
</tr>
219+
</thead>
220+
<tbody>
158221
{% for alias, name in collector.getData().jwe.compression_methods %}
159-
<li>{{ name }} (alias: <i>{{ alias }})</i></li>
222+
<tr>
223+
<td>{{ name }}</td>
224+
<td>{{ alias }}</td>
225+
</tr>
160226
{% endfor %}
161-
</ul>
227+
</tbody>
228+
</table>
162229
<h4>JWE Serialization Modes</h4>
163-
<ul>
230+
<table>
231+
<thead>
232+
<tr>
233+
<th>Name</th>
234+
<th>Alias</th>
235+
</tr>
236+
</thead>
237+
<tbody>
164238
{% for alias, name in collector.getData().jwe.jwe_serialization %}
165-
<li>{{ name }} (alias: <i>{{ alias }})</i></li>
239+
<tr>
240+
<td>{{ name }}</td>
241+
<td>{{ alias }}</td>
242+
</tr>
166243
{% endfor %}
167-
</ul>
244+
</tbody>
245+
</table>
168246
{% else %}
169247
The is no encryption algorithm. Did you installed "web-token/jwt-encryption-bundle"?
170248
{% endif %}

‎src/Bundle/JoseFramework/Resources/views/data_collector/tab/jws.html.twig

Lines changed: 56 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,14 @@
1616
<td>
1717
<ul>
1818
{% for algorithm in data.signature_algorithms %}
19-
<li><span{% if algorithm == 'none' %} class="severity-low"{% endif %}>{{ algorithm }}</span></li>
19+
<li>
20+
<span{% if algorithm in collector.getData().algorithm.messages|keys %}
21+
class="{{ collector.getData().algorithm.messages[algorithm]['severity'] }}"
22+
{% else %}
23+
{% endif %}>
24+
{{ algorithm }}
25+
</span>
26+
</li>
2027
{% endfor %}
2128
</ul>
2229
</td>
@@ -39,7 +46,13 @@
3946
<td>
4047
<ul>
4148
{% for algorithm in data.signature_algorithms %}
42-
<li><span{% if algorithm == 'none' %} class="severity-low"{% endif %}>{{ algorithm }}</span></li>
49+
<li>
50+
<span{% if algorithm in collector.getData().algorithm.messages|keys %}
51+
class="{{ collector.getData().algorithm.messages[algorithm]['severity'] }}"
52+
{% endif %}>
53+
{{ algorithm }}
54+
</span>
55+
</li>
4356
{% endfor %}
4457
</ul>
4558
</td>
@@ -81,19 +94,53 @@
8194
{% set signatureAlgorithms = collector.getData().algorithm.algorithms %}
8295
{% if signatureAlgorithms['Signature'] is defined %}
8396
<h4>Available Signature Algorithms</h4>
84-
<ul>
97+
<table>
98+
<thead>
99+
<tr>
100+
<th>Name</th>
101+
<th>Alias</th>
102+
<th>Message</th>
103+
</tr>
104+
</thead>
105+
<tbody>
85106
{% for alias, alg in signatureAlgorithms['Signature'] %}
86-
<li><span{% if alg.name == 'none' %} class="severity-low"{% endif %}>{{ alg.name }} (alias: <i>{{ alias }})</i>{% if alg.name == 'none' %}. This algorithm is not secured. Please use with caution{% endif %}</span></li>
107+
<tr>
108+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
109+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
110+
{% endif %}>{{ alg.name }}</td>
111+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
112+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
113+
{% endif %}>{{ alias }}</td>
114+
<td {% if alg.name in collector.getData().algorithm.messages|keys %}
115+
class="{{ collector.getData().algorithm.messages[alg.name]['severity'] }}"
116+
{% endif %}>
117+
{% if alg.name in collector.getData().algorithm.messages|keys %}
118+
{{ collector.getData().algorithm.messages[alg.name]['message']|raw }}
119+
{% endif %}
120+
</td>
121+
</tr>
87122
{% endfor %}
88-
</ul>
123+
</tbody>
124+
</table>
89125
<h4>Serialization Modes</h4>
90-
<ul>
126+
<table>
127+
<thead>
128+
<tr>
129+
<th>Name</th>
130+
<th>Alias</th>
131+
</tr>
132+
</thead>
133+
<tbody>
91134
{% for alias, name in collector.getData().jws.jws_serialization %}
92-
<li>{{ name }} (alias: <i>{{ alias }})</i></li>
135+
<tr>
136+
<td>{{ name }}</td>
137+
<td>{{ alias }}</td>
138+
</tr>
93139
{% endfor %}
94-
</ul>
140+
</tbody>
141+
</table>
95142
{% else %}
96-
The is no signature algorithm. Did you installed "web-token/jwt-signature-bundle"?
143+
There is no signature algorithm. Did you installed "web-token/jwt-signature-bundle"?
97144
{% endif %}
98145
</div>
99146
</div>

‎src/Bundle/JoseFramework/Resources/views/data_collector/template.html.twig

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,15 +56,15 @@
5656

5757
<style>
5858
.severity-low {
59-
background: yellow;
59+
background-color: yellow;
6060
color: #000;
6161
}
6262
.severity-medium {
63-
background: orange;
63+
background-color: orange;
6464
color: #000;
6565
}
6666
.severity-high {
67-
background: #B0413E;
67+
background-color: #B0413E;
6868
color: #FFF;
6969
font-weight: bold;
7070
}

0 commit comments

Comments
 (0)