Merge pull request #5476 from LibreSign/fix/isolate-all-dependencies

vitormattos · web-flow · commit cf80e4e27bfb · 2025-10-01T18:51:11.000-03:00
fix: isolate all dependencies
diff --git a/REUSE.toml b/REUSE.toml
@@ -32,6 +32,7 @@ path = [
     "l10n/*.js",
     "l10n/*.json",
     "Makefile",
+    "lib/Vendor/.gitkeep",
     "openapi-administration.json",
     "openapi-full.json",
     "openapi.json",
diff --git a/composer.json b/composer.json
@@ -36,13 +36,16 @@
 		"openapi": "generate-spec --verbose && (npm run typescript:generate || echo 'Please manually regenerate the typescript OpenAPI models')",
 		"psalm": "psalm --no-cache --threads=$(nproc)",
 		"psalm:update-baseline": "psalm --threads=$(nproc) --update-baseline --set-baseline=tests/psalm-baseline.xml",
+		"pre-autoload-dump": [
+			"mkdir -p lib/Vendor"
+		],
 		"post-install-cmd": [
 			"@composer bin all install --ansi",
-			"php -d error_reporting=E_ALL\\&~E_DEPRECATED\\&~E_USER_DEPRECATED vendor-bin/php-scoper/vendor/humbug/php-scoper/bin/php-scoper add-prefix --force",
+			"php -d error_reporting=E_ALL\\&~E_DEPRECATED\\&~E_USER_DEPRECATED vendor-bin/php-scoper/vendor/humbug/php-scoper/bin/php-scoper add-prefix --force && > lib/Vendor/.gitkeep",
 			"composer dump-autoload -o"
 		],
 		"post-update-cmd": [
-			"php -d error_reporting=E_ALL\\&~E_DEPRECATED\\&~E_USER_DEPRECATED vendor-bin/php-scoper/vendor/humbug/php-scoper/bin/php-scoper add-prefix --force",
+			"php -d error_reporting=E_ALL\\&~E_DEPRECATED\\&~E_USER_DEPRECATED vendor-bin/php-scoper/vendor/humbug/php-scoper/bin/php-scoper add-prefix --force && > lib/Vendor/.gitkeep",
 			"composer dump-autoload"
 		],
 		"test:unit": "vendor/bin/phpunit -c tests/php/phpunit.xml --no-coverage --colors=always --fail-on-warning --fail-on-risky --display-deprecations --display-phpunit-deprecations",
@@ -56,11 +59,11 @@
 	},
 	"autoload": {
 		"psr-4": {
-			"OCA\\Libresign\\": "lib/",
-			"OCA\\Libresign\\Vendor\\mikehaertl\\pdftk\\": "lib/Vendor/php-pdftk/src/",
-			"OCA\\Libresign\\Vendor\\mikehaertl\\shellcommand\\": "lib/Vendor/php-shellcommand/src/",
-			"OCA\\Libresign\\Vendor\\mikehaertl\\tmp\\": "lib/Vendor/php-tmpfile/src/"
-		}
+			"OCA\\Libresign\\": "lib/"
+		},
+		"classmap": [
+			"lib/Vendor/"
+		]
 	},
 	"autoload-dev": {
 		"psr-4": {
diff --git a/lib/Command/Developer/SignSetup.php b/lib/Command/Developer/SignSetup.php
@@ -12,9 +12,10 @@
 use OC\Core\Command\Base;
 use OCA\Libresign\Service\Install\InstallService;
 use OCA\Libresign\Service\Install\SignSetupService;
+use OCA\Libresign\Vendor\phpseclib3\Crypt\RSA;
+use OCA\Libresign\Vendor\phpseclib3\Exception\NoKeyLoadedException;
+use OCA\Libresign\Vendor\phpseclib3\File\X509;
 use OCP\IConfig;
-use phpseclib\Crypt\RSA;
-use phpseclib\File\X509;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
@@ -57,8 +58,9 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 			return 1;
 		}
 
-		$rsa = new RSA();
-		if ($rsa->loadKey($privateKey) === false) {
+		try {
+			$rsa = RSA::loadPrivateKey($privateKey);
+		} catch (NoKeyLoadedException) {
 			$output->writeln('Invalid private key');
 			return 1;
 		}
diff --git a/lib/Db/PagerFantaQueryAdapter.php b/lib/Db/PagerFantaQueryAdapter.php
@@ -9,9 +9,9 @@
 namespace OCA\Libresign\Db;
 
 use Doctrine\DBAL\Query\QueryBuilder;
+use OCA\Libresign\Vendor\Pagerfanta\Adapter\AdapterInterface;
+use OCA\Libresign\Vendor\Pagerfanta\Exception\InvalidArgumentException;
 use OCP\DB\QueryBuilder\IQueryBuilder;
-use Pagerfanta\Adapter\AdapterInterface;
-use Pagerfanta\Exception\InvalidArgumentException;
 
 /**
  * Adapter which calculates pagination from a Doctrine DBAL QueryBuilder.
diff --git a/lib/Handler/FooterHandler.php b/lib/Handler/FooterHandler.php
@@ -8,28 +8,28 @@
 
 namespace OCA\Libresign\Handler;
 
-use BaconQrCode\Encoder\Encoder;
-use Endroid\QrCode\Bacon\ErrorCorrectionLevelConverter;
-use Endroid\QrCode\Color\Color;
-use Endroid\QrCode\Encoding\Encoding;
-use Endroid\QrCode\ErrorCorrectionLevel;
-use Endroid\QrCode\QrCode;
-use Endroid\QrCode\RoundBlockSizeMode;
-use Endroid\QrCode\Writer\PngWriter;
-use Mpdf\Mpdf;
 use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Db\File as FileEntity;
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Service\PdfParserService;
+use OCA\Libresign\Vendor\BaconQrCode\Encoder\Encoder;
+use OCA\Libresign\Vendor\Endroid\QrCode\Bacon\ErrorCorrectionLevelConverter;
+use OCA\Libresign\Vendor\Endroid\QrCode\Color\Color;
+use OCA\Libresign\Vendor\Endroid\QrCode\Encoding\Encoding;
+use OCA\Libresign\Vendor\Endroid\QrCode\ErrorCorrectionLevel;
+use OCA\Libresign\Vendor\Endroid\QrCode\QrCode;
+use OCA\Libresign\Vendor\Endroid\QrCode\RoundBlockSizeMode;
+use OCA\Libresign\Vendor\Endroid\QrCode\Writer\PngWriter;
+use OCA\Libresign\Vendor\Mpdf\Mpdf;
+use OCA\Libresign\Vendor\Twig\Environment;
+use OCA\Libresign\Vendor\Twig\Error\SyntaxError;
+use OCA\Libresign\Vendor\Twig\Loader\FilesystemLoader;
 use OCP\Files\File;
 use OCP\IAppConfig;
 use OCP\IL10N;
 use OCP\ITempManager;
 use OCP\IURLGenerator;
 use OCP\L10N\IFactory;
-use Twig\Environment;
-use Twig\Error\SyntaxError;
-use Twig\Loader\FilesystemLoader;
 
 class FooterHandler {
 	private QrCode $qrCode;
diff --git a/lib/Handler/SignEngine/JSignPdfHandler.php b/lib/Handler/SignEngine/JSignPdfHandler.php
@@ -10,8 +10,6 @@
 
 use Imagick;
 use ImagickPixel;
-use Jeidison\JSignPDF\JSignPDF;
-use Jeidison\JSignPDF\Sign\JSignParam;
 use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Handler\CertificateEngine\CertificateEngineFactory;
@@ -20,6 +18,8 @@
 use OCA\Libresign\Service\SignatureBackgroundService;
 use OCA\Libresign\Service\SignatureTextService;
 use OCA\Libresign\Service\SignerElementsService;
+use OCA\Libresign\Vendor\Jeidison\JSignPDF\JSignPDF;
+use OCA\Libresign\Vendor\Jeidison\JSignPDF\Sign\JSignParam;
 use OCP\Files\File;
 use OCP\IAppConfig;
 use OCP\ITempManager;
diff --git a/lib/Handler/SignEngine/Pkcs12Handler.php b/lib/Handler/SignEngine/Pkcs12Handler.php
@@ -15,11 +15,11 @@
 use OCA\Libresign\Handler\CertificateEngine\OrderCertificatesTrait;
 use OCA\Libresign\Handler\FooterHandler;
 use OCA\Libresign\Service\FolderService;
+use OCA\Libresign\Vendor\phpseclib3\File\ASN1;
 use OCP\Files\File;
 use OCP\IAppConfig;
 use OCP\IL10N;
 use OCP\ITempManager;
-use phpseclib3\File\ASN1;
 use Psr\Log\LoggerInterface;
 
 class Pkcs12Handler extends SignEngineHandler {
diff --git a/lib/Helper/Pagination.php b/lib/Helper/Pagination.php
@@ -9,9 +9,9 @@
 namespace OCA\Libresign\Helper;
 
 use OCA\Libresign\Db\PagerFantaQueryAdapter;
+use OCA\Libresign\Vendor\Pagerfanta\Pagerfanta;
 use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\IURLGenerator;
-use Pagerfanta\Pagerfanta;
 
 class Pagination extends Pagerfanta {
 	private string $routeName;
diff --git a/lib/Service/IdentifyMethod/AbstractIdentifyMethod.php b/lib/Service/IdentifyMethod/AbstractIdentifyMethod.php
@@ -19,8 +19,8 @@
 use OCA\Libresign\Helper\JSActions;
 use OCA\Libresign\Service\IdentifyMethod\SignatureMethod\AbstractSignatureMethod;
 use OCA\Libresign\Service\SessionService;
+use OCA\Libresign\Vendor\Wobeto\EmailBlur\Blur;
 use OCP\IUser;
-use Wobeto\EmailBlur\Blur;
 
 abstract class AbstractIdentifyMethod implements IIdentifyMethod {
 	protected IdentifyMethod $entity;
diff --git a/lib/Service/IdentifyMethod/SignatureMethod/EmailToken.php b/lib/Service/IdentifyMethod/SignatureMethod/EmailToken.php
@@ -11,7 +11,7 @@
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Helper\JSActions;
 use OCA\Libresign\Service\IdentifyMethod\IdentifyService;
-use Wobeto\EmailBlur\Blur;
+use OCA\Libresign\Vendor\Wobeto\EmailBlur\Blur;
 
 class EmailToken extends AbstractSignatureMethod implements IToken {
 	public function __construct(
diff --git a/lib/Service/Install/SignSetupService.php b/lib/Service/Install/SignSetupService.php
@@ -17,6 +17,10 @@
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Exception\SignatureDataNotFoundException;
 use OCA\Libresign\Handler\CertificateEngine\CertificateHelper;
+use OCA\Libresign\Vendor\phpseclib3\Crypt\PublicKeyLoader;
+use OCA\Libresign\Vendor\phpseclib3\Crypt\RSA;
+use OCA\Libresign\Vendor\phpseclib3\Crypt\RSA\PrivateKey;
+use OCA\Libresign\Vendor\phpseclib3\File\X509;
 use OCP\App\IAppManager;
 use OCP\Files\AppData\IAppDataFactory;
 use OCP\Files\IAppData;
@@ -25,8 +29,6 @@
 use OCP\IAppConfig;
 use OCP\IConfig;
 use OCP\ITempManager;
-use phpseclib\Crypt\RSA;
-use phpseclib\File\X509;
 
 class SignSetupService {
 	private array $exclude = [
@@ -40,7 +42,7 @@ class SignSetupService {
 	private bool $willUseLocalCert = false;
 	private string $distro = '';
 	private ?X509 $x509 = null;
-	private ?RSA $rsa = null;
+	private ?PrivateKey $privateKey = null;
 	private string $instanceId;
 	private IAppData $appData;
 	public function __construct(
@@ -74,8 +76,8 @@ public function getArchitectures(): array {
 		return $appInfo['dependencies']['architecture'];
 	}
 
-	public function setPrivateKey(RSA $privateKey): void {
-		$this->rsa = $privateKey;
+	public function setPrivateKey(PrivateKey $privateKey): void {
+		$this->privateKey = $privateKey;
 	}
 
 	public function setCertificate(x509 $x509): void {
@@ -86,17 +88,19 @@ public function willUseLocalCert(bool $willUseLocalCert): void {
 		$this->willUseLocalCert = $willUseLocalCert;
 	}
 
-	private function getPrivateKey(): RSA {
-		if (!$this->rsa instanceof RSA) {
+	private function getPrivateKey(): PrivateKey {
+		if (!$this->privateKey instanceof PrivateKey) {
 			if (file_exists(__DIR__ . '/../../../build/tools/certificates/local/libresign.key')) {
 				$privateKey = file_get_contents(__DIR__ . '/../../../build/tools/certificates/local/libresign.key');
-				$this->rsa = new RSA();
-				$this->rsa->loadKey($privateKey);
+				$this->privateKey = PublicKeyLoader::loadPrivateKey($privateKey);
 			} else {
 				$this->getDevelopCert();
 			}
 		}
-		return $this->rsa;
+		if (!$this->privateKey instanceof PrivateKey) {
+			throw new LibresignException('Private key not found');
+		}
+		return $this->privateKey;
 	}
 
 	private function getCertificate(): X509 {
@@ -110,6 +114,9 @@ private function getCertificate(): X509 {
 				$this->getDevelopCert();
 			}
 		}
+		if (!$this->x509 instanceof x509) {
+			throw new LibresignException('Certificate not found');
+		}
 		return $this->x509;
 	}
 
@@ -381,12 +388,8 @@ private function validateIfIssignedByLibresignAppCertificate(array $expectedHash
 		$x509 = $this->getLibresignAppCertificate();
 
 		// Check if the signature of the files is valid
-		$rsa = new RSA();
-		$rsa->loadKey($x509->currentCert['tbsCertificate']['subjectPublicKeyInfo']['subjectPublicKey']);
-		$rsa->setSignatureMode(RSA::SIGNATURE_PSS);
-		$rsa->setMGFHash('sha512');
-		// See https://tools.ietf.org/html/rfc3447#page-38
-		$rsa->setSaltLength(0);
+		$rsa = $x509->getPublicKey()
+			->withPadding(RSA::SIGNATURE_PSS);
 
 		$signatureData = $this->getSignatureData();
 		$signature = base64_decode((string)$signatureData['signature']);
@@ -525,16 +528,14 @@ private function isExcluded(string $filename): bool {
 	private function createSignatureData(array $hashes): array {
 		ksort($hashes);
 
-		$this->getPrivateKey()->setSignatureMode(RSA::SIGNATURE_PSS);
-		$this->getPrivateKey()->setMGFHash('sha512');
-		// See https://tools.ietf.org/html/rfc3447#page-38
-		$this->getPrivateKey()->setSaltLength(0);
-		$signature = $this->getPrivateKey()->sign(json_encode($hashes));
+		$privateKey = $this->getPrivateKey()
+			->withPadding(RSA::SIGNATURE_PSS);
+		$signature = $privateKey->sign(json_encode($hashes));
 
 		return [
 			'hashes' => $hashes,
 			'signature' => base64_encode($signature),
-			'certificate' => $this->getCertificate()->saveX509($this->getCertificate()->currentCert),
+			'certificate' => $this->getCertificate()->saveX509($this->getCertificate()->getCurrentCert()),
 		];
 	}
 
@@ -574,11 +575,10 @@ public function getDevelopCert(): array {
 		openssl_x509_export($x509, $rootCertificate);
 		openssl_pkey_export($privateKey, $privateKeyCert);
 
-		$this->rsa = new RSA();
-		$this->rsa->loadKey($privateKeyCert);
+		$this->privateKey = RSA::loadPrivateKey($privateKeyCert);
 		$this->x509 = new X509();
 		$this->x509->loadX509($rootCertificate);
-		$this->x509->setPrivateKey($this->rsa);
+		$this->x509->setPrivateKey($this->privateKey);
 
 		$rootCertPath = __DIR__ . '/../../../build/tools/certificates/local/';
 		if (!is_dir($rootCertPath)) {
diff --git a/lib/Service/PdfParserService.php b/lib/Service/PdfParserService.php
@@ -9,10 +9,11 @@
 namespace OCA\Libresign\Service;
 
 use OCA\Libresign\Exception\LibresignException;
+use OCA\Libresign\Vendor\Smalot\PdfParser\Document;
+use OCA\Libresign\Vendor\Smalot\PdfParser\Parser;
 use OCP\Files\File;
 use OCP\ITempManager;
 use Psr\Log\LoggerInterface;
-use Smalot\PdfParser\Document;
 
 class PdfParserService {
 	private string $content = '';
@@ -52,7 +53,7 @@ private function getDocument(): Document {
 		if (!$this->document) {
 			$content = $this->getContent();
 			try {
-				$parser = new \Smalot\PdfParser\Parser();
+				$parser = new Parser();
 				$this->document = $parser->parseContent($content);
 				return $this->document;
 			} catch (\Throwable $th) {
diff --git a/lib/Service/SignatureTextService.php b/lib/Service/SignatureTextService.php
@@ -14,16 +14,16 @@
 use ImagickPixel;
 use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Exception\LibresignException;
+use OCA\Libresign\Vendor\Twig\Environment;
+use OCA\Libresign\Vendor\Twig\Error\SyntaxError;
+use OCA\Libresign\Vendor\Twig\Loader\FilesystemLoader;
 use OCP\IAppConfig;
 use OCP\IDateTimeZone;
 use OCP\IL10N;
 use OCP\IRequest;
 use OCP\IUserSession;
 use Psr\Log\LoggerInterface;
 use Sabre\DAV\UUIDUtil;
-use Twig\Environment;
-use Twig\Error\SyntaxError;
-use Twig\Loader\FilesystemLoader;
 
 class SignatureTextService {
 	public const TEMPLATE_DEFAULT_FONT_SIZE = 10;
diff --git a/lib/Service/TFile.php b/lib/Service/TFile.php
@@ -8,9 +8,9 @@
 
 namespace OCA\Libresign\Service;
 
+use OCA\Libresign\Vendor\setasign\Fpdi\PdfParserService\Type\PdfTypeException;
 use OCP\Files\Node;
 use OCP\Http\Client\IClientService;
-use setasign\Fpdi\PdfParserService\Type\PdfTypeException;
 
 trait TFile {
 	/** @var ?string */
diff --git a/lib/Vendor/.gitkeep b/lib/Vendor/.gitkeep
diff --git a/scoper.inc.php b/scoper.inc.php
diff --git a/tests/php/Api/Controller/SignFileControllerTest.php b/tests/php/Api/Controller/SignFileControllerTest.php
diff --git a/tests/php/Unit/Handler/SignEngine/JSignPdfHandlerTest.php b/tests/php/Unit/Handler/SignEngine/JSignPdfHandlerTest.php
diff --git a/tests/php/Unit/Service/Install/SignSetupServiceTest.php b/tests/php/Unit/Service/Install/SignSetupServiceTest.php
diff --git a/tests/psalm-baseline.xml b/tests/psalm-baseline.xml
