55 lines
1.6 KiB
PHP
55 lines
1.6 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace MintyPHP\Tests\Architecture;
|
||
|
|
|
||
|
|
use PHPUnit\Framework\TestCase;
|
||
|
|
|
||
|
|
/**
|
||
|
|
* GR-SEC-005: All encryption/decryption MUST use lib/Support/Crypto.php.
|
||
|
|
* No raw openssl_encrypt/decrypt calls outside that single file.
|
||
|
|
*/
|
||
|
|
class SecurityCryptoContractTest extends TestCase
|
||
|
|
{
|
||
|
|
use ProjectFileAssertionSupport;
|
||
|
|
|
||
|
|
private const CRYPTO_FILE = 'lib/Support/Crypto.php';
|
||
|
|
|
||
|
|
public function testNoRawOpensslEncryptOutsideCrypto(): void
|
||
|
|
{
|
||
|
|
$violations = array_merge(
|
||
|
|
$this->findPatternMatchesInPhpFiles('lib', '/\bopenssl_encrypt\s*\(/'),
|
||
|
|
$this->findPatternMatchesInPhpFiles('pages', '/\bopenssl_encrypt\s*\(/')
|
||
|
|
);
|
||
|
|
|
||
|
|
$violations = array_values(array_filter(
|
||
|
|
$violations,
|
||
|
|
static fn (string $path): bool => $path !== self::CRYPTO_FILE
|
||
|
|
));
|
||
|
|
|
||
|
|
$this->assertSame(
|
||
|
|
[],
|
||
|
|
$violations,
|
||
|
|
"Raw openssl_encrypt() found outside Crypto.php (GR-SEC-005):\n" . implode("\n", $violations)
|
||
|
|
);
|
||
|
|
}
|
||
|
|
|
||
|
|
public function testNoRawOpensslDecryptOutsideCrypto(): void
|
||
|
|
{
|
||
|
|
$violations = array_merge(
|
||
|
|
$this->findPatternMatchesInPhpFiles('lib', '/\bopenssl_decrypt\s*\(/'),
|
||
|
|
$this->findPatternMatchesInPhpFiles('pages', '/\bopenssl_decrypt\s*\(/')
|
||
|
|
);
|
||
|
|
|
||
|
|
$violations = array_values(array_filter(
|
||
|
|
$violations,
|
||
|
|
static fn (string $path): bool => $path !== self::CRYPTO_FILE
|
||
|
|
));
|
||
|
|
|
||
|
|
$this->assertSame(
|
||
|
|
[],
|
||
|
|
$violations,
|
||
|
|
"Raw openssl_decrypt() found outside Crypto.php (GR-SEC-005):\n" . implode("\n", $violations)
|
||
|
|
);
|
||
|
|
}
|
||
|
|
}
|