Skip to content

Commit db0b767

Browse files
nickdnknickdnk
committed
Remove pinned CA file
1 parent 7e782a8 commit db0b767

8 files changed

+13
-86
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22

33
## 8.x (UNOFFICIAL)
44

5+
- 8.0.1
6+
- Removed pinned [DigiCert High Assurance EV Root CA](https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates).
7+
OS-supplied CA is now used by default.
8+
59
- 8.0.0
610
- Requires PHP 8.1.
711
- Defaults to Facebook Graph v20.0, instead of v2.10 which is no longer accessible.

‎src/Facebook/HttpClients/FacebookCurlHttpClient.php‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,6 @@ public function openConnection(string $url, string $method, ?string $body, array
9191
CURLOPT_TIMEOUT => $timeOut,
9292
CURLOPT_RETURNTRANSFER => true, // Return response as string
9393
CURLOPT_HEADER => true, // Enable header processing
94-
CURLOPT_SSL_VERIFYHOST => 2,
95-
CURLOPT_SSL_VERIFYPEER => true,
96-
CURLOPT_CAINFO => __DIR__ . '/certs/DigiCertHighAssuranceEVRootCA.pem',
9794
];
9895

9996
if ($method !== "GET" && $body) {

‎src/Facebook/HttpClients/FacebookGuzzleHttpClient.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ public function send(string $url, string $method, ?string $body, array $headers,
5656
'timeout' => $timeOut,
5757
'http_errors' => false,
5858
'connect_timeout' => 10,
59-
'verify' => __DIR__ . '/certs/DigiCertHighAssuranceEVRootCA.pem',
6059
];
6160

6261
if ($body) {

‎src/Facebook/HttpClients/FacebookStreamHttpClient.php‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,6 @@ public function send(string $url, string $method, ?string $body, array $headers,
5454
'timeout' => $timeOut,
5555
'ignore_errors' => true
5656
],
57-
'ssl' => [
58-
'verify_peer' => true,
59-
'verify_peer_name' => true,
60-
'allow_self_signed' => true, // All root certificates are self-signed
61-
'cafile' => __DIR__ . '/certs/DigiCertHighAssuranceEVRootCA.pem',
62-
],
6357
];
6458

6559
$this->facebookStream->streamContextCreate($options);

‎src/Facebook/HttpClients/certs/DigiCertHighAssuranceEVRootCA.pem‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎tests/HttpClients/FacebookCurlHttpClientTest.php‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -68,22 +68,14 @@ public function testCanOpenGetCurlConnection(): void
6868
}
6969
unset($arg[CURLOPT_HTTPHEADER]);
7070

71-
$caInfo = array_diff($arg, [
71+
if (array_diff_assoc($arg, [
7272
CURLOPT_CUSTOMREQUEST => 'GET',
7373
CURLOPT_URL => 'http://foo.com',
7474
CURLOPT_CONNECTTIMEOUT => 10,
7575
CURLOPT_TIMEOUT => 123,
7676
CURLOPT_RETURNTRANSFER => true,
7777
CURLOPT_HEADER => true,
78-
CURLOPT_SSL_VERIFYHOST => 2,
79-
CURLOPT_SSL_VERIFYPEER => true,
80-
]);
81-
82-
if (count($caInfo) !== 1) {
83-
return false;
84-
}
85-
86-
if (1 !== preg_match('/.+\/certs\/DigiCertHighAssuranceEVRootCA\.pem$/', $caInfo[CURLOPT_CAINFO])) {
78+
])) {
8779
return false;
8880
}
8981

@@ -111,23 +103,15 @@ public function testCanOpenCurlConnectionWithPostBody(): void
111103
}
112104
unset($arg[CURLOPT_HTTPHEADER]);
113105

114-
$caInfo = array_diff($arg, [
106+
if (array_diff_assoc($arg, [
115107
CURLOPT_CUSTOMREQUEST => 'POST',
116108
CURLOPT_URL => 'http://bar.com',
117109
CURLOPT_CONNECTTIMEOUT => 10,
118110
CURLOPT_TIMEOUT => 60,
119111
CURLOPT_RETURNTRANSFER => true,
120112
CURLOPT_HEADER => true,
121-
CURLOPT_SSL_VERIFYHOST => 2,
122-
CURLOPT_SSL_VERIFYPEER => true,
123113
CURLOPT_POSTFIELDS => 'baz=bar',
124-
]);
125-
126-
if (count($caInfo) !== 1) {
127-
return false;
128-
}
129-
130-
if (1 !== preg_match('/.+\/certs\/DigiCertHighAssuranceEVRootCA\.pem$/', $caInfo[CURLOPT_CAINFO])) {
114+
])) {
131115
return false;
132116
}
133117

‎tests/HttpClients/FacebookGuzzleHttpClientTest.php‎

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -65,18 +65,12 @@ public function testCanSendNormalRequest()
6565
}
6666
unset($arg['headers']);
6767

68-
$caInfo = array_diff_assoc($arg, [
68+
if (array_diff_assoc($arg, [
6969
'body' => 'foo_body',
7070
'timeout' => 123,
7171
'http_errors' => false,
7272
'connect_timeout' => 10,
73-
]);
74-
75-
if (count($caInfo) !== 1) {
76-
return false;
77-
}
78-
79-
if (1 !== preg_match('/.+\/certs\/DigiCertHighAssuranceEVRootCA\.pem$/', $caInfo['verify'])) {
73+
])) {
8074
return false;
8175
}
8276

@@ -108,18 +102,12 @@ public function testThrowsExceptionOnClientError()
108102
}
109103
unset($arg['headers']);
110104

111-
$caInfo = array_diff_assoc($arg, [
105+
if (array_diff_assoc($arg, [
112106
'body' => 'foo_body',
113107
'timeout' => 60,
114108
'http_errors' => false,
115109
'connect_timeout' => 10,
116-
]);
117-
118-
if (count($caInfo) !== 1) {
119-
return false;
120-
}
121-
122-
if (1 !== preg_match('/.+\/certs\/DigiCertHighAssuranceEVRootCA\.pem$/', $caInfo['verify'])) {
110+
])) {
123111
return false;
124112
}
125113

‎tests/HttpClients/FacebookStreamHttpClientTest.php‎

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
namespace Facebook\Tests\HttpClients;
2525

2626
use Facebook\Exceptions\FacebookSDKException;
27-
use Facebook\Http\GraphRawResponse;
2827
use Facebook\HttpClients\FacebookStream;
2928
use Mockery as m;
3029
use Facebook\HttpClients\FacebookStreamHttpClient;
@@ -57,7 +56,7 @@ public function testCanSendNormalRequest()
5756
->shouldReceive('streamContextCreate')
5857
->once()
5958
->with(m::on(function ($arg) {
60-
if (!isset($arg['http']) || !isset($arg['ssl'])) {
59+
if (!isset($arg['http'])) {
6160
return false;
6261
}
6362

@@ -72,20 +71,6 @@ public function testCanSendNormalRequest()
7271
return false;
7372
}
7473

75-
$caInfo = array_diff_assoc($arg['ssl'], [
76-
'verify_peer' => true,
77-
'verify_peer_name' => true,
78-
'allow_self_signed' => true,
79-
]);
80-
81-
if (count($caInfo) !== 1) {
82-
return false;
83-
}
84-
85-
if (1 !== preg_match('/.+\/certs\/DigiCertHighAssuranceEVRootCA\.pem$/', $caInfo['cafile'])) {
86-
return false;
87-
}
88-
8974
return true;
9075
}))
9176
->andReturn(null);
@@ -101,7 +86,6 @@ public function testCanSendNormalRequest()
10186

10287
$response = $this->streamClient->send('http://foo.com/', 'GET', 'foo_body', ['X-foo' => 'bar'], 123);
10388

104-
$this->assertInstanceOf(GraphRawResponse::class, $response);
10589
$this->assertEquals($this->fakeRawBody, $response->getBody());
10690
$this->assertEquals($this->fakeHeadersAsArray, $response->getHeaders());
10791
$this->assertEquals(200, $response->getHttpResponseCode());

0 commit comments

Comments
 (0)