Skip to content

Commit 5776416

Browse files
bshafferbshaffer
authored
fix: mark all keyFile and keyFilePath options deprecated (#8617)
1 parent eb38bb7 commit 5776416

16 files changed

Lines changed: 602 additions & 137 deletions

File tree

‎AUTHENTICATION.md‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -93,30 +93,30 @@ $video = new VideoIntelligenceServiceClient([
9393
```
9494

9595
#### Note:
96-
Some clients accept the `keyFilePath` and `keyFile` configuration options pointing to the credentials file:
96+
Some clients accept the `keyFilePath` and `keyFile` configuration options pointing to the credentials
97+
file. However, both of these options are deprecated in favor of using the `credentialsFetcher`
98+
option or
99+
[Application Default Credentials](https://developers.google.com/identity/protocols/application-default-credentials).
97100

98101
```php
99-
use Google\Cloud\Storage\StorageClient;
102+
require 'vendor/autoload.php';
100103

101-
// Authenticate using a keyfile path
102-
$cloud = new StorageClient([
103-
'keyFilePath' => 'path/to/keyfile.json'
104-
]);
104+
use Google\Cloud\Storage\StorageClient;
105+
use Google\Auth\Credentials\ServiceAccountCredentials;
105106

106-
// Authenticate using keyfile data
107-
$cloud = new StorageClient([
108-
'keyFile' => json_decode(file_get_contents('/path/to/keyfile.json'), true)
107+
// Create the service account credentials and pass them in using the "credentialsFile" option
108+
$keyFile = json_decode(file_get_contents('/path/to/keyfile.json'), true);
109+
$storage = new StorageClient([
110+
'credentialsFetcher' => new ServiceAccountCredentials($scopes, $keyFile),
109111
]);
110112
```
111113
A list of clients that accept these parameters are:
112-
- [Bigtable](https://github.com/googleapis/google-cloud-php-bigtable)
113-
- [Spanner](https://github.com/googleapis/google-cloud-php-spanner)
114-
- [Firestore](https://github.com/googleapis/google-cloud-php-firestore)
114+
115+
- [BigQuery](https://github.com/googleapis/google-cloud-php-bigquery)
115116
- [Datastore](https://github.com/googleapis/google-cloud-php-datastore)
116-
- [Pubsub](https://github.com/googleapis/google-cloud-php-pubsub)
117+
- [Firestore](https://github.com/googleapis/google-cloud-php-firestore)
117118
- [Logging](https://github.com/googleapis/google-cloud-php-logging)
118-
- [Translate](https://github.com/googleapis/google-cloud-php-translate)
119-
- [Bigquery](https://github.com/googleapis/google-cloud-php-bigquery)
119+
- [Spanner](https://github.com/googleapis/google-cloud-php-spanner)
120120
- [Storage](https://github.com/googleapis/google-cloud-php-storage)
121121

122122
We recommend to visit the Check the [client documentation][php-ref-docs] for the client library you're using

‎BigQuery/src/BigQueryClient.php‎

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -93,12 +93,50 @@ class BigQueryClient
9393
* fetcher instance.
9494
* @type callable $httpHandler A handler used to deliver Psr7 requests.
9595
* Only valid for requests sent over REST.
96-
* @type array $keyFile The contents of the service account credentials
97-
* .json file retrieved from the Google Developer's Console.
98-
* Ex: `json_decode(file_get_contents($path), true)`.
99-
* @type string $keyFilePath The full path to your service account
100-
* credentials .json file retrieved from the Google Developers
101-
* Console.
96+
* @type array $keyFile [DEPRECATED]
97+
* @deprecated This option is being deprecated because of a potential security risk.
98+
* This option does not validate the credential configuration. The security
99+
* risk occurs when a credential configuration is accepted from a source
100+
* that is not under your control and used without validation on your side.
101+
* If you know that you will be loading credential configurations of a
102+
* specific type, it is recommended to create the credentials directly and
103+
* configure them using the `credentialsFetcher` option instead.
104+
* ```
105+
* use Google\Auth\Credentials\ServiceAccountCredentials;
106+
* $credentialsFetcher = new ServiceAccountCredentials($scopes, $json);
107+
* $creds = new BigQueryClient(['credentialsFetcher' => $creds]);
108+
* ```
109+
* This will ensure that an unexpected credential type with potential for
110+
* malicious intent is not loaded unintentionally. You might still have to do
111+
* validation for certain credential types.
112+
* If you are loading your credential configuration from an untrusted source and have
113+
* not mitigated the risks (e.g. by validating the configuration yourself), make
114+
* these changes as soon as possible to prevent security risks to your environment.
115+
* Regardless of the method used, it is always your responsibility to validate
116+
* configurations received from external sources.
117+
* @see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
118+
* @type string $keyFilePath [DEPRECATED]
119+
* @deprecated This option is being deprecated because of a potential security risk.
120+
* This option does not validate the credential configuration. The security
121+
* risk occurs when a credential configuration is accepted from a source
122+
* that is not under your control and used without validation on your side.
123+
* If you know that you will be loading credential configurations of a
124+
* specific type, it is recommended to create the credentials directly and
125+
* configure them using the `credentialsFetcher` option instead.
126+
* ```
127+
* use Google\Auth\Credentials\ServiceAccountCredentials;
128+
* $credentialsFetcher = new ServiceAccountCredentials($scopes, $json);
129+
* $creds = new BigQueryClient(['credentialsFetcher' => $creds]);
130+
* ```
131+
* This will ensure that an unexpected credential type with potential for
132+
* malicious intent is not loaded unintentionally. You might still have to do
133+
* validation for certain credential types.
134+
* If you are loading your credential configuration from an untrusted source and have
135+
* not mitigated the risks (e.g. by validating the configuration yourself), make
136+
* these changes as soon as possible to prevent security risks to your environment.
137+
* Regardless of the method used, it is always your responsibility to validate
138+
* configurations received from external sources.
139+
* @see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
102140
* @type float $requestTimeout Seconds to wait before timing out the
103141
* request. **Defaults to** `0` with REST and `60` with gRPC.
104142
* @type int $retries Number of retries for a failed request. **Defaults

‎Bigtable/src/BigtableClient.php‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -91,15 +91,23 @@ class BigtableClient
9191
* @type string $apiEndpoint The address of the API remote host. May
9292
* optionally include the port, formatted as "<uri>:<port>".
9393
* **Defaults to** 'bigtable.googleapis.com:443'.
94-
* @type string|array|FetchAuthTokenInterface|CredentialsWrapper $credentials
95-
* The credentials to be used by the client to authorize API calls.
96-
* This option accepts either a path to a credentials file, or a
97-
* decoded credentials file as a PHP array.
98-
* *Advanced usage*: In addition, this option can also accept a
99-
* pre-constructed {@see FetchAuthTokenInterface} object
100-
* or {@see CredentialsWrapper} object. Note that when one of
101-
* these objects are provided, any settings in
102-
* `$config['credentialsConfig']` will be ignored.
94+
* @type FetchAuthTokenInterface|CredentialsWrapper $credentials
95+
* This option should only be used with a pre-constructed
96+
* {@see FetchAuthTokenInterface} or {@see CredentialsWrapper} object. Note that
97+
* when one of these objects are provided, any settings in $credentialsConfig will
98+
* be ignored.
99+
* **Important**: If you are providing a path to a credentials file, or a decoded
100+
* credentials file as a PHP array, this usage is now DEPRECATED. Providing an
101+
* unvalidated credential configuration to Google APIs can compromise the security
102+
* of your systems and data. It is recommended to create the credentials explicitly
103+
* ```
104+
* use Google\Auth\Credentials\ServiceAccountCredentials;
105+
* use Google\Cloud\Bigtable\BigtableClient;
106+
* $creds = new ServiceAccountCredentials($scopes, $json);
107+
* $options = new BigtableClient(['credentials' => $creds]);
108+
* ```
109+
* {@see
110+
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
103111
* @type array $credentialsConfig Options used to configure credentials,
104112
* including auth token caching, for the client. For a full list of
105113
* supporting configuration options, see {@see CredentialsWrapper}.

‎Core/src/RequestWrapperTrait.php‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,9 +84,7 @@ trait RequestWrapperTrait
8484
* @type array $authCacheOptions Cache configuration options.
8585
* @type FetchAuthTokenInterface $credentialsFetcher A credentials
8686
* fetcher instance.
87-
* @type array $keyFile The contents of the service account credentials
88-
* .json file retrieved from the Google Developer's Console.
89-
* Ex: `json_decode(file_get_contents($path), true)`.
87+
* @type array $keyFile [DEPRECATED] use `credentialsFetcher` option.
9088
* @type float $requestTimeout Seconds to wait before timing out the
9189
* request. **Defaults to** `0` with REST and `60` with gRPC.
9290
* @type int $retries Number of retries for a failed request.

‎Core/src/ServiceBuilder.php‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -88,12 +88,8 @@ class ServiceBuilder
8888
* requests specifically for authentication.
8989
* @type callable $httpHandler A handler used to deliver Psr7 requests.
9090
* Only valid for requests sent over REST.
91-
* @type array $keyFile The contents of the service account credentials
92-
* .json file retrieved from the Google Developer's Console.
93-
* Ex: `json_decode(file_get_contents($path), true)`.
94-
* @type string $keyFilePath The full path to your service account
95-
* credentials .json file retrieved from the Google Developers
96-
* Console.
91+
* @type array $keyFile [DEPRECATED]
92+
* @type string $keyFilePath [DEPRECATED]
9793
* @type int $retries Number of retries for a failed request.
9894
* **Defaults to** `3`.
9995
* @type array $scopes Scopes to be used for the request.

‎Datastore/src/DatastoreClient.php‎

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -130,12 +130,50 @@ class DatastoreClient
130130
* fetcher instance.
131131
* @type callable $httpHandler A handler used to deliver Psr7 requests.
132132
* Only valid for requests sent over REST.
133-
* @type array $keyFile The contents of the service account credentials
134-
* .json file retrieved from the Google Developer's Console.
135-
* Ex: `json_decode(file_get_contents($path), true)`.
136-
* @type string $keyFilePath The full path to your service account
137-
* credentials .json file retrieved from the Google Developers
138-
* Console.
133+
* @type array $keyFile [DEPRECATED]
134+
* @deprecated This option is being deprecated because of a potential security risk.
135+
* This option does not validate the credential configuration. The security
136+
* risk occurs when a credential configuration is accepted from a source
137+
* that is not under your control and used without validation on your side.
138+
* If you know that you will be loading credential configurations of a
139+
* specific type, it is recommended to create the credentials directly and
140+
* configure them using the `credentialsFetcher` option instead.
141+
* ```
142+
* use Google\Auth\Credentials\ServiceAccountCredentials;
143+
* $credentialsFetcher = new ServiceAccountCredentials($scopes, $json);
144+
* $creds = new DatastoreClient(['credentialsFetcher' => $creds]);
145+
* ```
146+
* This will ensure that an unexpected credential type with potential for
147+
* malicious intent is not loaded unintentionally. You might still have to do
148+
* validation for certain credential types.
149+
* If you are loading your credential configuration from an untrusted source and have
150+
* not mitigated the risks (e.g. by validating the configuration yourself), make
151+
* these changes as soon as possible to prevent security risks to your environment.
152+
* Regardless of the method used, it is always your responsibility to validate
153+
* configurations received from external sources.
154+
* @see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
155+
* @type string $keyFilePath [DEPRECATED]
156+
* @deprecated This option is being deprecated because of a potential security risk.
157+
* This option does not validate the credential configuration. The security
158+
* risk occurs when a credential configuration is accepted from a source
159+
* that is not under your control and used without validation on your side.
160+
* If you know that you will be loading credential configurations of a
161+
* specific type, it is recommended to create the credentials directly and
162+
* configure them using the `credentialsFetcher` option instead.
163+
* ```
164+
* use Google\Auth\Credentials\ServiceAccountCredentials;
165+
* $credentialsFetcher = new ServiceAccountCredentials($scopes, $json);
166+
* $creds = new DatastoreClient(['credentialsFetcher' => $creds]);
167+
* ```
168+
* This will ensure that an unexpected credential type with potential for
169+
* malicious intent is not loaded unintentionally. You might still have to do
170+
* validation for certain credential types.
171+
* If you are loading your credential configuration from an untrusted source and have
172+
* not mitigated the risks (e.g. by validating the configuration yourself), make
173+
* these changes as soon as possible to prevent security risks to your environment.
174+
* Regardless of the method used, it is always your responsibility to validate
175+
* configurations received from external sources.
176+
* @see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
139177
* @type float $requestTimeout Seconds to wait before timing out the
140178
* request. **Defaults to** `0` with REST and `60` with gRPC.
141179
* @type int $retries Number of retries for a failed request. **Defaults

0 commit comments

Comments
 (0)