[8.x] Introducing Job Encryption

src/Illuminate/Contracts/Queue/UsesEncryption.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace Illuminate\Contracts\Queue;
+
+interface UsesEncryption
+{
+    //
+}

src/Illuminate/Queue/CallQueuedHandler.php

@@ -12,7 +12,9 @@
 use Illuminate\Contracts\Queue\ShouldBeUniqueUntilProcessing;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Pipeline\Pipeline;
+use Illuminate\Support\Str;
 use ReflectionClass;
+use RuntimeException;
 
 class CallQueuedHandler
 {
@@ -54,7 +56,7 @@ public function call(Job $job, array $data)
     {
         try {
             $command = $this->setJobInstanceIfNecessary(
-                $job, unserialize($data['command'])
+                $job, $this->getCommand($data)
             );
         } catch (ModelNotFoundException $e) {
             return $this->handleModelNotFound($job, $e);
@@ -226,7 +228,7 @@ protected function handleModelNotFound(Job $job, $e)
      */
     public function failed(array $data, $e, string $uuid)
     {
-        $command = unserialize($data['command']);
+        $command = $this->getCommand($data);
 
         if (! $command instanceof ShouldBeUniqueUntilProcessing) {
             $this->ensureUniqueJobLockIsReleased($command);
@@ -272,4 +274,23 @@ protected function ensureChainCatchCallbacksAreInvoked(string $uuid, $command, $
             $command->invokeChainCatchCallbacks($e);
         }
     }
+
+    /**
+     * Get the command from the given payload.
+     *
+     * @param  array  $data
+     * @return mixed
+     */
+    protected function getCommand(array $data)
+    {
+        if (Str::startsWith($data['command'], 'O:')) {
+            return unserialize($data['command']);
+        }
+
+        if ($this->container->bound('encrypter')) {
+            return unserialize($this->container['encrypter']->decrypt($data['command']));
+        }
+
+        throw new RuntimeException('Unable to extract job payload.');
+    }
 }

src/Illuminate/Queue/Queue.php

@@ -5,6 +5,7 @@
 use Closure;
 use DateTimeInterface;
 use Illuminate\Container\Container;
+use Illuminate\Contracts\Queue\UsesEncryption;
 use Illuminate\Support\Arr;
 use Illuminate\Support\InteractsWithTime;
 use Illuminate\Support\Str;
@@ -149,10 +150,14 @@ protected function createObjectPayload($job, $queue)
             ],
         ]);
 
+        $command = $job instanceof UsesEncryption && $this->container->bound('encrypter')
+                    ? $this->container['encrypter']->encrypt(serialize(clone $job))
+                    : serialize(clone $job);
+
         return array_merge($payload, [
             'data' => [
                 'commandName' => get_class($job),
-                'command' => serialize(clone $job),
+                'command' => $command,
             ],
         ]);
     }

tests/Integration/Queue/JobEncryptionTest.php

@@ -0,0 +1,119 @@
+<?php
+
+namespace Illuminate\Tests\Integration\Queue;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Contracts\Queue\UsesEncryption;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
+use Illuminate\Tests\Integration\Database\DatabaseTestCase;
+use Mockery as m;
+
+/**
+ * @group integration
+ */
+class JobEncryptionTest extends DatabaseTestCase
+{
+    protected function getEnvironmentSetUp($app)
+    {
+        parent::getEnvironmentSetUp($app);
+
+        $app['config']->set('app.key', Str::random(32));
+        $app['config']->set('app.debug', 'true');
+        $app['config']->set('queue.default', 'database');
+    }
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Schema::create('jobs', function (Blueprint $table) {
+            $table->bigIncrements('id');
+            $table->string('queue')->index();
+            $table->longText('payload');
+            $table->unsignedTinyInteger('attempts');
+            $table->unsignedInteger('reserved_at')->nullable();
+            $table->unsignedInteger('available_at');
+            $table->unsignedInteger('created_at');
+        });
+    }
+
+    protected function tearDown(): void
+    {
+        JobEncryptionTestEncryptedJob::$ran = false;
+        JobEncryptionTestNonEncryptedJob::$ran = false;
+
+        m::close();
+    }
+
+    public function testEncryptedJobPayloadIsStoredEncrypted()
+    {
+        Bus::dispatch(new JobEncryptionTestEncryptedJob);
+
+        $this->assertNotEmpty(
+            decrypt(json_decode(DB::table('jobs')->first()->payload)->data->command)
+        );
+    }
+
+    public function testNonEncryptedJobPayloadIsStoredRaw()
+    {
+        Bus::dispatch(new JobEncryptionTestNonEncryptedJob);
+
+        $this->expectExceptionMessage('The payload is invalid');
+
+        $this->assertInstanceOf(JobEncryptionTestNonEncryptedJob::class,
+            unserialize(json_decode(DB::table('jobs')->first()->payload)->data->command)
+        );
+
+        decrypt(json_decode(DB::table('jobs')->first()->payload)->data->command);
+    }
+
+    public function testQueueCanProcessEncryptedJob()
+    {
+        Bus::dispatch(new JobEncryptionTestEncryptedJob);
+
+        Queue::pop()->fire();
+
+        $this->assertTrue(JobEncryptionTestEncryptedJob::$ran);
+    }
+
+    public function testQueueCanProcessUnEncryptedJob()
+    {
+        Bus::dispatch(new JobEncryptionTestNonEncryptedJob);
+
+        Queue::pop()->fire();
+
+        $this->assertTrue(JobEncryptionTestNonEncryptedJob::$ran);
+    }
+}
+
+class JobEncryptionTestEncryptedJob implements ShouldQueue, UsesEncryption
+{
+    use Dispatchable, Queueable;
+
+    public static $ran = false;
+
+    public function handle()
+    {
+        static::$ran = true;
+    }
+}
+
+
+class JobEncryptionTestNonEncryptedJob implements ShouldQueue
+{
+    use Dispatchable, Queueable;
+
+    public static $ran = false;
+
+    public function handle()
+    {
+        static::$ran = true;
+    }
+}