[Summary view]

Differences Between: [Versions 310 and 403] [Versions 311 and 403] [Versions 39 and 403] [Versions 400 and 403] [Versions 401 and 403] [Versions 402 and 403]

   1  <?php
   2  
   3  namespace Firebase\JWT;
   4  
   5  use ArrayAccess;
   6  use DateTime;
   7  use DomainException;
   8  use Exception;
   9  use InvalidArgumentException;
  10  use OpenSSLAsymmetricKey;
  11  use OpenSSLCertificate;
  12  use stdClass;
  13  use UnexpectedValueException;
  14  
  15  /**
  16   * JSON Web Token implementation, based on this spec:
  17   * https://tools.ietf.org/html/rfc7519
  18   *
  19   * PHP version 5
  20   *
  21   * @category Authentication
  22   * @package  Authentication_JWT
  23   * @author   Neuman Vong <neuman@twilio.com>
  24   * @author   Anant Narayanan <anant@php.net>
  25   * @license  http://opensource.org/licenses/BSD-3-Clause 3-clause BSD
  26   * @link     https://github.com/firebase/php-jwt
  27   */
  28  class JWT
  29  {
  30      private const ASN1_INTEGER = 0x02;
  31      private const ASN1_SEQUENCE = 0x10;
  32      private const ASN1_BIT_STRING = 0x03;
  33  
  34      /**
  35       * When checking nbf, iat or expiration times,
  36       * we want to provide some extra leeway time to
  37       * account for clock skew.
  38       *
  39       * @var int
  40       */
  41      public static $leeway = 0;
  42  
  43      /**
  44       * Allow the current timestamp to be specified.
  45       * Useful for fixing a value within unit testing.
  46       * Will default to PHP time() value if null.
  47       *
  48       * @var ?int
  49       */
  50      public static $timestamp = null;
  51  
  52      /**
  53       * @var array<string, string[]>
  54       */
  55      public static $supported_algs = [
  56          'ES384' => ['openssl', 'SHA384'],
  57          'ES256' => ['openssl', 'SHA256'],
  58          'ES256K' => ['openssl', 'SHA256'],
  59          'HS256' => ['hash_hmac', 'SHA256'],
  60          'HS384' => ['hash_hmac', 'SHA384'],
  61          'HS512' => ['hash_hmac', 'SHA512'],
  62          'RS256' => ['openssl', 'SHA256'],
  63          'RS384' => ['openssl', 'SHA384'],
  64          'RS512' => ['openssl', 'SHA512'],
  65          'EdDSA' => ['sodium_crypto', 'EdDSA'],
  66      ];
  67  
  68      /**
  69       * Decodes a JWT string into a PHP object.
  70       *
  71       * @param string                 $jwt            The JWT
  72       * @param Key|ArrayAccess<string,Key>|array<string,Key> $keyOrKeyArray  The Key or associative array of key IDs
  73       *                                                                      (kid) to Key objects.
  74       *                                                                      If the algorithm used is asymmetric, this is
  75       *                                                                      the public key.
  76       *                                                                      Each Key object contains an algorithm and
  77       *                                                                      matching key.
  78       *                                                                      Supported algorithms are 'ES384','ES256',
  79       *                                                                      'HS256', 'HS384', 'HS512', 'RS256', 'RS384'
  80       *                                                                      and 'RS512'.
  81       * @param stdClass               $headers                               Optional. Populates stdClass with headers.
  82       *
  83       * @return stdClass The JWT's payload as a PHP object
  84       *
  85       * @throws InvalidArgumentException     Provided key/key-array was empty or malformed
  86       * @throws DomainException              Provided JWT is malformed
  87       * @throws UnexpectedValueException     Provided JWT was invalid
  88       * @throws SignatureInvalidException    Provided JWT was invalid because the signature verification failed
  89       * @throws BeforeValidException         Provided JWT is trying to be used before it's eligible as defined by 'nbf'
  90       * @throws BeforeValidException         Provided JWT is trying to be used before it's been created as defined by 'iat'
  91       * @throws ExpiredException             Provided JWT has since expired, as defined by the 'exp' claim
  92       *
  93       * @uses jsonDecode
  94       * @uses urlsafeB64Decode
  95       */
  96      public static function decode(
  97          string $jwt,
  98          $keyOrKeyArray,
  99          stdClass &$headers = null
 100      ): stdClass {
 101          // Validate JWT
 102          $timestamp = \is_null(static::$timestamp) ? \time() : static::$timestamp;
 103  
 104          if (empty($keyOrKeyArray)) {
 105              throw new InvalidArgumentException('Key may not be empty');
 106          }
 107          $tks = \explode('.', $jwt);
 108          if (\count($tks) !== 3) {
 109              throw new UnexpectedValueException('Wrong number of segments');
 110          }
 111          list($headb64, $bodyb64, $cryptob64) = $tks;
 112          $headerRaw = static::urlsafeB64Decode($headb64);
 113          if (null === ($header = static::jsonDecode($headerRaw))) {
 114              throw new UnexpectedValueException('Invalid header encoding');
 115          }
 116          if ($headers !== null) {
 117              $headers = $header;
 118          }
 119          $payloadRaw = static::urlsafeB64Decode($bodyb64);
 120          if (null === ($payload = static::jsonDecode($payloadRaw))) {
 121              throw new UnexpectedValueException('Invalid claims encoding');
 122          }
 123          if (\is_array($payload)) {
 124              // prevent PHP Fatal Error in edge-cases when payload is empty array
 125              $payload = (object) $payload;
 126          }
 127          if (!$payload instanceof stdClass) {
 128              throw new UnexpectedValueException('Payload must be a JSON object');
 129          }
 130          $sig = static::urlsafeB64Decode($cryptob64);
 131          if (empty($header->alg)) {
 132              throw new UnexpectedValueException('Empty algorithm');
 133          }
 134          if (empty(static::$supported_algs[$header->alg])) {
 135              throw new UnexpectedValueException('Algorithm not supported');
 136          }
 137  
 138          $key = self::getKey($keyOrKeyArray, property_exists($header, 'kid') ? $header->kid : null);
 139  
 140          // Check the algorithm
 141          if (!self::constantTimeEquals($key->getAlgorithm(), $header->alg)) {
 142              // See issue #351
 143              throw new UnexpectedValueException('Incorrect key for this algorithm');
 144          }
 145          if (\in_array($header->alg, ['ES256', 'ES256K', 'ES384'], true)) {
 146              // OpenSSL expects an ASN.1 DER sequence for ES256/ES256K/ES384 signatures
 147              $sig = self::signatureToDER($sig);
 148          }
 149          if (!self::verify("{$headb64}.{$bodyb64}", $sig, $key->getKeyMaterial(), $header->alg)) {
 150              throw new SignatureInvalidException('Signature verification failed');
 151          }
 152  
 153          // Check the nbf if it is defined. This is the time that the
 154          // token can actually be used. If it's not yet that time, abort.
 155          if (isset($payload->nbf) && floor($payload->nbf) > ($timestamp + static::$leeway)) {
 156              throw new BeforeValidException(
 157                  'Cannot handle token with nbf prior to ' . \date(DateTime::ISO8601, (int) $payload->nbf)
 158              );
 159          }
 160  
 161          // Check that this token has been created before 'now'. This prevents
 162          // using tokens that have been created for later use (and haven't
 163          // correctly used the nbf claim).
 164          if (!isset($payload->nbf) && isset($payload->iat) && floor($payload->iat) > ($timestamp + static::$leeway)) {
 165              throw new BeforeValidException(
 166                  'Cannot handle token with iat prior to ' . \date(DateTime::ISO8601, (int) $payload->iat)
 167              );
 168          }
 169  
 170          // Check if this token has expired.
 171          if (isset($payload->exp) && ($timestamp - static::$leeway) >= $payload->exp) {
 172              throw new ExpiredException('Expired token');
 173          }
 174  
 175          return $payload;
 176      }
 177  
 178      /**
 179       * Converts and signs a PHP array into a JWT string.
 180       *
 181       * @param array<mixed>          $payload PHP array
 182       * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate $key The secret key.
 183       * @param string                $alg     Supported algorithms are 'ES384','ES256', 'ES256K', 'HS256',
 184       *                                       'HS384', 'HS512', 'RS256', 'RS384', and 'RS512'
 185       * @param string                $keyId
 186       * @param array<string, string> $head    An array with header elements to attach
 187       *
 188       * @return string A signed JWT
 189       *
 190       * @uses jsonEncode
 191       * @uses urlsafeB64Encode
 192       */
 193      public static function encode(
 194          array $payload,
 195          $key,
 196          string $alg,
 197          string $keyId = null,
 198          array $head = null
 199      ): string {
 200          $header = ['typ' => 'JWT', 'alg' => $alg];
 201          if ($keyId !== null) {
 202              $header['kid'] = $keyId;
 203          }
 204          if (isset($head) && \is_array($head)) {
 205              $header = \array_merge($head, $header);
 206          }
 207          $segments = [];
 208          $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($header));
 209          $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($payload));
 210          $signing_input = \implode('.', $segments);
 211  
 212          $signature = static::sign($signing_input, $key, $alg);
 213          $segments[] = static::urlsafeB64Encode($signature);
 214  
 215          return \implode('.', $segments);
 216      }
 217  
 218      /**
 219       * Sign a string with a given key and algorithm.
 220       *
 221       * @param string $msg  The message to sign
 222       * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate  $key  The secret key.
 223       * @param string $alg  Supported algorithms are 'EdDSA', 'ES384', 'ES256', 'ES256K', 'HS256',
 224       *                    'HS384', 'HS512', 'RS256', 'RS384', and 'RS512'
 225       *
 226       * @return string An encrypted message
 227       *
 228       * @throws DomainException Unsupported algorithm or bad key was specified
 229       */
 230      public static function sign(
 231          string $msg,
 232          $key,
 233          string $alg
 234      ): string {
 235          if (empty(static::$supported_algs[$alg])) {
 236              throw new DomainException('Algorithm not supported');
 237          }
 238          list($function, $algorithm) = static::$supported_algs[$alg];
 239          switch ($function) {
 240              case 'hash_hmac':
 241                  if (!\is_string($key)) {
 242                      throw new InvalidArgumentException('key must be a string when using hmac');
 243                  }
 244                  return \hash_hmac($algorithm, $msg, $key, true);
 245              case 'openssl':
 246                  $signature = '';
 247                  $success = \openssl_sign($msg, $signature, $key, $algorithm); // @phpstan-ignore-line
 248                  if (!$success) {
 249                      throw new DomainException('OpenSSL unable to sign data');
 250                  }
 251                  if ($alg === 'ES256' || $alg === 'ES256K') {
 252                      $signature = self::signatureFromDER($signature, 256);
 253                  } elseif ($alg === 'ES384') {
 254                      $signature = self::signatureFromDER($signature, 384);
 255                  }
 256                  return $signature;
 257              case 'sodium_crypto':
 258                  if (!\function_exists('sodium_crypto_sign_detached')) {
 259                      throw new DomainException('libsodium is not available');
 260                  }
 261                  if (!\is_string($key)) {
 262                      throw new InvalidArgumentException('key must be a string when using EdDSA');
 263                  }
 264                  try {
 265                      // The last non-empty line is used as the key.
 266                      $lines = array_filter(explode("\n", $key));
 267                      $key = base64_decode((string) end($lines));
 268                      if (\strlen($key) === 0) {
 269                          throw new DomainException('Key cannot be empty string');
 270                      }
 271                      return sodium_crypto_sign_detached($msg, $key);
 272                  } catch (Exception $e) {
 273                      throw new DomainException($e->getMessage(), 0, $e);
 274                  }
 275          }
 276  
 277          throw new DomainException('Algorithm not supported');
 278      }
 279  
 280      /**
 281       * Verify a signature with the message, key and method. Not all methods
 282       * are symmetric, so we must have a separate verify and sign method.
 283       *
 284       * @param string $msg         The original message (header and body)
 285       * @param string $signature   The original signature
 286       * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate  $keyMaterial For Ed*, ES*, HS*, a string key works. for RS*, must be an instance of OpenSSLAsymmetricKey
 287       * @param string $alg         The algorithm
 288       *
 289       * @return bool
 290       *
 291       * @throws DomainException Invalid Algorithm, bad key, or OpenSSL failure
 292       */
 293      private static function verify(
 294          string $msg,
 295          string $signature,
 296          $keyMaterial,
 297          string $alg
 298      ): bool {
 299          if (empty(static::$supported_algs[$alg])) {
 300              throw new DomainException('Algorithm not supported');
 301          }
 302  
 303          list($function, $algorithm) = static::$supported_algs[$alg];
 304          switch ($function) {
 305              case 'openssl':
 306                  $success = \openssl_verify($msg, $signature, $keyMaterial, $algorithm); // @phpstan-ignore-line
 307                  if ($success === 1) {
 308                      return true;
 309                  }
 310                  if ($success === 0) {
 311                      return false;
 312                  }
 313                  // returns 1 on success, 0 on failure, -1 on error.
 314                  throw new DomainException(
 315                      'OpenSSL error: ' . \openssl_error_string()
 316                  );
 317              case 'sodium_crypto':
 318                  if (!\function_exists('sodium_crypto_sign_verify_detached')) {
 319                      throw new DomainException('libsodium is not available');
 320                  }
 321                  if (!\is_string($keyMaterial)) {
 322                      throw new InvalidArgumentException('key must be a string when using EdDSA');
 323                  }
 324                  try {
 325                      // The last non-empty line is used as the key.
 326                      $lines = array_filter(explode("\n", $keyMaterial));
 327                      $key = base64_decode((string) end($lines));
 328                      if (\strlen($key) === 0) {
 329                          throw new DomainException('Key cannot be empty string');
 330                      }
 331                      if (\strlen($signature) === 0) {
 332                          throw new DomainException('Signature cannot be empty string');
 333                      }
 334                      return sodium_crypto_sign_verify_detached($signature, $msg, $key);
 335                  } catch (Exception $e) {
 336                      throw new DomainException($e->getMessage(), 0, $e);
 337                  }
 338              case 'hash_hmac':
 339              default:
 340                  if (!\is_string($keyMaterial)) {
 341                      throw new InvalidArgumentException('key must be a string when using hmac');
 342                  }
 343                  $hash = \hash_hmac($algorithm, $msg, $keyMaterial, true);
 344                  return self::constantTimeEquals($hash, $signature);
 345          }
 346      }
 347  
 348      /**
 349       * Decode a JSON string into a PHP object.
 350       *
 351       * @param string $input JSON string
 352       *
 353       * @return mixed The decoded JSON string
 354       *
 355       * @throws DomainException Provided string was invalid JSON
 356       */
 357      public static function jsonDecode(string $input)
 358      {
 359          $obj = \json_decode($input, false, 512, JSON_BIGINT_AS_STRING);
 360  
 361          if ($errno = \json_last_error()) {
 362              self::handleJsonError($errno);
 363          } elseif ($obj === null && $input !== 'null') {
 364              throw new DomainException('Null result with non-null input');
 365          }
 366          return $obj;
 367      }
 368  
 369      /**
 370       * Encode a PHP array into a JSON string.
 371       *
 372       * @param array<mixed> $input A PHP array
 373       *
 374       * @return string JSON representation of the PHP array
 375       *
 376       * @throws DomainException Provided object could not be encoded to valid JSON
 377       */
 378      public static function jsonEncode(array $input): string
 379      {
 380          if (PHP_VERSION_ID >= 50400) {
 381              $json = \json_encode($input, \JSON_UNESCAPED_SLASHES);
 382          } else {
 383              // PHP 5.3 only
 384              $json = \json_encode($input);
 385          }
 386          if ($errno = \json_last_error()) {
 387              self::handleJsonError($errno);
 388          } elseif ($json === 'null') {
 389              throw new DomainException('Null result with non-null input');
 390          }
 391          if ($json === false) {
 392              throw new DomainException('Provided object could not be encoded to valid JSON');
 393          }
 394          return $json;
 395      }
 396  
 397      /**
 398       * Decode a string with URL-safe Base64.
 399       *
 400       * @param string $input A Base64 encoded string
 401       *
 402       * @return string A decoded string
 403       *
 404       * @throws InvalidArgumentException invalid base64 characters
 405       */
 406      public static function urlsafeB64Decode(string $input): string
 407      {
 408          return \base64_decode(self::convertBase64UrlToBase64($input));
 409      }
 410  
 411      /**
 412       * Convert a string in the base64url (URL-safe Base64) encoding to standard base64.
 413       *
 414       * @param string $input A Base64 encoded string with URL-safe characters (-_ and no padding)
 415       *
 416       * @return string A Base64 encoded string with standard characters (+/) and padding (=), when
 417       * needed.
 418       *
 419       * @see https://www.rfc-editor.org/rfc/rfc4648
 420       */
 421      public static function convertBase64UrlToBase64(string $input): string
 422      {
 423          $remainder = \strlen($input) % 4;
 424          if ($remainder) {
 425              $padlen = 4 - $remainder;
 426              $input .= \str_repeat('=', $padlen);
 427          }
 428          return \strtr($input, '-_', '+/');
 429      }
 430  
 431      /**
 432       * Encode a string with URL-safe Base64.
 433       *
 434       * @param string $input The string you want encoded
 435       *
 436       * @return string The base64 encode of what you passed in
 437       */
 438      public static function urlsafeB64Encode(string $input): string
 439      {
 440          return \str_replace('=', '', \strtr(\base64_encode($input), '+/', '-_'));
 441      }
 442  
 443  
 444      /**
 445       * Determine if an algorithm has been provided for each Key
 446       *
 447       * @param Key|ArrayAccess<string,Key>|array<string,Key> $keyOrKeyArray
 448       * @param string|null            $kid
 449       *
 450       * @throws UnexpectedValueException
 451       *
 452       * @return Key
 453       */
 454      private static function getKey(
 455          $keyOrKeyArray,
 456          ?string $kid
 457      ): Key {
 458          if ($keyOrKeyArray instanceof Key) {
 459              return $keyOrKeyArray;
 460          }
 461  
 462          if (empty($kid) && $kid !== '0') {
 463              throw new UnexpectedValueException('"kid" empty, unable to lookup correct key');
 464          }
 465  
 466          if ($keyOrKeyArray instanceof CachedKeySet) {
 467              // Skip "isset" check, as this will automatically refresh if not set
 468              return $keyOrKeyArray[$kid];
 469          }
 470  
 471          if (!isset($keyOrKeyArray[$kid])) {
 472              throw new UnexpectedValueException('"kid" invalid, unable to lookup correct key');
 473          }
 474  
 475          return $keyOrKeyArray[$kid];
 476      }
 477  
 478      /**
 479       * @param string $left  The string of known length to compare against
 480       * @param string $right The user-supplied string
 481       * @return bool
 482       */
 483      public static function constantTimeEquals(string $left, string $right): bool
 484      {
 485          if (\function_exists('hash_equals')) {
 486              return \hash_equals($left, $right);
 487          }
 488          $len = \min(self::safeStrlen($left), self::safeStrlen($right));
 489  
 490          $status = 0;
 491          for ($i = 0; $i < $len; $i++) {
 492              $status |= (\ord($left[$i]) ^ \ord($right[$i]));
 493          }
 494          $status |= (self::safeStrlen($left) ^ self::safeStrlen($right));
 495  
 496          return ($status === 0);
 497      }
 498  
 499      /**
 500       * Helper method to create a JSON error.
 501       *
 502       * @param int $errno An error number from json_last_error()
 503       *
 504       * @throws DomainException
 505       *
 506       * @return void
 507       */
 508      private static function handleJsonError(int $errno): void
 509      {
 510          $messages = [
 511              JSON_ERROR_DEPTH => 'Maximum stack depth exceeded',
 512              JSON_ERROR_STATE_MISMATCH => 'Invalid or malformed JSON',
 513              JSON_ERROR_CTRL_CHAR => 'Unexpected control character found',
 514              JSON_ERROR_SYNTAX => 'Syntax error, malformed JSON',
 515              JSON_ERROR_UTF8 => 'Malformed UTF-8 characters' //PHP >= 5.3.3
 516          ];
 517          throw new DomainException(
 518              isset($messages[$errno])
 519              ? $messages[$errno]
 520              : 'Unknown JSON error: ' . $errno
 521          );
 522      }
 523  
 524      /**
 525       * Get the number of bytes in cryptographic strings.
 526       *
 527       * @param string $str
 528       *
 529       * @return int
 530       */
 531      private static function safeStrlen(string $str): int
 532      {
 533          if (\function_exists('mb_strlen')) {
 534              return \mb_strlen($str, '8bit');
 535          }
 536          return \strlen($str);
 537      }
 538  
 539      /**
 540       * Convert an ECDSA signature to an ASN.1 DER sequence
 541       *
 542       * @param   string $sig The ECDSA signature to convert
 543       * @return  string The encoded DER object
 544       */
 545      private static function signatureToDER(string $sig): string
 546      {
 547          // Separate the signature into r-value and s-value
 548          $length = max(1, (int) (\strlen($sig) / 2));
 549          list($r, $s) = \str_split($sig, $length);
 550  
 551          // Trim leading zeros
 552          $r = \ltrim($r, "\x00");
 553          $s = \ltrim($s, "\x00");
 554  
 555          // Convert r-value and s-value from unsigned big-endian integers to
 556          // signed two's complement
 557          if (\ord($r[0]) > 0x7f) {
 558              $r = "\x00" . $r;
 559          }
 560          if (\ord($s[0]) > 0x7f) {
 561              $s = "\x00" . $s;
 562          }
 563  
 564          return self::encodeDER(
 565              self::ASN1_SEQUENCE,
 566              self::encodeDER(self::ASN1_INTEGER, $r) .
 567              self::encodeDER(self::ASN1_INTEGER, $s)
 568          );
 569      }
 570  
 571      /**
 572       * Encodes a value into a DER object.
 573       *
 574       * @param   int     $type DER tag
 575       * @param   string  $value the value to encode
 576       *
 577       * @return  string  the encoded object
 578       */
 579      private static function encodeDER(int $type, string $value): string
 580      {
 581          $tag_header = 0;
 582          if ($type === self::ASN1_SEQUENCE) {
 583              $tag_header |= 0x20;
 584          }
 585  
 586          // Type
 587          $der = \chr($tag_header | $type);
 588  
 589          // Length
 590          $der .= \chr(\strlen($value));
 591  
 592          return $der . $value;
 593      }
 594  
 595      /**
 596       * Encodes signature from a DER object.
 597       *
 598       * @param   string  $der binary signature in DER format
 599       * @param   int     $keySize the number of bits in the key
 600       *
 601       * @return  string  the signature
 602       */
 603      private static function signatureFromDER(string $der, int $keySize): string
 604      {
 605          // OpenSSL returns the ECDSA signatures as a binary ASN.1 DER SEQUENCE
 606          list($offset, $_) = self::readDER($der);
 607          list($offset, $r) = self::readDER($der, $offset);
 608          list($offset, $s) = self::readDER($der, $offset);
 609  
 610          // Convert r-value and s-value from signed two's compliment to unsigned
 611          // big-endian integers
 612          $r = \ltrim($r, "\x00");
 613          $s = \ltrim($s, "\x00");
 614  
 615          // Pad out r and s so that they are $keySize bits long
 616          $r = \str_pad($r, $keySize / 8, "\x00", STR_PAD_LEFT);
 617          $s = \str_pad($s, $keySize / 8, "\x00", STR_PAD_LEFT);
 618  
 619          return $r . $s;
 620      }
 621  
 622      /**
 623       * Reads binary DER-encoded data and decodes into a single object
 624       *
 625       * @param string $der the binary data in DER format
 626       * @param int $offset the offset of the data stream containing the object
 627       * to decode
 628       *
 629       * @return array{int, string|null} the new offset and the decoded object
 630       */
 631      private static function readDER(string $der, int $offset = 0): array
 632      {
 633          $pos = $offset;
 634          $size = \strlen($der);
 635          $constructed = (\ord($der[$pos]) >> 5) & 0x01;
 636          $type = \ord($der[$pos++]) & 0x1f;
 637  
 638          // Length
 639          $len = \ord($der[$pos++]);
 640          if ($len & 0x80) {
 641              $n = $len & 0x1f;
 642              $len = 0;
 643              while ($n-- && $pos < $size) {
 644                  $len = ($len << 8) | \ord($der[$pos++]);
 645              }
 646          }
 647  
 648          // Value
 649          if ($type === self::ASN1_BIT_STRING) {
 650              $pos++; // Skip the first contents octet (padding indicator)
 651              $data = \substr($der, $pos, $len - 1);
 652              $pos += $len - 1;
 653          } elseif (!$constructed) {
 654              $data = \substr($der, $pos, $len);
 655              $pos += $len;
 656          } else {
 657              $data = null;
 658          }
 659  
 660          return [$pos, $data];
 661      }
 662  }