clones/friendica
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix headers (string to array) and make sure the signature doesn't change

This commit is contained in:
Philipp 2021-08-25 13:45:00 +02:00
parent f2dcc2788d
commit befd5c860d
No known key found for this signature in database
GPG Key ID: 9A28B7D4FF5667BD
3 changed files with 14 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Module/Magic.php
View File

@ -88,9 +88,10 @@ class Magic extends BaseModule
$exp = explode('/profile/', $contact['url']); $exp = explode('/profile/', $contact['url']);
$basepath = $exp[0]; $basepath = $exp[0];
$header = []; $header = [
$header['Accept'] = 'application/x-dfrn+json, application/x-zot+json'; 'Accept' => ['application/x-dfrn+json', 'application/x-zot+json'],
$header['X-Open-Web-Auth'] = Strings::getRandomHex(); 'X-Open-Web-Auth' => [Strings::getRandomHex()],
];
// Create a header that is signed with the local users private key. // Create a header that is signed with the local users private key.
$header = HTTPSignature::createSig( $header = HTTPSignature::createSig(

16
src/Util/HTTPSignature.php
View File

@ -140,6 +140,9 @@ class HTTPSignature
public static function createSig($head, $prvkey, $keyid = 'Key') public static function createSig($head, $prvkey, $keyid = 'Key')
{ {
$return_headers = []; $return_headers = [];
if (!empty($head)) {
$return_headers = $head;
}
$alg = 'sha512'; $alg = 'sha512';
$algorithm = 'rsa-sha512'; $algorithm = 'rsa-sha512';
@ -149,15 +152,7 @@ class HTTPSignature
$headerval = 'keyId="' . $keyid . '",algorithm="' . $algorithm $headerval = 'keyId="' . $keyid . '",algorithm="' . $algorithm
. '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"'; . '",headers="' . $x['headers'] . '",signature="' . $x['signature'] . '"';
$sighead = 'Authorization: Signature ' . $headerval; $return_headers['Authorization'] = ['Signature ' . $headerval];
if ($head) {
foreach ($head as $k => $v) {
$return_headers[] = $k . ': ' . $v;
}
}
$return_headers[] = $sighead;
return $return_headers; return $return_headers;
} }
@ -176,6 +171,9 @@ class HTTPSignature
$fields = ''; $fields = '';
foreach ($head as $k => $v) { foreach ($head as $k => $v) {
if (is_array($v)) {
$v = implode(', ', $v);
}
$headers .= strtolower($k) . ': ' . trim($v) . "\n"; $headers .= strtolower($k) . ': ' . trim($v) . "\n";
if ($fields) { if ($fields) {
$fields .= ' '; $fields .= ' ';

7
tests/src/Util/HTTPSignatureTest.php
View File

@ -124,8 +124,8 @@ G1vVmRgkLDqhc4+r3wDz3qy6JpV7tg==
-----END PRIVATE KEY-----', -----END PRIVATE KEY-----',
'keyId' => 'acct:admin@friendica.local', 'keyId' => 'acct:admin@friendica.local',
'header' => [ 'header' => [
'Accept' => 'application/x-dfrn+json, application/x-zot+json', 'Accept' => ['application/x-dfrn+json', 'application/x-zot+json'],
'X-Open-Web-Auth' => '1dde649b855fd1aae542a91c4edd8c3a7a4c59d8eaf3136cdee05dfc16a30bac', 'X-Open-Web-Auth' => ['1dde649b855fd1aae542a91c4edd8c3a7a4c59d8eaf3136cdee05dfc16a30bac'],
], ],
'signature' => 'Signature keyId="acct:admin@friendica.local",algorithm="rsa-sha512",headers="accept x-open-web-auth",signature="cb09/wdmRdFhrQUczL0lR6LTkVh8qb/vYh70DFCW40QrzvuUYHzJ+GqqJW6tcCb2rXP4t+aobWKfZ4wFMBtVbejAiCgF01pzEBJfDevdyu7khlfKo+Gtw1CGk4/0so1QmqASeHdlG3ID3GnmuovqZn2v5f5D+1UAJ6Pu6mtAXrGRntoEM/oqYBAsRrMtDSDAE4tnOSDu2YfVJJLfyUX1ZWjUK0ejZXZ0YTDJwU8PqRcRX17NhBaDq82dEHlfhD7I/aOclwVbfKIi5Ud619XCxPq0sAAYso17MhUm40oBCJVze2x4pswJhv9IFYohtR5G/fKkz2eosu3xeRflvGicS4JdclhTRgCGWDy10DV76FiXiS5N2clLXreHItWEXlZKZx6m9zAZoEX92VRnc4BY4jDsRR89Pl88hELaxiNipviyHS7XYZTRnkLM+nvtOcxkHSCbEs7oGw+AX+pLHoU5otNOqy+ZbXQ1cUvFOBYZmYdX3DiWaLfBKraakPkslJuU3yJu95X1qYmQTpOZDR4Ma/yf5fmWJh5D9ywnXxxd6RaupoO6HTtIl6gmsfcsyZNi5hRbbgPI3BiQwGYVGF6qzJpEOMzEyHyAuFeanhicc8b+P+DCwXni5sjM7ntKwShbCBP80KHSdoumORin3/PYgHCmHZVv71N0HNlPZnyVzZw="', 'signature' => 'Signature keyId="acct:admin@friendica.local",algorithm="rsa-sha512",headers="accept x-open-web-auth",signature="cb09/wdmRdFhrQUczL0lR6LTkVh8qb/vYh70DFCW40QrzvuUYHzJ+GqqJW6tcCb2rXP4t+aobWKfZ4wFMBtVbejAiCgF01pzEBJfDevdyu7khlfKo+Gtw1CGk4/0so1QmqASeHdlG3ID3GnmuovqZn2v5f5D+1UAJ6Pu6mtAXrGRntoEM/oqYBAsRrMtDSDAE4tnOSDu2YfVJJLfyUX1ZWjUK0ejZXZ0YTDJwU8PqRcRX17NhBaDq82dEHlfhD7I/aOclwVbfKIi5Ud619XCxPq0sAAYso17MhUm40oBCJVze2x4pswJhv9IFYohtR5G/fKkz2eosu3xeRflvGicS4JdclhTRgCGWDy10DV76FiXiS5N2clLXreHItWEXlZKZx6m9zAZoEX92VRnc4BY4jDsRR89Pl88hELaxiNipviyHS7XYZTRnkLM+nvtOcxkHSCbEs7oGw+AX+pLHoU5otNOqy+ZbXQ1cUvFOBYZmYdX3DiWaLfBKraakPkslJuU3yJu95X1qYmQTpOZDR4Ma/yf5fmWJh5D9ywnXxxd6RaupoO6HTtIl6gmsfcsyZNi5hRbbgPI3BiQwGYVGF6qzJpEOMzEyHyAuFeanhicc8b+P+DCwXni5sjM7ntKwShbCBP80KHSdoumORin3/PYgHCmHZVv71N0HNlPZnyVzZw="',
] ]
@ -147,7 +147,6 @@ G1vVmRgkLDqhc4+r3wDz3qy6JpV7tg==
public function testSignHeader(string $privKey, string $keyId, array $header, string $signature) public function testSignHeader(string $privKey, string $keyId, array $header, string $signature)
{ {
$signed = HTTPSignature::createSig($header, $privKey, $keyId); $signed = HTTPSignature::createSig($header, $privKey, $keyId);
print_r($signed); self::assertEquals($signature, $signed['Authorization'][0]);
self::assertEquals($signature, substr($signed[2], strlen('Authorization: ')));
} }
} }