Merge pull request #6641 from nupplaphil/config_followup

[friendica.git] / src / Util / HTTPSignature.php

diff --git a/src/Util/HTTPSignature.php b/src/Util/HTTPSignature.php
index 07ff5e805d9b3293c921786d7ac195ac6ea02ff5..a3a73ce1366ddfab6d2e516d62b9e8de01e89a34 100644 (file)
--- a/src/Util/HTTPSignature.php
+++ b/src/Util/HTTPSignature.php
@@ -5,13 +5,10 @@
  */
 namespace Friendica\Util;
 
-use Friendica\BaseObject;
 use Friendica\Core\Config;
 use Friendica\Core\Logger;
-use Friendica\Database\DBA;
 use Friendica\Model\User;
 use Friendica\Model\APContact;
-use Friendica\Protocol\ActivityPub;
 
 /**
  * @brief Implements HTTP Signatures per draft-cavage-http-signatures-07.
@@ -33,6 +30,7 @@ class HTTPSignature
         * @param $key
         *
         * @return array with verification data
+        * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         */
        public static function verifyMagic($key)
        {
@@ -187,6 +185,7 @@ class HTTPSignature
         *   - \e string \b algorithm
         *   - \e array  \b headers
         *   - \e string \b signature
+        * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         */
        public static function parseSigheader($header)
        {
@@ -216,7 +215,7 @@ class HTTPSignature
                        $ret['signature'] = base64_decode(preg_replace('/\s+/', '', $matches[1]));
                }
 
-               if (($ret['signature']) && ($ret['algorithm']) && (!$ret['headers'])) {
+               if (!empty($ret['signature']) && !empty($ret['algorithm']) && empty($ret['headers'])) {
                        $ret['headers'] = ['date'];
                }
 
@@ -234,6 +233,7 @@ class HTTPSignature
         *   - \e string \b key
         *   - \e string \b alg
         *   - \e string \b data
+        * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         */
        private static function decryptSigheader($header, $prvkey = null)
        {
@@ -275,11 +275,12 @@ class HTTPSignature
        /**
         * @brief Transmit given data to a target for a user
         *
-        * @param array $data Data that is about to be send
-        * @param string $target The URL of the inbox
-        * @param integer $uid User id of the sender
+        * @param array   $data   Data that is about to be send
+        * @param string  $target The URL of the inbox
+        * @param integer $uid    User id of the sender
         *
         * @return boolean Was the transmission successful?
+        * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         */
        public static function transmit($data, $target, $uid)
        {
@@ -296,14 +297,15 @@ class HTTPSignature
                $path = parse_url($target, PHP_URL_PATH);
                $digest = 'SHA-256=' . base64_encode(hash('sha256', $content, true));
                $content_length = strlen($content);
+               $date = DateTimeFormat::utcNow(DateTimeFormat::HTTP);
 
-               $headers = ['Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
+               $headers = ['Date: ' . $date, 'Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
 
-               $signed_data = "(request-target): post " . $path . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
+               $signed_data = "(request-target): post " . $path . "\ndate: ". $date . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
 
                $signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
 
-               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) content-length digest host",signature="' . $signature . '"';
+               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) date content-length digest host",signature="' . $signature . '"';
 
                $headers[] = 'Content-Type: application/activity+json';
 
@@ -318,10 +320,11 @@ class HTTPSignature
        /**
         * @brief Fetches JSON data for a user
         *
-        * @param string $request request url
-        * @param integer $uid User id of the requester
+        * @param string  $request request url
+        * @param integer $uid     User id of the requester
         *
         * @return array JSON array
+        * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         */
        public static function fetch($request, $uid)
        {
@@ -334,14 +337,15 @@ class HTTPSignature
                // Header data that is about to be signed.
                $host = parse_url($request, PHP_URL_HOST);
                $path = parse_url($request, PHP_URL_PATH);
+               $date = DateTimeFormat::utcNow(DateTimeFormat::HTTP);
 
-               $headers = ['Host: ' . $host];
+               $headers = ['Date: ' . $date, 'Host: ' . $host];
 
-               $signed_data = "(request-target): get " . $path . "\nhost: " . $host;
+               $signed_data = "(request-target): get " . $path . "\ndate: ". $date . "\nhost: " . $host;
 
                $signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
 
-               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) host",signature="' . $signature . '"';
+               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) date host",signature="' . $signature . '"';
 
                $headers[] = 'Accept: application/activity+json, application/ld+json';
 
@@ -369,17 +373,25 @@ class HTTPSignature
         * @param $content
         * @param $http_headers
         *
-        * @return signer string
+        * @return string Signer
+        * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         */
        public static function getSigner($content, $http_headers)
        {
-               $object = json_decode($content, true);
-
-               if (empty($object)) {
+               if (empty($http_headers['HTTP_SIGNATURE'])) {
                        return false;
                }
 
-               $actor = JsonLD::fetchElement($object, 'actor', 'id');
+               if (!empty($content)) {
+                       $object = json_decode($content, true);
+                       if (empty($object)) {
+                               return false;
+                       }
+
+                       $actor = JsonLD::fetchElement($object, 'actor', 'id');
+               } else {
+                       $actor = '';
+               }
 
                $headers = [];
                $headers['(request-target)'] = strtolower($http_headers['REQUEST_METHOD']) . ' ' . $http_headers['REQUEST_URI'];
@@ -457,7 +469,14 @@ class HTTPSignature
                        }
                }
 
-               /// @todo Check if the signed date field is in an acceptable range
+               //  Check if the signed date field is in an acceptable range
+               if (in_array('date', $sig_block['headers'])) {
+                       $diff = abs(strtotime($headers['date']) - time());
+                       if ($diff > 300) {
+                               Logger::log("Header date '" . $headers['date'] . "' is with " . $diff . " seconds out of the 300 second frame. The signature is invalid.");
+                               return false;
+                       }
+               }
 
                // Check the content-length when it is part of the signed data
                if (in_array('content-length', $sig_block['headers'])) {
@@ -476,6 +495,7 @@ class HTTPSignature
         * @param $actor
         *
         * @return array with actor url and public key
+        * @throws \Exception
         */
        private static function fetchKey($id, $actor)
        {