X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=src%2FUtil%2FHTTPSignature.php;h=a3a73ce1366ddfab6d2e516d62b9e8de01e89a34;hb=256e845c5dd606d6e0f1d401a0859b6f8728fb2d;hp=07ff5e805d9b3293c921786d7ac195ac6ea02ff5;hpb=fabc90e9dd5f1c4280a9bfa6c6930a3fc985f87a;p=friendica.git

diff --git a/src/Util/HTTPSignature.php b/src/Util/HTTPSignature.php
index 07ff5e805d..a3a73ce136 100644
--- a/src/Util/HTTPSignature.php
+++ b/src/Util/HTTPSignature.php
@@ -5,13 +5,10 @@
  */
 namespace Friendica\Util;
 
-use Friendica\BaseObject;
 use Friendica\Core\Config;
 use Friendica\Core\Logger;
-use Friendica\Database\DBA;
 use Friendica\Model\User;
 use Friendica\Model\APContact;
-use Friendica\Protocol\ActivityPub;
 
 /**
  * @brief Implements HTTP Signatures per draft-cavage-http-signatures-07.
@@ -33,6 +30,7 @@ class HTTPSignature
 	 * @param $key
 	 *
 	 * @return array with verification data
+	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
 	 */
 	public static function verifyMagic($key)
 	{
@@ -187,6 +185,7 @@ class HTTPSignature
 	 *   - \e string \b algorithm
 	 *   - \e array  \b headers
 	 *   - \e string \b signature
+	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
 	 */
 	public static function parseSigheader($header)
 	{
@@ -216,7 +215,7 @@ class HTTPSignature
 			$ret['signature'] = base64_decode(preg_replace('/\s+/', '', $matches[1]));
 		}
 
-		if (($ret['signature']) && ($ret['algorithm']) && (!$ret['headers'])) {
+		if (!empty($ret['signature']) && !empty($ret['algorithm']) && empty($ret['headers'])) {
 			$ret['headers'] = ['date'];
 		}
 
@@ -234,6 +233,7 @@ class HTTPSignature
 	 *   - \e string \b key
 	 *   - \e string \b alg
 	 *   - \e string \b data
+	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
 	 */
 	private static function decryptSigheader($header, $prvkey = null)
 	{
@@ -275,11 +275,12 @@ class HTTPSignature
 	/**
 	 * @brief Transmit given data to a target for a user
 	 *
-	 * @param array $data Data that is about to be send
-	 * @param string $target The URL of the inbox
-	 * @param integer $uid User id of the sender
+	 * @param array   $data   Data that is about to be send
+	 * @param string  $target The URL of the inbox
+	 * @param integer $uid    User id of the sender
 	 *
 	 * @return boolean Was the transmission successful?
+	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
 	 */
 	public static function transmit($data, $target, $uid)
 	{
@@ -296,14 +297,15 @@ class HTTPSignature
 		$path = parse_url($target, PHP_URL_PATH);
 		$digest = 'SHA-256=' . base64_encode(hash('sha256', $content, true));
 		$content_length = strlen($content);
+		$date = DateTimeFormat::utcNow(DateTimeFormat::HTTP);
 
-		$headers = ['Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
+		$headers = ['Date: ' . $date, 'Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
 
-		$signed_data = "(request-target): post " . $path . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
+		$signed_data = "(request-target): post " . $path . "\ndate: ". $date . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
 
 		$signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
 
-		$headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) content-length digest host",signature="' . $signature . '"';
+		$headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) date content-length digest host",signature="' . $signature . '"';
 
 		$headers[] = 'Content-Type: application/activity+json';
 
@@ -318,10 +320,11 @@ class HTTPSignature
 	/**
 	 * @brief Fetches JSON data for a user
 	 *
-	 * @param string $request request url
-	 * @param integer $uid User id of the requester
+	 * @param string  $request request url
+	 * @param integer $uid     User id of the requester
 	 *
 	 * @return array JSON array
+	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
 	 */
 	public static function fetch($request, $uid)
 	{
@@ -334,14 +337,15 @@ class HTTPSignature
 		// Header data that is about to be signed.
 		$host = parse_url($request, PHP_URL_HOST);
 		$path = parse_url($request, PHP_URL_PATH);
+		$date = DateTimeFormat::utcNow(DateTimeFormat::HTTP);
 
-		$headers = ['Host: ' . $host];
+		$headers = ['Date: ' . $date, 'Host: ' . $host];
 
-		$signed_data = "(request-target): get " . $path . "\nhost: " . $host;
+		$signed_data = "(request-target): get " . $path . "\ndate: ". $date . "\nhost: " . $host;
 
 		$signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
 
-		$headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) host",signature="' . $signature . '"';
+		$headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) date host",signature="' . $signature . '"';
 
 		$headers[] = 'Accept: application/activity+json, application/ld+json';
 
@@ -369,17 +373,25 @@ class HTTPSignature
 	 * @param $content
 	 * @param $http_headers
 	 *
-	 * @return signer string
+	 * @return string Signer
+	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
 	 */
 	public static function getSigner($content, $http_headers)
 	{
-		$object = json_decode($content, true);
-
-		if (empty($object)) {
+		if (empty($http_headers['HTTP_SIGNATURE'])) {
 			return false;
 		}
 
-		$actor = JsonLD::fetchElement($object, 'actor', 'id');
+		if (!empty($content)) {
+			$object = json_decode($content, true);
+			if (empty($object)) {
+				return false;
+			}
+
+			$actor = JsonLD::fetchElement($object, 'actor', 'id');
+		} else {
+			$actor = '';
+		}
 
 		$headers = [];
 		$headers['(request-target)'] = strtolower($http_headers['REQUEST_METHOD']) . ' ' . $http_headers['REQUEST_URI'];
@@ -457,7 +469,14 @@ class HTTPSignature
 			}
 		}
 
-		/// @todo Check if the signed date field is in an acceptable range
+		//  Check if the signed date field is in an acceptable range
+		if (in_array('date', $sig_block['headers'])) {
+			$diff = abs(strtotime($headers['date']) - time());
+			if ($diff > 300) {
+				Logger::log("Header date '" . $headers['date'] . "' is with " . $diff . " seconds out of the 300 second frame. The signature is invalid.");
+				return false;
+			}
+		}
 
 		// Check the content-length when it is part of the signed data
 		if (in_array('content-length', $sig_block['headers'])) {
@@ -476,6 +495,7 @@ class HTTPSignature
 	 * @param $actor
 	 *
 	 * @return array with actor url and public key
+	 * @throws \Exception
 	 */
 	private static function fetchKey($id, $actor)
 	{