aiden
/
pixelfed
mirror of https://github.com/pixelfed/pixelfed
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update AP helpers

Browse Source
pull/5252/head
Daniel Supernault 10 months ago
parent 9847fbd898
commit 8fea821504
No known key found for this signature in database
GPG Key ID: 23740873EE6F76A1
2 changed files with 181 additions and 148 deletions
Show Stats Download Patch File Download Diff File

70
app/Util/ActivityPub/Helpers.php
Unescape Escape View File

@ -25,6 +25,8 @@ use Cache;
use Carbon\Carbon; use Carbon\Carbon;
use Illuminate\Support\Str; use Illuminate\Support\Str;
use Illuminate\Validation\Rule; use Illuminate\Validation\Rule;
use League\Uri\Exceptions\UriException;
use League\Uri\Uri;
use Purify; use Purify;
use Validator; use Validator;
@ -153,61 +155,74 @@ class Helpers
return in_array($url, $audience['to']) || in_array($url, $audience['cc']); return in_array($url, $audience['to']) || in_array($url, $audience['cc']);
} }
public static function validateUrl($url) public static function validateUrl($url = null, $disableDNSCheck = false)
{ {
if (is_array($url)) { if (is_array($url) && ! empty($url)) {
$url = $url[0]; $url = $url[0];
} }
if (! $url || strlen($url) === 0) {
return false;
}
try {
$uri = Uri::new($url);
$hash = hash('sha256', $url); if (! $uri) {
$key = "helpers:url:valid:sha256-{$hash}";
$valid = Cache::remember($key, 900, function () use ($url) {
$localhosts = [
'127.0.0.1', 'localhost', '::1',
];
if (strtolower(mb_substr($url, 0, 8)) !== 'https://') {
return false; return false;
} }
if (substr_count($url, '://') !== 1) { if ($uri->getScheme() !== 'https') {
return false; return false;
} }
if (mb_substr($url, 0, 8) !== 'https://') { $host = $uri->getHost();
$url = 'https://'.substr($url, 8);
if (! $host || $host === '') {
return false;
} }
$valid = filter_var($url, FILTER_VALIDATE_URL); if (! filter_var($host, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME)) {
return false;
}
if (! $valid) { if (! str_contains($host, '.')) {
return false; return false;
} }
$host = parse_url($valid, PHP_URL_HOST); $localhosts = [
'localhost',
'127.0.0.1',
'::1',
'broadcasthost',
'ip6-localhost',
'ip6-loopback',
];
if (in_array($host, $localhosts)) { if (in_array($host, $localhosts)) {
return false; return false;
} }
if (config('security.url.verify_dns')) { if ($disableDNSCheck !== true && app()->environment() === 'production' && (bool) config('security.url.verify_dns')) {
if (DomainService::hasValidDns($host) === false) { $hash = hash('sha256', $host);
$key = "helpers:url:valid-dns:sha256-{$hash}";
$domainValidDns = Cache::remember($key, 14440, function () use ($host) {
return DomainService::hasValidDns($host);
});
if (! $domainValidDns) {
return false; return false;
} }
} }
if (app()->environment() === 'production') { if ($disableDNSCheck !== true && app()->environment() === 'production') {
$bannedInstances = InstanceService::getBannedDomains(); $bannedInstances = InstanceService::getBannedDomains();
if (in_array($host, $bannedInstances)) { if (in_array($host, $bannedInstances)) {
return false; return false;
} }
} }
return $url; return $uri->toString();
}); } catch (UriException $e) {
return false;
return $valid; }
} }
public static function validateLocalUrl($url) public static function validateLocalUrl($url)
@ -215,7 +230,12 @@ class Helpers
$url = self::validateUrl($url); $url = self::validateUrl($url);
if ($url == true) { if ($url == true) {
$domain = config('pixelfed.domain.app'); $domain = config('pixelfed.domain.app');
$host = parse_url($url, PHP_URL_HOST);
$uri = Uri::new($url);
$host = $uri->getHost();
if (! $host || empty($host)) {
return false;
}
$url = strtolower($domain) === strtolower($host) ? $url : false; $url = strtolower($domain) === strtolower($host) ? $url : false;
return $url; return $url;

43
app/Util/ActivityPub/HttpSignature.php
Unescape Escape View File

@ -2,19 +2,20 @@
namespace App\Util\ActivityPub; namespace App\Util\ActivityPub;
use Cache, Log;
use App\Models\InstanceActor; use App\Models\InstanceActor;
use App\Profile; use App\Profile;
use \DateTime; use Cache;
use DateTime;
class HttpSignature {
class HttpSignature
{
/* /*
* source: https://github.com/aaronpk/Nautilus/blob/master/app/ActivityPub/HTTPSignature.php * source: https://github.com/aaronpk/Nautilus/blob/master/app/ActivityPub/HTTPSignature.php
* thanks aaronpk! * thanks aaronpk!
*/ */
public static function sign(Profile $profile, $url, $body = false, $addlHeaders = []) { public static function sign(Profile $profile, $url, $body = false, $addlHeaders = [])
{
if ($body) { if ($body) {
$digest = self::_digest($body); $digest = self::_digest($body);
} }
@ -56,7 +57,8 @@ class HttpSignature {
return $headers; return $headers;
} }
public static function parseSignatureHeader($signature) { public static function parseSignatureHeader($signature)
{
$parts = explode(',', $signature); $parts = explode(',', $signature);
$signatureData = []; $signatureData = [];
@ -68,26 +70,33 @@ class HttpSignature {
if (! isset($signatureData['keyId'])) { if (! isset($signatureData['keyId'])) {
return [ return [
'error' => 'No keyId was found in the signature header. Found: '.implode(', ', array_keys($signatureData)) 'error' => 'No keyId was found in the signature header. Found: '.implode(', ', array_keys($signatureData)),
]; ];
} }
if (! filter_var($signatureData['keyId'], FILTER_VALIDATE_URL)) { if (! filter_var($signatureData['keyId'], FILTER_VALIDATE_URL)) {
return [ return [
'error' => 'keyId is not a URL: '.$signatureData['keyId'] 'error' => 'keyId is not a URL: '.$signatureData['keyId'],
];
}
if (! Helpers::validateUrl($signatureData['keyId'])) {
return [
'error' => 'keyId is not a URL: '.$signatureData['keyId'],
]; ];
} }
if (! isset($signatureData['headers']) || ! isset($signatureData['signature'])) { if (! isset($signatureData['headers']) || ! isset($signatureData['signature'])) {
return [ return [
'error' => 'Signature is missing headers or signature parts' 'error' => 'Signature is missing headers or signature parts',
]; ];
} }
return $signatureData; return $signatureData;
} }
public static function verify($publicKey, $signatureData, $inputHeaders, $path, $body) { public static function verify($publicKey, $signatureData, $inputHeaders, $path, $body)
{
$digest = 'SHA-256='.base64_encode(hash('sha256', $body, true)); $digest = 'SHA-256='.base64_encode(hash('sha256', $body, true));
$headersToSign = []; $headersToSign = [];
foreach (explode(' ', $signatureData['headers']) as $h) { foreach (explode(' ', $signatureData['headers']) as $h) {
@ -106,26 +115,31 @@ class HttpSignature {
return [$verified, $signingString]; return [$verified, $signingString];
} }
private static function _headersToSigningString($headers) { private static function _headersToSigningString($headers)
{
return implode("\n", array_map(function ($k, $v) { return implode("\n", array_map(function ($k, $v) {
return strtolower($k).': '.$v; return strtolower($k).': '.$v;
}, array_keys($headers), $headers)); }, array_keys($headers), $headers));
} }
private static function _headersToCurlArray($headers) { private static function _headersToCurlArray($headers)
{
return array_map(function ($k, $v) { return array_map(function ($k, $v) {
return "$k: $v"; return "$k: $v";
}, array_keys($headers), $headers); }, array_keys($headers), $headers);
} }
private static function _digest($body) { private static function _digest($body)
{
if (is_array($body)) { if (is_array($body)) {
$body = json_encode($body); $body = json_encode($body);
} }
return base64_encode(hash('sha256', $body, true)); return base64_encode(hash('sha256', $body, true));
} }
protected static function _headersToSign($url, $digest = false, $method = 'post') { protected static function _headersToSign($url, $digest = false, $method = 'post')
{
$date = new DateTime('UTC'); $date = new DateTime('UTC');
if (! in_array($method, ['post', 'get'])) { if (! in_array($method, ['post', 'get'])) {
@ -143,5 +157,4 @@ class HttpSignature {
return $headers; return $headers;
} }
} }

Write Preview
Loading…
Cancel
Save