Updaet InboxPipelines, improve handling of missing signature validation headers

This commit is contained in:
Daniel Supernault 2023-03-18 22:46:22 -06:00
parent da38b33a24
commit 419c0fb0fb
No known key found for this signature in database
GPG key ID: 0DEF1C662C9033F7
3 changed files with 357 additions and 328 deletions

View file

@ -126,6 +126,11 @@ class DeleteWorker implements ShouldQueue
return false;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return false;
}
$keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST);
@ -186,6 +191,11 @@ class DeleteWorker implements ShouldQueue
return;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return;
}
$keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
if(!$actor) {

View file

@ -113,6 +113,11 @@ class InboxValidator implements ShouldQueue
return false;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return false;
}
$keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST);
@ -173,6 +178,11 @@ class InboxValidator implements ShouldQueue
return;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return;
}
$keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
if(!$actor) {

View file

@ -94,6 +94,11 @@ class InboxWorker implements ShouldQueue
return false;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return false;
}
$keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST);
@ -154,6 +159,10 @@ class InboxWorker implements ShouldQueue
return;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return;
}
$keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
if(!$actor) {