techhub/mastodon
2
0
Fork 0
Code Activity

Change HttpMessageSignature to perform assertions directly on Linzer objects (#36510)

Browse Source
This commit is contained in:
Claire
2025-10-17 10:41:28 +02:00
committed by GitHub
parent ccac6da3e8
commit c96e28a41d
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/lib/signed_request.rb
View File

@@ -153,6 +153,7 @@ class SignedRequest
'signature-input' => @request.headers['signature-input'], 'signature-input' => @request.headers['signature-input'],
'signature' => @request.headers['signature'], 'signature' => @request.headers['signature'],
}) })
@message = Linzer::Message.new(@request.rack_request)
end end
def key_id def key_id
@@ -174,7 +175,7 @@ class SignedRequest
def verified?(actor) def verified?(actor)
key = Linzer.new_rsa_v1_5_sha256_public_key(actor.public_key) key = Linzer.new_rsa_v1_5_sha256_public_key(actor.public_key)
Linzer.verify!(@request.rack_request, key:) Linzer.verify(key, @message, @signature)
rescue Linzer::VerifyError rescue Linzer::VerifyError
false false
end end
@@ -187,9 +188,9 @@ class SignedRequest
def verify_body_digest! def verify_body_digest!
return unless signed_headers.include?('content-digest') return unless signed_headers.include?('content-digest')
raise Mastodon::SignatureVerificationError, 'Content-Digest header missing' unless @request.headers.key?('content-digest') raise Mastodon::SignatureVerificationError, 'Content-Digest header missing' if @message.header('content-digest').nil?
digests = Starry.parse_dictionary(@request.headers['content-digest']) digests = Starry.parse_dictionary(@message.header('content-digest'))
raise Mastodon::SignatureVerificationError, "Mastodon only supports SHA-256 in Content-Digest header. Offered algorithms: #{digests.keys.join(', ')}" unless digests.key?('sha-256') raise Mastodon::SignatureVerificationError, "Mastodon only supports SHA-256 in Content-Digest header. Offered algorithms: #{digests.keys.join(', ')}" unless digests.key?('sha-256')
received_digest = Base64.strict_encode64(digests['sha-256'].value) received_digest = Base64.strict_encode64(digests['sha-256'].value)