From 419c0fb0fbed0427567b13706ac15e785689083e Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Sat, 18 Mar 2023 22:46:22 -0600 Subject: [PATCH] Updaet InboxPipelines, improve handling of missing signature validation headers --- app/Jobs/InboxPipeline/DeleteWorker.php | 10 + app/Jobs/InboxPipeline/InboxValidator.php | 352 +++++++++++----------- app/Jobs/InboxPipeline/InboxWorker.php | 323 ++++++++++---------- 3 files changed, 357 insertions(+), 328 deletions(-) diff --git a/app/Jobs/InboxPipeline/DeleteWorker.php b/app/Jobs/InboxPipeline/DeleteWorker.php index 05d0138e3..03a20bdd5 100644 --- a/app/Jobs/InboxPipeline/DeleteWorker.php +++ b/app/Jobs/InboxPipeline/DeleteWorker.php @@ -126,6 +126,11 @@ class DeleteWorker implements ShouldQueue return false; } $signatureData = HttpSignature::parseSignatureHeader($signature); + + if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) { + return false; + } + $keyId = Helpers::validateUrl($signatureData['keyId']); $id = Helpers::validateUrl($bodyDecoded['id']); $keyDomain = parse_url($keyId, PHP_URL_HOST); @@ -186,6 +191,11 @@ class DeleteWorker implements ShouldQueue return; } $signatureData = HttpSignature::parseSignatureHeader($signature); + + if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) { + return; + } + $keyId = Helpers::validateUrl($signatureData['keyId']); $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first(); if(!$actor) { diff --git a/app/Jobs/InboxPipeline/InboxValidator.php b/app/Jobs/InboxPipeline/InboxValidator.php index 8b4d018a4..4017d3acd 100644 --- a/app/Jobs/InboxPipeline/InboxValidator.php +++ b/app/Jobs/InboxPipeline/InboxValidator.php @@ -5,9 +5,9 @@ namespace App\Jobs\InboxPipeline; use Cache; use App\Profile; use App\Util\ActivityPub\{ - Helpers, - HttpSignature, - Inbox + Helpers, + HttpSignature, + Inbox }; use Illuminate\Bus\Queueable; use Illuminate\Contracts\Queue\ShouldQueue; @@ -21,189 +21,199 @@ use Illuminate\Support\Lottery; class InboxValidator implements ShouldQueue { - use Dispatchable, InteractsWithQueue, Queueable, SerializesModels; + use Dispatchable, InteractsWithQueue, Queueable, SerializesModels; - protected $username; - protected $headers; - protected $payload; + protected $username; + protected $headers; + protected $payload; - public $timeout = 300; - public $tries = 1; - public $maxExceptions = 1; + public $timeout = 300; + public $tries = 1; + public $maxExceptions = 1; - /** - * Create a new job instance. - * - * @return void - */ - public function __construct($username, $headers, $payload) - { - $this->username = $username; - $this->headers = $headers; - $this->payload = $payload; - } + /** + * Create a new job instance. + * + * @return void + */ + public function __construct($username, $headers, $payload) + { + $this->username = $username; + $this->headers = $headers; + $this->payload = $payload; + } - /** - * Execute the job. - * - * @return void - */ - public function handle() - { - $username = $this->username; - $headers = $this->headers; + /** + * Execute the job. + * + * @return void + */ + public function handle() + { + $username = $this->username; + $headers = $this->headers; - if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) { - return; - } + if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) { + return; + } - $payload = json_decode($this->payload, true, 8); + $payload = json_decode($this->payload, true, 8); - if(isset($payload['id'])) { - $lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']); - if(Cache::get($lockKey) !== null) { - // Job processed already - return 1; - } - Cache::put($lockKey, 1, 3600); - } + if(isset($payload['id'])) { + $lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']); + if(Cache::get($lockKey) !== null) { + // Job processed already + return 1; + } + Cache::put($lockKey, 1, 3600); + } - $profile = Profile::whereNull('domain')->whereUsername($username)->first(); + $profile = Profile::whereNull('domain')->whereUsername($username)->first(); - if(empty($profile) || empty($headers) || empty($payload)) { - return; - } + if(empty($profile) || empty($headers) || empty($payload)) { + return; + } - if($profile->status != null) { - return; - } + if($profile->status != null) { + return; + } - if($this->verifySignature($headers, $profile, $payload) == true) { - if(isset($payload['type']) && in_array($payload['type'], ['Follow', 'Accept']) ) { - ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('follow'); - } else { - $onQueue = Lottery::odds(1, 12)->winner(fn () => 'high')->loser(fn () => 'inbox')->choose(); - ActivityHandler::dispatch($headers, $profile, $payload)->onQueue($onQueue); - } - return; - } else { - return; - } + if($this->verifySignature($headers, $profile, $payload) == true) { + if(isset($payload['type']) && in_array($payload['type'], ['Follow', 'Accept']) ) { + ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('follow'); + } else { + $onQueue = Lottery::odds(1, 12)->winner(fn () => 'high')->loser(fn () => 'inbox')->choose(); + ActivityHandler::dispatch($headers, $profile, $payload)->onQueue($onQueue); + } + return; + } else { + return; + } - } + } - protected function verifySignature($headers, $profile, $payload) - { - $body = $this->payload; - $bodyDecoded = $payload; - $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; - $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; - if(!$signature) { - return false; - } - if(!$date) { - return false; - } - if(!now()->parse($date)->gt(now()->subDays(1)) || - !now()->parse($date)->lt(now()->addDays(1)) - ) { - return false; - } - if(!isset($bodyDecoded['id'])) { - return false; - } - $signatureData = HttpSignature::parseSignatureHeader($signature); - $keyId = Helpers::validateUrl($signatureData['keyId']); - $id = Helpers::validateUrl($bodyDecoded['id']); - $keyDomain = parse_url($keyId, PHP_URL_HOST); - $idDomain = parse_url($id, PHP_URL_HOST); - if(isset($bodyDecoded['object']) - && is_array($bodyDecoded['object']) - && isset($bodyDecoded['object']['attributedTo']) - ) { - $attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']); - if(is_array($attr)) { - if(isset($attr['id'])) { - $attr = $attr['id']; - } else { - $attr = ""; - } - } - if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) { - return false; - } - } - if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) { - return false; - } - $actor = Profile::whereKeyId($keyId)->first(); - if(!$actor) { - $actorUrl = Helpers::pluckval($bodyDecoded['actor']); - $actor = Helpers::profileFirstOrNew($actorUrl); - } - if(!$actor) { - return false; - } - $pkey = openssl_pkey_get_public($actor->public_key); - if(!$pkey) { - return false; - } - $inboxPath = "/users/{$profile->username}/inbox"; - list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body); - if($verified == 1) { - return true; - } else { - return false; - } - } + protected function verifySignature($headers, $profile, $payload) + { + $body = $this->payload; + $bodyDecoded = $payload; + $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; + $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; + if(!$signature) { + return false; + } + if(!$date) { + return false; + } + if(!now()->parse($date)->gt(now()->subDays(1)) || + !now()->parse($date)->lt(now()->addDays(1)) + ) { + return false; + } + if(!isset($bodyDecoded['id'])) { + return false; + } + $signatureData = HttpSignature::parseSignatureHeader($signature); - protected function blindKeyRotation($headers, $profile, $payload) - { - $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; - $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; - if(!$signature) { - return; - } - if(!$date) { - return; - } - if(!now()->parse($date)->gt(now()->subDays(1)) || - !now()->parse($date)->lt(now()->addDays(1)) - ) { - return; - } - $signatureData = HttpSignature::parseSignatureHeader($signature); - $keyId = Helpers::validateUrl($signatureData['keyId']); - $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first(); - if(!$actor) { - return; - } - if(Helpers::validateUrl($actor->remote_url) == false) { - return; - } + if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) { + return false; + } - try { - $res = Http::timeout(20)->withHeaders([ - 'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', - 'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org', - ])->get($actor->remote_url); - } catch (ConnectionException $e) { - return false; - } + $keyId = Helpers::validateUrl($signatureData['keyId']); + $id = Helpers::validateUrl($bodyDecoded['id']); + $keyDomain = parse_url($keyId, PHP_URL_HOST); + $idDomain = parse_url($id, PHP_URL_HOST); + if(isset($bodyDecoded['object']) + && is_array($bodyDecoded['object']) + && isset($bodyDecoded['object']['attributedTo']) + ) { + $attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']); + if(is_array($attr)) { + if(isset($attr['id'])) { + $attr = $attr['id']; + } else { + $attr = ""; + } + } + if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) { + return false; + } + } + if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) { + return false; + } + $actor = Profile::whereKeyId($keyId)->first(); + if(!$actor) { + $actorUrl = Helpers::pluckval($bodyDecoded['actor']); + $actor = Helpers::profileFirstOrNew($actorUrl); + } + if(!$actor) { + return false; + } + $pkey = openssl_pkey_get_public($actor->public_key); + if(!$pkey) { + return false; + } + $inboxPath = "/users/{$profile->username}/inbox"; + list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body); + if($verified == 1) { + return true; + } else { + return false; + } + } - if(!$res->ok()) { - return false; - } + protected function blindKeyRotation($headers, $profile, $payload) + { + $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; + $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; + if(!$signature) { + return; + } + if(!$date) { + return; + } + if(!now()->parse($date)->gt(now()->subDays(1)) || + !now()->parse($date)->lt(now()->addDays(1)) + ) { + return; + } + $signatureData = HttpSignature::parseSignatureHeader($signature); - $res = json_decode($res->body(), true, 8); - if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) { - return; - } - if($res['publicKey']['id'] !== $actor->key_id) { - return; - } - $actor->public_key = $res['publicKey']['publicKeyPem']; - $actor->save(); - return $this->verifySignature($headers, $profile, $payload); - } + if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) { + return; + } + + $keyId = Helpers::validateUrl($signatureData['keyId']); + $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first(); + if(!$actor) { + return; + } + if(Helpers::validateUrl($actor->remote_url) == false) { + return; + } + + try { + $res = Http::timeout(20)->withHeaders([ + 'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + 'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org', + ])->get($actor->remote_url); + } catch (ConnectionException $e) { + return false; + } + + if(!$res->ok()) { + return false; + } + + $res = json_decode($res->body(), true, 8); + if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) { + return; + } + if($res['publicKey']['id'] !== $actor->key_id) { + return; + } + $actor->public_key = $res['publicKey']['publicKeyPem']; + $actor->save(); + return $this->verifySignature($headers, $profile, $payload); + } } diff --git a/app/Jobs/InboxPipeline/InboxWorker.php b/app/Jobs/InboxPipeline/InboxWorker.php index 305430085..c8508c0fc 100644 --- a/app/Jobs/InboxPipeline/InboxWorker.php +++ b/app/Jobs/InboxPipeline/InboxWorker.php @@ -5,9 +5,9 @@ namespace App\Jobs\InboxPipeline; use Cache; use App\Profile; use App\Util\ActivityPub\{ - Helpers, - HttpSignature, - Inbox + Helpers, + HttpSignature, + Inbox }; use Illuminate\Bus\Queueable; use Illuminate\Contracts\Queue\ShouldQueue; @@ -20,171 +20,180 @@ use Illuminate\Http\Client\ConnectionException; class InboxWorker implements ShouldQueue { - use Dispatchable, InteractsWithQueue, Queueable, SerializesModels; + use Dispatchable, InteractsWithQueue, Queueable, SerializesModels; - protected $headers; - protected $payload; + protected $headers; + protected $payload; - public $timeout = 300; - public $tries = 1; - public $maxExceptions = 1; + public $timeout = 300; + public $tries = 1; + public $maxExceptions = 1; - /** - * Create a new job instance. - * - * @return void - */ - public function __construct($headers, $payload) - { - $this->headers = $headers; - $this->payload = $payload; - } + /** + * Create a new job instance. + * + * @return void + */ + public function __construct($headers, $payload) + { + $this->headers = $headers; + $this->payload = $payload; + } - /** - * Execute the job. - * - * @return void - */ - public function handle() - { - $profile = null; - $headers = $this->headers; + /** + * Execute the job. + * + * @return void + */ + public function handle() + { + $profile = null; + $headers = $this->headers; - if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) { - return; - } + if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) { + return; + } - $payload = json_decode($this->payload, true, 8); + $payload = json_decode($this->payload, true, 8); - if(isset($payload['id'])) { - $lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']); - if(Cache::get($lockKey) !== null) { - // Job processed already - return 1; - } - Cache::put($lockKey, 1, 3600); - } + if(isset($payload['id'])) { + $lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']); + if(Cache::get($lockKey) !== null) { + // Job processed already + return 1; + } + Cache::put($lockKey, 1, 3600); + } - if($this->verifySignature($headers, $payload) == true) { - ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('shared'); - return; - } else { - return; - } - } + if($this->verifySignature($headers, $payload) == true) { + ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('shared'); + return; + } else { + return; + } + } - protected function verifySignature($headers, $payload) - { - $body = $this->payload; - $bodyDecoded = $payload; - $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; - $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; - if(!$signature) { - return false; - } - if(!$date) { - return false; - } - if(!now()->parse($date)->gt(now()->subDays(1)) || - !now()->parse($date)->lt(now()->addDays(1)) - ) { - return false; - } - if(!isset($bodyDecoded['id'])) { - return false; - } - $signatureData = HttpSignature::parseSignatureHeader($signature); - $keyId = Helpers::validateUrl($signatureData['keyId']); - $id = Helpers::validateUrl($bodyDecoded['id']); - $keyDomain = parse_url($keyId, PHP_URL_HOST); - $idDomain = parse_url($id, PHP_URL_HOST); - if(isset($bodyDecoded['object']) - && is_array($bodyDecoded['object']) - && isset($bodyDecoded['object']['attributedTo']) - ) { - $attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']); - if(is_array($attr)) { - if(isset($attr['id'])) { - $attr = $attr['id']; - } else { - $attr = ""; - } - } - if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) { - return false; - } - } - if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) { - return false; - } - $actor = Profile::whereKeyId($keyId)->first(); - if(!$actor) { - $actorUrl = Helpers::pluckval($bodyDecoded['actor']); - $actor = Helpers::profileFirstOrNew($actorUrl); - } - if(!$actor) { - return false; - } - $pkey = openssl_pkey_get_public($actor->public_key); - if(!$pkey) { - return false; - } - $inboxPath = "/f/inbox"; - list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body); - if($verified == 1) { - return true; - } else { - return false; - } - } + protected function verifySignature($headers, $payload) + { + $body = $this->payload; + $bodyDecoded = $payload; + $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; + $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; + if(!$signature) { + return false; + } + if(!$date) { + return false; + } + if(!now()->parse($date)->gt(now()->subDays(1)) || + !now()->parse($date)->lt(now()->addDays(1)) + ) { + return false; + } + if(!isset($bodyDecoded['id'])) { + return false; + } + $signatureData = HttpSignature::parseSignatureHeader($signature); - protected function blindKeyRotation($headers, $payload) - { - $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; - $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; - if(!$signature) { - return; - } - if(!$date) { - return; - } - if(!now()->parse($date)->gt(now()->subDays(1)) || - !now()->parse($date)->lt(now()->addDays(1)) - ) { - return; - } - $signatureData = HttpSignature::parseSignatureHeader($signature); - $keyId = Helpers::validateUrl($signatureData['keyId']); - $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first(); - if(!$actor) { - return; - } - if(Helpers::validateUrl($actor->remote_url) == false) { - return; - } + if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) { + return false; + } - try { - $res = Http::timeout(20)->withHeaders([ - 'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', - 'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org', - ])->get($actor->remote_url); - } catch (ConnectionException $e) { - return false; - } + $keyId = Helpers::validateUrl($signatureData['keyId']); + $id = Helpers::validateUrl($bodyDecoded['id']); + $keyDomain = parse_url($keyId, PHP_URL_HOST); + $idDomain = parse_url($id, PHP_URL_HOST); + if(isset($bodyDecoded['object']) + && is_array($bodyDecoded['object']) + && isset($bodyDecoded['object']['attributedTo']) + ) { + $attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']); + if(is_array($attr)) { + if(isset($attr['id'])) { + $attr = $attr['id']; + } else { + $attr = ""; + } + } + if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) { + return false; + } + } + if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) { + return false; + } + $actor = Profile::whereKeyId($keyId)->first(); + if(!$actor) { + $actorUrl = Helpers::pluckval($bodyDecoded['actor']); + $actor = Helpers::profileFirstOrNew($actorUrl); + } + if(!$actor) { + return false; + } + $pkey = openssl_pkey_get_public($actor->public_key); + if(!$pkey) { + return false; + } + $inboxPath = "/f/inbox"; + list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body); + if($verified == 1) { + return true; + } else { + return false; + } + } - if(!$res->ok()) { - return false; - } + protected function blindKeyRotation($headers, $payload) + { + $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; + $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; + if(!$signature) { + return; + } + if(!$date) { + return; + } + if(!now()->parse($date)->gt(now()->subDays(1)) || + !now()->parse($date)->lt(now()->addDays(1)) + ) { + return; + } + $signatureData = HttpSignature::parseSignatureHeader($signature); + if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) { + return; + } - $res = json_decode($res->body(), true, 8); - if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) { - return; - } - if($res['publicKey']['id'] !== $actor->key_id) { - return; - } - $actor->public_key = $res['publicKey']['publicKeyPem']; - $actor->save(); - return $this->verifySignature($headers, $payload); - } + $keyId = Helpers::validateUrl($signatureData['keyId']); + $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first(); + if(!$actor) { + return; + } + if(Helpers::validateUrl($actor->remote_url) == false) { + return; + } + + try { + $res = Http::timeout(20)->withHeaders([ + 'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + 'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org', + ])->get($actor->remote_url); + } catch (ConnectionException $e) { + return false; + } + + if(!$res->ok()) { + return false; + } + + $res = json_decode($res->body(), true, 8); + if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) { + return; + } + if($res['publicKey']['id'] !== $actor->key_id) { + return; + } + $actor->public_key = $res['publicKey']['publicKeyPem']; + $actor->save(); + return $this->verifySignature($headers, $payload); + } }