chinwagsocial/app
ThibG 4ea7193f0a Add support for latest HTTP Signatures spec draft (#14556)
* Add support for latest HTTP Signatures spec draft

https://www.ietf.org/id/draft-ietf-httpbis-message-signatures-00.html

- add support for the “hs2019” signature algorithm (assumed to be equivalent
  to RSA-SHA256, since we do not have a mechanism to specify the algorithm
  within the key metadata yet)
- add support for (created) and (expires) pseudo-headers and related
  signature parameters, when using the hs2019 signature algorithm
- adjust default “headers” parameter while being backwards-compatible with
  previous implementation
- change the acceptable time window logic from 12 hours surrounding the “date”
  header to accepting signatures created up to 1 hour in the future and
  expiring up to 1 hour in the past (but only allowing expiration dates up to
  12 hours after the creation date)
  This doesn't conform with the current draft, as it doesn't permit accounting
  for clock skew.
  This, however, should be addressed in a next version of the draft:
  https://github.com/httpwg/http-extensions/pull/1235

* Add additional signature requirements

* Rewrite signature params parsing using Parslet

* Make apparent which signature algorithm Mastodon on verification failure

Mastodon uses RSASSA-PKCS1-v1_5, which is not recommended for new applications,
and new implementers may thus unknowingly use RSASSA-PSS.

* Add workaround for PeerTube's invalid signature header

The previous parser allowed incorrect Signature headers, such as
those produced by old versions of the `http-signature` node.js package,
and seemingly used by PeerTube.

This commit adds a workaround for that.

* Fix `signature_key_id` raising an exception

Previously, parsing failures would result in `signature_key_id` being nil,
but the parser changes made that result in an exception.

This commit changes the `signature_key_id` method to return `nil` in case
of parsing failures.

* Move extra HTTP signature helper methods to private methods

* Relax (request-target) requirement to (request-target) || digest

This lets requests from Plume work without lowering security significantly.
2020-10-19 15:41:25 +02:00
..
chewy Change tootctl search deploy algorithm (#14300) 2020-07-14 18:10:35 +02:00
controllers Add support for latest HTTP Signatures spec draft (#14556) 2020-10-19 15:41:25 +02:00
helpers Remove dependency on goldfinger gem (#14919) 2020-10-19 14:48:54 +02:00
javascript Fix: also use custom private boost icon for detailed status (#14471) 2020-10-19 15:40:51 +02:00
lib Fix dereferencing remote statuses not using the correct account (#14656) 2020-10-19 15:41:11 +02:00
mailers Add e-mail-based sign in challenge for users with disabled 2FA (#14013) 2020-06-09 10:23:06 +02:00
models Fix videos with near-60 fps being rejected (#14684) 2020-10-19 14:49:14 +02:00
policies Add ability to delete files uploaded for settings in admin UI (#13192) 2020-03-08 16:00:24 +01:00
presenters Add user notes on accounts (#14148) 2020-06-30 19:19:50 +02:00
serializers Add thumbnail_remote_url in MediaAttachment REST response (#14358) 2020-07-19 19:53:31 +02:00
services Remove dependency on goldfinger gem (#14919) 2020-10-19 14:48:54 +02:00
validators Add E2EE API (#13820) 2020-06-02 19:24:53 +02:00
views Fix audio/video player not using CDN_HOST in media paths on public pages (#14486) 2020-10-19 15:40:03 +02:00
workers Changed retries and rescued in ActivityPub::ProcessingWorker (#14355) 2020-07-20 11:26:12 +02:00