Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c1156a2

Browse files
BaptisteContrerasBaptisteContreras
committed
[HttpFoundation] Add temporary URI signed
1 parent c71348a commit c1156a2

File tree

5 files changed

+203
-11
lines changed

5 files changed

+203
-11
lines changed

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

+3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ CHANGELOG
44
7.1
55
---
66

7+
* Add optional `$expirationParameter` argument to `UriSigner::__construct()`
8+
* Add optional `$expiration` argument to `UriSigner::sign()`
9+
* Rename `$parameter` argument of `UriSigner::__construct()` to `$hashParameter`
710
* Add `UploadedFile::getClientOriginalPath()`
811

912
7.0

‎src/Symfony/Component/HttpFoundation/Exception/ExceptionInterface.php

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <[email protected]>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\HttpFoundation\Exception;
13+
14+
interface ExceptionInterface extends \Throwable
15+
{
16+
}

‎src/Symfony/Component/HttpFoundation/Exception/LogicException.php

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <[email protected]>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\HttpFoundation\Exception;
13+
14+
/**
15+
* Base LogicException for Http Foundation component.
16+
*/
17+
class LogicException extends \LogicException implements ExceptionInterface
18+
{
19+
}

‎src/Symfony/Component/HttpFoundation/Tests/UriSignerTest.php

+108-1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\HttpFoundation\Tests;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Component\HttpFoundation\Exception\LogicException;
1516
use Symfony\Component\HttpFoundation\Request;
1617
use Symfony\Component\HttpFoundation\UriSigner;
1718

@@ -24,21 +25,38 @@ public function testSign()
2425
$this->assertStringContainsString('?_hash=', $signer->sign('http://example.com/foo'));
2526
$this->assertStringContainsString('?_hash=', $signer->sign('http://example.com/foo?foo=bar'));
2627
$this->assertStringContainsString('&foo=', $signer->sign('http://example.com/foo?foo=bar'));
28+
29+
$this->assertStringContainsString('?_expiration=', $signer->sign('http://example.com/foo', 1));
30+
$this->assertStringContainsString('&_hash=', $signer->sign('http://example.com/foo', 1));
31+
$this->assertStringContainsString('?_expiration=', $signer->sign('http://example.com/foo?foo=bar', 1));
32+
$this->assertStringContainsString('&_hash=', $signer->sign('http://example.com/foo?foo=bar', 1));
33+
$this->assertStringContainsString('&foo=', $signer->sign('http://example.com/foo?foo=bar', 1));
2734
}
2835

2936
public function testCheck()
3037
{
3138
$signer = new UriSigner('foobar');
3239

40+
$this->assertFalse($signer->check('http://example.com/foo'));
3341
$this->assertFalse($signer->check('http://example.com/foo?_hash=foo'));
3442
$this->assertFalse($signer->check('http://example.com/foo?foo=bar&_hash=foo'));
3543
$this->assertFalse($signer->check('http://example.com/foo?foo=bar&_hash=foo&bar=foo'));
3644

45+
$this->assertFalse($signer->check('http://example.com/foo?_expiration=4070908800'));
46+
$this->assertFalse($signer->check('http://example.com/foo?_expiration=4070908800?_hash=foo'));
47+
$this->assertFalse($signer->check('http://example.com/foo?_expiration=4070908800&foo=bar&_hash=foo'));
48+
$this->assertFalse($signer->check('http://example.com/foo?_expiration=4070908800&foo=bar&_hash=foo&bar=foo'));
49+
3750
$this->assertTrue($signer->check($signer->sign('http://example.com/foo')));
3851
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar')));
3952
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer')));
4053

54+
$this->assertTrue($signer->check($signer->sign('http://example.com/foo', new \DateTimeImmutable('2099-01-01 00:00:00'))));
55+
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar', new \DateTimeImmutable('2099-01-01 00:00:00'))));
56+
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer', new \DateTimeImmutable('2099-01-01 00:00:00'))));
57+
4158
$this->assertSame($signer->sign('http://example.com/foo?foo=bar&bar=foo'), $signer->sign('http://example.com/foo?bar=foo&foo=bar'));
59+
$this->assertSame($signer->sign('http://example.com/foo?foo=bar&bar=foo', 1), $signer->sign('http://example.com/foo?bar=foo&foo=bar', 1));
4260
}
4361

4462
public function testCheckWithDifferentArgSeparator()
@@ -51,6 +69,12 @@ public function testCheckWithDifferentArgSeparator()
5169
$signer->sign('http://example.com/foo?foo=bar&baz=bay')
5270
);
5371
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&baz=bay')));
72+
73+
$this->assertSame(
74+
'http://example.com/foo?_expiration=4070908800&_hash=xfui5FoP0vbD9Cp7pI0tHnqR1Fmj2UARqkIUw7SZVfQ%3D&baz=bay&foo=bar',
75+
$signer->sign('http://example.com/foo?foo=bar&baz=bay', new \DateTimeImmutable('2099-01-01 00:00:00'))
76+
);
77+
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&baz=bay', new \DateTimeImmutable('2099-01-01 00:00:00'))));
5478
}
5579

5680
public function testCheckWithRequest()
@@ -60,17 +84,27 @@ public function testCheckWithRequest()
6084
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo'))));
6185
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo?foo=bar'))));
6286
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo?foo=bar&0=integer'))));
87+
88+
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo', new \DateTimeImmutable('2099-01-01 00:00:00')))));
89+
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo?foo=bar', new \DateTimeImmutable('2099-01-01 00:00:00')))));
90+
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo?foo=bar&0=integer', new \DateTimeImmutable('2099-01-01 00:00:00')))));
6391
}
6492

6593
public function testCheckWithDifferentParameter()
6694
{
67-
$signer = new UriSigner('foobar', 'qux');
95+
$signer = new UriSigner('foobar', 'qux', 'abc');
6896

6997
$this->assertSame(
7098
'http://example.com/foo?baz=bay&foo=bar&qux=rIOcC%2FF3DoEGo%2FvnESjSp7uU9zA9S%2F%2BOLhxgMexoPUM%3D',
7199
$signer->sign('http://example.com/foo?foo=bar&baz=bay')
72100
);
73101
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&baz=bay')));
102+
103+
$this->assertSame(
104+
'http://example.com/foo?abc=4070908800&baz=bay&foo=bar&qux=hdhUhBVPpzKJdz5ZjC%2FkLvtOYdGKOvKVOczmmMIZK0A%3D',
105+
$signer->sign('http://example.com/foo?foo=bar&baz=bay', new \DateTimeImmutable('2099-01-01 00:00:00'))
106+
);
107+
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&baz=bay', new \DateTimeImmutable('2099-01-01 00:00:00'))));
74108
}
75109

76110
public function testSignerWorksWithFragments()
@@ -81,6 +115,79 @@ public function testSignerWorksWithFragments()
81115
'http://example.com/foo?_hash=EhpAUyEobiM3QTrKxoLOtQq5IsWyWedoXDPqIjzNj5o%3D&bar=foo&foo=bar#foobar',
82116
$signer->sign('http://example.com/foo?bar=foo&foo=bar#foobar')
83117
);
118+
84119
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?bar=foo&foo=bar#foobar')));
120+
121+
$this->assertSame(
122+
'http://example.com/foo?_expiration=4070908800&_hash=qHl626U5d7LMsVtBxPt9GNzysdSxyOQ1fHA59Y1ib0Y%3D&bar=foo&foo=bar#foobar',
123+
$signer->sign('http://example.com/foo?bar=foo&foo=bar#foobar', new \DateTimeImmutable('2099-01-01 00:00:00'))
124+
);
125+
126+
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?bar=foo&foo=bar#foobar', new \DateTimeImmutable('2099-01-01 00:00:00'))));
127+
}
128+
129+
public function testSignWithUriExpiration()
130+
{
131+
$signer = new UriSigner('foobar');
132+
133+
$this->assertSame($signer->sign('http://example.com/foo?foo=bar&bar=foo', new \DateTimeImmutable('2099-01-01 00:00:00')), $signer->sign('http://example.com/foo?bar=foo&foo=bar', 4070908800));
134+
}
135+
136+
public function testSignWithoutExpirationAndWithReservedHashParameter()
137+
{
138+
$signer = new UriSigner('foobar');
139+
140+
$this->expectException(LogicException::class);
141+
142+
$signer->sign('http://example.com/foo?_hash=bar');
143+
}
144+
145+
public function testSignWithoutExpirationAndWithReservedParameter()
146+
{
147+
$signer = new UriSigner('foobar');
148+
149+
$this->expectException(LogicException::class);
150+
151+
$signer->sign('http://example.com/foo?_expiration=4070908800');
152+
}
153+
154+
public function testSignWithExpirationAndWithReservedHashParameter()
155+
{
156+
$signer = new UriSigner('foobar');
157+
158+
$this->expectException(LogicException::class);
159+
160+
$signer->sign('http://example.com/foo?_hash=bar', new \DateTimeImmutable('2099-01-01 00:00:00'));
161+
}
162+
163+
public function testSignWithExpirationAndWithReservedParameter()
164+
{
165+
$signer = new UriSigner('foobar');
166+
167+
$this->expectException(LogicException::class);
168+
169+
$signer->sign('http://example.com/foo?_expiration=4070908800', new \DateTimeImmutable('2099-01-01 00:00:00'));
170+
}
171+
172+
public function testCheckWithUriExpiration()
173+
{
174+
$signer = new UriSigner('foobar');
175+
176+
$this->assertFalse($signer->check($signer->sign('http://example.com/foo', new \DateTimeImmutable('2000-01-01 00:00:00'))));
177+
$this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar', new \DateTimeImmutable('2000-01-01 00:00:00'))));
178+
$this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer', new \DateTimeImmutable('2000-01-01 00:00:00'))));
179+
180+
$this->assertFalse($signer->check($signer->sign('http://example.com/foo', 1577836800))); // 2000-01-01
181+
$this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar', 1577836800))); // 2000-01-01
182+
$this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer', 1577836800))); // 2000-01-01
183+
184+
$relativeUriFromNow1 = $signer->sign('http://example.com/foo', new \DateInterval('PT3S'));
185+
$relativeUriFromNow2 = $signer->sign('http://example.com/foo?foo=bar', new \DateInterval('PT3S'));
186+
$relativeUriFromNow3 = $signer->sign('http://example.com/foo?foo=bar&0=integer', new \DateInterval('PT3S'));
187+
sleep(10);
188+
189+
$this->assertFalse($signer->check($relativeUriFromNow1));
190+
$this->assertFalse($signer->check($relativeUriFromNow2));
191+
$this->assertFalse($signer->check($relativeUriFromNow3));
85192
}
86193
}

‎src/Symfony/Component/HttpFoundation/UriSigner.php

+57-10
Original file line numberDiff line numberDiff line change
@@ -11,34 +11,47 @@
1111

1212
namespace Symfony\Component\HttpFoundation;
1313

14+
use Symfony\Component\HttpFoundation\Exception\LogicException;
15+
1416
/**
1517
* @author Fabien Potencier <[email protected]>
1618
*/
1719
class UriSigner
1820
{
1921
private string $secret;
20-
private string $parameter;
22+
private string $hashParameter;
23+
private string $expirationParameter;
2124

2225
/**
23-
* @param string $parameter Query string parameter to use
26+
* @param string $hashParameter Query string parameter to use
27+
* @param string $expirationParameter Query string parameter to use for expiration
2428
*/
25-
public function __construct(#[\SensitiveParameter] string $secret, string $parameter = '_hash')
29+
public function __construct(#[\SensitiveParameter] string $secret, string $hashParameter = '_hash', string $expirationParameter = '_expiration')
2630
{
2731
if (!$secret) {
2832
throw new \InvalidArgumentException('A non-empty secret is required.');
2933
}
3034

3135
$this->secret = $secret;
32-
$this->parameter = $parameter;
36+
$this->hashParameter = $hashParameter;
37+
$this->expirationParameter = $expirationParameter;
3338
}
3439

3540
/**
3641
* Signs a URI.
3742
*
3843
* The given URI is signed by adding the query string parameter
3944
* which value depends on the URI and the secret.
45+
*
46+
* @param \DateTimeInterface|\DateInterval|int|null $expiration The expiration for the given URI.
47+
* If $expiration is a \DateTimeInterface, it's expected to be the exact date + time.
48+
* If $expiration is a \DateInterval, the interval is added to "now" to get the date + time.
49+
* If $expiration is an int, it's expected to be a timestamp in seconds of the exact date + time.
50+
* If $expiration is null, no expiration.
51+
*
52+
* The expiration is added as a query string parameter.
4053
*/
41-
public function sign(string $uri): string
54+
public function sign(string $uri, \DateTimeInterface|\DateInterval|int $expiration = null): string
4255
{
4356
$url = parse_url($uri);
4457
$params = [];
@@ -47,14 +60,27 @@ public function sign(string $uri): string
4760
parse_str($url['query'], $params);
4861
}
4962

63+
if (isset($params[$this->hashParameter])) {
64+
throw new LogicException(sprintf('URI query parameter conflict: parameter name "%s" is reserved.', $this->hashParameter));
65+
}
66+
67+
if (isset($params[$this->expirationParameter])) {
68+
throw new LogicException(sprintf('URI query parameter conflict: parameter name "%s" is reserved.', $this->expirationParameter));
69+
}
70+
71+
if (null !== $expiration) {
72+
$params[$this->expirationParameter] = $this->getExpirationTime($expiration);
73+
}
74+
5075
$uri = $this->buildUrl($url, $params);
51-
$params[$this->parameter] = $this->computeHash($uri);
76+
$params[$this->hashParameter] = $this->computeHash($uri);
5277

5378
return $this->buildUrl($url, $params);
5479
}
5580

5681
/**
5782
* Checks that a URI contains the correct hash.
83+
* Also checks if the URI has not expired (If you used expiration during signing).
5884
*/
5985
public function check(string $uri): bool
6086
{
@@ -65,14 +91,22 @@ public function check(string $uri): bool
6591
parse_str($url['query'], $params);
6692
}
6793

68-
if (empty($params[$this->parameter])) {
94+
if (empty($params[$this->hashParameter])) {
6995
return false;
7096
}
7197

72-
$hash = $params[$this->parameter];
73-
unset($params[$this->parameter]);
98+
$hash = $params[$this->hashParameter];
99+
unset($params[$this->hashParameter]);
74100

75-
return hash_equals($this->computeHash($this->buildUrl($url, $params)), $hash);
101+
if (!hash_equals($this->computeHash($this->buildUrl($url, $params)), $hash)) {
102+
return false;
103+
}
104+
105+
if ($expiration = $params[$this->expirationParameter] ?? false) {
106+
return time() < $expiration;
107+
}
108+
109+
return true;
76110
}
77111

78112
public function checkRequest(Request $request): bool
@@ -105,4 +139,17 @@ private function buildUrl(array $url, array $params = []): string
105139

106140
return $scheme.$user.$pass.$host.$port.$path.$query.$fragment;
107141
}
142+
143+
private function getExpirationTime(\DateTimeInterface|\DateInterval|int $expiration): string
144+
{
145+
if ($expiration instanceof \DateTimeInterface) {
146+
return $expiration->format('U');
147+
}
148+
149+
if ($expiration instanceof \DateInterval) {
150+
return \DateTimeImmutable::createFromFormat('U', time())->add($expiration)->format('U');
151+
}
152+
153+
return (string) $expiration;
154+
}
108155
}

0 commit comments

Comments
 (0)