rafaelcaricio/fuwuqi
1
0
Fork 0
forked from mirrors/fuwuqi
Code Issues Pull requests Packages Projects Releases Wiki Activity

Clean up HTTP signature verification code

Browse source
This commit is contained in:
Anthony Wang 2023-01-19 22:09:55 +00:00
parent 7cbb9f7e49
commit f7403f75da
No known key found for this signature in database
GPG key ID: 1DDC6BC38786C595
1 changed files with 7 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
server.py
View file

@ -64,10 +64,9 @@ class fuwuqi(SimpleHTTPRequestHandler):
username = search('^/users/(.*)\.(in|out)box$', self.path).group(1) username = search('^/users/(.*)\.(in|out)box$', self.path).group(1)
# Get actor public key # Get signer public key
keyid = search('keyId="(.*?)"', self.headers['Signature']).group(1) signer = iri_to_actor(search('keyId="(.*?)"', self.headers['Signature']).group(1))
actor = iri_to_actor(keyid) pubkeypem = signer['publicKey']['publicKeyPem'].encode('utf8')
pubkeypem = actor['publicKey']['publicKeyPem'].encode('utf8')
pubkey = serialization.load_pem_public_key(pubkeypem, None) pubkey = serialization.load_pem_public_key(pubkeypem, None)
# Assemble headers # Assemble headers
@ -84,11 +83,10 @@ class fuwuqi(SimpleHTTPRequestHandler):
signature = search('signature="(.*?)"', self.headers['Signature']).group(1) signature = search('signature="(.*?)"', self.headers['Signature']).group(1)
pubkey.verify(b64decode(signature), message[:-1].encode('utf8'), padding.PKCS1v15(), hashes.SHA256()) pubkey.verify(b64decode(signature), message[:-1].encode('utf8'), padding.PKCS1v15(), hashes.SHA256())
# Make sure activity doer matches HTTP signature # Make sure activity doer matches HTTP signature
actor = keyid.removesuffix('#main-key') if ('actor' in activity and activity['actor'] != signer['id']) or \
if ('actor' in activity and activity['actor'] != actor) or \ ('attributedTo' in activity and activity['attributedTo'] != signer['id']) or \
('attributedTo' in activity and activity['attributedTo'] != actor) or \ ('attributedTo' in activity['object'] and activity['object']['attributedTo'] != signer['id']):
('attributedTo' in activity['object'] and activity['object']['attributedTo'] != actor):
self.send_response(401) self.send_response(401)
return return