mastodon/app/controllers
ThibG 4ea7193f0a Add support for latest HTTP Signatures spec draft (#14556)
* Add support for latest HTTP Signatures spec draft

https://www.ietf.org/id/draft-ietf-httpbis-message-signatures-00.html

- add support for the “hs2019” signature algorithm (assumed to be equivalent
  to RSA-SHA256, since we do not have a mechanism to specify the algorithm
  within the key metadata yet)
- add support for (created) and (expires) pseudo-headers and related
  signature parameters, when using the hs2019 signature algorithm
- adjust default “headers” parameter while being backwards-compatible with
  previous implementation
- change the acceptable time window logic from 12 hours surrounding the “date”
  header to accepting signatures created up to 1 hour in the future and
  expiring up to 1 hour in the past (but only allowing expiration dates up to
  12 hours after the creation date)
  This doesn't conform with the current draft, as it doesn't permit accounting
  for clock skew.
  This, however, should be addressed in a next version of the draft:
  https://github.com/httpwg/http-extensions/pull/1235

* Add additional signature requirements

* Rewrite signature params parsing using Parslet

* Make apparent which signature algorithm Mastodon on verification failure

Mastodon uses RSASSA-PKCS1-v1_5, which is not recommended for new applications,
and new implementers may thus unknowingly use RSASSA-PSS.

* Add workaround for PeerTube's invalid signature header

The previous parser allowed incorrect Signature headers, such as
those produced by old versions of the `http-signature` node.js package,
and seemingly used by PeerTube.

This commit adds a workaround for that.

* Fix `signature_key_id` raising an exception

Previously, parsing failures would result in `signature_key_id` being nil,
but the parser changes made that result in an exception.

This commit changes the `signature_key_id` method to return `nil` in case
of parsing failures.

* Move extra HTTP signature helper methods to private methods

* Relax (request-target) requirement to (request-target) || digest

This lets requests from Plume work without lowering security significantly.
2020-10-19 15:41:25 +02:00
..
activitypub Add E2EE API (#13820) 2020-06-02 19:24:53 +02:00
admin Fix unpermitted operations on custom emojis leading to cryptic errors (#13951) 2020-06-05 15:23:27 +02:00
api Fix/14021 behaviour on add or remove toots (#14212) 2020-07-19 17:04:02 +02:00
auth Fix rubocop warning (#14288) 2020-07-14 19:05:07 +02:00
concerns Add support for latest HTTP Signatures spec draft (#14556) 2020-10-19 15:41:25 +02:00
oauth Fix settings pages being cacheable by the browser (#12714) 2019-12-30 04:38:30 +01:00
settings Add customizable thumbnails for audio and video attachments (#14145) 2020-06-29 13:56:55 +02:00
well_known Fix webfinger returning wrong status code on malformed or missing param (#13759) 2020-05-14 23:28:06 +02:00
about_controller.rb Add table of contents to about page (#11885) 2019-09-19 11:09:05 +02:00
account_follow_controller.rb Add specific rate limits for posting and following (#13172) 2020-03-08 15:17:39 +01:00
account_unfollow_controller.rb Restful refactor of accounts/ routes (#2133) 2017-04-19 13:52:37 +02:00
accounts_controller.rb Do not serve account actors at all in limited federation mode (#14800) 2020-10-19 14:45:12 +02:00
application_controller.rb Fix RSS feeds not being cachable (#14368) 2020-07-22 11:44:02 +02:00
authorize_interactions_controller.rb Add specific rate limits for posting and following (#13172) 2020-03-08 15:17:39 +01:00
custom_css_controller.rb Fix redirecting non-functional accounts on public pages (#11978) 2019-09-28 01:33:27 +02:00
directories_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
emojis_controller.rb Add (back) rails-level JSON caching (#11333) 2019-07-21 22:32:16 +02:00
filters_controller.rb Fix missing authentication call in filters controller (#12746) 2020-01-03 05:29:08 +01:00
follower_accounts_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
following_accounts_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
home_controller.rb Fix other sessions not being logged out on password change (#14252) 2020-07-07 15:26:31 +02:00
instance_actors_controller.rb Fix reverse-proxy caching of instance actor object (#11561) 2019-08-13 15:30:37 +02:00
intents_controller.rb Refactor controllers for statuses, accounts, and more (#11249) 2019-07-08 12:03:45 +02:00
invites_controller.rb Add invite comments (#10465) 2019-08-19 11:40:42 +02:00
manifests_controller.rb Fix redirecting non-functional accounts on public pages (#11978) 2019-09-28 01:33:27 +02:00
media_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
media_proxy_controller.rb Fix media attachments enumeration (#14254) 2020-07-07 15:26:51 +02:00
public_timelines_controller.rb Fix blurhash and autoplay not working on public pages (#11585) 2019-08-16 19:15:05 +02:00
relationships_controller.rb Change followers page to relationships page in admin UI (#12927) 2020-01-23 20:33:20 +01:00
remote_follow_controller.rb Fix redirecting non-functional accounts on public pages (#11978) 2019-09-28 01:33:27 +02:00
remote_interaction_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
shares_controller.rb Fix blurhash and autoplay not working on public pages (#11585) 2019-08-16 19:15:05 +02:00
statuses_controller.rb Fix functional user requirements in whitelist mode (#14093) 2020-06-19 19:18:47 +02:00
tags_controller.rb Fix rubocop warning (#14288) 2020-07-14 19:05:07 +02:00