indymedia
/
epicyon
mirror of https://gitlab.com/bashrc2/epicyon
7
4
Fork 1
Code Issues 14 Releases Wiki Activity

Fixing signed get

merge-requests/30/head
Bob Mottram 2021-09-01 19:46:28 +01:00
parent 1398685e74
commit a751dbdf14
3 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
httpsig.py
View File

@ -56,7 +56,7 @@ def signPostHeaders(dateStr: str, privateKeyPem: str,
keyID = httpPrefix + '://' + domain + '/actor#main-key' keyID = httpPrefix + '://' + domain + '/actor#main-key'
if not messageBodyJsonStr: if not messageBodyJsonStr:
headers = { headers = {
'(request-target)': f'post {path}', '(request-target)': f'get {path}',
'host': toDomain, 'host': toDomain,
'date': dateStr, 'date': dateStr,
'accept': 'application/json' 'accept': 'application/json'
@ -201,7 +201,7 @@ def createSignedHeader(privateKeyPem: str, nickname: str,
dateStr = strftime("%a, %d %b %Y %H:%M:%S %Z", gmtime()) dateStr = strftime("%a, %d %b %Y %H:%M:%S %Z", gmtime())
if not withDigest: if not withDigest:
headers = { headers = {
'(request-target)': f'post {path}', '(request-target)': f'get {path}',
'host': headerDomain, 'host': headerDomain,
'date': dateStr, 'date': dateStr,
'accept': contentType 'accept': contentType

6
session.py
View File

@ -184,9 +184,13 @@ def _getJsonSigned(session, url: str, domainFull: str, sessionHeaders: {},
print('Signed GET httpPrefix: ' + httpPrefix) print('Signed GET httpPrefix: ' + httpPrefix)
messageStr = '' messageStr = ''
withDigest = False withDigest = False
if toDomainFull + '/' in url:
path = '/' + url.split(toDomainFull + '/')[1]
else:
path = '/actor'
signatureHeaderJson = \ signatureHeaderJson = \
createSignedHeader(signingPrivateKeyPem, nickname, domain, port, createSignedHeader(signingPrivateKeyPem, nickname, domain, port,
toDomain, toPort, url, httpPrefix, withDigest, toDomain, toPort, path, httpPrefix, withDigest,
messageStr) messageStr)
print('Signed GET signatureHeaderJson ' + str(signatureHeaderJson)) print('Signed GET signatureHeaderJson ' + str(signatureHeaderJson))
for key, value in signatureHeaderJson.items(): for key, value in signatureHeaderJson.items():

11
tests.py
View File

@ -452,20 +452,21 @@ def _testHttpsigBase(withDigest):
boxpath, httpPrefix, messageBodyJsonStr) boxpath, httpPrefix, messageBodyJsonStr)
headers['signature'] = signatureHeader headers['signature'] = signatureHeader
GETmethod = not withDigest
assert verifyPostHeaders(httpPrefix, publicKeyPem, headers, assert verifyPostHeaders(httpPrefix, publicKeyPem, headers,
boxpath, False, None, boxpath, GETmethod, None,
messageBodyJsonStr, False) messageBodyJsonStr, False)
if withDigest: if withDigest:
# everything correct except for content-length # everything correct except for content-length
headers['content-length'] = str(contentLength + 2) headers['content-length'] = str(contentLength + 2)
assert verifyPostHeaders(httpPrefix, publicKeyPem, headers, assert verifyPostHeaders(httpPrefix, publicKeyPem, headers,
boxpath, False, None, boxpath, GETmethod, None,
messageBodyJsonStr, False) is False messageBodyJsonStr, False) is False
assert verifyPostHeaders(httpPrefix, publicKeyPem, headers, assert verifyPostHeaders(httpPrefix, publicKeyPem, headers,
'/parambulator' + boxpath, False, None, '/parambulator' + boxpath, GETmethod, None,
messageBodyJsonStr, False) is False messageBodyJsonStr, False) is False
assert verifyPostHeaders(httpPrefix, publicKeyPem, headers, assert verifyPostHeaders(httpPrefix, publicKeyPem, headers,
boxpath, True, None, boxpath, not GETmethod, None,
messageBodyJsonStr, False) is False messageBodyJsonStr, False) is False
if not withDigest: if not withDigest:
# fake domain # fake domain
@ -490,7 +491,7 @@ def _testHttpsigBase(withDigest):
} }
headers['signature'] = signatureHeader headers['signature'] = signatureHeader
assert verifyPostHeaders(httpPrefix, publicKeyPem, headers, assert verifyPostHeaders(httpPrefix, publicKeyPem, headers,
boxpath, True, None, boxpath, not GETmethod, None,
messageBodyJsonStr, False) is False messageBodyJsonStr, False) is False
os.chdir(baseDir) os.chdir(baseDir)