updated plugin WP-WebAuthn version 1.3.1
This commit is contained in:
Gitium
@ -0,0 +1,96 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* The MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014-2020 Spomky-Labs
|
||||
*
|
||||
* This software may be modified and distributed under the terms
|
||||
* of the MIT license. See the LICENSE file for details.
|
||||
*/
|
||||
|
||||
namespace Jose\Component\Signature\Serializer;
|
||||
|
||||
use Base64Url\Base64Url;
|
||||
use function count;
|
||||
use InvalidArgumentException;
|
||||
use Jose\Component\Core\Util\JsonConverter;
|
||||
use Jose\Component\Signature\JWS;
|
||||
use LogicException;
|
||||
use Throwable;
|
||||
|
||||
final class CompactSerializer extends Serializer
|
||||
{
|
||||
public const NAME = 'jws_compact';
|
||||
|
||||
public function displayName(): string
|
||||
{
|
||||
return 'JWS Compact';
|
||||
}
|
||||
|
||||
public function name(): string
|
||||
{
|
||||
return self::NAME;
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws LogicException if the JWS has unprotected header (invalid for compact JSON)
|
||||
* @throws LogicException if the payload is not encoded but contains unauthorized characters
|
||||
*/
|
||||
public function serialize(JWS $jws, ?int $signatureIndex = null): string
|
||||
{
|
||||
if (null === $signatureIndex) {
|
||||
$signatureIndex = 0;
|
||||
}
|
||||
$signature = $jws->getSignature($signatureIndex);
|
||||
if (0 !== count($signature->getHeader())) {
|
||||
throw new LogicException('The signature contains unprotected header parameters and cannot be converted into compact JSON.');
|
||||
}
|
||||
$isEmptyPayload = null === $jws->getEncodedPayload() || '' === $jws->getEncodedPayload();
|
||||
if (!$this->isPayloadEncoded($signature->getProtectedHeader()) && !$isEmptyPayload) {
|
||||
if (1 !== preg_match('/^[\x{20}-\x{2d}|\x{2f}-\x{7e}]*$/u', $jws->getPayload())) {
|
||||
throw new LogicException('Unable to convert the JWS with non-encoded payload.');
|
||||
}
|
||||
}
|
||||
|
||||
return sprintf(
|
||||
'%s.%s.%s',
|
||||
$signature->getEncodedProtectedHeader(),
|
||||
$jws->getEncodedPayload(),
|
||||
Base64Url::encode($signature->getSignature())
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws InvalidArgumentException if the input is invalid
|
||||
*/
|
||||
public function unserialize(string $input): JWS
|
||||
{
|
||||
$parts = explode('.', $input);
|
||||
if (3 !== count($parts)) {
|
||||
throw new InvalidArgumentException('Unsupported input');
|
||||
}
|
||||
|
||||
try {
|
||||
$encodedProtectedHeader = $parts[0];
|
||||
$protectedHeader = JsonConverter::decode(Base64Url::decode($parts[0]));
|
||||
$hasPayload = '' !== $parts[1];
|
||||
if (!$hasPayload) {
|
||||
$payload = null;
|
||||
$encodedPayload = null;
|
||||
} else {
|
||||
$encodedPayload = $parts[1];
|
||||
$payload = $this->isPayloadEncoded($protectedHeader) ? Base64Url::decode($encodedPayload) : $encodedPayload;
|
||||
}
|
||||
$signature = Base64Url::decode($parts[2]);
|
||||
|
||||
$jws = new JWS($payload, $encodedPayload, !$hasPayload);
|
||||
|
||||
return $jws->addSignature($signature, $protectedHeader, $encodedProtectedHeader);
|
||||
} catch (Throwable $throwable) {
|
||||
throw new InvalidArgumentException('Unsupported input', $throwable->getCode(), $throwable);
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,110 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* The MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014-2020 Spomky-Labs
|
||||
*
|
||||
* This software may be modified and distributed under the terms
|
||||
* of the MIT license. See the LICENSE file for details.
|
||||
*/
|
||||
|
||||
namespace Jose\Component\Signature\Serializer;
|
||||
|
||||
use Base64Url\Base64Url;
|
||||
use function count;
|
||||
use InvalidArgumentException;
|
||||
use function is_array;
|
||||
use Jose\Component\Core\Util\JsonConverter;
|
||||
use Jose\Component\Signature\JWS;
|
||||
|
||||
final class JSONFlattenedSerializer extends Serializer
|
||||
{
|
||||
public const NAME = 'jws_json_flattened';
|
||||
|
||||
public function displayName(): string
|
||||
{
|
||||
return 'JWS JSON Flattened';
|
||||
}
|
||||
|
||||
public function name(): string
|
||||
{
|
||||
return self::NAME;
|
||||
}
|
||||
|
||||
public function serialize(JWS $jws, ?int $signatureIndex = null): string
|
||||
{
|
||||
if (null === $signatureIndex) {
|
||||
$signatureIndex = 0;
|
||||
}
|
||||
$signature = $jws->getSignature($signatureIndex);
|
||||
|
||||
$data = [];
|
||||
$values = [
|
||||
'payload' => $jws->getEncodedPayload(),
|
||||
'protected' => $signature->getEncodedProtectedHeader(),
|
||||
'header' => $signature->getHeader(),
|
||||
];
|
||||
$encodedPayload = $jws->getEncodedPayload();
|
||||
if (null !== $encodedPayload && '' !== $encodedPayload) {
|
||||
$data['payload'] = $encodedPayload;
|
||||
}
|
||||
$encodedProtectedHeader = $signature->getEncodedProtectedHeader();
|
||||
if (null !== $encodedProtectedHeader && '' !== $encodedProtectedHeader) {
|
||||
$data['protected'] = $encodedProtectedHeader;
|
||||
}
|
||||
$header = $signature->getHeader();
|
||||
if (0 !== count($header)) {
|
||||
$data['header'] = $header;
|
||||
}
|
||||
$data['signature'] = Base64Url::encode($signature->getSignature());
|
||||
|
||||
return JsonConverter::encode($data);
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws InvalidArgumentException if the input is not supported
|
||||
* @throws InvalidArgumentException if the JWS header is invalid
|
||||
*/
|
||||
public function unserialize(string $input): JWS
|
||||
{
|
||||
$data = JsonConverter::decode($input);
|
||||
if (!is_array($data)) {
|
||||
throw new InvalidArgumentException('Unsupported input.');
|
||||
}
|
||||
if (!isset($data['signature'])) {
|
||||
throw new InvalidArgumentException('Unsupported input.');
|
||||
}
|
||||
$signature = Base64Url::decode($data['signature']);
|
||||
|
||||
if (isset($data['protected'])) {
|
||||
$encodedProtectedHeader = $data['protected'];
|
||||
$protectedHeader = JsonConverter::decode(Base64Url::decode($data['protected']));
|
||||
} else {
|
||||
$encodedProtectedHeader = null;
|
||||
$protectedHeader = [];
|
||||
}
|
||||
if (isset($data['header'])) {
|
||||
if (!is_array($data['header'])) {
|
||||
throw new InvalidArgumentException('Bad header.');
|
||||
}
|
||||
$header = $data['header'];
|
||||
} else {
|
||||
$header = [];
|
||||
}
|
||||
|
||||
if (isset($data['payload'])) {
|
||||
$encodedPayload = $data['payload'];
|
||||
$payload = $this->isPayloadEncoded($protectedHeader) ? Base64Url::decode($encodedPayload) : $encodedPayload;
|
||||
} else {
|
||||
$payload = null;
|
||||
$encodedPayload = null;
|
||||
}
|
||||
|
||||
$jws = new JWS($payload, $encodedPayload, null === $encodedPayload);
|
||||
|
||||
return $jws->addSignature($signature, $protectedHeader, $encodedProtectedHeader, $header);
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,167 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* The MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014-2020 Spomky-Labs
|
||||
*
|
||||
* This software may be modified and distributed under the terms
|
||||
* of the MIT license. See the LICENSE file for details.
|
||||
*/
|
||||
|
||||
namespace Jose\Component\Signature\Serializer;
|
||||
|
||||
use function array_key_exists;
|
||||
use Base64Url\Base64Url;
|
||||
use function count;
|
||||
use InvalidArgumentException;
|
||||
use function is_array;
|
||||
use function is_string;
|
||||
use Jose\Component\Core\Util\JsonConverter;
|
||||
use Jose\Component\Signature\JWS;
|
||||
use LogicException;
|
||||
|
||||
final class JSONGeneralSerializer extends Serializer
|
||||
{
|
||||
public const NAME = 'jws_json_general';
|
||||
|
||||
public function displayName(): string
|
||||
{
|
||||
return 'JWS JSON General';
|
||||
}
|
||||
|
||||
public function name(): string
|
||||
{
|
||||
return self::NAME;
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws LogicException if no signature is attached
|
||||
*/
|
||||
public function serialize(JWS $jws, ?int $signatureIndex = null): string
|
||||
{
|
||||
if (0 === $jws->countSignatures()) {
|
||||
throw new LogicException('No signature.');
|
||||
}
|
||||
|
||||
$data = [];
|
||||
$this->checkPayloadEncoding($jws);
|
||||
|
||||
if (false === $jws->isPayloadDetached()) {
|
||||
$data['payload'] = $jws->getEncodedPayload();
|
||||
}
|
||||
|
||||
$data['signatures'] = [];
|
||||
foreach ($jws->getSignatures() as $signature) {
|
||||
$tmp = ['signature' => Base64Url::encode($signature->getSignature())];
|
||||
$values = [
|
||||
'protected' => $signature->getEncodedProtectedHeader(),
|
||||
'header' => $signature->getHeader(),
|
||||
];
|
||||
|
||||
foreach ($values as $key => $value) {
|
||||
if ((is_string($value) && '' !== $value) || (is_array($value) && 0 !== count($value))) {
|
||||
$tmp[$key] = $value;
|
||||
}
|
||||
}
|
||||
$data['signatures'][] = $tmp;
|
||||
}
|
||||
|
||||
return JsonConverter::encode($data);
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws InvalidArgumentException if the input is not supported
|
||||
*/
|
||||
public function unserialize(string $input): JWS
|
||||
{
|
||||
$data = JsonConverter::decode($input);
|
||||
if (!isset($data['signatures'])) {
|
||||
throw new InvalidArgumentException('Unsupported input.');
|
||||
}
|
||||
|
||||
$isPayloadEncoded = null;
|
||||
$rawPayload = $data['payload'] ?? null;
|
||||
$signatures = [];
|
||||
foreach ($data['signatures'] as $signature) {
|
||||
if (!isset($signature['signature'])) {
|
||||
throw new InvalidArgumentException('Unsupported input.');
|
||||
}
|
||||
[$encodedProtectedHeader, $protectedHeader, $header] = $this->processHeaders($signature);
|
||||
$signatures[] = [
|
||||
'signature' => Base64Url::decode($signature['signature']),
|
||||
'protected' => $protectedHeader,
|
||||
'encoded_protected' => $encodedProtectedHeader,
|
||||
'header' => $header,
|
||||
];
|
||||
$isPayloadEncoded = $this->processIsPayloadEncoded($isPayloadEncoded, $protectedHeader);
|
||||
}
|
||||
|
||||
$payload = $this->processPayload($rawPayload, $isPayloadEncoded);
|
||||
$jws = new JWS($payload, $rawPayload);
|
||||
foreach ($signatures as $signature) {
|
||||
$jws = $jws->addSignature(
|
||||
$signature['signature'],
|
||||
$signature['protected'],
|
||||
$signature['encoded_protected'],
|
||||
$signature['header']
|
||||
);
|
||||
}
|
||||
|
||||
return $jws;
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws InvalidArgumentException if the payload encoding is invalid
|
||||
*/
|
||||
private function processIsPayloadEncoded(?bool $isPayloadEncoded, array $protectedHeader): bool
|
||||
{
|
||||
if (null === $isPayloadEncoded) {
|
||||
return $this->isPayloadEncoded($protectedHeader);
|
||||
}
|
||||
if ($this->isPayloadEncoded($protectedHeader) !== $isPayloadEncoded) {
|
||||
throw new InvalidArgumentException('Foreign payload encoding detected.');
|
||||
}
|
||||
|
||||
return $isPayloadEncoded;
|
||||
}
|
||||
|
||||
private function processHeaders(array $signature): array
|
||||
{
|
||||
$encodedProtectedHeader = $signature['protected'] ?? null;
|
||||
$protectedHeader = null === $encodedProtectedHeader ? [] : JsonConverter::decode(Base64Url::decode($encodedProtectedHeader));
|
||||
$header = array_key_exists('header', $signature) ? $signature['header'] : [];
|
||||
|
||||
return [$encodedProtectedHeader, $protectedHeader, $header];
|
||||
}
|
||||
|
||||
private function processPayload(?string $rawPayload, ?bool $isPayloadEncoded): ?string
|
||||
{
|
||||
if (null === $rawPayload) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return false === $isPayloadEncoded ? $rawPayload : Base64Url::decode($rawPayload);
|
||||
}
|
||||
|
||||
// @throws LogicException if the payload encoding is invalid
|
||||
private function checkPayloadEncoding(JWS $jws): void
|
||||
{
|
||||
if ($jws->isPayloadDetached()) {
|
||||
return;
|
||||
}
|
||||
$is_encoded = null;
|
||||
foreach ($jws->getSignatures() as $signature) {
|
||||
if (null === $is_encoded) {
|
||||
$is_encoded = $this->isPayloadEncoded($signature->getProtectedHeader());
|
||||
}
|
||||
if (false === $jws->isPayloadDetached()) {
|
||||
if ($is_encoded !== $this->isPayloadEncoded($signature->getProtectedHeader())) {
|
||||
throw new LogicException('Foreign payload encoding detected.');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,38 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* The MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014-2020 Spomky-Labs
|
||||
*
|
||||
* This software may be modified and distributed under the terms
|
||||
* of the MIT license. See the LICENSE file for details.
|
||||
*/
|
||||
|
||||
namespace Jose\Component\Signature\Serializer;
|
||||
|
||||
use Jose\Component\Signature\JWS;
|
||||
|
||||
interface JWSSerializer
|
||||
{
|
||||
/**
|
||||
* The name of the serialization.
|
||||
*/
|
||||
public function name(): string;
|
||||
|
||||
public function displayName(): string;
|
||||
|
||||
/**
|
||||
* Converts a JWS into a string.
|
||||
*/
|
||||
public function serialize(JWS $jws, ?int $signatureIndex = null): string;
|
||||
|
||||
/**
|
||||
* Loads data and return a JWS object.
|
||||
*
|
||||
* @param string $input A string that represents a JWS
|
||||
*/
|
||||
public function unserialize(string $input): JWS;
|
||||
}
|
||||
@ -0,0 +1,86 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* The MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014-2020 Spomky-Labs
|
||||
*
|
||||
* This software may be modified and distributed under the terms
|
||||
* of the MIT license. See the LICENSE file for details.
|
||||
*/
|
||||
|
||||
namespace Jose\Component\Signature\Serializer;
|
||||
|
||||
use InvalidArgumentException;
|
||||
use Jose\Component\Signature\JWS;
|
||||
|
||||
class JWSSerializerManager
|
||||
{
|
||||
/**
|
||||
* @var JWSSerializer[]
|
||||
*/
|
||||
private $serializers = [];
|
||||
|
||||
/**
|
||||
* @param JWSSerializer[] $serializers
|
||||
*/
|
||||
public function __construct(array $serializers)
|
||||
{
|
||||
foreach ($serializers as $serializer) {
|
||||
$this->add($serializer);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string[]
|
||||
*/
|
||||
public function list(): array
|
||||
{
|
||||
return array_keys($this->serializers);
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts a JWS into a string.
|
||||
*
|
||||
* @throws InvalidArgumentException if the serializer is not supported
|
||||
*/
|
||||
public function serialize(string $name, JWS $jws, ?int $signatureIndex = null): string
|
||||
{
|
||||
if (!isset($this->serializers[$name])) {
|
||||
throw new InvalidArgumentException(sprintf('Unsupported serializer "%s".', $name));
|
||||
}
|
||||
|
||||
return $this->serializers[$name]->serialize($jws, $signatureIndex);
|
||||
}
|
||||
|
||||
/**
|
||||
* Loads data and return a JWS object.
|
||||
*
|
||||
* @param string $input A string that represents a JWS
|
||||
* @param null|string $name the name of the serializer if the input is unserialized
|
||||
*
|
||||
* @throws InvalidArgumentException if the input is not supported
|
||||
*/
|
||||
public function unserialize(string $input, ?string &$name = null): JWS
|
||||
{
|
||||
foreach ($this->serializers as $serializer) {
|
||||
try {
|
||||
$jws = $serializer->unserialize($input);
|
||||
$name = $serializer->name();
|
||||
|
||||
return $jws;
|
||||
} catch (InvalidArgumentException $e) {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
throw new InvalidArgumentException('Unsupported input.');
|
||||
}
|
||||
|
||||
private function add(JWSSerializer $serializer): void
|
||||
{
|
||||
$this->serializers[$serializer->name()] = $serializer;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,63 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* The MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014-2020 Spomky-Labs
|
||||
*
|
||||
* This software may be modified and distributed under the terms
|
||||
* of the MIT license. See the LICENSE file for details.
|
||||
*/
|
||||
|
||||
namespace Jose\Component\Signature\Serializer;
|
||||
|
||||
use InvalidArgumentException;
|
||||
|
||||
class JWSSerializerManagerFactory
|
||||
{
|
||||
/**
|
||||
* @var JWSSerializer[]
|
||||
*/
|
||||
private $serializers = [];
|
||||
|
||||
/**
|
||||
* @param string[] $names
|
||||
*
|
||||
* @throws InvalidArgumentException if the serializer is not supported
|
||||
*/
|
||||
public function create(array $names): JWSSerializerManager
|
||||
{
|
||||
$serializers = [];
|
||||
foreach ($names as $name) {
|
||||
if (!isset($this->serializers[$name])) {
|
||||
throw new InvalidArgumentException(sprintf('Unsupported serializer "%s".', $name));
|
||||
}
|
||||
$serializers[] = $this->serializers[$name];
|
||||
}
|
||||
|
||||
return new JWSSerializerManager($serializers);
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string[]
|
||||
*/
|
||||
public function names(): array
|
||||
{
|
||||
return array_keys($this->serializers);
|
||||
}
|
||||
|
||||
/**
|
||||
* @return JWSSerializer[]
|
||||
*/
|
||||
public function all(): array
|
||||
{
|
||||
return $this->serializers;
|
||||
}
|
||||
|
||||
public function add(JWSSerializer $serializer): void
|
||||
{
|
||||
$this->serializers[$serializer->name()] = $serializer;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,24 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* The MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014-2020 Spomky-Labs
|
||||
*
|
||||
* This software may be modified and distributed under the terms
|
||||
* of the MIT license. See the LICENSE file for details.
|
||||
*/
|
||||
|
||||
namespace Jose\Component\Signature\Serializer;
|
||||
|
||||
use function array_key_exists;
|
||||
|
||||
abstract class Serializer implements JWSSerializer
|
||||
{
|
||||
protected function isPayloadEncoded(array $protectedHeader): bool
|
||||
{
|
||||
return !array_key_exists('b64', $protectedHeader) || true === $protectedHeader['b64'];
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user