diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Simplify UriSigner when working with HttpFoundation's Request

Browse Source
This commit is contained in:
Yanick Witschi 2020-01-09 17:25:47 +01:00 committed by Fabien Potencier
parent 5c37ab016c
commit 4887b4bee1
3 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Symfony/Component/HttpKernel/EventListener/FragmentListener.php
View File

@ -83,8 +83,7 @@ class FragmentListener implements EventSubscriberInterface
} }
// is the Request signed? // is the Request signed?
// we cannot use $request->getUri() here as we want to work with the original URI (no query string reordering) if ($this->signer->checkRequest($request)) {
if ($this->signer->check($request->getSchemeAndHttpHost().$request->getBaseUrl().$request->getPathInfo().(null !== ($qs = $request->server->get('QUERY_STRING')) ? '?'.$qs : ''))) {
return; return;
} }

10
src/Symfony/Component/HttpKernel/Tests/UriSignerTest.php
View File

@ -12,6 +12,7 @@
namespace Symfony\Component\HttpKernel\Tests; namespace Symfony\Component\HttpKernel\Tests;
use PHPUnit\Framework\TestCase; use PHPUnit\Framework\TestCase;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpKernel\UriSigner; use Symfony\Component\HttpKernel\UriSigner;
class UriSignerTest extends TestCase class UriSignerTest extends TestCase
@ -52,6 +53,15 @@ class UriSignerTest extends TestCase
$this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&baz=bay'))); $this->assertTrue($signer->check($signer->sign('http://example.com/foo?foo=bar&baz=bay')));
} }
public function testCheckWithRequest()
{
$signer = new UriSigner('foobar');
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo'))));
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo?foo=bar'))));
$this->assertTrue($signer->checkRequest(Request::create($signer->sign('http://example.com/foo?foo=bar&0=integer'))));
}
public function testCheckWithDifferentParameter() public function testCheckWithDifferentParameter()
{ {
$signer = new UriSigner('foobar', 'qux'); $signer = new UriSigner('foobar', 'qux');

10
src/Symfony/Component/HttpKernel/UriSigner.php
View File

@ -11,6 +11,8 @@
namespace Symfony\Component\HttpKernel; namespace Symfony\Component\HttpKernel;
use Symfony\Component\HttpFoundation\Request;
/** /**
* Signs URIs. * Signs URIs.
* *
@ -78,6 +80,14 @@ class UriSigner
return hash_equals($this->computeHash($this->buildUrl($url, $params)), $hash); return hash_equals($this->computeHash($this->buildUrl($url, $params)), $hash);
} }
public function checkRequest(Request $request): bool
{
$qs = ($qs = $request->server->get('QUERY_STRING')) ? '?'.$qs : '';
// we cannot use $request->getUri() here as we want to work with the original URI (no query string reordering)
return $this->check($request->getSchemeAndHttpHost().$request->getBaseUrl().$request->getPathInfo().$qs);
}
private function computeHash(string $uri): string private function computeHash(string $uri): string
{ {
return base64_encode(hash_hmac('sha256', $uri, $this->secret, true)); return base64_encode(hash_hmac('sha256', $uri, $this->secret, true));