pixelfed/app/Jobs/InboxPipeline/InboxValidator.php

240 lines
7.8 KiB
PHP
Raw Normal View History

2019-06-10 00:51:00 +00:00
<?php
namespace App\Jobs\InboxPipeline;
use Cache;
2019-06-10 00:51:00 +00:00
use App\Profile;
use App\Util\ActivityPub\{
Helpers,
HttpSignature,
Inbox
};
use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldQueue;
use Illuminate\Foundation\Bus\Dispatchable;
2020-11-26 08:22:53 +00:00
use Illuminate\Queue\InteractsWithQueue;
use Illuminate\Queue\SerializesModels;
2020-02-22 11:33:35 +00:00
use Zttp\Zttp;
use App\Jobs\DeletePipeline\DeleteRemoteProfilePipeline;
2019-06-10 00:51:00 +00:00
class InboxValidator implements ShouldQueue
{
use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
protected $username;
protected $headers;
protected $payload;
public $timeout = 60;
2020-05-22 02:44:13 +00:00
public $tries = 1;
2019-06-10 00:51:00 +00:00
/**
* Create a new job instance.
*
* @return void
*/
public function __construct($username, $headers, $payload)
{
$this->username = $username;
$this->headers = $headers;
$this->payload = $payload;
}
/**
* Execute the job.
*
* @return void
*/
public function handle()
{
$username = $this->username;
$headers = $this->headers;
$payload = json_decode($this->payload, true, 8);
$profile = Profile::whereNull('domain')->whereUsername($username)->first();
2021-02-17 06:39:39 +00:00
if(isset($payload['id'])) {
$lockKey = hash('sha256', $payload['id']);
if(Cache::get($lockKey) !== null) {
// Job processed already
return 1;
}
2022-03-17 03:02:23 +00:00
Cache::put($lockKey, 1, 3600);
2021-02-17 06:39:39 +00:00
}
if(!isset($headers['signature']) || !isset($headers['date'])) {
return;
}
2019-06-10 02:35:32 +00:00
if(empty($profile) || empty($headers) || empty($payload)) {
return;
2019-06-10 00:51:00 +00:00
}
if( $payload['type'] === 'Delete' &&
( ( is_string($payload['object']) &&
$payload['object'] === $payload['actor'] ) ||
( is_array($payload['object']) &&
isset($payload['object']['id'], $payload['object']['type']) &&
$payload['object']['type'] === 'Person' &&
$payload['actor'] === $payload['object']['id']
))
) {
$actor = $payload['actor'];
$hash = strlen($actor) <= 48 ?
'b:' . base64_encode($actor) :
'h:' . hash('sha256', $actor);
$lockKey = 'ap:inbox:actor-delete-exists:lock:' . $hash;
Cache::lock($lockKey, 10)->block(5, function () use(
$headers,
$payload,
$actor,
2021-01-15 01:54:13 +00:00
$hash,
$profile
) {
$key = 'ap:inbox:actor-delete-exists:' . $hash;
$actorDelete = Cache::remember($key, now()->addMinutes(15), function() use($actor) {
return Profile::whereRemoteUrl($actor)
->whereNotNull('domain')
->exists();
});
if($actorDelete) {
2021-01-15 01:54:13 +00:00
if($this->verifySignature($headers, $profile, $payload) == true) {
Cache::set($key, false);
$profile = Profile::whereNotNull('domain')
->whereNull('status')
->whereRemoteUrl($actor)
->first();
if($profile) {
DeleteRemoteProfilePipeline::dispatchNow($profile);
}
return;
} else {
// Signature verification failed, exit.
return;
}
} else {
// Remote user doesn't exist, exit early.
return;
}
});
return;
}
2019-06-10 00:51:00 +00:00
if($profile->status != null) {
return;
2019-06-10 00:51:00 +00:00
}
if($this->verifySignature($headers, $profile, $payload) == true) {
2020-05-22 02:58:31 +00:00
(new Inbox($headers, $profile, $payload))->handle();
return;
2019-06-10 01:04:37 +00:00
} else if($this->blindKeyRotation($headers, $profile, $payload) == true) {
2020-05-22 02:58:31 +00:00
(new Inbox($headers, $profile, $payload))->handle();
return;
2019-06-10 00:51:00 +00:00
} else {
return;
}
}
protected function verifySignature($headers, $profile, $payload)
{
$body = $this->payload;
$bodyDecoded = $payload;
2019-06-10 01:01:34 +00:00
$signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature'];
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
2019-06-10 00:51:00 +00:00
if(!$signature) {
return;
2019-06-10 00:51:00 +00:00
}
if(!$date) {
return;
2019-06-10 00:51:00 +00:00
}
if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1))
) {
return;
2019-06-10 00:51:00 +00:00
}
2022-03-17 03:02:23 +00:00
if(!isset($bodyDecoded['id'])) {
return;
}
2019-06-10 00:51:00 +00:00
$signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST);
$idDomain = parse_url($id, PHP_URL_HOST);
if(isset($bodyDecoded['object'])
&& is_array($bodyDecoded['object'])
&& isset($bodyDecoded['object']['attributedTo'])
) {
if(parse_url($bodyDecoded['object']['attributedTo'], PHP_URL_HOST) !== $keyDomain) {
return;
2019-06-10 00:51:00 +00:00
abort(400, 'Invalid request');
}
}
if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) {
return;
2019-06-10 00:51:00 +00:00
abort(400, 'Invalid request');
}
$actor = Profile::whereKeyId($keyId)->first();
if(!$actor) {
2019-06-10 01:12:09 +00:00
$actorUrl = is_array($bodyDecoded['actor']) ? $bodyDecoded['actor'][0] : $bodyDecoded['actor'];
$actor = Helpers::profileFirstOrNew($actorUrl);
2019-06-10 00:51:00 +00:00
}
if(!$actor) {
return;
2019-06-10 00:51:00 +00:00
}
$pkey = openssl_pkey_get_public($actor->public_key);
if(!$pkey) {
return 0;
}
2019-06-10 00:51:00 +00:00
$inboxPath = "/users/{$profile->username}/inbox";
2020-05-22 02:29:51 +00:00
list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
2019-06-10 00:51:00 +00:00
if($verified == 1) {
return true;
} else {
return false;
}
}
protected function blindKeyRotation($headers, $profile, $payload)
{
2019-06-10 01:01:34 +00:00
$signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature'];
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
2019-06-10 00:51:00 +00:00
if(!$signature) {
return;
2019-06-10 00:51:00 +00:00
}
if(!$date) {
return;
2019-06-10 00:51:00 +00:00
}
if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1))
) {
return;
2019-06-10 00:51:00 +00:00
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
if(!$actor) {
return;
2019-06-10 00:51:00 +00:00
}
if(Helpers::validateUrl($actor->remote_url) == false) {
return;
2019-06-10 00:51:00 +00:00
}
$res = Zttp::timeout(5)->withHeaders([
'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org',
])->get($actor->remote_url);
$res = json_decode($res->body(), true, 8);
2022-03-13 06:49:11 +00:00
if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) {
return;
}
2019-06-10 00:51:00 +00:00
if($res['publicKey']['id'] !== $actor->key_id) {
return;
2019-06-10 00:51:00 +00:00
}
$actor->public_key = $res['publicKey']['publicKeyPem'];
$actor->save();
return $this->verifySignature($headers, $profile, $payload);
}
}