Code Coverage |
||||||||||
Lines |
Functions and Methods |
Classes and Traits |
||||||||
Total | |
0.00% |
0 / 10 |
|
0.00% |
0 / 1 |
CRAP | |
0.00% |
0 / 1 |
SignatureMethod | |
0.00% |
0 / 10 |
|
0.00% |
0 / 1 |
30 | |
0.00% |
0 / 1 |
getName | n/a |
0 / 0 |
n/a |
0 / 0 |
0 | |||||
buildSignature | n/a |
0 / 0 |
n/a |
0 / 0 |
0 | |||||
checkSignature | |
0.00% |
0 / 10 |
|
0.00% |
0 / 1 |
30 |
1 | <?php |
2 | /** |
3 | * @section LICENSE |
4 | * Copyright (c) 2007 Andy Smith |
5 | * |
6 | * Permission is hereby granted, free of charge, to any person obtaining |
7 | * a copy of this software and associated documentation files (the |
8 | * "Software"), to deal in the Software without restriction, including without |
9 | * limitation the rights to use, copy, modify, merge, publish, distribute, |
10 | * sublicense, and/or sell copies of the Software, and to permit persons to |
11 | * whom the Software is furnished to do so, subject to the following |
12 | * conditions: |
13 | * |
14 | * The above copyright notice and this permission notice shall be included in |
15 | * all copies or substantial portions of the Software. |
16 | * |
17 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
18 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
19 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
20 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
21 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING |
22 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
23 | * DEALINGS IN THE SOFTWARE. |
24 | * |
25 | * @file |
26 | */ |
27 | |
28 | namespace MediaWiki\OAuthClient; |
29 | |
30 | /** |
31 | * A class for implementing a Signature Method |
32 | * See section 9 ("Signing Requests") in the spec |
33 | */ |
34 | abstract class SignatureMethod { |
35 | /** |
36 | * Needs to return the name of the Signature Method (ie HMAC-SHA1) |
37 | * @return string |
38 | */ |
39 | abstract public function getName(); |
40 | |
41 | /** |
42 | * Build up the signature |
43 | * NOTE: The output of this function MUST NOT be urlencoded. |
44 | * the encoding is handled in Request when the final request |
45 | * is serialized |
46 | * @param Request $request |
47 | * @param Consumer $consumer |
48 | * @param Token|null $token |
49 | * @return string |
50 | */ |
51 | abstract public function buildSignature( |
52 | Request $request, |
53 | Consumer $consumer, |
54 | ?Token $token = null |
55 | ); |
56 | |
57 | /** |
58 | * Verifies that a given signature is correct |
59 | * @param Request $request |
60 | * @param Consumer $consumer |
61 | * @param Token|null $token |
62 | * @param string $signature |
63 | * @return bool |
64 | */ |
65 | public function checkSignature( |
66 | Request $request, |
67 | Consumer $consumer, |
68 | /*Token*/ $token, |
69 | $signature |
70 | ) { |
71 | $built = $this->buildSignature( $request, $consumer, $token ); |
72 | |
73 | // Check for zero length, although unlikely here |
74 | if ( strlen( $built ) === 0 || strlen( $signature ) === 0 ) { |
75 | return false; |
76 | } |
77 | |
78 | if ( strlen( $built ) !== strlen( $signature ) ) { |
79 | return false; |
80 | } |
81 | |
82 | // Avoid a timing leak with a (hopefully) time insensitive compare |
83 | $result = 0; |
84 | $len = strlen( $signature ); |
85 | for ( $i = 0; $i < $len; $i++ ) { |
86 | $result |= ord( $built[$i] ) ^ ord( $signature[$i] ); |
87 | } |
88 | |
89 | return $result == 0; |
90 | } |
91 | } |