diff --git a/DependencyInjection/RezzzaSecurityExtension.php b/DependencyInjection/RezzzaSecurityExtension.php index b9b7bfa..18677de 100644 --- a/DependencyInjection/RezzzaSecurityExtension.php +++ b/DependencyInjection/RezzzaSecurityExtension.php @@ -9,8 +9,8 @@ use Symfony\Component\Config\FileLocator; use Symfony\Component\DependencyInjection\ContainerBuilder; use Symfony\Component\DependencyInjection\Definition; -use Symfony\Component\DependencyInjection\Loader\XmlFileLoader; -use Symfony\Component\HttpKernel\DependencyInjection\Extension; +use Symfony\Component\DependencyInjection\Extension\Extension; +use Symfony\Component\DependencyInjection\Loader\PhpFileLoader; /** * RezzzaSecurityExtension. @@ -28,14 +28,14 @@ public function load(array $configs, ContainerBuilder $container): void $config = $processor->processConfiguration($configuration, $configs); - $loader = new XmlFileLoader($container, new FileLocator(__DIR__.'/../Resources/config/services')); + $loader = new PhpFileLoader($container, new FileLocator(__DIR__.'/../Resources/config/services')); - $loader->load('security.xml'); + $loader->load('security.php'); $container->setParameter('rezzza.security.request_obfuscator.enabled', $config['request_obfuscator']['enabled']); if ($container->getParameter('rezzza.security.request_obfuscator.enabled')) { - $loader->load('request_obfuscator.xml'); + $loader->load('request_obfuscator.php'); } $firewalls = $config['firewalls']; diff --git a/Resources/config/services/request_obfuscator.php b/Resources/config/services/request_obfuscator.php new file mode 100644 index 0000000..901170c --- /dev/null +++ b/Resources/config/services/request_obfuscator.php @@ -0,0 +1,15 @@ +services(); + $parameters = $container->parameters(); + + $parameters->set('rezzza.security.request_obfuscator.obfuscator.class', RequestObfuscator::class); + + $services->set('rezzza.security.request_obfuscator.obfuscator', '%rezzza.security.request_obfuscator.obfuscator.class%'); +}; diff --git a/Resources/config/services/request_obfuscator.xml b/Resources/config/services/request_obfuscator.xml deleted file mode 100644 index bdb1807..0000000 --- a/Resources/config/services/request_obfuscator.xml +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - Rezzza\SecurityBundle\Request\Obfuscator\RequestObfuscator - - - - - - - diff --git a/Resources/config/services/security.php b/Resources/config/services/security.php new file mode 100644 index 0000000..23f58a7 --- /dev/null +++ b/Resources/config/services/security.php @@ -0,0 +1,60 @@ +services(); + $parameters = $container->parameters(); + + $parameters->set('rezzza.security.request_signature.listener.class', RequestSignatureListener::class); + $parameters->set('rezzza.security.request_signature.signature_query_parameters.class', SignatureQueryParameters::class); + $parameters->set('rezzza.security.request_signature.signature_config.class', SignatureConfig::class); + $parameters->set('rezzza.security.request_signature.replay_protection.class', ReplayProtection::class); + + $services->set('fulll.cors_listener', CorsSecurityListener::class) + ->private() + ->args([ + service('logger')->nullOnInvalid(), + ]) + ->tag('kernel.event_listener', [ + 'event' => 'kernel.request', + 'method' => 'onKernelRequest', + 'priority' => 200, + ]); + + $services->set('fulll.request_signature.provider', RequestSignatureProdiver::class); + + $services->set('rezzza.security.request_signature.listener', '%rezzza.security.request_signature.listener.class%') + ->private() + ->args([ + service('security.token_storage'), + null, // injected via RequestSignatureFactory + null, // injected via RequestSignatureFactory + null, // injected via RequestSignatureFactory + null, // injected via RequestSignatureFactory + ]); + + $services->set('rezzza.security.request_signature.signature_query_parameters', '%rezzza.security.request_signature.signature_query_parameters.class%') + ->private(); + + $services->set('rezzza.security.request_signature.signature_config', '%rezzza.security.request_signature.signature_config.class%') + ->private(); + + $services->set('rezzza.security.request_signature.replay_protection', '%rezzza.security.request_signature.replay_protection.class%') + ->private(); + + // for 2.0 + $services->set('rezzza.security.request_signature.factory', RequestSignatureFactory::class) + ->tag('security.listener.factory'); +}; diff --git a/Resources/config/services/security.xml b/Resources/config/services/security.xml deleted file mode 100644 index 3be0192..0000000 --- a/Resources/config/services/security.xml +++ /dev/null @@ -1,42 +0,0 @@ - - - - - - Rezzza\SecurityBundle\Security\Firewall\RequestSignatureListener - Rezzza\SecurityBundle\Security\Firewall\SignatureQueryParameters - Rezzza\SecurityBundle\Security\Firewall\SignatureConfig - Rezzza\SecurityBundle\Security\Firewall\ReplayProtection - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/Security/Firewall/RequestSignatureListener.php b/Security/Firewall/RequestSignatureListener.php index 8b6302e..ad99566 100644 --- a/Security/Firewall/RequestSignatureListener.php +++ b/Security/Firewall/RequestSignatureListener.php @@ -37,9 +37,11 @@ public function authenticate(Request $request): Passport ); } - $signature = $request->get($this->signatureQueryParameters->getNonceQueryParameter()); + $nonceQueryParameter = $this->signatureQueryParameters->getNonceQueryParameter(); - if (null === $signature) { + $signature = $request->query->getString($nonceQueryParameter); + + if ('' === $signature) { throw new UnauthorizedHttpException('Signature must be filled.'); } diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon index b2523fa..0de664c 100644 --- a/phpstan-baseline.neon +++ b/phpstan-baseline.neon @@ -43,10 +43,10 @@ parameters: - message: "#^Call to an undefined method Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeDefinition\\:\\:children\\(\\)\\.$#" count: 1 - path: DependencyInjection/Configuration.php + path: DependencyInjection/Security/Factory/RequestSignatureFactory.php - - message: "#^Call to an undefined method Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeDefinition\\:\\:children\\(\\)\\.$#" + message: "#^Method Rezzza\\\\SecurityBundle\\\\DependencyInjection\\\\Security\\\\Factory\\\\RequestSignatureFactory\\:\\:addConfiguration\\(\\) has parameter \\$node with generic class Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeDefinition but does not specify its types\\: TParent$#" count: 1 path: DependencyInjection/Security/Factory/RequestSignatureFactory.php @@ -170,21 +170,11 @@ parameters: count: 1 path: Security/Firewall/RequestSignatureListener.php - - - message: "#^Parameter \\#1 \\$signature of method Rezzza\\\\SecurityBundle\\\\Security\\\\Firewall\\\\SignedRequest\\:\\:authenticateSignature\\(\\) expects string, mixed given\\.$#" - count: 1 - path: Security/Firewall/RequestSignatureListener.php - - message: "#^Parameter \\#1 \\$user of class Rezzza\\\\SecurityBundle\\\\Security\\\\SignatureValidToken constructor expects Rezzza\\\\SecurityBundle\\\\Security\\\\SignatureValidUser, Symfony\\\\Component\\\\Security\\\\Core\\\\User\\\\UserInterface given\\.$#" count: 1 path: Security/Firewall/RequestSignatureListener.php - - - message: "#^Parameter \\#1 \\$userIdentifier of class Symfony\\\\Component\\\\Security\\\\Http\\\\Authenticator\\\\Passport\\\\Badge\\\\UserBadge constructor expects string, mixed given\\.$#" - count: 1 - path: Security/Firewall/RequestSignatureListener.php - - message: "#^Parameter \\#2 \\$host of class Rezzza\\\\SecurityBundle\\\\Security\\\\Firewall\\\\SignedRequest constructor expects string, mixed given\\.$#" count: 1