signer.php

<?php
namespace Bitrix\Main\Security\Sign;
 
use Bitrix\Main\ArgumentTypeException;
use Bitrix\Main\Config;
 
class Signer
{
    protected $algorithm = null;
    protected $separator = '.';
    protected $key = null;
 
    public function __construct(SigningAlgorithm $algorithm = null)
    {
        if ($algorithm !== null)
            $this->algorithm = $algorithm;
        else
            $this->algorithm = new HmacAlgorithm();
    }
 
    public function setKey($value)
    {
        if (!is_string($value))
            throw new ArgumentTypeException('value', 'string');
 
        $this->key = $value;
        return $this;
    }
 
    public function getSeparator()
    {
        return $this->separator;
    }
 
    public function setSeparator($value)
    {
        if (!is_string($value))
            throw new ArgumentTypeException('value', 'string');
 
        $this->separator = $value;
        return $this;
    }
 
    public function getSignature($value, $salt = null)
    {
        if (!is_string($value))
            throw new ArgumentTypeException('value', 'string');
 
        $key = $this->getKey($salt);
        $signature = $this->algorithm->getSignature($value, $key);
        $signature = $this->encodeSignature($signature);
        return $signature;
    }
 
    public function sign($value, $salt = null)
    {
        if (!is_string($value))
            throw new ArgumentTypeException('value', 'string');
 
        $signature = $this->getSignature($value, $salt);
        return $this->pack(array($value, $signature));
    }
 
    public function unsign($signedValue, $salt = null)
    {
        if (!is_string($signedValue))
            throw new ArgumentTypeException('signedValue', 'string');
 
        list($value, $signature) = $this->unpack($signedValue);
        if (!$this->verifySignature($value, $signature, $salt))
            throw new BadSignatureException('Signature does not match');
 
        return $value;
    }
 
    public function validate($value, $signature, $salt = null)
    {
        return $this->verifySignature($value, $signature, $salt);
    }
 
    protected function verifySignature($value, $sig, $salt = null)
    {
        $key = $this->getKey($salt);
        $signature = $this->decodeSignature($sig);
        return $this->algorithm->verify($value, $key, $signature);
    }
 
    protected function getKey($salt = null)
    {
        if ($salt !== null && !preg_match('#^[a-zA-Z0-9_.-]{3,50}$#D', $salt))
            throw new BadSignatureException('Malformed salt, only [a-zA-Z0-9_.-]{3,50} characters are acceptable');
 
        if ($this->key !== null)
            $key = $this->key;
        else
            $key = $this->getDefaultKey();
 
        return strval($salt).$key;
    }
 
    protected function getDefaultKey()
    {
        static $defaultKey = null;
        if ($defaultKey === null)
        {
            $defaultKey = Config\Option::get('main', 'signer_default_key', false);
            if (!$defaultKey)
            {
                $defaultKey = hash('sha512', \Bitrix\Main\Security\Random::getString(64));
                Config\Option::set('main', 'signer_default_key', $defaultKey);
            }
 
            $options = Config\Configuration::getValue("crypto");
            if(isset($options["crypto_key"]))
            {
                $defaultKey .= $options["crypto_key"];
            }
        }
 
        return $defaultKey;
    }
 
 
    public function pack(array $values)
    {
        return join($this->separator, $values);
    }
 
    public function unpack($value, $limit = 2)
    {
        // Some kind of optimization
        if ($limit === 0)
        {
            if (strpos($value, $this->separator) === false)
                throw new BadSignatureException('Separator not found in value');
 
            return explode($this->separator, $value);
        }
 
        $result = array();
        while(--$limit > 0)
        {
            $pos = bxstrrpos($value, $this->separator);
            if ($pos === false)
                throw new BadSignatureException('Separator not found in value');
 
            $result[] = mb_substr($value, $pos + 1);
            $value = mb_substr($value, 0, $pos);
        }
        $result[] = $value;
 
        return array_reverse($result);
    }
 
    protected function encodeSignature($value)
    {
        return bin2hex($value);
    }
 
    protected function decodeSignature($value)
    {
        if (preg_match('#[^[:xdigit:]]#', $value))
            throw new BadSignatureException('Signature must be hexadecimal string');
 
        // ToDo: use hex2bin instead pack for PHP > 5.4.0
        return pack('H*', $value);
    }
}