[pfefferle]

Fixes #

Proposed changes:

• Both signature verifiers read the host a signature is made out to from the request: Draft Cavage from Host (or X-Original-Host), RFC 9421 from Host for @authority, @target-uri and the host field. Only X-Original-Host was checked against this site's hosts so far. Now every one of these values has to name a host this site answers on, otherwise the signature does not verify.
• The check that already existed for X-Original-Host moved into is_signature_host(), so both verifiers use the same one. It folds the host the same way as before (IDN, case, port, trailing dot) and uses the same activitypub_signature_original_hosts filter.
• In RFC 9421 the check runs before the signing key is looked up.

Other information:

• Have you written new tests for your changes, if applicable?

Sites reached under more than one domain, or behind a proxy that rewrites Host without setting X-Original-Host, have to add the other names with the activitypub_signature_original_hosts filter. With Mastodon these requests most likely failed already, because it signs the host.

Three existing tests used example.org / example.net as request host while the test site runs on another host. They only passed because the host was not checked, so they now use the site's own host (or allow example.org through the filter in Test_Signature).

Testing instructions:

• vendor/bin/phpunit --filter 'Test_Signature|Test_Functions_Url|Test_Server|Test_Trait_Verification'
• Follow the blog from Mastodon and reply to a post, both should still work.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message