[pfefferle]

Fixes #

Proposed changes:

• is_signature_host() now also requires the raw Host / X-Original-Host value to be a bare host with an optional port. That raw value is what enters the signature base, so values with userinfo, a path, query or fragment, whitespace, an empty port or a port with leading zeros are rejected, even when they parse to this site's host. It reuses get_authority() for the check.
• The Draft Cavage verifier now checks the signed data (host and time window) before it looks up the signing key, like the RFC 9421 verifier already does. A request for another host, or outside its time window, no longer triggers a key fetch.

Other information:

• Have you written new tests for your changes, if applicable?

When a request has invalid signed data and an unknown key at the same time, the error is now invalid_signed_data instead of the key lookup error.

Testing instructions:

• vendor/bin/phpunit --filter 'test_is_signature_host|test_verify_http_signature_rejects_a_foreign_host'
• Follow the blog from Mastodon and reply to a post, both should still work.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message