nextcloud / server

lib/private/Files/ObjectStore/S3Signature.php

Doc Comments +3 added lines

@@ -119,6 +119,9 @@
 		return Psr7\modify_request($request, $modify);
 	}
 
+	/**
+	 * @param string $string
+	 */
 	private function signString($string, CredentialsInterface $credentials)
 	{
 		return base64_encode(

Indentation +187 added lines, -187 removed lines

@@ -14,191 +14,191 @@
  */
 class S3Signature implements SignatureInterface
 {
-	/** @var array Query string values that must be signed */
-	private $signableQueryString = [
-		'acl', 'cors', 'delete', 'lifecycle', 'location', 'logging',
-		'notification', 'partNumber', 'policy', 'requestPayment',
-		'response-cache-control', 'response-content-disposition',
-		'response-content-encoding', 'response-content-language',
-		'response-content-type', 'response-expires', 'restore', 'tagging',
-		'torrent', 'uploadId', 'uploads', 'versionId', 'versioning',
-		'versions', 'website'
-	];
-
-	/** @var array Sorted headers that must be signed */
-	private $signableHeaders = ['Content-MD5', 'Content-Type'];
-
-	/** @var \Aws\S3\S3UriParser S3 URI parser */
-	private $parser;
-
-	public function __construct()
-	{
-		$this->parser = new S3UriParser();
-		// Ensure that the signable query string parameters are sorted
-		sort($this->signableQueryString);
-	}
-
-	public function signRequest(
-		RequestInterface $request,
-		CredentialsInterface $credentials
-	) {
-		$request = $this->prepareRequest($request, $credentials);
-		$stringToSign = $this->createCanonicalizedString($request);
-		$auth = 'AWS '
-			. $credentials->getAccessKeyId() . ':'
-			. $this->signString($stringToSign, $credentials);
-
-		return $request->withHeader('Authorization', $auth);
-	}
-
-	public function presign(
-		RequestInterface $request,
-		CredentialsInterface $credentials,
-		$expires
-	) {
-		$query = [];
-		// URL encoding already occurs in the URI template expansion. Undo that
-		// and encode using the same encoding as GET object, PUT object, etc.
-		$uri = $request->getUri();
-		$path = S3Client::encodeKey(rawurldecode($uri->getPath()));
-		$request = $request->withUri($uri->withPath($path));
-
-		// Make sure to handle temporary credentials
-		if ($token = $credentials->getSecurityToken()) {
-			$request = $request->withHeader('X-Amz-Security-Token', $token);
-			$query['X-Amz-Security-Token'] = $token;
-		}
-
-		if ($expires instanceof \DateTime) {
-			$expires = $expires->getTimestamp();
-		} elseif (!is_numeric($expires)) {
-			$expires = strtotime($expires);
-		}
-
-		// Set query params required for pre-signed URLs
-		$query['AWSAccessKeyId'] = $credentials->getAccessKeyId();
-		$query['Expires'] = $expires;
-		$query['Signature'] = $this->signString(
-			$this->createCanonicalizedString($request, $expires),
-			$credentials
-		);
-
-		// Move X-Amz-* headers to the query string
-		foreach ($request->getHeaders() as $name => $header) {
-			$name = strtolower($name);
-			if (strpos($name, 'x-amz-') === 0) {
-				$query[$name] = implode(',', $header);
-			}
-		}
-
-		$queryString = http_build_query($query, null, '&', PHP_QUERY_RFC3986);
-
-		return $request->withUri($request->getUri()->withQuery($queryString));
-	}
-
-	/**
-	 * @param RequestInterface     $request
-	 * @param CredentialsInterface $creds
-	 *
-	 * @return RequestInterface
-	 */
-	private function prepareRequest(
-		RequestInterface $request,
-		CredentialsInterface $creds
-	) {
-		$modify = [
-			'remove_headers' => ['X-Amz-Date'],
-			'set_headers'    => ['Date' => gmdate(\DateTime::RFC2822)]
-		];
-
-		// Add the security token header if one is being used by the credentials
-		if ($token = $creds->getSecurityToken()) {
-			$modify['set_headers']['X-Amz-Security-Token'] = $token;
-		}
-
-		return Psr7\modify_request($request, $modify);
-	}
-
-	private function signString($string, CredentialsInterface $credentials)
-	{
-		return base64_encode(
-			hash_hmac('sha1', $string, $credentials->getSecretKey(), true)
-		);
-	}
-
-	private function createCanonicalizedString(
-		RequestInterface $request,
-		$expires = null
-	) {
-		$buffer = $request->getMethod() . "\n";
-
-		// Add the interesting headers
-		foreach ($this->signableHeaders as $header) {
-			$buffer .= $request->getHeaderLine($header) . "\n";
-		}
-
-		$date = $expires ?: $request->getHeaderLine('date');
-		$buffer .= "{$date}\n"
-			. $this->createCanonicalizedAmzHeaders($request)
-			. $this->createCanonicalizedResource($request);
-
-		return $buffer;
-	}
-
-	private function createCanonicalizedAmzHeaders(RequestInterface $request)
-	{
-		$headers = [];
-		foreach ($request->getHeaders() as $name => $header) {
-			$name = strtolower($name);
-			if (strpos($name, 'x-amz-') === 0) {
-				$value = implode(',', $header);
-				if (strlen($value) > 0) {
-					$headers[$name] = $name . ':' . $value;
-				}
-			}
-		}
-
-		if (!$headers) {
-			return '';
-		}
-
-		ksort($headers);
-
-		return implode("\n", $headers) . "\n";
-	}
-
-	private function createCanonicalizedResource(RequestInterface $request)
-	{
-		$data = $this->parser->parse($request->getUri());
-		$buffer = '/';
-
-		if ($data['bucket']) {
-			$buffer .= $data['bucket'];
-			if (!empty($data['key']) || !$data['path_style']) {
-				$buffer .= '/' . $data['key'];
-			}
-		}
-
-		// Add sub resource parameters if present.
-		$query = $request->getUri()->getQuery();
-
-		if ($query) {
-			$params = Psr7\parse_query($query);
-			$first = true;
-			foreach ($this->signableQueryString as $key) {
-				if (array_key_exists($key, $params)) {
-					$value = $params[$key];
-					$buffer .= $first ? '?' : '&';
-					$first = false;
-					$buffer .= $key;
-					// Don't add values for empty sub-resources
-					if (strlen($value)) {
-						$buffer .= "={$value}";
-					}
-				}
-			}
-		}
-
-		return $buffer;
-	}
+    /** @var array Query string values that must be signed */
+    private $signableQueryString = [
+        'acl', 'cors', 'delete', 'lifecycle', 'location', 'logging',
+        'notification', 'partNumber', 'policy', 'requestPayment',
+        'response-cache-control', 'response-content-disposition',
+        'response-content-encoding', 'response-content-language',
+        'response-content-type', 'response-expires', 'restore', 'tagging',
+        'torrent', 'uploadId', 'uploads', 'versionId', 'versioning',
+        'versions', 'website'
+    ];
+
+    /** @var array Sorted headers that must be signed */
+    private $signableHeaders = ['Content-MD5', 'Content-Type'];
+
+    /** @var \Aws\S3\S3UriParser S3 URI parser */
+    private $parser;
+
+    public function __construct()
+    {
+        $this->parser = new S3UriParser();
+        // Ensure that the signable query string parameters are sorted
+        sort($this->signableQueryString);
+    }
+
+    public function signRequest(
+        RequestInterface $request,
+        CredentialsInterface $credentials
+    ) {
+        $request = $this->prepareRequest($request, $credentials);
+        $stringToSign = $this->createCanonicalizedString($request);
+        $auth = 'AWS '
+            . $credentials->getAccessKeyId() . ':'
+            . $this->signString($stringToSign, $credentials);
+
+        return $request->withHeader('Authorization', $auth);
+    }
+
+    public function presign(
+        RequestInterface $request,
+        CredentialsInterface $credentials,
+        $expires
+    ) {
+        $query = [];
+        // URL encoding already occurs in the URI template expansion. Undo that
+        // and encode using the same encoding as GET object, PUT object, etc.
+        $uri = $request->getUri();
+        $path = S3Client::encodeKey(rawurldecode($uri->getPath()));
+        $request = $request->withUri($uri->withPath($path));
+
+        // Make sure to handle temporary credentials
+        if ($token = $credentials->getSecurityToken()) {
+            $request = $request->withHeader('X-Amz-Security-Token', $token);
+            $query['X-Amz-Security-Token'] = $token;
+        }
+
+        if ($expires instanceof \DateTime) {
+            $expires = $expires->getTimestamp();
+        } elseif (!is_numeric($expires)) {
+            $expires = strtotime($expires);
+        }
+
+        // Set query params required for pre-signed URLs
+        $query['AWSAccessKeyId'] = $credentials->getAccessKeyId();
+        $query['Expires'] = $expires;
+        $query['Signature'] = $this->signString(
+            $this->createCanonicalizedString($request, $expires),
+            $credentials
+        );
+
+        // Move X-Amz-* headers to the query string
+        foreach ($request->getHeaders() as $name => $header) {
+            $name = strtolower($name);
+            if (strpos($name, 'x-amz-') === 0) {
+                $query[$name] = implode(',', $header);
+            }
+        }
+
+        $queryString = http_build_query($query, null, '&', PHP_QUERY_RFC3986);
+
+        return $request->withUri($request->getUri()->withQuery($queryString));
+    }
+
+    /**
+     * @param RequestInterface     $request
+     * @param CredentialsInterface $creds
+     *
+     * @return RequestInterface
+     */
+    private function prepareRequest(
+        RequestInterface $request,
+        CredentialsInterface $creds
+    ) {
+        $modify = [
+            'remove_headers' => ['X-Amz-Date'],
+            'set_headers'    => ['Date' => gmdate(\DateTime::RFC2822)]
+        ];
+
+        // Add the security token header if one is being used by the credentials
+        if ($token = $creds->getSecurityToken()) {
+            $modify['set_headers']['X-Amz-Security-Token'] = $token;
+        }
+
+        return Psr7\modify_request($request, $modify);
+    }
+
+    private function signString($string, CredentialsInterface $credentials)
+    {
+        return base64_encode(
+            hash_hmac('sha1', $string, $credentials->getSecretKey(), true)
+        );
+    }
+
+    private function createCanonicalizedString(
+        RequestInterface $request,
+        $expires = null
+    ) {
+        $buffer = $request->getMethod() . "\n";
+
+        // Add the interesting headers
+        foreach ($this->signableHeaders as $header) {
+            $buffer .= $request->getHeaderLine($header) . "\n";
+        }
+
+        $date = $expires ?: $request->getHeaderLine('date');
+        $buffer .= "{$date}\n"
+            . $this->createCanonicalizedAmzHeaders($request)
+            . $this->createCanonicalizedResource($request);
+
+        return $buffer;
+    }
+
+    private function createCanonicalizedAmzHeaders(RequestInterface $request)
+    {
+        $headers = [];
+        foreach ($request->getHeaders() as $name => $header) {
+            $name = strtolower($name);
+            if (strpos($name, 'x-amz-') === 0) {
+                $value = implode(',', $header);
+                if (strlen($value) > 0) {
+                    $headers[$name] = $name . ':' . $value;
+                }
+            }
+        }
+
+        if (!$headers) {
+            return '';
+        }
+
+        ksort($headers);
+
+        return implode("\n", $headers) . "\n";
+    }
+
+    private function createCanonicalizedResource(RequestInterface $request)
+    {
+        $data = $this->parser->parse($request->getUri());
+        $buffer = '/';
+
+        if ($data['bucket']) {
+            $buffer .= $data['bucket'];
+            if (!empty($data['key']) || !$data['path_style']) {
+                $buffer .= '/' . $data['key'];
+            }
+        }
+
+        // Add sub resource parameters if present.
+        $query = $request->getUri()->getQuery();
+
+        if ($query) {
+            $params = Psr7\parse_query($query);
+            $first = true;
+            foreach ($this->signableQueryString as $key) {
+                if (array_key_exists($key, $params)) {
+                    $value = $params[$key];
+                    $buffer .= $first ? '?' : '&';
+                    $first = false;
+                    $buffer .= $key;
+                    // Don't add values for empty sub-resources
+                    if (strlen($value)) {
+                        $buffer .= "={$value}";
+                    }
+                }
+            }
+        }
+
+        return $buffer;
+    }
 }

Spacing +6 added lines, -6 removed lines

@@ -45,7 +45,7 @@ 
 		$request = $this->prepareRequest($request, $credentials);
 		$stringToSign = $this->createCanonicalizedString($request);
 		$auth = 'AWS '
-			. $credentials->getAccessKeyId() . ':'
+			. $credentials->getAccessKeyId().':'
 			. $this->signString($stringToSign, $credentials);
 
 		return $request->withHeader('Authorization', $auth);
@@ -130,11 +130,11 @@ 
 		RequestInterface $request,
 		$expires = null
 	) {
-		$buffer = $request->getMethod() . "\n";
+		$buffer = $request->getMethod()."\n";
 
 		// Add the interesting headers
 		foreach ($this->signableHeaders as $header) {
-			$buffer .= $request->getHeaderLine($header) . "\n";
+			$buffer .= $request->getHeaderLine($header)."\n";
 		}
 
 		$date = $expires ?: $request->getHeaderLine('date');
@@ -153,7 +153,7 @@ 
 			if (strpos($name, 'x-amz-') === 0) {
 				$value = implode(',', $header);
 				if (strlen($value) > 0) {
-					$headers[$name] = $name . ':' . $value;
+					$headers[$name] = $name.':'.$value;
 				}
 			}
 		}
@@ -164,7 +164,7 @@ 
 
 		ksort($headers);
 
-		return implode("\n", $headers) . "\n";
+		return implode("\n", $headers)."\n";
 	}
 
 	private function createCanonicalizedResource(RequestInterface $request)
@@ -175,7 +175,7 @@ 
 		if ($data['bucket']) {
 			$buffer .= $data['bucket'];
 			if (!empty($data['key']) || !$data['path_style']) {
-				$buffer .= '/' . $data['key'];
+				$buffer .= '/'.$data['key'];
 			}
 		}
 

lib/private/Files/ObjectStore/S3ConnectionTrait.php

Indentation +106 added lines, -106 removed lines

@@ -29,110 +29,110 @@
 use Aws\S3\S3Client;
 
 trait S3ConnectionTrait {
-	/** @var array */
-	protected $params;
-
-	/** @var S3Client */
-	protected $connection;
-
-	/** @var string */
-	protected $id;
-
-	/** @var string */
-	protected $bucket;
-
-	/** @var int */
-	protected $timeout;
-
-	protected $test;
-
-	protected function parseParams($params) {
-		if (empty($params['key']) || empty($params['secret']) || empty($params['bucket'])) {
-			throw new \Exception("Access Key, Secret and Bucket have to be configured.");
-		}
-
-		$this->id = 'amazon::' . $params['bucket'];
-
-		$this->test = isset($params['test']);
-		$this->bucket = $params['bucket'];
-		$this->timeout = (!isset($params['timeout'])) ? 15 : $params['timeout'];
-		$params['region'] = empty($params['region']) ? 'eu-west-1' : $params['region'];
-		$params['hostname'] = empty($params['hostname']) ? 's3.' . $params['region'] . '.amazonaws.com' : $params['hostname'];
-		if (!isset($params['port']) || $params['port'] === '') {
-			$params['port'] = (isset($params['use_ssl']) && $params['use_ssl'] === false) ? 80 : 443;
-		}
-		$this->params = $params;
-	}
-
-
-	/**
-	 * Returns the connection
-	 *
-	 * @return S3Client connected client
-	 * @throws \Exception if connection could not be made
-	 */
-	protected function getConnection() {
-		if (!is_null($this->connection)) {
-			return $this->connection;
-		}
-
-		$scheme = (isset($this->params['use_ssl']) && $this->params['use_ssl'] === false) ? 'http' : 'https';
-		$base_url = $scheme . '://' . $this->params['hostname'] . ':' . $this->params['port'] . '/';
-
-		$options = [
-			'version' => isset($this->params['version']) ? $this->params['version'] : 'latest',
-			'credentials' => [
-				'key' => $this->params['key'],
-				'secret' => $this->params['secret'],
-			],
-			'endpoint' => $base_url,
-			'region' => $this->params['region'],
-			'use_path_style_endpoint' => isset($this->params['use_path_style']) ? $this->params['use_path_style'] : false,
-			'signature_provider' => \Aws\or_chain([self::class, 'legacySignatureProvider'], ClientResolver::_default_signature_provider())
-		];
-		if (isset($this->params['proxy'])) {
-			$options['request.options'] = ['proxy' => $this->params['proxy']];
-		}
-		if (isset($this->params['legacy_auth']) && $this->params['legacy_auth']) {
-			$options['signature_version'] = 'v2';
-		}
-		$this->connection = new S3Client($options);
-
-		if (!$this->connection->isBucketDnsCompatible($this->bucket)) {
-			throw new \Exception("The configured bucket name is invalid: " . $this->bucket);
-		}
-
-		if (!$this->connection->doesBucketExist($this->bucket)) {
-			try {
-				$this->connection->createBucket(array(
-					'Bucket' => $this->bucket
-				));
-				$this->testTimeout();
-			} catch (S3Exception $e) {
-				\OCP\Util::logException('files_external', $e);
-				throw new \Exception('Creation of bucket failed. ' . $e->getMessage());
-			}
-		}
-
-		return $this->connection;
-	}
-
-	/**
-	 * when running the tests wait to let the buckets catch up
-	 */
-	private function testTimeout() {
-		if ($this->test) {
-			sleep($this->timeout);
-		}
-	}
-
-	public static function legacySignatureProvider($version, $service, $region) {
-		switch ($version) {
-			case 'v2':
-			case 's3':
-				return new S3Signature();
-			default:
-				return null;
-		}
-	}
+    /** @var array */
+    protected $params;
+
+    /** @var S3Client */
+    protected $connection;
+
+    /** @var string */
+    protected $id;
+
+    /** @var string */
+    protected $bucket;
+
+    /** @var int */
+    protected $timeout;
+
+    protected $test;
+
+    protected function parseParams($params) {
+        if (empty($params['key']) || empty($params['secret']) || empty($params['bucket'])) {
+            throw new \Exception("Access Key, Secret and Bucket have to be configured.");
+        }
+
+        $this->id = 'amazon::' . $params['bucket'];
+
+        $this->test = isset($params['test']);
+        $this->bucket = $params['bucket'];
+        $this->timeout = (!isset($params['timeout'])) ? 15 : $params['timeout'];
+        $params['region'] = empty($params['region']) ? 'eu-west-1' : $params['region'];
+        $params['hostname'] = empty($params['hostname']) ? 's3.' . $params['region'] . '.amazonaws.com' : $params['hostname'];
+        if (!isset($params['port']) || $params['port'] === '') {
+            $params['port'] = (isset($params['use_ssl']) && $params['use_ssl'] === false) ? 80 : 443;
+        }
+        $this->params = $params;
+    }
+
+
+    /**
+     * Returns the connection
+     *
+     * @return S3Client connected client
+     * @throws \Exception if connection could not be made
+     */
+    protected function getConnection() {
+        if (!is_null($this->connection)) {
+            return $this->connection;
+        }
+
+        $scheme = (isset($this->params['use_ssl']) && $this->params['use_ssl'] === false) ? 'http' : 'https';
+        $base_url = $scheme . '://' . $this->params['hostname'] . ':' . $this->params['port'] . '/';
+
+        $options = [
+            'version' => isset($this->params['version']) ? $this->params['version'] : 'latest',
+            'credentials' => [
+                'key' => $this->params['key'],
+                'secret' => $this->params['secret'],
+            ],
+            'endpoint' => $base_url,
+            'region' => $this->params['region'],
+            'use_path_style_endpoint' => isset($this->params['use_path_style']) ? $this->params['use_path_style'] : false,
+            'signature_provider' => \Aws\or_chain([self::class, 'legacySignatureProvider'], ClientResolver::_default_signature_provider())
+        ];
+        if (isset($this->params['proxy'])) {
+            $options['request.options'] = ['proxy' => $this->params['proxy']];
+        }
+        if (isset($this->params['legacy_auth']) && $this->params['legacy_auth']) {
+            $options['signature_version'] = 'v2';
+        }
+        $this->connection = new S3Client($options);
+
+        if (!$this->connection->isBucketDnsCompatible($this->bucket)) {
+            throw new \Exception("The configured bucket name is invalid: " . $this->bucket);
+        }
+
+        if (!$this->connection->doesBucketExist($this->bucket)) {
+            try {
+                $this->connection->createBucket(array(
+                    'Bucket' => $this->bucket
+                ));
+                $this->testTimeout();
+            } catch (S3Exception $e) {
+                \OCP\Util::logException('files_external', $e);
+                throw new \Exception('Creation of bucket failed. ' . $e->getMessage());
+            }
+        }
+
+        return $this->connection;
+    }
+
+    /**
+     * when running the tests wait to let the buckets catch up
+     */
+    private function testTimeout() {
+        if ($this->test) {
+            sleep($this->timeout);
+        }
+    }
+
+    public static function legacySignatureProvider($version, $service, $region) {
+        switch ($version) {
+            case 'v2':
+            case 's3':
+                return new S3Signature();
+            default:
+                return null;
+        }
+    }
 }

apps/files_external/lib/Lib/Backend/AmazonS3.php

Indentation +26 added lines, -26 removed lines

@@ -33,32 +33,32 @@
 
 class AmazonS3 extends Backend {
 
-	use LegacyDependencyCheckPolyfill;
+    use LegacyDependencyCheckPolyfill;
 
-	public function __construct(IL10N $l, AccessKey $legacyAuth) {
-		$this
-			->setIdentifier('amazons3')
-			->addIdentifierAlias('\OC\Files\Storage\AmazonS3') // legacy compat
-			->setStorageClass('\OCA\Files_External\Lib\Storage\AmazonS3')
-			->setText($l->t('Amazon S3'))
-			->addParameters([
-				(new DefinitionParameter('bucket', $l->t('Bucket'))),
-				(new DefinitionParameter('hostname', $l->t('Hostname')))
-					->setFlag(DefinitionParameter::FLAG_OPTIONAL),
-				(new DefinitionParameter('port', $l->t('Port')))
-					->setFlag(DefinitionParameter::FLAG_OPTIONAL),
-				(new DefinitionParameter('region', $l->t('Region')))
-					->setFlag(DefinitionParameter::FLAG_OPTIONAL),
-				(new DefinitionParameter('use_ssl', $l->t('Enable SSL')))
-					->setType(DefinitionParameter::VALUE_BOOLEAN),
-				(new DefinitionParameter('use_path_style', $l->t('Enable Path Style')))
-					->setType(DefinitionParameter::VALUE_BOOLEAN),
-				(new DefinitionParameter('legacy_auth', $l->t('Legacy (v2) authentication')))
-					->setType(DefinitionParameter::VALUE_BOOLEAN),
-			])
-			->addAuthScheme(AccessKey::SCHEME_AMAZONS3_ACCESSKEY)
-			->setLegacyAuthMechanism($legacyAuth)
-		;
-	}
+    public function __construct(IL10N $l, AccessKey $legacyAuth) {
+        $this
+            ->setIdentifier('amazons3')
+            ->addIdentifierAlias('\OC\Files\Storage\AmazonS3') // legacy compat
+            ->setStorageClass('\OCA\Files_External\Lib\Storage\AmazonS3')
+            ->setText($l->t('Amazon S3'))
+            ->addParameters([
+                (new DefinitionParameter('bucket', $l->t('Bucket'))),
+                (new DefinitionParameter('hostname', $l->t('Hostname')))
+                    ->setFlag(DefinitionParameter::FLAG_OPTIONAL),
+                (new DefinitionParameter('port', $l->t('Port')))
+                    ->setFlag(DefinitionParameter::FLAG_OPTIONAL),
+                (new DefinitionParameter('region', $l->t('Region')))
+                    ->setFlag(DefinitionParameter::FLAG_OPTIONAL),
+                (new DefinitionParameter('use_ssl', $l->t('Enable SSL')))
+                    ->setType(DefinitionParameter::VALUE_BOOLEAN),
+                (new DefinitionParameter('use_path_style', $l->t('Enable Path Style')))
+                    ->setType(DefinitionParameter::VALUE_BOOLEAN),
+                (new DefinitionParameter('legacy_auth', $l->t('Legacy (v2) authentication')))
+                    ->setType(DefinitionParameter::VALUE_BOOLEAN),
+            ])
+            ->addAuthScheme(AccessKey::SCHEME_AMAZONS3_ACCESSKEY)
+            ->setLegacyAuthMechanism($legacyAuth)
+        ;
+    }
 
 }