1 line
9.2 KiB
JSON
1 line
9.2 KiB
JSON
{"ast":null,"code":"// Copyright 2015 Joyent, Inc.\nvar assert = require('assert-plus');\n\nvar crypto = require('crypto');\n\nvar sshpk = require('sshpk');\n\nvar utils = require('./utils');\n\nvar HASH_ALGOS = utils.HASH_ALGOS;\nvar PK_ALGOS = utils.PK_ALGOS;\nvar InvalidAlgorithmError = utils.InvalidAlgorithmError;\nvar HttpSignatureError = utils.HttpSignatureError;\nvar validateAlgorithm = utils.validateAlgorithm; ///--- Exported API\n\nmodule.exports = {\n /**\n * Verify RSA/DSA signature against public key. You are expected to pass in\n * an object that was returned from `parse()`.\n *\n * @param {Object} parsedSignature the object you got from `parse`.\n * @param {String} pubkey RSA/DSA private key PEM.\n * @return {Boolean} true if valid, false otherwise.\n * @throws {TypeError} if you pass in bad arguments.\n * @throws {InvalidAlgorithmError}\n */\n verifySignature: function verifySignature(parsedSignature, pubkey) {\n assert.object(parsedSignature, 'parsedSignature');\n if (typeof pubkey === 'string' || Buffer.isBuffer(pubkey)) pubkey = sshpk.parseKey(pubkey);\n assert.ok(sshpk.Key.isKey(pubkey, [1, 1]), 'pubkey must be a sshpk.Key');\n var alg = validateAlgorithm(parsedSignature.algorithm);\n if (alg[0] === 'hmac' || alg[0] !== pubkey.type) return false;\n var v = pubkey.createVerify(alg[1]);\n v.update(parsedSignature.signingString);\n return v.verify(parsedSignature.params.signature, 'base64');\n },\n\n /**\n * Verify HMAC against shared secret. You are expected to pass in an object\n * that was returned from `parse()`.\n *\n * @param {Object} parsedSignature the object you got from `parse`.\n * @param {String} secret HMAC shared secret.\n * @return {Boolean} true if valid, false otherwise.\n * @throws {TypeError} if you pass in bad arguments.\n * @throws {InvalidAlgorithmError}\n */\n verifyHMAC: function verifyHMAC(parsedSignature, secret) {\n assert.object(parsedSignature, 'parsedHMAC');\n assert.string(secret, 'secret');\n var alg = validateAlgorithm(parsedSignature.algorithm);\n if (alg[0] !== 'hmac') return false;\n var hashAlg = alg[1].toUpperCase();\n var hmac = crypto.createHmac(hashAlg, secret);\n hmac.update(parsedSignature.signingString);\n /*\n * Now double-hash to avoid leaking timing information - there's\n * no easy constant-time compare in JS, so we use this approach\n * instead. See for more info:\n * https://www.isecpartners.com/blog/2011/february/double-hmac-\n * verification.aspx\n */\n\n var h1 = crypto.createHmac(hashAlg, secret);\n h1.update(hmac.digest());\n h1 = h1.digest();\n var h2 = crypto.createHmac(hashAlg, secret);\n h2.update(new Buffer(parsedSignature.params.signature, 'base64'));\n h2 = h2.digest();\n /* Node 0.8 returns strings from .digest(). */\n\n if (typeof h1 === 'string') return h1 === h2;\n /* And node 0.10 lacks the .equals() method on Buffers. */\n\n if (Buffer.isBuffer(h1) && !h1.equals) return h1.toString('binary') === h2.toString('binary');\n return h1.equals(h2);\n }\n};","map":{"version":3,"sources":["/Users/tylerkoenig/Code/personal/react-scss2/node_modules/http-signature/lib/verify.js"],"names":["assert","require","crypto","sshpk","utils","HASH_ALGOS","PK_ALGOS","InvalidAlgorithmError","HttpSignatureError","validateAlgorithm","module","exports","verifySignature","parsedSignature","pubkey","object","Buffer","isBuffer","parseKey","ok","Key","isKey","alg","algorithm","type","v","createVerify","update","signingString","verify","params","signature","verifyHMAC","secret","string","hashAlg","toUpperCase","hmac","createHmac","h1","digest","h2","equals","toString"],"mappings":"AAAA;AAEA,IAAIA,MAAM,GAAGC,OAAO,CAAC,aAAD,CAApB;;AACA,IAAIC,MAAM,GAAGD,OAAO,CAAC,QAAD,CAApB;;AACA,IAAIE,KAAK,GAAGF,OAAO,CAAC,OAAD,CAAnB;;AACA,IAAIG,KAAK,GAAGH,OAAO,CAAC,SAAD,CAAnB;;AAEA,IAAII,UAAU,GAAGD,KAAK,CAACC,UAAvB;AACA,IAAIC,QAAQ,GAAGF,KAAK,CAACE,QAArB;AACA,IAAIC,qBAAqB,GAAGH,KAAK,CAACG,qBAAlC;AACA,IAAIC,kBAAkB,GAAGJ,KAAK,CAACI,kBAA/B;AACA,IAAIC,iBAAiB,GAAGL,KAAK,CAACK,iBAA9B,C,CAEA;;AAEAC,MAAM,CAACC,OAAP,GAAiB;AACf;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACEC,EAAAA,eAAe,EAAE,SAASA,eAAT,CAAyBC,eAAzB,EAA0CC,MAA1C,EAAkD;AACjEd,IAAAA,MAAM,CAACe,MAAP,CAAcF,eAAd,EAA+B,iBAA/B;AACA,QAAI,OAAQC,MAAR,KAAoB,QAApB,IAAgCE,MAAM,CAACC,QAAP,CAAgBH,MAAhB,CAApC,EACEA,MAAM,GAAGX,KAAK,CAACe,QAAN,CAAeJ,MAAf,CAAT;AACFd,IAAAA,MAAM,CAACmB,EAAP,CAAUhB,KAAK,CAACiB,GAAN,CAAUC,KAAV,CAAgBP,MAAhB,EAAwB,CAAC,CAAD,EAAI,CAAJ,CAAxB,CAAV,EAA2C,4BAA3C;AAEA,QAAIQ,GAAG,GAAGb,iBAAiB,CAACI,eAAe,CAACU,SAAjB,CAA3B;AACA,QAAID,GAAG,CAAC,CAAD,CAAH,KAAW,MAAX,IAAqBA,GAAG,CAAC,CAAD,CAAH,KAAWR,MAAM,CAACU,IAA3C,EACE,OAAQ,KAAR;AAEF,QAAIC,CAAC,GAAGX,MAAM,CAACY,YAAP,CAAoBJ,GAAG,CAAC,CAAD,CAAvB,CAAR;AACAG,IAAAA,CAAC,CAACE,MAAF,CAASd,eAAe,CAACe,aAAzB;AACA,WAAQH,CAAC,CAACI,MAAF,CAAShB,eAAe,CAACiB,MAAhB,CAAuBC,SAAhC,EAA2C,QAA3C,CAAR;AACD,GAxBc;;AA0Bf;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACEC,EAAAA,UAAU,EAAE,SAASA,UAAT,CAAoBnB,eAApB,EAAqCoB,MAArC,EAA6C;AACvDjC,IAAAA,MAAM,CAACe,MAAP,CAAcF,eAAd,EAA+B,YAA/B;AACAb,IAAAA,MAAM,CAACkC,MAAP,CAAcD,MAAd,EAAsB,QAAtB;AAEA,QAAIX,GAAG,GAAGb,iBAAiB,CAACI,eAAe,CAACU,SAAjB,CAA3B;AACA,QAAID,GAAG,CAAC,CAAD,CAAH,KAAW,MAAf,EACE,OAAQ,KAAR;AAEF,QAAIa,OAAO,GAAGb,GAAG,CAAC,CAAD,CAAH,CAAOc,WAAP,EAAd;AAEA,QAAIC,IAAI,GAAGnC,MAAM,CAACoC,UAAP,CAAkBH,OAAlB,EAA2BF,MAA3B,CAAX;AACAI,IAAAA,IAAI,CAACV,MAAL,CAAYd,eAAe,CAACe,aAA5B;AAEA;AACJ;AACA;AACA;AACA;AACA;AACA;;AACI,QAAIW,EAAE,GAAGrC,MAAM,CAACoC,UAAP,CAAkBH,OAAlB,EAA2BF,MAA3B,CAAT;AACAM,IAAAA,EAAE,CAACZ,MAAH,CAAUU,IAAI,CAACG,MAAL,EAAV;AACAD,IAAAA,EAAE,GAAGA,EAAE,CAACC,MAAH,EAAL;AACA,QAAIC,EAAE,GAAGvC,MAAM,CAACoC,UAAP,CAAkBH,OAAlB,EAA2BF,MAA3B,CAAT;AACAQ,IAAAA,EAAE,CAACd,MAAH,CAAU,IAAIX,MAAJ,CAAWH,eAAe,CAACiB,MAAhB,CAAuBC,SAAlC,EAA6C,QAA7C,CAAV;AACAU,IAAAA,EAAE,GAAGA,EAAE,CAACD,MAAH,EAAL;AAEA;;AACA,QAAI,OAAQD,EAAR,KAAgB,QAApB,EACE,OAAQA,EAAE,KAAKE,EAAf;AACF;;AACA,QAAIzB,MAAM,CAACC,QAAP,CAAgBsB,EAAhB,KAAuB,CAACA,EAAE,CAACG,MAA/B,EACE,OAAQH,EAAE,CAACI,QAAH,CAAY,QAAZ,MAA0BF,EAAE,CAACE,QAAH,CAAY,QAAZ,CAAlC;AAEF,WAAQJ,EAAE,CAACG,MAAH,CAAUD,EAAV,CAAR;AACD;AAvEc,CAAjB","sourcesContent":["// Copyright 2015 Joyent, Inc.\n\nvar assert = require('assert-plus');\nvar crypto = require('crypto');\nvar sshpk = require('sshpk');\nvar utils = require('./utils');\n\nvar HASH_ALGOS = utils.HASH_ALGOS;\nvar PK_ALGOS = utils.PK_ALGOS;\nvar InvalidAlgorithmError = utils.InvalidAlgorithmError;\nvar HttpSignatureError = utils.HttpSignatureError;\nvar validateAlgorithm = utils.validateAlgorithm;\n\n///--- Exported API\n\nmodule.exports = {\n /**\n * Verify RSA/DSA signature against public key. You are expected to pass in\n * an object that was returned from `parse()`.\n *\n * @param {Object} parsedSignature the object you got from `parse`.\n * @param {String} pubkey RSA/DSA private key PEM.\n * @return {Boolean} true if valid, false otherwise.\n * @throws {TypeError} if you pass in bad arguments.\n * @throws {InvalidAlgorithmError}\n */\n verifySignature: function verifySignature(parsedSignature, pubkey) {\n assert.object(parsedSignature, 'parsedSignature');\n if (typeof (pubkey) === 'string' || Buffer.isBuffer(pubkey))\n pubkey = sshpk.parseKey(pubkey);\n assert.ok(sshpk.Key.isKey(pubkey, [1, 1]), 'pubkey must be a sshpk.Key');\n\n var alg = validateAlgorithm(parsedSignature.algorithm);\n if (alg[0] === 'hmac' || alg[0] !== pubkey.type)\n return (false);\n\n var v = pubkey.createVerify(alg[1]);\n v.update(parsedSignature.signingString);\n return (v.verify(parsedSignature.params.signature, 'base64'));\n },\n\n /**\n * Verify HMAC against shared secret. You are expected to pass in an object\n * that was returned from `parse()`.\n *\n * @param {Object} parsedSignature the object you got from `parse`.\n * @param {String} secret HMAC shared secret.\n * @return {Boolean} true if valid, false otherwise.\n * @throws {TypeError} if you pass in bad arguments.\n * @throws {InvalidAlgorithmError}\n */\n verifyHMAC: function verifyHMAC(parsedSignature, secret) {\n assert.object(parsedSignature, 'parsedHMAC');\n assert.string(secret, 'secret');\n\n var alg = validateAlgorithm(parsedSignature.algorithm);\n if (alg[0] !== 'hmac')\n return (false);\n\n var hashAlg = alg[1].toUpperCase();\n\n var hmac = crypto.createHmac(hashAlg, secret);\n hmac.update(parsedSignature.signingString);\n\n /*\n * Now double-hash to avoid leaking timing information - there's\n * no easy constant-time compare in JS, so we use this approach\n * instead. See for more info:\n * https://www.isecpartners.com/blog/2011/february/double-hmac-\n * verification.aspx\n */\n var h1 = crypto.createHmac(hashAlg, secret);\n h1.update(hmac.digest());\n h1 = h1.digest();\n var h2 = crypto.createHmac(hashAlg, secret);\n h2.update(new Buffer(parsedSignature.params.signature, 'base64'));\n h2 = h2.digest();\n\n /* Node 0.8 returns strings from .digest(). */\n if (typeof (h1) === 'string')\n return (h1 === h2);\n /* And node 0.10 lacks the .equals() method on Buffers. */\n if (Buffer.isBuffer(h1) && !h1.equals)\n return (h1.toString('binary') === h2.toString('binary'));\n\n return (h1.equals(h2));\n }\n};\n"]},"metadata":{},"sourceType":"script"} |