signer.php

См. документацию.

<?php
 
namespace Bitrix\Main\Security\Sign;
 
use Bitrix\Main\ArgumentTypeException;
use Bitrix\Main\Config;

class Signer
{
    protected $algorithm = null;
    protected $separator = '.';
    protected $key = null;

    public function __construct(SigningAlgorithm $algorithm = null)
    {
        if ($algorithm !== null)
        {
            $this->algorithm = $algorithm;
        }
        else
        {
            $this->algorithm = new HmacAlgorithm();
        }
    }

    public function setKey($value)
    {
        if (!is_string($value))
        {
            throw new ArgumentTypeException('value', 'string');
        }
 
        $this->key = $value;
        return $this;
    }

    public function getSeparator()
    {
        return $this->separator;
    }

    public function setSeparator($value)
    {
        if (!is_string($value))
        {
            throw new ArgumentTypeException('value', 'string');
        }
 
        $this->separator = $value;
        return $this;
    }

    public function getSignature($value, $salt = null)
    {
        if (!is_string($value))
        {
            throw new ArgumentTypeException('value', 'string');
        }
 
        $key = $this->getKey($salt);
        $signature = $this->algorithm->getSignature($value, $key);
        $signature = $this->encodeSignature($signature);
        return $signature;
    }

    public function sign($value, $salt = null)
    {
        if (!is_string($value))
        {
            throw new ArgumentTypeException('value', 'string');
        }
 
        $signature = $this->getSignature($value, $salt);
        return $this->pack([$value, $signature]);
    }

    public function unsign($signedValue, $salt = null)
    {
        if (!is_string($signedValue))
        {
            throw new ArgumentTypeException('signedValue', 'string');
        }
 
        [$value, $signature] = $this->unpack($signedValue);
        if (!$this->verifySignature($value, $signature, $salt))
        {
            throw new BadSignatureException('Signature does not match');
        }
 
        return $value;
    }

    public function validate($value, $signature, $salt = null)
    {
        if (is_string($value) && is_string($signature))
        {
            return $this->verifySignature($value, $signature, $salt);
        }
        return false;
    }

    protected function verifySignature($value, $sig, $salt = null)
    {
        $key = $this->getKey($salt);
        $signature = $this->decodeSignature($sig);
        return $this->algorithm->verify($value, $key, $signature);
    }

    protected function getKey($salt = null)
    {
        if ($salt !== null && !preg_match('#^[a-zA-Z0-9_.-]{3,50}$#D', $salt))
        {
            throw new BadSignatureException('Malformed salt, only [a-zA-Z0-9_.-]{3,50} characters are acceptable');
        }
 
        if ($this->key !== null)
        {
            $key = $this->key;
        }
        else
        {
            $key = $this->getDefaultKey();
        }
 
        return $salt . $key;
    }

    protected function getDefaultKey()
    {
        static $defaultKey = null;
        if ($defaultKey === null)
        {
            $defaultKey = Config\Option::get('main', 'signer_default_key', false);
            if (!$defaultKey)
            {
                $defaultKey = hash('sha512', \Bitrix\Main\Security\Random::getString(64));
                Config\Option::set('main', 'signer_default_key', $defaultKey);
            }
 
            $options = Config\Configuration::getValue("crypto");
            if (isset($options["crypto_key"]))
            {
                $defaultKey .= $options["crypto_key"];
            }
        }
 
        return $defaultKey;
    }

    public function pack(array $values)
    {
        return join($this->separator, $values);
    }

    public function unpack($value, $limit = 2)
    {
        // Some kind of optimization
        if ($limit === 0)
        {
            if (!str_contains($value, $this->separator))
            {
                throw new BadSignatureException('Separator not found in value');
            }
 
            return explode($this->separator, $value);
        }
 
        $result = [];
        while (--$limit > 0)
        {
            $pos = bxstrrpos($value, $this->separator);
            if ($pos === false)
            {
                throw new BadSignatureException('Separator not found in value');
            }
 
            $result[] = mb_substr($value, $pos + 1);
            $value = mb_substr($value, 0, $pos);
        }
        $result[] = $value;
 
        return array_reverse($result);
    }

    protected function encodeSignature($value)
    {
        return bin2hex($value);
    }

    protected function decodeSignature($value)
    {
        if (preg_match('#[^[:xdigit:]]#', $value))
        {
            throw new BadSignatureException('Signature must be hexadecimal string');
        }
 
        // ToDo: use hex2bin instead pack for PHP > 5.4.0
        return pack('H*', $value);
    }
}