Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix:signature mistmatch with encrypted data #122

Merged
merged 4 commits into from
Jan 22, 2024
Merged

fix:signature mistmatch with encrypted data #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
82ff06c
fix: fix issue of signature mismatch due to url encoding component di…
mohitpubnub Jan 21, 2024
1ed5218
test: added test for signature calculation with special characters input
mohitpubnub Jan 21, 2024
a71fb7e
simlified condition for url encoder difference in api through inverti…
mohitpubnub Jan 22, 2024
7fb7901
PubNub SDK v4.3.2 release.
pubnub-release-bot Jan 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .pubnub.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
---
changelog:
- date: 2024-01-22
version: v4.3.2
changes:
- type: bug
text: "Fixes issue of getting signature mismatch exception while publishing encrypted data."
- date: 2023-11-27
version: v4.3.1
changes:
Expand Down Expand Up @@ -437,7 +442,7 @@ supported-platforms:
platforms:
- "Dart SDK >=2.6.0 <3.0.0"
version: "PubNub Dart SDK"
version: "4.3.1"
version: "4.3.2"
sdks:
-
full-name: PubNub Dart SDK
Expand Down
6 changes: 6 additions & 0 deletions pubnub/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
## v4.3.2
January 22 2024

#### Fixed
- Fixes issue of getting signature mismatch exception while publishing encrypted data.

## v4.3.1
November 27 2023

Expand Down
2 changes: 1 addition & 1 deletion pubnub/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ To add the package to your Dart or Flutter project, add `pubnub` as a dependency

```yaml
dependencies:
pubnub: ^4.3.1
pubnub: ^4.3.2
```

After adding the dependency to `pubspec.yaml`, run the `dart pub get` command in the root directory of your project (the same that the `pubspec.yaml` is in).
Expand Down
2 changes: 1 addition & 1 deletion pubnub/lib/src/core/core.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ class Core {
/// Internal module responsible for supervising.
SupervisorModule supervisor = SupervisorModule();

static String version = '4.3.1';
static String version = '4.3.2';

Core(
{Keyset? defaultKeyset,
Expand Down
5 changes: 4 additions & 1 deletion pubnub/lib/src/dx/_utils/signature.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ String computeV2Signature(

var encodedPathSegments = <String>[];
pathSegments.forEach(
(component) => encodedPathSegments.add(Uri.encodeFull(component)));
(component) => encodedPathSegments.add(encodePathSegament(component)));

var plaintext = '''${type.method.toUpperCase()}
${keyset.publishKey}
Expand All @@ -55,3 +55,6 @@ ${'$body' == 'null' ? '' : '$body'}''';
.replaceAll(RegExp(r'\/'), '_')
.replaceAll(RegExp(r'\=*$'), '');
}

String encodePathSegament(String pathSegment) =>
Uri.encodeFull(pathSegment).replaceAll('/', '%2F').replaceAll('#', '%23');
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just curious, why Uri.encodeFull method doesn't encode the whole path segment? Looks like you have to still replace / with %2F and # with %23

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

encodeFull consider / as path segment separation character which is correct.
We may use encodecomponent but It encodes all special characters which doesn't fit our requirement for signature calculation and we may need to reverse by selecting like this:

Uri.encodeComponent(pathSegment).replaceAllMapped(
        RegExp('%3D|%2B|%3A|%2A|%2C|%40|%24|%26|%28|%29'),
        (match) => {
              '%3D': '=',
              '%2B': '+',
              '%3A': ':',
              '%2A': '*',
              '%2C': ',',
              '%40': '@',
              '%24': '\$',
              '%26': '&',
              '%28': '(',
              '%29': ')',
            }[match.group(0)]!);

2 changes: 1 addition & 1 deletion pubnub/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: pubnub
description: PubNub SDK v5 for Dart lang (with Flutter support) that allows you to create real-time applications
version: 4.3.1
version: 4.3.2
homepage: https://www.pubnub.com/docs/sdks/dart

environment:
Expand Down
19 changes: 19 additions & 0 deletions pubnub/test/unit/dx/utils_test.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,25 @@ void main() {
var body = 'test';
var expectedSign = 'v2.GtlYbLJgz5DjClB2Z2o47BbJngI7uQ3E07HUnL1NN3Q';

var response =
computeV2Signature(keyset, requestType, path, queryParams, body);
expect(response, equals(expectedSign));
});
test('computeV2Signature should return valid signature when special characters included', () {
PubNub.version = '1.0.0';
Core.version = '1.0.0';
Time.mock(DateTime.fromMillisecondsSinceEpoch(1234567890000));
var keyset = Keyset(
subscribeKey: 'test',
publishKey: 'test',
secretKey: 'test',
userId: UserId('test'));
var requestType = RequestType.post;
var queryParams = {'b': 'second', 'c': 'third', 'a': 'first'};
var path = ['test', 'UE5FROJRyR0JX/51v9ktWH4ybF{}()*&^%@#a\$WReE3@#\$'];
var body = 'test';
var expectedSign = 'v2.d-_yEq5ZA_T8GseWOKTWr8XS4suakWKTnESmfxMLw-E';

var response =
computeV2Signature(keyset, requestType, path, queryParams, body);
expect(response, equals(expectedSign));
Expand Down
Loading