updated-packages

vendor/aws/aws-sdk-php/src/Signature/AnonymousSignature.php

@@ -9,6 +9,9 @@ use Psr\Http\Message\RequestInterface;
  */
 class AnonymousSignature implements SignatureInterface
 {
+    /**
+     * /** {@inheritdoc}
+     */
     public function signRequest(
         RequestInterface $request,
         CredentialsInterface $credentials
@@ -16,10 +19,14 @@ class AnonymousSignature implements SignatureInterface
         return $request;
     }
 
+    /**
+     * /** {@inheritdoc}
+     */
     public function presign(
         RequestInterface $request,
         CredentialsInterface $credentials,
-        $expires
+        $expires,
+        array $options = []
     ) {
         return $request;
     }

vendor/aws/aws-sdk-php/src/Signature/S3SignatureV4.php

@@ -10,24 +10,41 @@ use Psr\Http\Message\RequestInterface;
 class S3SignatureV4 extends SignatureV4
 {
     /**
-     * Always add a x-amz-content-sha-256 for data integrity.
+     * S3-specific signing logic
+     *
+     * {@inheritdoc}
      */
+    use SignatureTrait;
+
     public function signRequest(
         RequestInterface $request,
-        CredentialsInterface $credentials
+        CredentialsInterface $credentials,
+        $signingService = null
     ) {
+        // Always add a x-amz-content-sha-256 for data integrity
         if (!$request->hasHeader('x-amz-content-sha256')) {
             $request = $request->withHeader(
-                'X-Amz-Content-Sha256',
+                'x-amz-content-sha256',
                 $this->getPayload($request)
             );
         }
-
-        return parent::signRequest($request, $credentials);
+        $useCrt =
+            strpos($request->getUri()->getHost(), "accesspoint.s3-global")
+            !== false;
+        if (!$useCrt) {
+            if (strpos($request->getUri()->getHost(), "s3-object-lambda")) {
+                return parent::signRequest($request, $credentials, "s3-object-lambda");
+            }
+            return parent::signRequest($request, $credentials);
+        }
+        $signingService = $signingService ?: 's3';
+        return $this->signWithV4a($credentials, $request, $signingService);
     }
 
     /**
      * Always add a x-amz-content-sha-256 for data integrity.
+     *
+     * {@inheritdoc}
      */
     public function presign(
         RequestInterface $request,
@@ -41,6 +58,9 @@ class S3SignatureV4 extends SignatureV4
                 $this->getPresignedPayload($request)
             );
         }
+        if (strpos($request->getUri()->getHost(), "accesspoint.s3-global")) {
+            $request = $request->withHeader("x-amz-region-set", "*");
+        }
 
         return parent::presign($request, $credentials, $expires, $options);
     }

vendor/aws/aws-sdk-php/src/Signature/SignatureInterface.php

@@ -28,9 +28,9 @@ interface SignatureInterface
     /**
      * Create a pre-signed request.
      *
-     * @param RequestInterface     $request     Request to sign
-     * @param CredentialsInterface $credentials Credentials used to sign
-     * @param int|string|\DateTime $expires The time at which the URL should
+     * @param RequestInterface              $request     Request to sign
+     * @param CredentialsInterface          $credentials Credentials used to sign
+     * @param int|string|\DateTimeInterface $expires The time at which the URL should
      *     expire. This can be a Unix timestamp, a PHP DateTime object, or a
      *     string that can be evaluated by strtotime.
      *
@@ -39,6 +39,7 @@ interface SignatureInterface
     public function presign(
         RequestInterface $request,
         CredentialsInterface $credentials,
-        $expires
+        $expires,
+        array $options = []
     );
 }

vendor/aws/aws-sdk-php/src/Signature/SignatureProvider.php

@@ -2,6 +2,7 @@
 namespace Aws\Signature;
 
 use Aws\Exception\UnresolvedSignatureException;
+use Aws\Token\BearerTokenAuthorization;
 
 /**
  * Signature providers.
@@ -43,6 +44,7 @@ class SignatureProvider
     private static $s3v4SignedServices = [
         's3' => true,
         's3control' => true,
+        's3-object-lambda' => true,
     ];
 
     /**
@@ -59,7 +61,9 @@ class SignatureProvider
     public static function resolve(callable $provider, $version, $service, $region)
     {
         $result = $provider($version, $service, $region);
-        if ($result instanceof SignatureInterface) {
+        if ($result instanceof SignatureInterface
+            || $result instanceof BearerTokenAuthorization
+        ) {
             return $result;
         }
 
@@ -119,8 +123,14 @@ class SignatureProvider
                     return !empty(self::$s3v4SignedServices[$service])
                         ? new S3SignatureV4($service, $region)
                         : new SignatureV4($service, $region);
+                case 'v4a':
+                    return new SignatureV4($service, $region, ['use_v4a' => true]);
                 case 'v4-unsigned-body':
-                    return new SignatureV4($service, $region, ['unsigned-body' => 'true']);
+                    return !empty(self::$s3v4SignedServices[$service])
+                    ? new S3SignatureV4($service, $region, ['unsigned-body' => 'true'])
+                    : new SignatureV4($service, $region, ['unsigned-body' => 'true']);
+                case 'bearer':
+                    return new BearerTokenAuthorization();
                 case 'anonymous':
                     return new AnonymousSignature();
                 default:

vendor/aws/aws-sdk-php/src/Signature/SignatureTrait.php

@@ -11,7 +11,7 @@ trait SignatureTrait
 
     /** @var int Size of the hash cache */
     private $cacheSize = 0;
-
+    
     private function createScope($shortDate, $region, $service)
     {
         return "$shortDate/$region/$service/aws4_request";
@@ -43,7 +43,6 @@ trait SignatureTrait
                 true
             );
         }
-
         return $this->cache[$k];
     }
 }

vendor/aws/aws-sdk-php/src/Signature/SignatureV4.php

@@ -2,6 +2,14 @@
 namespace Aws\Signature;
 
 use Aws\Credentials\CredentialsInterface;
+use AWS\CRT\Auth\Signable;
+use AWS\CRT\Auth\SignatureType;
+use AWS\CRT\Auth\Signing;
+use AWS\CRT\Auth\SigningAlgorithm;
+use AWS\CRT\Auth\SigningConfigAWS;
+use AWS\CRT\Auth\StaticCredentialsProvider;
+use AWS\CRT\HTTP\Request;
+use Aws\Exception\CommonRuntimeException;
 use Aws\Exception\CouldNotCreateChecksumException;
 use GuzzleHttp\Psr7;
 use Psr\Http\Message\RequestInterface;
@@ -21,11 +29,14 @@ class SignatureV4 implements SignatureInterface
     private $service;
 
     /** @var string */
-    private $region;
+    protected $region;
 
     /** @var bool */
     private $unsigned;
 
+    /** @var bool */
+    private $useV4a;
+
     /**
      * The following headers are not signed because signing these headers
      * would potentially cause a signature mismatch when sending a request
@@ -33,7 +44,7 @@ class SignatureV4 implements SignatureInterface
      *
      * @return array
      */
-    private function getHeaderBlacklist()
+    protected function getHeaderBlacklist()
     {
         return [
             'cache-control'         => true,
@@ -55,6 +66,7 @@ class SignatureV4 implements SignatureInterface
             'from'                  => true,
             'referer'               => true,
             'user-agent'            => true,
+            'X-Amz-User-Agent'      => true,
             'x-amzn-trace-id'       => true,
             'aws-sdk-invocation-id' => true,
             'aws-sdk-retry'         => true,
@@ -73,11 +85,16 @@ class SignatureV4 implements SignatureInterface
         $this->service = $service;
         $this->region = $region;
         $this->unsigned = isset($options['unsigned-body']) ? $options['unsigned-body'] : false;
+        $this->useV4a = isset($options['use_v4a']) && $options['use_v4a'] === true;
     }
 
+    /**
+     * {@inheritdoc}
+     */
     public function signRequest(
         RequestInterface $request,
-        CredentialsInterface $credentials
+        CredentialsInterface $credentials,
+        $signingService = null
     ) {
         $ldt = gmdate(self::ISO8601_BASIC);
         $sdt = substr($ldt, 0, 8);
@@ -87,7 +104,13 @@ class SignatureV4 implements SignatureInterface
         if ($token = $credentials->getSecurityToken()) {
             $parsed['headers']['X-Amz-Security-Token'] = [$token];
         }
-        $cs = $this->createScope($sdt, $this->region, $this->service);
+        $service = isset($signingService) ? $signingService : $this->service;
+
+        if ($this->useV4a) {
+            return $this->signWithV4a($credentials, $request, $service);
+        }
+
+        $cs = $this->createScope($sdt, $this->region, $service);
         $payload = $this->getPayload($request);
 
         if ($payload == self::UNSIGNED_PAYLOAD) {
@@ -99,7 +122,7 @@ class SignatureV4 implements SignatureInterface
         $signingKey = $this->getSigningKey(
             $sdt,
             $this->region,
-            $this->service,
+            $service,
             $credentials->getSecretKey()
         );
         $signature = hash_hmac('sha256', $toSign, $signingKey);
@@ -134,6 +157,9 @@ class SignatureV4 implements SignatureInterface
         return $presignHeaders;
     }
 
+    /**
+     * {@inheritdoc}
+     */
     public function presign(
         RequestInterface $request,
         CredentialsInterface $credentials,
@@ -142,8 +168,8 @@ class SignatureV4 implements SignatureInterface
     ) {
 
         $startTimestamp = isset($options['start_time'])
-                            ? $this->convertToTimestamp($options['start_time'], null)
-                            : time();
+            ? $this->convertToTimestamp($options['start_time'], null)
+            : time();
 
         $expiresTimestamp = $this->convertToTimestamp($expires, $startTimestamp);
 
@@ -185,7 +211,7 @@ class SignatureV4 implements SignatureInterface
      * @return RequestInterface
      * @throws \InvalidArgumentException if the method is not POST
      */
-    public static function convertPostToGet(RequestInterface $request)
+    public static function convertPostToGet(RequestInterface $request, $additionalQueryParams = "")
     {
         if ($request->getMethod() !== 'POST') {
             throw new \InvalidArgumentException('Expected a POST request but '
@@ -193,13 +219,13 @@ class SignatureV4 implements SignatureInterface
         }
 
         $sr = $request->withMethod('GET')
-            ->withBody(Psr7\stream_for(''))
+            ->withBody(Psr7\Utils::streamFor(''))
             ->withoutHeader('Content-Type')
             ->withoutHeader('Content-Length');
 
         // Move POST fields to the query if they are present
         if ($request->getHeaderLine('Content-Type') === 'application/x-www-form-urlencoded') {
-            $body = (string) $request->getBody();
+            $body = (string) $request->getBody() . $additionalQueryParams;
             $sr = $sr->withUri($sr->getUri()->withQuery($body));
         }
 
@@ -222,7 +248,7 @@ class SignatureV4 implements SignatureInterface
         }
 
         try {
-            return Psr7\hash($request->getBody(), 'sha256');
+            return Psr7\Utils::hash($request->getBody(), 'sha256');
         } catch (\Exception $e) {
             throw new CouldNotCreateChecksumException('sha256', $e);
         }
@@ -315,11 +341,11 @@ class SignatureV4 implements SignatureInterface
         ksort($query);
         foreach ($query as $k => $v) {
             if (!is_array($v)) {
-                $qs .= rawurlencode($k) . '=' . rawurlencode($v) . '&';
+                $qs .= rawurlencode($k) . '=' . rawurlencode($v !== null ? $v : '') . '&';
             } else {
                 sort($v);
                 foreach ($v as $value) {
-                    $qs .= rawurlencode($k) . '=' . rawurlencode($value) . '&';
+                    $qs .= rawurlencode($k) . '=' . rawurlencode($value !== null ? $value : '') . '&';
                 }
             }
         }
@@ -333,7 +359,7 @@ class SignatureV4 implements SignatureInterface
             $timestamp = $dateValue->getTimestamp();
         } elseif (!is_numeric($dateValue)) {
             $timestamp = strtotime($dateValue,
-                                   $relativeTimeBase === null ? time() : $relativeTimeBase
+                $relativeTimeBase === null ? time() : $relativeTimeBase
             );
         } else {
             $timestamp = $dateValue;
@@ -358,6 +384,9 @@ class SignatureV4 implements SignatureInterface
 
     private function moveHeadersToQuery(array $parsedRequest)
     {
+        //x-amz-user-agent shouldn't be put in a query param
+        unset($parsedRequest['headers']['X-Amz-User-Agent']);
+
         foreach ($parsedRequest['headers'] as $name => $header) {
             $lname = strtolower($name);
             if (substr($lname, 0, 5) == 'x-amz') {
@@ -387,7 +416,7 @@ class SignatureV4 implements SignatureInterface
         return [
             'method'  => $request->getMethod(),
             'path'    => $uri->getPath(),
-            'query'   => Psr7\parse_query($uri->getQuery()),
+            'query'   => Psr7\Query::parse($uri->getQuery()),
             'uri'     => $uri,
             'headers' => $request->getHeaders(),
             'body'    => $request->getBody(),
@@ -398,7 +427,7 @@ class SignatureV4 implements SignatureInterface
     private function buildRequest(array $req)
     {
         if ($req['query']) {
-            $req['uri'] = $req['uri']->withQuery(Psr7\build_query($req['query']));
+            $req['uri'] = $req['uri']->withQuery(Psr7\Query::build($req['query']));
         }
 
         return new Psr7\Request(
@@ -409,4 +438,74 @@ class SignatureV4 implements SignatureInterface
             $req['version']
         );
     }
+
+    /**
+     * @param CredentialsInterface $credentials
+     * @param RequestInterface $request
+     * @param $signingService
+     * @return RequestInterface
+     */
+    protected function signWithV4a(CredentialsInterface $credentials, RequestInterface $request, $signingService)
+    {
+        if (!extension_loaded('awscrt')) {
+            throw new CommonRuntimeException(
+                "AWS Common Runtime for PHP is required to use Signature V4A"
+                . ".  Please install it using the instructions found at"
+                . " https://github.com/aws/aws-sdk-php/blob/master/CRT_INSTRUCTIONS.md"
+            );
+        }
+        $credentials_provider = new StaticCredentialsProvider([
+            'access_key_id' => $credentials->getAccessKeyId(),
+            'secret_access_key' => $credentials->getSecretKey(),
+            'session_token' => $credentials->getSecurityToken(),
+        ]);
+
+        $sha = $this->getPayload($request);
+        $signingConfig = new SigningConfigAWS([
+            'algorithm' => SigningAlgorithm::SIGv4_ASYMMETRIC,
+            'signature_type' => SignatureType::HTTP_REQUEST_HEADERS,
+            'credentials_provider' => $credentials_provider,
+            'signed_body_value' => $sha,
+            'region' => "*",
+            'service' => $signingService,
+            'date' => time(),
+        ]);
+
+        $illegalV4aHeaders = [
+            self::AMZ_CONTENT_SHA256_HEADER,
+            "aws-sdk-invocation-id",
+            "aws-sdk-retry",
+        ];
+
+        $storedIllegalHeaders = [];
+        foreach ($illegalV4aHeaders as $header) {
+            if ($request->hasHeader($header)){
+                $storedIllegalHeaders[$header] = $request->getHeader($header);
+                $request = $request->withoutHeader($header);
+            }
+        }
+
+        $http_request = new Request(
+            $request->getMethod(),
+            (string) $request->getUri(),
+            [], //leave empty as the query is parsed from the uri object
+            array_map(function ($header) {return $header[0];}, $request->getHeaders())
+        );
+
+        Signing::signRequestAws(
+            Signable::fromHttpRequest($http_request),
+            $signingConfig, function ($signing_result, $error_code) use (&$http_request) {
+            $signing_result->applyToHttpRequest($http_request);
+        });
+        foreach ($storedIllegalHeaders as $header => $value) {
+            $request = $request->withHeader($header, $value);
+        }
+
+        $sigV4AHeaders = $http_request->headers();
+        foreach ($sigV4AHeaders->toArray() as $h => $v) {
+            $request = $request->withHeader($h, $v);
+        }
+
+        return $request;
+    }
 }