nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Micke Nordin	dae8a36460	fix(ocm): treat RFC 9421 keyid as opaque, verify by sender origin RFC 7517 §4.5 leaves the keyid structure unspecified, so the receiver must not parse it. The signer origin now comes from the trusted OCM share/sender identity; the JWK Set is resolved against that origin and the keyid is matched opaquely to the JWKS kid. Aligns with the OCM verification procedure and fixes the origin-mismatch / flaky-kid failures in the two-port integration rig. Reverts the per-request host-based kid back to a stable persisted kid, drops keyid->host parsing, threads a sender-origin parameter through verification, and resolves that origin in every OCM inbound entry point (notifications, shares, token exchange, OCM requests) and the federation rate limiter. Cavage is unchanged. Assisted-by: ClaudeCode:glm-5.2 Signed-off-by: Micke Nordin <kano@sunet.se>	2 weeks ago
Micke Nordin	410d8c144b	feat(ocm): align RFC 9421 http-sig with updated OCM spec Implements the changes from cs3org/OCM-API#391 and closes the remaining gaps with the HTTP Message Signatures section: - discover peer JWK Sets via the new `jwksUri` discovery field instead of the fixed /.well-known/jwks.json path; advertise our own jwksUri and require it (https) from peers advertising the `http-sig` capability - stop covering the Date header; freshness is anchored on the `created` signature parameter - mark and select the OCM signature by its integrity-protected tag="ocm" parameter instead of the dictionary label - require the JWK `alg` parameter and derive the signature algorithm from it, accepting fully-specified RFC 9864 names - reject signed requests whose verification key cannot be resolved instead of treating them as unsigned - derive the signer origin from the spec-canonical fqdn#id keyid form Signed-off-by: Micke Nordin <kano@sunet.se>	2 weeks ago
nextcloud-command	cbbbe5ac14	refactor: Apply rector changes Signed-off-by: GitHub <noreply@github.com>	1 month ago
David Dreschner	146f2a1f29	chore(tests): Fix failing nodb tests due to AlgorithmTest Assisted-by: ClaudeCode:claude-fable-5 Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>	1 month ago
provokateurin	405d250aef	test: Add missing calls to the parent setUp method Signed-off-by: provokateurin <kate@provokateurin.de>	2 months ago
Côme Chilliet	1ab09ec753	chore: Apply new coding standard to all files The diff can be checked using: git diff --ignore-all-space --ignore-blank-lines To see only the changes not related to blank lines. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 months ago
Micke Nordin	cc9e0ba582	fix(http-sig): make setSignature public and skip third-party-dependent test Two CI failures introduced by the test additions in this PR: 1. testEd25519VerifyAcceptedWhenSodiumLoaded calls setSignature() to inject an externally-produced Ed25519 signature (since Algorithm::sign() rejects Ed25519 by design). setSignature was declared protected, so the test couldn't call it from outside the class hierarchy. Make it public — SignedRequest lives in the OC\ private namespace, so this widens internal-only visibility, not the public API surface. 2. testParseKeyRejectsContradictoryAlg expected firebase/php-jwt's JWK::parseKey() to throw on a kty=OKP/crv=Ed25519/alg=ES256 key. The current firebase/php-jwt version does not validate that coherence at parse time, so the test now fails to see any throwable. The actual security check happens at Algorithm::verify() time and is covered by testVerifyEd25519KeyAgainstES256Alg right above it. Skip the parse-time test with a comment pointing at the verify-time coverage. Signed-off-by: Micke Nordin <kano@sunet.se>	3 months ago
Micke Nordin	1bad4fe238	fix: Make sodium optional This commit switches the default signature algorithm to ecdsa-p256-sha256 instead of Ed25519. This allows us to make sodium optional again, and we only pull it in to use it for verifying incomming signatures. If sodium is not installed, we throw on Ed25519 signatures instead. At least it is easy for most people to make their Nextcloud install fully RFC compliant by installing sodium. I also renamed all the Ed25519 function names to be more precis, using Jwks for the JSON Web Keys, and RFC9421 for the http-signature code, where it is needed to distinguish from draft-cavage signatures. Signed-off-by: Micke Nordin <kano@sunet.se>	3 months ago
Micke Nordin	0eb927e617	feat(http-sig): RFC 9421 protocol primitives Add the RFC 9421 (HTTP Message Signatures) sign/verify path alongside the existing draft-cavage implementation: - Algorithm: sodium for Ed25519, JWT::sign for RSA / ECDSA, ecdsaRawToDer for the ECDSA wire format. JWK parsing via JWK::parseKey. - SignatureBase: RFC 9421 §2.5 base construction for the derived components OCM uses plus plain HTTP fields. - ContentDigest: RFC 9530 helpers used as a covered component. - Rfc9421IncomingSignedRequest / Rfc9421OutgoingSignedRequest: request models. Parsing of Signature-Input / Signature delegates to gapple\\StructuredFields\\Parser. - IJwkResolvingSignatoryManager: capability bit signatory managers advertise to participate in RFC 9421 verification. - OcmProfile: OCM-mandated dictionary label. - SignatureManager: dispatch to RFC 9421 inbound when Signature-Input is present, outbound when rfc9421.format is set. Plus tests for each primitive and a full round-trip across the model. Signed-off-by: Micke Nordin <kano@sunet.se>	3 months ago
Anna Larch	29f43d8e7a	fix(security): don't propagate ValueError from Crypto::decrypt() fallback When decrypting a v3 ciphertext with a mismatched secret, the first attempt throws an Exception (HMAC mismatch). The fallback then calls decryptWithoutSecret() with an empty string, which causes hash_hkdf() to throw a ValueError. Since ValueError extends \Error rather than \Exception, it bypassed the catch block and propagated as an unhandled error, crashing the whole request. Wrap the fallback in its own try/catch(\Throwable) and rethrow the original Exception so callers get a meaningful HMAC mismatch error. Signed-off-by: Anna Larch <anna@nextcloud.com> AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>	3 months ago
Ferdinand Thiessen	e5b1799079	chore: add missing `Override` attribute to test files Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	4 months ago
Côme Chilliet	78fd649e47	chore: Remove long deprecated methods from OCP These have been deprecated from before 20 Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 months ago
Carl Schwan	5d0d0c17e5	chore(rector): Run rector on apps, core and tests directory Signed-off-by: Carl Schwan <carl.schwan@nextcloud.com>	7 months ago
provokateurin	0c3a872908	feat(CertificateManager): Add option to specify the default certificates bundle path Signed-off-by: provokateurin <kate@provokateurin.de>	9 months ago
Marcel Müller	234f183f8e	feat: Add option to update the public key of a user Signed-off-by: Marcel Müller <marcel-mueller@gmx.de>	9 months ago
Ferdinand Thiessen	d6d6747a73	refactor: apply rector rules for PHPUnit 10 Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	10 months ago
Christoph Wurst	3e90ce89eb	test(net): include test for localhost by IP Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	10 months ago
Joas Schilling	51f596e0c2	test: Fix double space Signed-off-by: Joas Schilling <coding@schilljs.com>	1 year ago
Joas Schilling	894fda1a4d	ci: Update testing certificates that expired after 10 years Signed-off-by: Joas Schilling <coding@schilljs.com>	1 year ago
Marcel Müller	520d8beaf5	feat: Cache user keys Signed-off-by: Marcel Müller <marcel-mueller@gmx.de>	1 year ago
Maxence Lange	484491e7cc	fix(bruteforce): limit appconfig lazy loading Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Robin Appelman	aa15f9d16d	chore: run rector Signed-off-by: Robin Appelman <robin@icewind.nl>	1 year ago
Ferdinand Thiessen	5981b7eb51	chore: apply new CSFixer rules Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> # Conflicts: # apps/settings/lib/SetupChecks/PhpOpcacheSetup.php	1 year ago
Robin Appelman	29e39c0a2e	chore: run rector on tests Signed-off-by: Robin Appelman <robin@icewind.nl>	1 year ago
Joas Schilling	f474b5b3a9	test: Fix tests/lib/Security/ Signed-off-by: Joas Schilling <coding@schilljs.com>	1 year ago
Daniel Kesselberg	a53e15c971	fix: log requests exceeding the rate limiting Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	1 year ago
Joas Schilling	b77011a918	test: Prepare more tests for PHPUnit 10 Signed-off-by: Joas Schilling <coding@schilljs.com>	1 year ago
Benjamin Gaussorgues	9f666c2b73	feat(ip): add configurable IPv6 subnet for BFP and throttling Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
Benjamin Gaussorgues	c4021c8d38	feat(ip): use larger IPv6 range by default Some providers assign `/48` IPv6 blocks instead of `/64` so it sounds safer to use this mask by default. Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
Joas Schilling	c1655bcde7	fix(ratelimit): Allow to bypass rate-limit from bruteforce allowlist Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Christoph Wurst	1323e5bcb1	fix(migration): Decrypt ownCloud secrets v2 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	2 years ago
Josh	97421fb143	fix(tests): Add RemoteAddress v6 zone ID test Signed-off-by: Josh <josh.t.richards@gmail.com>	2 years ago
Richard Steinmetz	19ad13571c	fix: gracefully parse non-standard trusted certificates Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>	2 years ago
Côme Chilliet	af0b8fbd17	fix(tests): Fix tests now that trashbin listens to events properly Hooks are cleared in test bootstrap so switching to events activates them in tests. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
provokateurin	9836e9b164	chore(deps): Update nextcloud/coding-standard to v1.3.1 Signed-off-by: provokateurin <kate@provokateurin.de>	2 years ago
Christoph Wurst	49dd79eabb	refactor: Add void return type to PHPUnit test methods Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	2 years ago
Daniel Kesselberg	af6de04e9e	style: update codestyle for coding-standard 1.2.3 Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	2 years ago
Ferdinand Thiessen	127cacdd19	feat(Security): Allow setting password context for validation and generation Co-authored-by: Ferdinand Thiessen <opensource@fthiessen.de> Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Ferdinand Thiessen	009761be58	test: Adjust tests for CSP nonce Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Ferdinand Thiessen	9716b0d735	refactor: Migrate some legacy and core functions to `IFilenameValidator` Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Joas Schilling	047479ccf9	feat(security): Add public API to allow validating IP Ranges and checking for "in range" Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Benjamin Gaussorgues	202e5b1e95	feat(security): restrict admin actions to IP ranges Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Christopher Ng	48b69c53dc	test: Test hash validation Signed-off-by: Christopher Ng <chrng8@gmail.com>	2 years ago
Andy Scherzinger	1f7e2ba599	chore: Add SPDX header Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	2 years ago
Joas Schilling	33e1c8b236	fix(security): Handle idn_to_utf8 returning false Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	aa5f037af7	chore: apply changes from Nextcloud coding standards 1.1.1 Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	3 years ago
Ferdinand Thiessen	ecf9f0a872	fix(CSP): Only add `strict-dynamic` when using nonces Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	3 years ago
Ferdinand Thiessen	e231abd9bf	fix!(ContentSecurityPolicy): Make `strict-dynamic` enabled by default on `script-src-elem` Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	3 years ago
Joas Schilling	124588d4a6	fix: Make bypass function public API Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	fd9b2d488e	feat: Expose if the own IP is allowed to bypass bruteforce protection Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago

1 2 3 4

159 Commits (55e1270b94aa0f4ea003e2cbc87a8ea56bcae96d)