Signature: Use lowercase key in Content-Digest (#1901)

Author: obenland

includes/signature/class-http-message-signature.php

@@ -22,6 +22,16 @@
  */
 class Http_Message_Signature implements Signature_Standard {
 
+	/**
+	 * Digest algorithms.
+	 *
+	 * @var string[]
+	 */
+	private $digest_algorithms = array(
+		'sha-256' => 'sha256',
+		'sha-512' => 'sha512',
+	);
+
 	/**
 	 * Generate RFC-9421 compliant Signature-Input and Signature headers for an outgoing HTTP request.
 	 *
@@ -105,7 +115,7 @@ public function verify( array $headers, $body = null ) {
 	 * @return string The digest.
 	 */
 	public function generate_digest( $body ) {
-		return 'SHA-256=:' . \base64_encode( \hash( 'sha256', $body, true ) ) . ':';
+		return 'sha-256=:' . \base64_encode( \hash( 'sha256', $body, true ) ) . ':';
 	}
 
 	/**
@@ -216,16 +226,11 @@ private function verify_content_digest( $headers, $body ) {
 			if ( \preg_match( '/^([a-z0-9-]+)=:(.+):$/i', $digest, $matches ) ) {
 				list( , $alg, $encoded ) = $matches;
 
-				$map = array(
-					'SHA-256' => 'sha256',
-					'SHA-512' => 'sha512',
-				);
-
-				if ( ! isset( $map[ $alg ] ) ) {
-					return new \WP_Error( 'unsupported_digest', 'WordPress supports SHA-256 and SHA-512 in Digest header. Offered algorithm: ' . $alg );
+				if ( ! isset( $this->digest_algorithms[ $alg ] ) ) {
+					return new \WP_Error( 'unsupported_digest', 'WordPress supports sha-256 and sha-512 in Digest header. Offered algorithm: ' . $alg );
 				}
 
-				if ( \hash_equals( $encoded, \base64_encode( \hash( $map[ $alg ], $body, true ) ) ) ) {
+				if ( \hash_equals( $encoded, \base64_encode( \hash( $this->digest_algorithms[ $alg ], $body, true ) ) ) ) {
 					return true;
 				}
 			}

tests/includes/class-test-signature.php

@@ -571,7 +571,7 @@ function () use ( $keys ) {
 		$body = '{"type":"Create","actor":"https://example.org/author/admin","object":{"type":"Note","content":"Test content."}}';
 
 		// Generate a digest for the body.
-		$digest = 'SHA-256=:' . \base64_encode( \hash( 'sha256', $body, true ) ) . ':';
+		$digest = 'sha-256=:' . \base64_encode( \hash( 'sha256', $body, true ) ) . ':';
 
 		// Create a date for the request.
 		$date = \gmdate( 'D, d M Y H:i:s T' );