[HttpFoundation] Add #[IsSignatureValid] attribute

santysisi · santysisi · commit 35cbbc0ee39f · 2025-07-18T19:41:32.000-03:00
diff --git a/src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md b/src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md
@@ -8,6 +8,7 @@ CHANGELOG
  * Allow using their name without added suffix when using `#[Target]` for custom services
  * Deprecate `Symfony\Bundle\FrameworkBundle\Console\Application::add()` in favor of `Symfony\Bundle\FrameworkBundle\Console\Application::addCommand()`
  * Add `assertEmailAddressNotContains()` to the `MailerAssertionsTrait`
+ * Add autoconfiguration tag `security.uri_signer` to `Symfony\Component\HttpFoundation\UriSigner`
 
 7.3
 ---
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Compiler/UnusedTagsPass.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Compiler/UnusedTagsPass.php
@@ -89,6 +89,7 @@ class UnusedTagsPass implements CompilerPassInterface
         'security.authenticator.login_linker',
         'security.expression_language_provider',
         'security.remember_me_handler',
+        'security.uri_signer',
         'security.voter',
         'serializer.encoder',
         'serializer.normalizer',
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -98,6 +98,7 @@
 use Symfony\Component\HttpClient\ThrottlingHttpClient;
 use Symfony\Component\HttpClient\UriTemplateHttpClient;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\UriSigner;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\HttpKernel\Attribute\AsTargetedValueResolver;
 use Symfony\Component\HttpKernel\CacheClearer\CacheClearerInterface;
@@ -749,6 +750,8 @@ public function load(array $configs, ContainerBuilder $container): void
             ->addTag('mime.mime_type_guesser');
         $container->registerForAutoconfiguration(LoggerAwareInterface::class)
             ->addMethodCall('setLogger', [new Reference('logger')]);
+        $container->registerForAutoconfiguration(UriSigner::class)
+            ->addTag('security.uri_signer');
 
         $container->registerAttributeForAutoconfiguration(AsEventListener::class, static function (ChildDefinition $definition, AsEventListener $attribute, \ReflectionClass|\ReflectionMethod $reflector) {
             $tagAttributes = get_object_vars($attribute);
diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php
@@ -64,6 +64,7 @@
 use Symfony\Component\Security\Http\Authenticator\Debug\TraceableAuthenticator;
 use Symfony\Component\Security\Http\Authenticator\Debug\TraceableAuthenticatorManagerListener;
 use Symfony\Component\Security\Http\Event\CheckPassportEvent;
+use Symfony\Component\Security\Http\EventListener\IsSignatureValidAttributeListener;
 
 /**
  * SecurityExtension.
@@ -134,6 +135,9 @@ public function load(array $configs, ContainerBuilder $container): void
             $container->removeDefinition('form.type_extension.form.password_hasher');
             $container->removeDefinition('form.type_extension.password.password_hasher');
         }
+        if (!class_exists(IsSignatureValidAttributeListener::class)) {
+            $container->removeDefinition('controller.is_signature_valid_attribute_listener');
+        }
 
         // set some global scalars
         $container->setParameter('security.access.denied_url', $config['access_denied_url']);
diff --git a/src/Symfony/Bundle/SecurityBundle/Resources/config/security.php b/src/Symfony/Bundle/SecurityBundle/Resources/config/security.php
@@ -48,6 +48,7 @@
 use Symfony\Component\Security\Http\Controller\SecurityTokenValueResolver;
 use Symfony\Component\Security\Http\Controller\UserValueResolver;
 use Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener;
+use Symfony\Component\Security\Http\EventListener\IsSignatureValidAttributeListener;
 use Symfony\Component\Security\Http\Firewall;
 use Symfony\Component\Security\Http\FirewallMapInterface;
 use Symfony\Component\Security\Http\HttpUtils;
@@ -323,5 +324,12 @@
         ->set('cache.security_is_csrf_token_valid_attribute_expression_language')
             ->parent('cache.system')
             ->tag('cache.pool')
+
+        ->set('controller.is_signature_valid_attribute_listener', IsSignatureValidAttributeListener::class)
+            ->args([
+                service('uri_signer'),
+                tagged_locator('security.uri_signer'),
+            ])
+            ->tag('kernel.event_subscriber')
     ;
 };
diff --git a/src/Symfony/Component/HttpFoundation/CHANGELOG.md b/src/Symfony/Component/HttpFoundation/CHANGELOG.md
@@ -5,6 +5,7 @@ CHANGELOG
 ---
 
  * Deprecate using `Request::sendHeaders()` after headers have already been sent; use a `StreamedResponse` instead
+ * Add `#[WithHttpStatus]` to define status codes: 404 for `SignedUriException` and 403 for `ExpiredSignedUriException`
 
 7.3
 ---
diff --git a/src/Symfony/Component/HttpFoundation/Exception/ExpiredSignedUriException.php b/src/Symfony/Component/HttpFoundation/Exception/ExpiredSignedUriException.php
@@ -11,9 +11,13 @@
 
 namespace Symfony\Component\HttpFoundation\Exception;
 
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Attribute\WithHttpStatus;
+
 /**
  * @author Kevin Bond <kevinbond@gmail.com>
  */
+#[WithHttpStatus(Response::HTTP_FORBIDDEN)]
 final class ExpiredSignedUriException extends SignedUriException
 {
     /**
diff --git a/src/Symfony/Component/HttpFoundation/Exception/SignedUriException.php b/src/Symfony/Component/HttpFoundation/Exception/SignedUriException.php
@@ -11,9 +11,13 @@
 
 namespace Symfony\Component\HttpFoundation\Exception;
 
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Attribute\WithHttpStatus;
+
 /**
  * @author Kevin Bond <kevinbond@gmail.com>
  */
+#[WithHttpStatus(Response::HTTP_NOT_FOUND)]
 abstract class SignedUriException extends \RuntimeException implements ExceptionInterface
 {
 }
diff --git a/src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php b/src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php
@@ -0,0 +1,52 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Http\Attribute;
+
+use Symfony\Component\HttpFoundation\UriSigner;
+
+/**
+ * Validates the request signature for specific HTTP methods.
+ *
+ * This class determines whether a request's signature should be validated
+ * based on the configured HTTP methods. If the request method matches one
+ * of the specified methods (or if no methods are specified), the signature
+ * is checked.
+ *
+ * If the signature is invalid, a {@see \Symfony\Component\HttpFoundation\Exception\SignedUriException}
+ * is thrown during validation.
+ *
+ * @author Santiago San Martin <sanmartindev@gmail.com>
+ */
+#[\Attribute(\Attribute::IS_REPEATABLE | \Attribute::TARGET_CLASS | \Attribute::TARGET_METHOD | \Attribute::TARGET_FUNCTION)]
+final class IsSignatureValid
+{
+    public readonly array $methods;
+    public readonly ?string $signer;
+
+    /**
+     * @param string[]|string $methods HTTP methods that require signature validation. An empty array means that no method filtering is done
+     * @param string          $signer  The ID of the UriSigner service to use for signature validation. Defaults to 'uri_signer'
+     *
+     * @throws \LogicException If the UriSigner class does not support the 'verify' method (requires symfony/http-foundation >= 7.3)
+     */
+    public function __construct(
+        array|string $methods = [],
+        ?string $signer = null,
+    ) {
+        if (!method_exists(UriSigner::class, 'verify')) {
+            throw new \LogicException('The `IsSignatureValid` attribute requires symfony/http-foundation >= 7.3.');
+        }
+
+        $this->methods = (array) $methods;
+        $this->signer = $signer;
+    }
+}
diff --git a/src/Symfony/Component/Security/Http/CHANGELOG.md b/src/Symfony/Component/Security/Http/CHANGELOG.md
@@ -6,6 +6,7 @@ CHANGELOG
 
  * Deprecate callable firewall listeners, extend `AbstractListener` or implement `FirewallListenerInterface` instead
  * Deprecate `AbstractListener::__invoke`
+ * Add `#[IsSignatureValid]` attribute to validate URI signatures
 
 7.3
 ---
diff --git a/src/Symfony/Component/Security/Http/EventListener/IsSignatureValidAttributeListener.php b/src/Symfony/Component/Security/Http/EventListener/IsSignatureValidAttributeListener.php
@@ -0,0 +1,65 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Http\EventListener;
+
+use Psr\Container\ContainerInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\UriSigner;
+use Symfony\Component\HttpKernel\Event\ControllerArgumentsEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Security\Http\Attribute\IsSignatureValid;
+
+/**
+ * Handles the IsSignatureValid attribute.
+ *
+ * @author Santiago San Martin <sanmartindev@gmail.com>
+ */
+class IsSignatureValidAttributeListener implements EventSubscriberInterface
+{
+    public function __construct(
+        private readonly UriSigner $uriSigner,
+        private readonly ContainerInterface $container,
+    ) {
+    }
+
+    public function onKernelControllerArguments(ControllerArgumentsEvent $event): void
+    {
+        if (!$attributes = $event->getAttributes(IsSignatureValid::class)) {
+            return;
+        }
+
+        $request = $event->getRequest();
+        foreach ($attributes as $attribute) {
+            $methods = array_map('strtoupper', $attribute->methods);
+            if ($methods && !\in_array($request->getMethod(), $methods, true)) {
+                continue;
+            }
+
+            if (null === $attribute->signer) {
+                $this->uriSigner->verify($request);
+                continue;
+            }
+
+            $signer = $this->container->get($attribute->signer);
+            if (!$signer instanceof UriSigner) {
+                throw new \LogicException(\sprintf('The service "%s" is not an instance of "%s".', $attribute->signer, UriSigner::class));
+            }
+
+            $signer->verify($request);
+        }
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [KernelEvents::CONTROLLER_ARGUMENTS => ['onKernelControllerArguments', 30]];
+    }
+}
diff --git a/src/Symfony/Component/Security/Http/Tests/EventListener/IsSignatureValidAttributeListenerTest.php b/src/Symfony/Component/Security/Http/Tests/EventListener/IsSignatureValidAttributeListenerTest.php
diff --git a/src/Symfony/Component/Security/Http/Tests/Fixtures/ExtendedSigner.php b/src/Symfony/Component/Security/Http/Tests/Fixtures/ExtendedSigner.php
diff --git a/src/Symfony/Component/Security/Http/Tests/Fixtures/IsSignatureValidAttributeController.php b/src/Symfony/Component/Security/Http/Tests/Fixtures/IsSignatureValidAttributeController.php
diff --git a/src/Symfony/Component/Security/Http/Tests/Fixtures/IsSignatureValidAttributeMethodsController.php b/src/Symfony/Component/Security/Http/Tests/Fixtures/IsSignatureValidAttributeMethodsController.php

Original file line number	Diff line number	Diff line change
`@@ -11,9 +11,13 @@`
`11`	`11`
`12`	`12`	`namespace Symfony\Component\HttpFoundation\Exception;`
`13`	`13`
	`14`	`+use Symfony\Component\HttpFoundation\Response;`
	`15`	`+use Symfony\Component\HttpKernel\Attribute\WithHttpStatus;`
	`16`	`+`
`14`	`17`	`/**`
`15`	`18`	`* @author Kevin Bond <kevinbond@gmail.com>`
`16`	`19`	`*/`
	`20`	`+#[WithHttpStatus(Response::HTTP_NOT_FOUND)]`
`17`	`21`	`abstract class SignedUriException extends \RuntimeException implements ExceptionInterface`
`18`	`22`	`{`
`19`	`23`	`}`