File Coverage

blib/lib/OpenSocialX/Shindig/Crypter.pm

Criterion	Covered	Total	%
statement	63	65	96.9
branch	9	18	50.0
condition	3	9	33.3
subroutine	11	11	100.0
pod	6	6	100.0
total	92	109	84.4

package OpenSocialX::Shindig::Crypter;
our $VERSION = '0.03';

# ABSTRACT: OpenSocial Shindig Crypter

use URI::Escape qw/uri_escape uri_unescape/;
use MIME::Base64 qw/decode_base64 encode_base64/;
use Crypt::CBC;
use Digest::SHA;

# Key used for time stamp (in seconds) of data
my $TIMESTAMP_KEY = 't';

# allow three minutes for clock skew
my $CLOCK_SKEW_ALLOWANCE = 180;

sub new {
    my $class = shift;

    my $cfg = defined $_[0] && ref( $_[0] ) eq 'HASH' ? shift : {@_};

    # validate
    $cfg->{cipher} or die 'cipher key is required';
    $cfg->{hmac}   or die 'hmac key is required';
    $cfg->{iv}     or die 'iv key is required';

    ( length( $cfg->{cipher} ) == 16 ) or die 'cipher key must be 16 chars';
    ( length( $cfg->{iv} ) == 16 )     or die 'iv key must be 16 chars';

    return bless $cfg, $class;
}

sub wrap {
    my ( $self, $in ) = @_;

    my $encoded = _serializeAndTimestamp($in);
    my $cipher  = Crypt::CBC->new(
        {
            'key'         => $self->{cipher},
            'cipher'      => 'Rijndael',
            'iv'          => $self->{iv},
            'literal_key' => 1,
            'padding'     => 'null',
            'header'      => 'none',
            keysize       => 128 / 8,
        }
    );
    my $cipherText = $cipher->encrypt($encoded);
    my $hmac       = Digest::SHA::hmac_sha1( $cipherText, $self->{hmac} );
    my $b64        = encode_base64( $cipherText . $hmac );
    return $b64;
}

sub _serializeAndTimestamp {
    my ($in) = @_;

    my $encoded;
    foreach my $key ( keys %$in ) {
        $encoded .= uri_escape($key) . "=" . uri_escape( $in->{$key} ) . "&";
    }
    $encoded .= $TIMESTAMP_KEY . "=" . time();
    return $encoded;
}

sub unwrap {
    my ( $self, $in, $max_age ) = @_;

    my $bin        = decode_base64($in);
    my $cipherText = substr( $bin, 0, -20 );
    my $hmac       = substr( $bin, length($cipherText) );

    # verify
    my $v_hmac = Digest::SHA::hmac_sha1( $cipherText, $self->{hmac} );
    if ( $v_hmac ne $hmac ) {
        die 'HMAC verification failure';
    }
    my $cipher = Crypt::CBC->new(
        {
            'key'         => $self->{cipher},
            'cipher'      => 'Rijndael',
            'iv'          => $self->{iv},
            'literal_key' => 1,
            'padding'     => 'null',
            'header'      => 'none',
            keysize       => 128 / 8,
        }
    );
    my $plain = $cipher->decrypt($cipherText);
    my $out   = $self->deserialize($plain);

    $self->checkTimestamp( $out, $max_age );

    return $out;
}

sub deserialize {
    my ( $self, $plain ) = @_;

    my $h;
    my @items = split( /[\&\=]/, $plain );
    my $i;
    for ( $i = 0 ; $i < scalar(@items) ; ) {
        my $key   = uri_unescape( $items[ $i++ ] );
        my $value = uri_unescape( $items[ $i++ ] );
        $h->{$key} = $value;
    }
    return $h;
}

sub checkTimestamp {
    my ( $self, $out, $max_age ) = @_;

    my $minTime = $out->{$TIMESTAMP_KEY} - $CLOCK_SKEW_ALLOWANCE;
    my $maxTime = $out->{$TIMESTAMP_KEY} + $max_age + $CLOCK_SKEW_ALLOWANCE;
    my $now     = time();
    if ( !( $minTime < $now && $now < $maxTime ) ) {
        die "Security token expired";
    }
}

my $OWNER_KEY  = "o";
my $APP_KEY    = "a";
my $VIEWER_KEY = "v";
my $DOMAIN_KEY = "d";
my $APPURL_KEY = "u";
my $MODULE_KEY = "m";

sub create_token {
    my $self = shift;

    my $data = defined $_[0] && ref( $_[0] ) eq 'HASH' ? shift : {@_};
    my $token_data = {
        $OWNER_KEY  => $data->{owner},
        $APP_KEY    => $data->{app},
        $VIEWER_KEY => $data->{viewer},
        $DOMAIN_KEY => $data->{domain},
        $APPURL_KEY => $data->{app_url},
        $MODULE_KEY => $data->{module_id},
    };
    my $token = $self->wrap($token_data);
    return uri_escape($token);
}

1;
__END__