WebhookSignature.php — Booking for Appointments and Events Calendar – Amelia 2.4.4

ameliabooking / vendor / stripe / stripe-php / lib / WebhookSignature.php

ameliabooking / vendor / stripe / stripe-php / lib Last commit date

WebhookSignature.php

111 lines

1	<?php
2
3	namespace AmeliaVendor\Stripe;
4
5	abstract class WebhookSignature
6	{
7	const EXPECTED_SCHEME = 'v1';
8	/**
9	* Verifies the signature header sent by Stripe. Throws an
10	* Exception\SignatureVerificationException exception if the verification fails for
11	* any reason.
12	*
13	* @param string $payload the payload sent by Stripe
14	* @param string $header the contents of the signature header sent by
15	* Stripe
16	* @param string $secret secret used to generate the signature
17	* @param int $tolerance maximum difference allowed between the header's
18	* timestamp and the current time
19	*
20	* @return bool
21	*
22	* @throws Exception\SignatureVerificationException if the verification fails
23	*/
24	public static function verifyHeader($payload, $header, $secret, $tolerance = null)
25	{
26	// Extract timestamp and signatures from header
27	$timestamp = self::getTimestamp($header);
28	$signatures = self::getSignatures($header, self::EXPECTED_SCHEME);
29	if (-1 === $timestamp) {
30	throw \Stripe\Exception\SignatureVerificationException::factory('Unable to extract timestamp and signatures from header', $payload, $header);
31	}
32	if (empty($signatures)) {
33	throw \Stripe\Exception\SignatureVerificationException::factory('No signatures found with expected scheme', $payload, $header);
34	}
35	// Check if expected signature is found in list of signatures from
36	// header
37	$signedPayload = "{$timestamp}.{$payload}";
38	$expectedSignature = self::computeSignature($signedPayload, $secret);
39	$signatureFound = false;
40	foreach ($signatures as $signature) {
41	if (\AmeliaVendor\Stripe\Util\Util::secureCompare($expectedSignature, $signature)) {
42	$signatureFound = true;
43	break;
44	}
45	}
46	if (!$signatureFound) {
47	throw \Stripe\Exception\SignatureVerificationException::factory('No signatures found matching the expected signature for payload', $payload, $header);
48	}
49	// Check if timestamp is within tolerance
50	if ($tolerance > 0 && \abs(\time() - $timestamp) > $tolerance) {
51	throw \Stripe\Exception\SignatureVerificationException::factory('Timestamp outside the tolerance zone', $payload, $header);
52	}
53	return true;
54	}
55	/**
56	* Extracts the timestamp in a signature header.
57	*
58	* @param string $header the signature header
59	*
60	* @return int the timestamp contained in the header, or -1 if no valid
61	* timestamp is found
62	*/
63	private static function getTimestamp($header)
64	{
65	$items = \explode(',', $header);
66	foreach ($items as $item) {
67	$itemParts = \explode('=', $item, 2);
68	if ('t' === $itemParts[0]) {
69	if (!\is_numeric($itemParts[1])) {
70	return -1;
71	}
72	return (int) $itemParts[1];
73	}
74	}
75	return -1;
76	}
77	/**
78	* Extracts the signatures matching a given scheme in a signature header.
79	*
80	* @param string $header the signature header
81	* @param string $scheme the signature scheme to look for
82	*
83	* @return array the list of signatures matching the provided scheme
84	*/
85	private static function getSignatures($header, $scheme)
86	{
87	$signatures = [];
88	$items = \explode(',', $header);
89	foreach ($items as $item) {
90	$itemParts = \explode('=', $item, 2);
91	if (\trim($itemParts[0]) === $scheme) {
92	$signatures[] = $itemParts[1];
93	}
94	}
95	return $signatures;
96	}
97	/**
98	* Computes the signature for a given payload and secret.
99	*
100	* The current scheme used by Stripe ("v1") is HMAC/SHA-256.
101	*
102	* @param string $payload the payload to sign
103	* @param string $secret the secret used to generate the signature
104	*
105	* @return string the signature as a string
106	*/
107	private static function computeSignature($payload, $secret)
108	{
109	return \hash_hmac('sha256', $payload, $secret);
110	}
111	}