FR: implement URL tampering encoding (v3/Thumbor)

In 3.x, I generated safe URLs by setting a SECURITY_KEY env var, which is used by Thumbor to create the encoded url: https://github.com/thumbor/thumbor/wiki/security

I could then use this same SECURITY_KEY to generate a valid url with another backend-system (eg PHP.

How can I do something similar with 4.x/Sharp?

Related: https://github.com/awslabs/serverless-image-handler/issues/106

[hayesry]

@timkelty Thanks for adding this request, I’m copying it into our feature backlog to be looked into and addressed in a future release. Your feedback has been super helpful in the improvement of this solution!

[soupy1976]

Due to the fact that AWS have updated the lambda execution environment, which caused our old thumbor implementation to break, we had to implement this ourselves. If anyone is interested, this is the code we have so far (this is not tested in production yet, so no guarantees…but maybe helpful to someone)

     /**
     * verifies that the security hash sent in the path is valid
     * @param {Object} event - The request body.
     * @param {String} security_key - The security key from environment variable.*     
     */
    verifySecurityHash(event, security_key) {
        var crypto = require('crypto');

        var path = event.path;
        const pathParts = path.split('/');
        var securityHash = pathParts[securityHashPathIndex];
        path = path.replace('/' + securityHash + '/', '');
        var hash = crypto.createHmac('sha1', security_key).update(path).digest('base64').replace(/\+/g, "-").replace(/\//g, "_");

        if (securityHash !== hash) {
            throw new Error('ThumborMapping::VerifySecurityHash::InvalidSecurityHash');
        }
        return true;
    }

securityHashPathIndex (for us at least) is 1. We get security_key from the environment variables (ie. process.env.SECURITY_KEY) and set that in the AWS lambda environment vars.

Here are a couple of unit tests we wrote for it, with the keys and paths removed:

// ----------------------------------------------------------------------------
// verifySecurityHash()
// ----------------------------------------------------------------------------
describe('verifySecurityHash()', function () {
    describe('001/validHash', function () {
        it(`Should pass if the security hash is being validated correctly`, function () {

                // Arrange
                var security_key = '{[[insert your security key here]]';
                var securityHash = '[[insert your 'correct' hash of the security key here]]';

                const event = {
                    path: '/' + securityHash +'[[insert your path which results in the above hash here]]'
                }
                // Act
                const thumborMapping = new ThumborMapping();
                var result = thumborMapping.verifySecurityHash(event, security_key);
                // Assert
                const expectedResult = true;
                assert.deepEqual(result, expectedResult);
            });
    });
    describe('002/InvalidHash', function () {
        it(`Should pass if it is throwing error for invalid security hash`, function () {

            // Arrange
			var security_key = '{[[insert your security key here]]';
			var securityHash = '[[insert your 'incorrect' hash of the security key here]]';

			const event = {
				path: '/' + securityHash +'[[insert your path which does not result in the above hash here]]'
			}
			
            // Act
            const thumborMapping = new ThumborMapping();
            // Assert
            assert.throws(function () {
                thumborMapping.verifySecurityHash(event, security_key);
            }, Error, 'ThumborMapping::VerifySecurityHash::InvalidSecurityHash');
        });
    });
});