ACP2E-2969: REST API unable to make requests with slash (/) in SKU when using Oauth1

Author: aplapana

lib/internal/Magento/Framework/Oauth/Helper/Utility.php

@@ -1,27 +1,15 @@
 <?php
-/************************************************************************
- *
+/**
  * Copyright 2024 Adobe
  * All Rights Reserved.
- *
- * NOTICE: All information contained herein is, and remains
- * the property of Adobe and its suppliers, if any. The intellectual
- * and technical concepts contained herein are proprietary to Adobe
- * and its suppliers and are protected by all applicable intellectual
- * property laws, including trade secret and copyright laws.
- * Dissemination of this information or reproduction of this material
- * is strictly forbidden unless prior written permission is obtained
- * from Adobe.
- * ************************************************************************
  */
 declare(strict_types=1);
 
 namespace Magento\Framework\Oauth\Helper;
 
 use Laminas\Crypt\Hmac as HMACEncryption;
-use Laminas\OAuth\Http\Utility as HTTPUtility;
 
-class Utility extends HTTPUtility
+class Utility
 {
     /**
      * Generate signature string
@@ -35,18 +23,19 @@ class Utility extends HTTPUtility
      * @return string
      */
     public function sign(
-        array $params,
-        $signatureMethod,
-        $consumerSecret,
-        $tokenSecret = null,
-        $method = null,
-        $url = null
+        array  $params,
+        string $signatureMethod,
+        string $consumerSecret,
+        ?string $tokenSecret = null,
+        ?string $method = null,
+        ?string $url = null
     ): string {
         unset($params['oauth_signature']);
 
+        $parts     = explode('-', $signatureMethod);
         $binaryHash = HMACEncryption::compute(
             $this->assembleKey($consumerSecret, $tokenSecret),
-            $signatureMethod,
+            count($parts) > 1 ? $parts[1] : $signatureMethod,
             $this->getBaseSignatureString($params, $method, $url),
             HMACEncryption::OUTPUT_BINARY
         );
@@ -68,7 +57,7 @@ private function assembleKey(string $consumerSecret, ?string $tokenSecret): stri
             $parts[] = $tokenSecret;
         }
         foreach ($parts as $key => $secret) {
-            $parts[$key] = self::urlEncode($secret);
+            $parts[$key] = $this->urlEncode($secret);
         }
 
         return implode('&', $parts);
@@ -86,20 +75,20 @@ private function getBaseSignatureString(array $params, $method = null, $url = nu
     {
         $encodedParams = [];
         foreach ($params as $key => $value) {
-            $encodedParams[self::urlEncode($key)] =
-                self::urlEncode($value);
+            $encodedParams[$this->urlEncode($key)] =
+                $this->urlEncode($value);
         }
         $baseStrings = [];
         if (isset($method)) {
             $baseStrings[] = strtoupper($method);
         }
         if (isset($url)) {
-            $baseStrings[] = self::urlEncode($url);
+            $baseStrings[] = $this->urlEncode($url);
         }
         if (isset($encodedParams['oauth_signature'])) {
             unset($encodedParams['oauth_signature']);
         }
-        $baseStrings[] = self::urlEncode(
+        $baseStrings[] = $this->urlEncode(
             $this->toByteValueOrderedQueryString($encodedParams)
         );
 
@@ -128,4 +117,16 @@ private function toByteValueOrderedQueryString(array $params): string
         }
         return implode('&', $return);
     }
+
+    /**
+     * URL encode a value
+     *
+     * @param string $value
+     * @return string
+     */
+    private function urlEncode(string $value): string
+    {
+        $encoded = rawurlencode($value);
+        return str_replace('%7E', '~', $encoded);
+    }
 }

lib/internal/Magento/Framework/Oauth/Oauth.php

@@ -156,7 +156,7 @@ public function buildAuthorizationHeader(
         $headerParameters = array_merge($headerParameters, $params);
         $headerParameters['oauth_signature'] = $this->hmacSignatureHelper->sign(
             $params,
-            'SHA256',
+            $signatureMethod,
             $headerParameters['oauth_consumer_secret'],
             $headerParameters['oauth_token_secret'],
             $httpMethod,
@@ -192,7 +192,7 @@ protected function _validateSignature($params, $consumerSecret, $httpMethod, $re
 
         $calculatedSign = $this->hmacSignatureHelper->sign(
             $params,
-            'SHA256',
+            $params['oauth_signature_method'],
             $consumerSecret,
             $tokenSecret,
             $httpMethod,