Enforce signed media URL lifetime limits

app/services/media_url_signer.py

@@ -24,7 +24,11 @@ class MediaURLSigner:
         key = self._key()
         if key is None:
             return None
-        expires = int(time.time()) + (ttl or self.settings.media_signed_url_ttl_seconds)
+        requested_ttl = self.settings.media_signed_url_ttl_seconds if ttl is None else ttl
+        # A caller may request a shorter link, but cannot mint a link longer
+        # than the configured maximum lifetime.
+        lifetime = max(1, min(int(requested_ttl), self.settings.media_signed_url_ttl_seconds))
+        expires = int(time.time()) + lifetime
         message = f"{request_id}\n{filename}\n{expires}".encode("utf-8")
         digest = hmac.new(key, message, hashlib.sha256).digest()
         token = base64.urlsafe_b64encode(digest).decode("ascii").rstrip("=")
@@ -33,8 +37,15 @@ class MediaURLSigner:
 
     def verify(self, request_id: str, filename: str, expires: int, signature: str) -> bool:
         key = self._key()
-        if key is None or expires < int(time.time()):
+        now = int(time.time())
+        if (
+            key is None
+            or expires <= now
+            or expires > now + self.settings.media_signed_url_ttl_seconds
+        ):
             return False
         message = f"{request_id}\n{filename}\n{expires}".encode("utf-8")
-        expected = base64.urlsafe_b64encode(hmac.new(key, message, hashlib.sha256).digest()).decode("ascii").rstrip("=")
+        expected = base64.urlsafe_b64encode(
+            hmac.new(key, message, hashlib.sha256).digest()
+        ).decode("ascii").rstrip("=")
         return hmac.compare_digest(expected, signature)