active_hashcash 0.3.2 → 0.5.0

data/lib/active_hashcash/version.rb

@@ -1,3 +1,3 @@
 module ActiveHashcash
-  VERSION = "0.3.2"
+  VERSION = "0.5.0"
 end

data/lib/active_hashcash.rb

@@ -1,6 +1,22 @@
+# frozen_string_literal: true
+
 require "active_hashcash/version"
 require "active_hashcash/engine"
 
+# ActiveHashcash protects Rails applications against bots and brute force attacks without annoying humans.
+# See the rdoc-ref:README.md for more explanations about Hashcash.
+#
+# Include this module into your Rails controller.
+#
+#   class SessionController < ApplicationController
+#     include ActiveHashcash
+#
+#     before_action :check_hashcash, only: :create
+#   end
+#
+# Your are welcome to override most of the methods to customize to your needs.
+# For example, if your app runs behind a loab balancer you should probably override #hashcash_ip_address.
+#
 module ActiveHashcash
   extend ActiveSupport::Concern
 
@@ -16,7 +32,14 @@ module ActiveHashcash
 
   mattr_accessor :date_format, instance_accessor: false, default: "%y%m%d"
 
-  # Call me via a before_action when the form is submitted : `before_action :check_hashcash, only: :create`
+  mattr_accessor :base_controller_class, default: "ActionController::Base"
+
+  # Call that method via a before_action when the form is submitted:
+  #
+  #   before_action :check_hashcash, only: :create
+  #
+  # In case of invalid hashcash it calls hashcash_after_failure that you can override.
+  # Otherwise, hashcash stamp is stored in database to prevent from double spending.
   def check_hashcash
     attrs = {
       ip_address: hashcash_ip_address,
@@ -30,21 +53,26 @@ module ActiveHashcash
     end
   end
 
-  # Override the methods below in your controller, to change any parameter or behaviour.
-
+  # Returns remote IP address.
+  # They are used to automatically increase complexity when the same IP sends many valid hashcash.
+  # If you're app is behind a load balancer, you should probably override it to read the right HTTP header.
   def hashcash_ip_address
     request.remote_ip
   end
 
+  # Return current request path to be saved to the sucessful ActiveHash::Stamp.
+  # If multiple forms are protected via hashcash this is an interesting info.
   def hashcash_request_path
     request.path
   end
 
+  # Override this method to store custom data for each stamp.
+  # It must returns a hash or nil.
   def hashcash_stamp_context
-    # Override this method to store custom data for each stamp
   end
 
-  # By default the host name is used as the resource.
+  # This is the resource used to build the hashcash stamp.
+  # By default the host name is returned.
   # It' should be good for most cases and prevent from reusing the same stamp between sites.
   def hashcash_resource
     ActiveHashcash.resource || request.host
@@ -52,7 +80,7 @@ module ActiveHashcash
 
   # Returns the complexity, the higher the slower it is.
   # Complexity is increased logarithmicly for each IP during the last 24H to slowdown brute force attacks.
-  # The minimun value returned is `ActiveHashcash.bits`.
+  # The minimun value returned is ActiveHashcash.bits.
   def hashcash_bits
     if (previous_stamp_count = ActiveHashcash::Stamp.where(ip_address: hashcash_ip_address).where(created_at: 1.day.ago..).count) > 0
       (ActiveHashcash.bits + Math.log2(previous_stamp_count)).floor
@@ -71,7 +99,9 @@ module ActiveHashcash
     t("active_hashcash.waiting_label")
   end
 
-  # Override to provide a different behaviour when hashcash failed
+  # That method is called when #check_hashcash fails.
+  # It raises ActionController::InvalidAuthenticityToken so HTTP response will be 422 by default.
+  # Override this method to provide a different behaviour.
   def hashcash_after_failure
     raise ActionController::InvalidAuthenticityToken.new("Invalid hashcash #{hashcash_param}")
   end
@@ -83,8 +113,19 @@ module ActiveHashcash
 
   # Call it inside the form that have to be protected and don't forget to initialize the JavaScript Hascash.setup().
   # Unless you need something really special, you should not need to override this method.
+  #
+  #   <% form_for model do |form| %>
+  #     <%= hashcash_hidden_field_tag %>
+  #
+  #   <% end %>
+  #
   def hashcash_hidden_field_tag(name = :hashcash)
-    options = {resource: hashcash_resource, bits: hashcash_bits, waiting_message: hashcash_waiting_message}
+    options = {
+      resource: hashcash_resource,
+      bits: hashcash_bits,
+      waiting_message: hashcash_waiting_message,
+      date: Date.today.strftime("%y%m%d")
+    }
     view_context.hidden_field_tag(name, "", "data-hashcash" => options.to_json)
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: active_hashcash
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.5.0
 platform: ruby
 authors:
 - Alexis Bernard
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-08-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -62,6 +61,7 @@ files:
 - app/views/active_hashcash/stamps/index.html.erb
 - app/views/active_hashcash/stamps/show.html.erb
 - app/views/layouts/active_hashcash/application.html.erb
+- config/locales/ca.yml
 - config/locales/de.yml
 - config/locales/en.yml
 - config/locales/es.yml
@@ -74,7 +74,6 @@ files:
 - lib/active_hashcash.rb
 - lib/active_hashcash/engine.rb
 - lib/active_hashcash/version.rb
-- lib/hashcash.js
 - lib/tasks/active_hashcash_tasks.rake
 homepage: https://github.com/BaseSecrete/active_hashcash
 licenses:
@@ -83,7 +82,6 @@ metadata:
   homepage_uri: https://github.com/BaseSecrete/active_hashcash
   source_code_uri: https://github.com/BaseSecrete/active_hashcash
   changelog_uri: https://github.com/BaseSecrete/active_hashcash/CHANGELOG.md
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -98,8 +96,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.9
-signing_key: 
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Protect Rails applications against bots and brute force attacks without annoying
   humans.

data/lib/hashcash.js

@@ -1,257 +0,0 @@
-// http://www.hashcash.org/docs/hashcash.html
-// <input type="hiden" name="hashcash" data-hashcash="{resource: 'site.example', bits: 16}"/>
-Hashcash = function(input) {
-  options = JSON.parse(input.getAttribute("data-hashcash"))
-  Hashcash.disableParentForm(input, options)
-  input.dispatchEvent(new CustomEvent("hashcash:mint", {bubbles: true}))
-
-  Hashcash.mint(options.resource, options, function(stamp) {
-    input.value = stamp.toString()
-    Hashcash.enableParentForm(input, options)
-    input.dispatchEvent(new CustomEvent("hashcash:minted", {bubbles: true, detail: {stamp: stamp}}))
-  })
-}
-
-Hashcash.setup = function() {
-  if (document.readyState != "loading") {
-    var input = document.querySelector("input#hashcash")
-    input && new Hashcash(input)
-  } else
-    document.addEventListener("DOMContentLoaded", Hashcash.setup )
-}
-
-Hashcash.disableParentForm = function(input, options) {
-  input.form.querySelectorAll("[type=submit]").forEach(function(submit) {
-    submit.originalValue = submit.value
-    options["waiting_message"] && (submit.value = options["waiting_message"])
-    submit.disabled = true
-  })
-}
-
-Hashcash.enableParentForm = function(input, options) {
-  input.form.querySelectorAll("[type=submit]").forEach(function(submit) {
-    submit.originalValue && (submit.value = submit.originalValue)
-    submit.disabled = null
-  })
-}
-
-Hashcash.default = {
-  version: 1,
-  bits: 20,
-  extension: null,
-}
-
-Hashcash.mint = function(resource, options, callback) {
-  // Format date to YYMMDD
-  var date = new Date
-  var year = date.getFullYear().toString()
-  year = year.slice(year.length - 2, year.length)
-  var month = (date.getMonth() + 1).toString().padStart(2, "0")
-  var day = date.getDate().toString().padStart(2, "0")
-
-  var stamp = new Hashcash.Stamp(
-    options.version || Hashcash.default.version,
-    options.bits || Hashcash.default.bits,
-    options.date || year + month + day,
-    resource,
-    options.extension || Hashcash.default.extension,
-    options.rand || Math.random().toString(36).substr(2, 10),
-  )
-  return stamp.work(callback)
-}
-
-Hashcash.Stamp = function(version, bits, date, resource, extension, rand, counter = 0) {
-  this.version = version
-  this.bits = bits
-  this.date = date
-  this.resource = resource
-  this.extension = extension
-  this.rand = rand
-  this.counter = counter
-}
-
-Hashcash.Stamp.parse = function(string) {
-  var args = string.split(":")
-  return new Hashcash.Stamp(args[0], args[1], args[2], args[3], args[4], args[5], args[6])
-}
-
-Hashcash.Stamp.prototype.toString = function() {
-  return [this.version, this.bits, this.date, this.resource, this.extension, this.rand, this.counter].join(":")
-}
-
-// Trigger the given callback when the problem is solved.
-// In order to not freeze the page, setTimeout is called every 100ms to let some CPU to other tasks.
-Hashcash.Stamp.prototype.work = function(callback) {
-  this.startClock()
-  var timer = performance.now()
-  while (!this.check())
-    if (this.counter++ && performance.now() - timer > 100)
-      return setTimeout(this.work.bind(this), 0, callback)
-  this.stopClock()
-  callback(this)
-}
-
-Hashcash.Stamp.prototype.check = function() {
-  var array = Hashcash.sha1(this.toString())
-  return array[0] >> (160-this.bits) == 0
-}
-
-Hashcash.Stamp.prototype.startClock = function() {
-  this.startedAt || (this.startedAt = performance.now())
-}
-
-Hashcash.Stamp.prototype.stopClock = function() {
-  this.endedAt || (this.endedAt = performance.now())
-  var duration = this.endedAt - this.startedAt
-  var speed = Math.round(this.counter * 1000 / duration)
-  console.debug("Hashcash " + this.toString() + " minted in " + duration + "ms (" + speed + " per seconds)")
-}
-
-/**
- * Secure Hash Algorithm (SHA1)
- * http://www.webtoolkit.info/
- **/
-Hashcash.sha1 = function(msg) {
-  var rotate_left = Hashcash.sha1.rotate_left
-  var Utf8Encode = Hashcash.sha1.Utf8Encode
-
-  var blockstart;
-  var i, j;
-  var W = new Array(80);
-  var H0 = 0x67452301;
-  var H1 = 0xEFCDAB89;
-  var H2 = 0x98BADCFE;
-  var H3 = 0x10325476;
-  var H4 = 0xC3D2E1F0;
-  var A, B, C, D, E;
-  var temp;
-  msg = Utf8Encode(msg);
-  var msg_len = msg.length;
-  var word_array = new Array();
-  for (i = 0; i < msg_len - 3; i += 4) {
-    j = msg.charCodeAt(i) << 24 | msg.charCodeAt(i + 1) << 16 |
-      msg.charCodeAt(i + 2) << 8 | msg.charCodeAt(i + 3);
-    word_array.push(j);
-  }
-  switch (msg_len % 4) {
-    case 0:
-      i = 0x080000000;
-      break;
-    case 1:
-      i = msg.charCodeAt(msg_len - 1) << 24 | 0x0800000;
-      break;
-    case 2:
-      i = msg.charCodeAt(msg_len - 2) << 24 | msg.charCodeAt(msg_len - 1) << 16 | 0x08000;
-      break;
-    case 3:
-      i = msg.charCodeAt(msg_len - 3) << 24 | msg.charCodeAt(msg_len - 2) << 16 | msg.charCodeAt(msg_len - 1) << 8 | 0x80;
-      break;
-  }
-  word_array.push(i);
-  while ((word_array.length % 16) != 14) word_array.push(0);
-  word_array.push(msg_len >>> 29);
-  word_array.push((msg_len << 3) & 0x0ffffffff);
-  for (blockstart = 0; blockstart < word_array.length; blockstart += 16) {
-    for (i = 0; i < 16; i++) W[i] = word_array[blockstart + i];
-    for (i = 16; i <= 79; i++) W[i] = rotate_left(W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16], 1);
-    A = H0;
-    B = H1;
-    C = H2;
-    D = H3;
-    E = H4;
-    for (i = 0; i <= 19; i++) {
-      temp = (rotate_left(A, 5) + ((B & C) | (~B & D)) + E + W[i] + 0x5A827999) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
-    }
-    for (i = 20; i <= 39; i++) {
-      temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0x6ED9EBA1) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
-    }
-    for (i = 40; i <= 59; i++) {
-      temp = (rotate_left(A, 5) + ((B & C) | (B & D) | (C & D)) + E + W[i] + 0x8F1BBCDC) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
-    }
-    for (i = 60; i <= 79; i++) {
-      temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0xCA62C1D6) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
-    }
-    H0 = (H0 + A) & 0x0ffffffff;
-    H1 = (H1 + B) & 0x0ffffffff;
-    H2 = (H2 + C) & 0x0ffffffff;
-    H3 = (H3 + D) & 0x0ffffffff;
-    H4 = (H4 + E) & 0x0ffffffff;
-  }
-  return [H0, H1, H2, H3, H4]
-}
-
-Hashcash.hexSha1 = function(msg) {
-  var array = Hashcash.sha1(msg)
-  var cvt_hex = Hashcash.sha1.cvt_hex
-  return cvt_hex(array[0]) + cvt_hex(array[1]) + cvt_hex(array[2]) + cvt_hex(array3) + cvt_hex(array[4])
-}
-
-Hashcash.sha1.rotate_left = function(n, s) {
-  var t4 = (n << s) | (n >>> (32 - s));
-  return t4;
-};
-
-Hashcash.sha1.lsb_hex = function(val) {
-  var str = '';
-  var i;
-  var vh;
-  var vl;
-  for (i = 0; i <= 6; i += 2) {
-    vh = (val >>> (i * 4 + 4)) & 0x0f;
-    vl = (val >>> (i * 4)) & 0x0f;
-    str += vh.toString(16) + vl.toString(16);
-  }
-  return str;
-};
-
-Hashcash.sha1.cvt_hex = function(val) {
-  var str = '';
-  var i;
-  var v;
-  for (i = 7; i >= 0; i--) {
-    v = (val >>> (i * 4)) & 0x0f;
-    str += v.toString(16);
-  }
-  return str;
-};
-
-Hashcash.sha1.Utf8Encode = function(string) {
-  string = string.replace(/\r\n/g, '\n');
-  var utftext = '';
-  for (var n = 0; n < string.length; n++) {
-    var c = string.charCodeAt(n);
-    if (c < 128) {
-      utftext += String.fromCharCode(c);
-    } else if ((c > 127) && (c < 2048)) {
-      utftext += String.fromCharCode((c >> 6) | 192);
-      utftext += String.fromCharCode((c & 63) | 128);
-    } else {
-      utftext += String.fromCharCode((c >> 12) | 224);
-      utftext += String.fromCharCode(((c >> 6) & 63) | 128);
-      utftext += String.fromCharCode((c & 63) | 128);
-    }
-  }
-  return utftext;
-};
-
-Hashcash.setup()