activity_notification 2.6.1 → 2.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa4bf56cbe8f0a7b85c9d582615af447e15acc1193c94b9e12bdb0a1e2dcbfe9
-  data.tar.gz: 7e5db0f7477270c39626132b255b7a21d11c290a9f7aee9dc18d1042f2969df5
+  metadata.gz: bafe2d6977f08838087612f2d58947783a2e6add85633d85abe024cbe3a8041b
+  data.tar.gz: '095b581d3e475f27bfd186265083ea42f953b9b7c992c963fbb5fdd40cedd96e'
 SHA512:
-  metadata.gz: 4c9ca166727a66e201f9b1af1588a262223a69331999b272a24c1d7508fcad7a1ffa47e5f9b4bb1eae8d93e1e062cdb84ba4fd0c6bee892dc17e2dce87eb2ee0
-  data.tar.gz: 927fbf635366912c5d8c1f4f1fe8d48d638978dc37d1c6d8192226d00aea7db163f300ea29722cec1aa32643b3021aa4070aafc9284bf5b5634be00934c2cb42
+  metadata.gz: f6c687e0c9df39d2950bd2f2b2f2da4e10b95404315e09a9c91b8002cbaf98140a33877700c5c5b8a36b46f3387658caba039c722a91664b52d56ec29eac47d8
+  data.tar.gz: a9ebe7817f6c78fceb53e5ce0adee2b20e7b964e97c5ad812933a2d097d42f3d1617a29d26b0b07225309d56ebb2168fdcf64bd26c4d3478523ed6d1354de0ff

data/README.md

@@ -1,12 +1,10 @@
 # ActivityNotification
 
-[![Build Status](https://github.com/simukappu/activity_notification/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/activity_notification/actions/workflows/build.yml)
-[![Coverage Status](https://coveralls.io/repos/github/simukappu/activity_notification/badge.svg?branch=master)](https://coveralls.io/github/simukappu/activity_notification?branch=master)
-[![Dependency](https://img.shields.io/depfu/simukappu/activity_notification.svg)](https://depfu.com/repos/simukappu/activity_notification)
-[![Inline docs](http://inch-ci.org/github/simukappu/activity_notification.svg?branch=master)](http://inch-ci.org/github/simukappu/activity_notification)
 [![Gem Version](https://badge.fury.io/rb/activity_notification.svg)](https://rubygems.org/gems/activity_notification)
 [![Gem Downloads](https://img.shields.io/gem/dt/activity_notification.svg)](https://rubygems.org/gems/activity_notification)
-[![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](MIT-LICENSE)
+[![Build Status](https://github.com/simukappu/activity_notification/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/activity_notification/actions/workflows/build.yml)
+[![Coverage Status](https://coveralls.io/repos/github/simukappu/activity_notification/badge.svg?branch=master)](https://coveralls.io/github/simukappu/activity_notification?branch=master)
+[![License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](MIT-LICENSE)
 
 *activity_notification* provides integrated user activity notifications for [Ruby on Rails](https://rubyonrails.org). You can easily use it to configure multiple notification targets and make activity notifications with notifiable models, like adding comments, responding etc.
 

data/app/controllers/activity_notification/notifications_api_controller.rb

@@ -135,14 +135,26 @@ module ActivityNotification
       # Returns options for notification JSON
       # @api protected
       def notification_json_options
+        include_options =
+          if ActivityNotification.config.restrict_api_response_fields
+            {
+              target: { only: [:id], methods: [:printable_type, :printable_target_name] },
+              notifiable: { only: [:id], methods: [:printable_type] },
+              group: { only: [:id], methods: [:printable_type, :printable_group_name] },
+              notifier: { only: [:id], methods: [:printable_type, :printable_notifier_name] },
+              group_members: { only: [:id] }
+            }
+          else
+            {
+              target: { methods: [:printable_type, :printable_target_name] },
+              notifiable: { methods: [:printable_type] },
+              group: { methods: [:printable_type, :printable_group_name] },
+              notifier: { methods: [:printable_type, :printable_notifier_name] },
+              group_members: {}
+            }
+          end
         {
-          include: {
-            target: { methods: [:printable_type, :printable_target_name] },
-            notifiable: { methods: [:printable_type] },
-            group: { methods: [:printable_type, :printable_group_name] },
-            notifier: { methods: [:printable_type, :printable_notifier_name] },
-            group_members: {}
-          },
+          include: include_options,
           methods: [:notifiable_path, :printable_notifiable_name, :group_member_notifier_count, :group_notification_count]
         }
       end

data/app/controllers/activity_notification/notifications_controller.rb

@@ -47,7 +47,7 @@ module ActivityNotification
     #   @option params [String] :reload                 ('true')  Whether notification index will be reloaded
     #   @return [Response] JavaScript view for ajax request or redirects to back as default
     def open_all
-      @opened_notifications = @target.open_all_notifications(params)
+      @opened_notifications = @target.open_all_notifications(bulk_action_options)
       return_back_or_ajax
     end
 
@@ -70,7 +70,7 @@ module ActivityNotification
     #   @option params [String] :reload                 ('true')  Whether notification index will be reloaded
     #   @return [Response] JavaScript view for ajax request or redirects to back as default
     def destroy_all
-      @destroyed_notifications = @target.destroy_all_notifications(params)
+      @destroyed_notifications = @target.destroy_all_notifications(bulk_action_options)
       set_index_options
       load_index if params[:reload].to_s.to_boolean(true)
       return_back_or_ajax
@@ -152,6 +152,21 @@ module ActivityNotification
         validate_target(@notification = Notification.with_target.find(params[:id]))
       end
 
+      # Builds a permitted options hash for bulk actions (open_all / destroy_all)
+      # from request parameters.
+      # Only known-safe filter keys are permitted here. Request parameters must
+      # never be forwarded to the model layer as-is, because :custom_filter is
+      # passed straight to ActiveRecord's where as a raw SQL fragment and would
+      # allow SQL injection from untrusted input.
+      # @api protected
+      # @return [Hash] permitted options for bulk actions
+      def bulk_action_options
+        params.permit(:filter, :limit, :reverse, :without_grouping, :with_group_members,
+                      :filtered_by_type, :filtered_by_group_type, :filtered_by_group_id, :filtered_by_key,
+                      :later_than, :earlier_than, :routing_scope, :devise_default_routes, ids: [])
+              .to_h.symbolize_keys
+      end
+
       # Sets options to load notification index from request parameters.
       # @api protected
       # @return [Hash] options to load notification index

data/app/controllers/activity_notification/subscriptions_api_controller.rb

@@ -171,7 +171,11 @@ module ActivityNotification
       # Returns include option for subscription JSON
       # @api protected
       def subscription_json_include_option
-        [:target].freeze
+        if ActivityNotification.config.restrict_api_response_fields
+          { target: { only: [:id], methods: [:printable_type, :printable_target_name] } }.freeze
+        else
+          [:target].freeze
+        end
       end
 
       # Returns methods option for subscription JSON

data/docs/Functions.md

@@ -709,6 +709,22 @@ When you want to use REST API backend integrated with Devise authentication, see
 
 You can see [sample single page application](/spec/rails_app/app/javascript/) using [Vue.js](https://vuejs.org) as a part of example Rails application. This sample application works with *activity_notification* REST API backend.
 
+#### Securing the REST API
+
+The REST API endpoints do not authenticate requests on their own. Authenticating requests and authorizing access to a target's notifications and subscriptions is the responsibility of your application. The recommended way is to use the *:with_devise* option so that only the authenticated resource can access its own records. See [REST API backend with Devise Token Auth](#rest-api-backend-with-devise-token-auth) for the setup. The controllers shipped for *:with_devise* return HTTP 403 for a target that does not belong to the authenticated resource.
+
+By default, notification and subscription responses embed the associated records (target, notifiable, notifier, group, group members and subscription target) with all of their database columns. When those associated records are your user model, the response can include columns you may not want to expose to the frontend, such as authentication identifiers. Two options are available to reduce this exposure.
+
+The simplest option is to enable *config.restrict_api_response_fields*, which restricts every embedded associated record to its *id* and *printable_\** method values instead of all columns. It is disabled by default to preserve the existing response shape:
+
+```ruby
+ActivityNotification.configure do |config|
+  config.restrict_api_response_fields = true
+end
+```
+
+If you need finer control over the response shape, override the serialization options in your own API controllers instead. *ActivityNotification::NotificationsApiController#notification_json_options* and *ActivityNotification::SubscriptionsApiController#subscription_json_include_option* are protected methods that you can override to return only the fields your frontend consumes.
+
 #### API reference as OpenAPI Specification
 
 *activity_notification* provides API reference as [OpenAPI Specification](https://github.com/OAI/OpenAPI-Specification).

data/lib/activity_notification/apis/notification_api.rb

@@ -135,7 +135,7 @@ module ActivityNotification
             filtered_notifications = filtered_notifications.earlier_than(Time.iso8601(options[:earlier_than]))
           end
           if options.has_key?(:custom_filter)
-            filtered_notifications = filtered_notifications.where(options[:custom_filter])
+            filtered_notifications = filtered_notifications.where(ActivityNotification.validate_custom_filter(options[:custom_filter]))
           end
           filtered_notifications
         }

data/lib/activity_notification/apis/subscription_api.rb

@@ -31,7 +31,7 @@ module ActivityNotification
             filtered_subscriptions = filtered_subscriptions.filtered_by_key(options[:filtered_by_key])
           end
           if options.has_key?(:custom_filter)
-            filtered_subscriptions = filtered_subscriptions.where(options[:custom_filter])
+            filtered_subscriptions = filtered_subscriptions.where(ActivityNotification.validate_custom_filter(options[:custom_filter]))
           end
           filtered_subscriptions
         }

data/lib/activity_notification/common.rb

@@ -47,6 +47,24 @@ module ActivityNotification
     end
   end
 
+  # Validates a :custom_filter value before it is passed to the ORM query layer.
+  # A String is rejected because ActiveRecord's where treats a String as a raw
+  # SQL fragment, which allows SQL injection when the value originates from
+  # untrusted input. The documented and supported forms are an Array of a SQL
+  # fragment with bind parameters (e.g. ["created_at >= ?", time]) or a Hash of
+  # conditions, both of which are safe.
+  # @param [Array, Hash] custom_filter Custom filter value
+  # @return [Array, Hash] The same value when it is safe to use
+  # @raise [ArgumentError] When custom_filter is a raw SQL String
+  def self.validate_custom_filter(custom_filter)
+    if custom_filter.is_a?(String)
+      raise ArgumentError,
+        ":custom_filter must be an array of a SQL fragment and bind parameters " \
+        "(e.g. [\"created_at >= ?\", time]) or a hash of conditions, not a raw SQL string"
+    end
+    custom_filter
+  end
+
   # Casts to indifferent hash
   # @param [ActionController::Parameters, Hash] hash
   # @return [HashWithIndifferentAccess] Converted indifferent hash

data/lib/activity_notification/config.rb

@@ -240,6 +240,15 @@ module ActivityNotification
     #   @return [Boolean] Whether activity_notification internally rescues optional target errors.
     attr_accessor :rescue_optional_target_errors
 
+    # @overload restrict_api_response_fields
+    #   Returns whether the REST API restricts embedded associated records to their id and printable_* method values
+    #   @return [Boolean] Whether the REST API restricts embedded associated records to their id and printable_* method values.
+    # @overload restrict_api_response_fields=(value)
+    #   Sets whether the REST API restricts embedded associated records (target, notifiable, notifier, group, group members and subscription target) in JSON responses to their id and printable_* method values instead of all database columns. This is an opt-in hardening option to avoid exposing columns the frontend does not need (e.g. authentication identifiers on an associated user record). It is disabled by default to preserve the existing response shape.
+    #   @param [Boolean] restrict_api_response_fields The new restrict_api_response_fields
+    #   @return [Boolean] Whether the REST API restricts embedded associated records to their id and printable_* method values.
+    attr_accessor :restrict_api_response_fields
+
     # Initialize configuration for ActivityNotification.
     # These configuration can be overridden in initializer.
     # @return [Config] A new instance of Config
@@ -272,6 +281,7 @@ module ActivityNotification
       @notification_channel_prefix              = 'activity_notification_channel'
       @notification_api_channel_prefix          = 'activity_notification_api_channel'
       @rescue_optional_target_errors            = true
+      @restrict_api_response_fields             = false
     end
 
     # Sets ORM name for ActivityNotification (:active_record, :mongoid or :dynamodb)

data/lib/activity_notification/orm/dynamoid.rb

@@ -332,7 +332,7 @@ module Dynamoid # :nodoc: all
           filtered_notifications = filtered_notifications.earlier_than(Time.iso8601(options[:earlier_than]))
         end
         if options.has_key?(:custom_filter)
-          filtered_notifications = filtered_notifications.where(options[:custom_filter])
+          filtered_notifications = filtered_notifications.where(ActivityNotification.validate_custom_filter(options[:custom_filter]))
         end
         filtered_notifications
       end

data/lib/activity_notification/version.rb

@@ -1,3 +1,3 @@
 module ActivityNotification
-  VERSION = "2.6.1"
+  VERSION = "2.7.0"
 end

data/lib/generators/templates/activity_notification.rb

@@ -121,4 +121,12 @@ ActivityNotification.configure do |config|
   # See https://github.com/simukappu/activity_notification/issues/155 for more details.
   config.rescue_optional_target_errors = true
 
+  # Configure if the REST API restricts embedded associated records in JSON responses.
+  # When set true, associated records (target, notifiable, notifier, group, group members
+  # and subscription target) are serialized with only their id and printable_* method values
+  # instead of all database columns, to avoid exposing columns the frontend does not need.
+  # Note that authentication and authorization of the REST API is still the responsibility of
+  # your application (see the :with_devise routing option). Default value is false.
+  # config.restrict_api_response_fields = false
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activity_notification
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.7.0
 platform: ruby
 authors:
 - Shota Yamazaki
@@ -311,7 +311,7 @@ description: Integrated user activity notifications for Ruby on Rails. Provides
   to configure multiple notification targets and make activity notifications with
   notifiable models, like adding comments, responding etc.
 email:
-- shota.yamazaki.8@gmail.com
+- shota.yamazaki.work@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []