activity_notification 2.6.1 → 2.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa4bf56cbe8f0a7b85c9d582615af447e15acc1193c94b9e12bdb0a1e2dcbfe9
-  data.tar.gz: 7e5db0f7477270c39626132b255b7a21d11c290a9f7aee9dc18d1042f2969df5
+  metadata.gz: 56122565c61de552c48285f449429a7d64616f5c13f04f0e023a68b33273db6f
+  data.tar.gz: 6462762a8f2d8b7b68b82be0632c1dd3d89379aa7fe904c6f4492053be2633fb
 SHA512:
-  metadata.gz: 4c9ca166727a66e201f9b1af1588a262223a69331999b272a24c1d7508fcad7a1ffa47e5f9b4bb1eae8d93e1e062cdb84ba4fd0c6bee892dc17e2dce87eb2ee0
-  data.tar.gz: 927fbf635366912c5d8c1f4f1fe8d48d638978dc37d1c6d8192226d00aea7db163f300ea29722cec1aa32643b3021aa4070aafc9284bf5b5634be00934c2cb42
+  metadata.gz: fd7b507f00663ebcf26694a0c8c98a0051f51f7bf35e67687a77e668fb61f500f1cf84e2fa433ecbc39bf59357449fcd0cfd0303b107b7e16ea9838d39e3848f
+  data.tar.gz: 12cd4b4e589aa66e4ccb6108beb5624d5b13f3d327234491520551c5d9134afabe718367ee3d5193a92e9a1fd2491c9bf5d59250e8e2bb8588c3bcdfaf8565b7

data/README.md

@@ -1,12 +1,10 @@
 # ActivityNotification
 
-[![Build Status](https://github.com/simukappu/activity_notification/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/activity_notification/actions/workflows/build.yml)
-[![Coverage Status](https://coveralls.io/repos/github/simukappu/activity_notification/badge.svg?branch=master)](https://coveralls.io/github/simukappu/activity_notification?branch=master)
-[![Dependency](https://img.shields.io/depfu/simukappu/activity_notification.svg)](https://depfu.com/repos/simukappu/activity_notification)
-[![Inline docs](http://inch-ci.org/github/simukappu/activity_notification.svg?branch=master)](http://inch-ci.org/github/simukappu/activity_notification)
 [![Gem Version](https://badge.fury.io/rb/activity_notification.svg)](https://rubygems.org/gems/activity_notification)
 [![Gem Downloads](https://img.shields.io/gem/dt/activity_notification.svg)](https://rubygems.org/gems/activity_notification)
-[![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](MIT-LICENSE)
+[![Build Status](https://github.com/simukappu/activity_notification/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/activity_notification/actions/workflows/build.yml)
+[![Coverage Status](https://coveralls.io/repos/github/simukappu/activity_notification/badge.svg?branch=master)](https://coveralls.io/github/simukappu/activity_notification?branch=master)
+[![License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](MIT-LICENSE)
 
 *activity_notification* provides integrated user activity notifications for [Ruby on Rails](https://rubyonrails.org). You can easily use it to configure multiple notification targets and make activity notifications with notifiable models, like adding comments, responding etc.
 

data/app/channels/activity_notification/notification_api_channel.rb

@@ -4,6 +4,8 @@ class ActivityNotification::NotificationApiChannel < ActivityNotification::Notif
   # ActionCable::Channel::Base#subscribed
   # @see https://api.rubyonrails.org/classes/ActionCable/Channel/Base.html#method-i-subscribed
     def subscribed
+      # before_subscribe callbacks do not halt the chain on reject
+      return if subscription_rejected?
       stream_from "#{ActivityNotification.config.notification_api_channel_prefix}_#{@target.to_class_name}#{ActivityNotification.config.composite_key_delimiter}#{@target.id}"
     rescue
       reject

data/app/channels/activity_notification/notification_channel.rb

@@ -7,6 +7,8 @@ if defined?(ActionCable)
     # ActionCable::Channel::Base#subscribed
     # @see https://api.rubyonrails.org/classes/ActionCable/Channel/Base.html#method-i-subscribed
     def subscribed
+      # before_subscribe callbacks do not halt the chain on reject
+      return if subscription_rejected?
       stream_from "#{ActivityNotification.config.notification_channel_prefix}_#{@target.to_class_name}#{ActivityNotification.config.composite_key_delimiter}#{@target.id}"
     rescue
       reject

data/app/controllers/activity_notification/notifications_api_controller.rb

@@ -5,7 +5,6 @@ module ActivityNotification
     include Swagger::NotificationsApi
     # Include CommonApiController to select target and define common methods
     include CommonApiController
-    protect_from_forgery except: [:open_all]
     rescue_from ActivityNotification::NotifiableNotFoundError, with: :render_notifiable_not_found
 
     # Returns notification index of the target.
@@ -135,14 +134,26 @@ module ActivityNotification
       # Returns options for notification JSON
       # @api protected
       def notification_json_options
+        include_options =
+          if ActivityNotification.config.restrict_api_response_fields
+            {
+              target: { only: [:id], methods: [:printable_type, :printable_target_name] },
+              notifiable: { only: [:id], methods: [:printable_type] },
+              group: { only: [:id], methods: [:printable_type, :printable_group_name] },
+              notifier: { only: [:id], methods: [:printable_type, :printable_notifier_name] },
+              group_members: { only: [:id] }
+            }
+          else
+            {
+              target: { methods: [:printable_type, :printable_target_name] },
+              notifiable: { methods: [:printable_type] },
+              group: { methods: [:printable_type, :printable_group_name] },
+              notifier: { methods: [:printable_type, :printable_notifier_name] },
+              group_members: {}
+            }
+          end
         {
-          include: {
-            target: { methods: [:printable_type, :printable_target_name] },
-            notifiable: { methods: [:printable_type] },
-            group: { methods: [:printable_type, :printable_group_name] },
-            notifier: { methods: [:printable_type, :printable_notifier_name] },
-            group_members: {}
-          },
+          include: include_options,
           methods: [:notifiable_path, :printable_notifiable_name, :group_member_notifier_count, :group_notification_count]
         }
       end

data/app/controllers/activity_notification/notifications_controller.rb

@@ -47,7 +47,7 @@ module ActivityNotification
     #   @option params [String] :reload                 ('true')  Whether notification index will be reloaded
     #   @return [Response] JavaScript view for ajax request or redirects to back as default
     def open_all
-      @opened_notifications = @target.open_all_notifications(params)
+      @opened_notifications = @target.open_all_notifications(bulk_action_options)
       return_back_or_ajax
     end
 
@@ -70,7 +70,7 @@ module ActivityNotification
     #   @option params [String] :reload                 ('true')  Whether notification index will be reloaded
     #   @return [Response] JavaScript view for ajax request or redirects to back as default
     def destroy_all
-      @destroyed_notifications = @target.destroy_all_notifications(params)
+      @destroyed_notifications = @target.destroy_all_notifications(bulk_action_options)
       set_index_options
       load_index if params[:reload].to_s.to_boolean(true)
       return_back_or_ajax
@@ -152,6 +152,21 @@ module ActivityNotification
         validate_target(@notification = Notification.with_target.find(params[:id]))
       end
 
+      # Builds a permitted options hash for bulk actions (open_all / destroy_all)
+      # from request parameters.
+      # Only known-safe filter keys are permitted here. Request parameters must
+      # never be forwarded to the model layer as-is, because :custom_filter is
+      # passed straight to ActiveRecord's where as a raw SQL fragment and would
+      # allow SQL injection from untrusted input.
+      # @api protected
+      # @return [Hash] permitted options for bulk actions
+      def bulk_action_options
+        params.permit(:filter, :limit, :reverse, :without_grouping, :with_group_members,
+                      :filtered_by_type, :filtered_by_group_type, :filtered_by_group_id, :filtered_by_key,
+                      :later_than, :earlier_than, :routing_scope, :devise_default_routes, ids: [])
+              .to_h.symbolize_keys
+      end
+
       # Sets options to load notification index from request parameters.
       # @api protected
       # @return [Hash] options to load notification index

data/app/controllers/activity_notification/subscriptions_api_controller.rb

@@ -5,7 +5,6 @@ module ActivityNotification
     include Swagger::SubscriptionsApi
     # Include CommonApiController to select target and define common methods
     include CommonApiController
-    protect_from_forgery except: [:create]
     before_action :set_subscription, except: [:index, :create, :find, :optional_target_names]
     before_action ->{ validate_param(:key) }, only: [:find, :optional_target_names]
 
@@ -171,7 +170,11 @@ module ActivityNotification
       # Returns include option for subscription JSON
       # @api protected
       def subscription_json_include_option
-        [:target].freeze
+        if ActivityNotification.config.restrict_api_response_fields
+          { target: { only: [:id], methods: [:printable_type, :printable_target_name] } }.freeze
+        else
+          [:target].freeze
+        end
       end
 
       # Returns methods option for subscription JSON

data/app/views/activity_notification/notifications/default/index.html.erb

@@ -40,7 +40,7 @@
 </style>
 
 <% if @target.notification_action_cable_allowed? %>
-  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js"></script>
+  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js" integrity="sha512-eiqtDDb4GUVCSqOSOTz/s/eiU4B31GrdSb17aPAA4Lv/Cjc8o+hnDvuNkgXhSI5yHuDvYkuojMaQmrB5JB31XQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   <script>
     App.activity_notification = App.cable.subscriptions.create(
       {

data/docs/Functions.md

@@ -336,6 +336,8 @@ You can also add conditions to filter notifications, like this:
 User.send_batch_unopened_notification_email(batch_key: 'batch.comment.post', filtered_by_key: 'comment.post', custom_filter: ["created_at >= ?", time.hour.ago])
 ```
 
+*custom_filter* accepts an array of a SQL fragment with bind parameters or a hash of conditions. Write it in your application code and never build it from request parameters, since it is passed to the ORM query layer as is. A raw SQL string, an array without bind parameters and MongoDB JavaScript operators (`$where`, `$function` and `$accumulator`) are rejected with `ArgumentError`.
+
 #### Batch sender configuration
 
 *activity_notification* uses same sender configuration of real-time email notification as batch email sender.
@@ -709,6 +711,22 @@ When you want to use REST API backend integrated with Devise authentication, see
 
 You can see [sample single page application](/spec/rails_app/app/javascript/) using [Vue.js](https://vuejs.org) as a part of example Rails application. This sample application works with *activity_notification* REST API backend.
 
+#### Securing the REST API
+
+The REST API endpoints do not authenticate requests on their own. Authenticating requests and authorizing access to a target's notifications and subscriptions is the responsibility of your application. The recommended way is to use the *:with_devise* option so that only the authenticated resource can access its own records. See [REST API backend with Devise Token Auth](#rest-api-backend-with-devise-token-auth) for the setup. The controllers shipped for *:with_devise* return HTTP 403 for a target that does not belong to the authenticated resource.
+
+By default, notification and subscription responses embed the associated records (target, notifiable, notifier, group, group members and subscription target) with all of their database columns. When those associated records are your user model, the response can include columns you may not want to expose to the frontend, such as authentication identifiers. Two options are available to reduce this exposure.
+
+The simplest option is to enable *config.restrict_api_response_fields*, which restricts every embedded associated record to its *id* and *printable_\** method values instead of all columns. It is disabled by default to preserve the existing response shape:
+
+```ruby
+ActivityNotification.configure do |config|
+  config.restrict_api_response_fields = true
+end
+```
+
+If you need finer control over the response shape, override the serialization options in your own API controllers instead. *ActivityNotification::NotificationsApiController#notification_json_options* and *ActivityNotification::SubscriptionsApiController#subscription_json_include_option* are protected methods that you can override to return only the fields your frontend consumes.
+
 #### API reference as OpenAPI Specification
 
 *activity_notification* provides API reference as [OpenAPI Specification](https://github.com/OAI/OpenAPI-Specification).
@@ -991,7 +1009,7 @@ Then, *activity_notification* will broadcast configured notifications to target
 You can simply create subscriptions for the specified target in your view like this:
 
 ```js
-<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js"></script>
+<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js" integrity="sha512-eiqtDDb4GUVCSqOSOTz/s/eiU4B31GrdSb17aPAA4Lv/Cjc8o+hnDvuNkgXhSI5yHuDvYkuojMaQmrB5JB31XQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
 <script>
   App.activity_notification = App.cable.subscriptions.create(
     {
@@ -1029,7 +1047,7 @@ You can simply create subscriptions for the specified target in your view like t
 or create subscriptions in your single page application with API channels like this:
 
 ```js
-// Vue.js implementation with actioncable-vue
+// Vue.js implementation with a small Action Cable plugin (see spec/rails_app/app/javascript/plugins/action-cable.js)
 export default {
   // ...
   mounted () {

data/lib/activity_notification/apis/notification_api.rb

@@ -135,7 +135,7 @@ module ActivityNotification
             filtered_notifications = filtered_notifications.earlier_than(Time.iso8601(options[:earlier_than]))
           end
           if options.has_key?(:custom_filter)
-            filtered_notifications = filtered_notifications.where(options[:custom_filter])
+            filtered_notifications = filtered_notifications.where(ActivityNotification.validate_custom_filter(options[:custom_filter]))
           end
           filtered_notifications
         }

data/lib/activity_notification/apis/subscription_api.rb

@@ -31,7 +31,7 @@ module ActivityNotification
             filtered_subscriptions = filtered_subscriptions.filtered_by_key(options[:filtered_by_key])
           end
           if options.has_key?(:custom_filter)
-            filtered_subscriptions = filtered_subscriptions.where(options[:custom_filter])
+            filtered_subscriptions = filtered_subscriptions.where(ActivityNotification.validate_custom_filter(options[:custom_filter]))
           end
           filtered_subscriptions
         }

data/lib/activity_notification/common.rb

@@ -47,6 +47,51 @@ module ActivityNotification
     end
   end
 
+  # MongoDB query operators which execute JavaScript on the database server.
+  JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
+  # Validates a :custom_filter value before it is passed to the ORM query layer.
+  # custom_filter is a trusted input written by the application developer and
+  # must not be built from request parameters. This validation rejects the forms
+  # that run raw SQL or server-side JavaScript:
+  # - A String, since ActiveRecord's where treats it as a raw SQL fragment
+  # - An Array without bind parameters (e.g. ["1=1"]), which is also a raw SQL fragment
+  # - A Hash containing MongoDB JavaScript operators ($where, $function and $accumulator)
+  # The supported forms are an Array of a SQL fragment with bind parameters
+  # (e.g. ["created_at >= ?", time]) or a Hash of conditions.
+  # @param [Array, Hash] custom_filter Custom filter value
+  # @return [Array, Hash] The same value when it is safe to use
+  # @raise [ArgumentError] When custom_filter is not in the supported forms
+  def self.validate_custom_filter(custom_filter)
+    valid =
+      case custom_filter
+      when Array then custom_filter.size >= 2 && custom_filter.first.is_a?(String)
+      when Hash  then !contains_javascript_query_operator?(custom_filter)
+      else false
+      end
+    unless valid
+      raise ArgumentError,
+        ":custom_filter must be an array of a SQL fragment and bind parameters " \
+        "(e.g. [\"created_at >= ?\", time]) or a hash of conditions without JavaScript operators"
+    end
+    custom_filter
+  end
+
+  # Returns whether the value contains MongoDB query operators which execute JavaScript.
+  # @param [Object] value Value to check
+  # @return [Boolean] Whether the value contains JavaScript query operators
+  def self.contains_javascript_query_operator?(value)
+    case value
+    when Hash
+      value.any? { |k, v| JAVASCRIPT_QUERY_OPERATORS.include?(k.to_s) || contains_javascript_query_operator?(v) }
+    when Array
+      value.any? { |v| contains_javascript_query_operator?(v) }
+    else
+      false
+    end
+  end
+  private_class_method :contains_javascript_query_operator?
+
   # Casts to indifferent hash
   # @param [ActionController::Parameters, Hash] hash
   # @return [HashWithIndifferentAccess] Converted indifferent hash

data/lib/activity_notification/config.rb

@@ -240,6 +240,15 @@ module ActivityNotification
     #   @return [Boolean] Whether activity_notification internally rescues optional target errors.
     attr_accessor :rescue_optional_target_errors
 
+    # @overload restrict_api_response_fields
+    #   Returns whether the REST API restricts embedded associated records to their id and printable_* method values
+    #   @return [Boolean] Whether the REST API restricts embedded associated records to their id and printable_* method values.
+    # @overload restrict_api_response_fields=(value)
+    #   Sets whether the REST API restricts embedded associated records (target, notifiable, notifier, group, group members and subscription target) in JSON responses to their id and printable_* method values instead of all database columns. This is an opt-in hardening option to avoid exposing columns the frontend does not need (e.g. authentication identifiers on an associated user record). It is disabled by default to preserve the existing response shape.
+    #   @param [Boolean] restrict_api_response_fields The new restrict_api_response_fields
+    #   @return [Boolean] Whether the REST API restricts embedded associated records to their id and printable_* method values.
+    attr_accessor :restrict_api_response_fields
+
     # Initialize configuration for ActivityNotification.
     # These configuration can be overridden in initializer.
     # @return [Config] A new instance of Config
@@ -272,6 +281,7 @@ module ActivityNotification
       @notification_channel_prefix              = 'activity_notification_channel'
       @notification_api_channel_prefix          = 'activity_notification_api_channel'
       @rescue_optional_target_errors            = true
+      @restrict_api_response_fields             = false
     end
 
     # Sets ORM name for ActivityNotification (:active_record, :mongoid or :dynamodb)

data/lib/activity_notification/helpers/view_helpers.rb

@@ -21,7 +21,7 @@ module ActivityNotification
         notifications.render self, options
       elsif notifications.respond_to?(:map)
         return nil if (notifications.respond_to?(:empty?) ? notifications.empty? : notifications.to_a.empty?)
-        notifications.map {|notification| notification.render self, options.dup }.join.html_safe
+        safe_join(notifications.map {|notification| notification.render self, options.dup })
       end
     end
     alias_method :render_notifications, :render_notification

data/lib/activity_notification/orm/dynamoid.rb

@@ -332,7 +332,7 @@ module Dynamoid # :nodoc: all
           filtered_notifications = filtered_notifications.earlier_than(Time.iso8601(options[:earlier_than]))
         end
         if options.has_key?(:custom_filter)
-          filtered_notifications = filtered_notifications.where(options[:custom_filter])
+          filtered_notifications = filtered_notifications.where(ActivityNotification.validate_custom_filter(options[:custom_filter]))
         end
         filtered_notifications
       end

data/lib/activity_notification/version.rb

@@ -1,3 +1,3 @@
 module ActivityNotification
-  VERSION = "2.6.1"
+  VERSION = "2.7.1"
 end

data/lib/generators/templates/activity_notification.rb

@@ -121,4 +121,12 @@ ActivityNotification.configure do |config|
   # See https://github.com/simukappu/activity_notification/issues/155 for more details.
   config.rescue_optional_target_errors = true
 
+  # Configure if the REST API restricts embedded associated records in JSON responses.
+  # When set true, associated records (target, notifiable, notifier, group, group members
+  # and subscription target) are serialized with only their id and printable_* method values
+  # instead of all database columns, to avoid exposing columns the frontend does not need.
+  # Note that authentication and authorization of the REST API is still the responsibility of
+  # your application (see the :with_devise routing option). Default value is false.
+  # config.restrict_api_response_fields = false
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activity_notification
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.7.1
 platform: ruby
 authors:
 - Shota Yamazaki
@@ -311,7 +311,7 @@ description: Integrated user activity notifications for Ruby on Rails. Provides
   to configure multiple notification targets and make activity notifications with
   notifiable models, like adding comments, responding etc.
 email:
-- shota.yamazaki.8@gmail.com
+- shota.yamazaki.work@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []