activity_notification 2.7.0 → 2.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bafe2d6977f08838087612f2d58947783a2e6add85633d85abe024cbe3a8041b
-  data.tar.gz: '095b581d3e475f27bfd186265083ea42f953b9b7c992c963fbb5fdd40cedd96e'
+  metadata.gz: 9c4c8885cdeaf0c979ae2474e5ca5459a16e0f14c605fa5d2f0ad37076e7c793
+  data.tar.gz: 267223c3dbc745920baabb75d5e936cafef5a3fbe2e301f46aab04ae9d6a34a8
 SHA512:
-  metadata.gz: f6c687e0c9df39d2950bd2f2b2f2da4e10b95404315e09a9c91b8002cbaf98140a33877700c5c5b8a36b46f3387658caba039c722a91664b52d56ec29eac47d8
-  data.tar.gz: a9ebe7817f6c78fceb53e5ce0adee2b20e7b964e97c5ad812933a2d097d42f3d1617a29d26b0b07225309d56ebb2168fdcf64bd26c4d3478523ed6d1354de0ff
+  metadata.gz: bcb53649395b3e43ab8e3b4a043a40947305ee35cd15fe16a9737f16c866ff543749e78b00c5c5659d8a34eaf198a6c30b6933d29a048db00d56ea17b7c4694e
+  data.tar.gz: cc390e51688280d2c84bb949814ae6a3ecad9f1c444066b45d91316d47fea5bb71a7dec03fd4a582d503cc5f7aad70e47c9c0f7ddf16b1da1f92ae1485c10595

data/app/channels/activity_notification/notification_api_channel.rb

@@ -4,6 +4,8 @@ class ActivityNotification::NotificationApiChannel < ActivityNotification::Notif
   # ActionCable::Channel::Base#subscribed
   # @see https://api.rubyonrails.org/classes/ActionCable/Channel/Base.html#method-i-subscribed
     def subscribed
+      # before_subscribe callbacks do not halt the chain on reject
+      return if subscription_rejected?
       stream_from "#{ActivityNotification.config.notification_api_channel_prefix}_#{@target.to_class_name}#{ActivityNotification.config.composite_key_delimiter}#{@target.id}"
     rescue
       reject

data/app/channels/activity_notification/notification_channel.rb

@@ -7,6 +7,8 @@ if defined?(ActionCable)
     # ActionCable::Channel::Base#subscribed
     # @see https://api.rubyonrails.org/classes/ActionCable/Channel/Base.html#method-i-subscribed
     def subscribed
+      # before_subscribe callbacks do not halt the chain on reject
+      return if subscription_rejected?
       stream_from "#{ActivityNotification.config.notification_channel_prefix}_#{@target.to_class_name}#{ActivityNotification.config.composite_key_delimiter}#{@target.id}"
     rescue
       reject

data/app/controllers/activity_notification/notifications_api_controller.rb

@@ -5,7 +5,6 @@ module ActivityNotification
     include Swagger::NotificationsApi
     # Include CommonApiController to select target and define common methods
     include CommonApiController
-    protect_from_forgery except: [:open_all]
     rescue_from ActivityNotification::NotifiableNotFoundError, with: :render_notifiable_not_found
 
     # Returns notification index of the target.

data/app/controllers/activity_notification/notifications_controller.rb

@@ -4,6 +4,7 @@ module ActivityNotification
     # Include CommonController to select target and define common methods
     include CommonController
     before_action :set_notification, except: [:index, :open_all, :destroy_all]
+    before_action :validate_time_params, only: [:index, :open_all, :destroy_all]
 
     # Shows notification index of the target.
     #
@@ -125,6 +126,7 @@ module ActivityNotification
     # @overload open(params)
     #   @param [Hash] params Request parameters
     #   @option params [String] :open                   ('false') Whether the notification will be opened
+    #   @option params [String] :open_token             (nil)     Token to open the notification, which is required with open parameter since GET requests are not protected from CSRF (See Notification#open_token)
     #   @option params [String] :filter                 (nil)     Filter option to load notification index by their status (Nothing as auto, 'opened' or 'unopened')
     #   @option params [String] :limit                  (nil)     Maximum number of notifications to return
     #   @option params [String] :without_grouping       ('false') Whether notification index will include group members
@@ -133,7 +135,7 @@ module ActivityNotification
     #   @return [Response] JavaScript view for ajax request or redirects to back as default
     def move
       with_members = !(params[:with_group_members].to_s.to_boolean(false) || params[:without_grouping].to_s.to_boolean(false))
-      @opened_notifications_count = @notification.open!(with_members: with_members) if params[:open].to_s.to_boolean(false)
+      @opened_notifications_count = @notification.open!(with_members: with_members) if params[:open].to_s.to_boolean(false) && @notification.valid_open_token?(params[:open_token])
       redirect_to_notifiable_path
     end
   
@@ -171,7 +173,7 @@ module ActivityNotification
       # @api protected
       # @return [Hash] options to load notification index
       def set_index_options
-        limit              = params[:limit].to_i > 0 ? params[:limit].to_i : nil
+        limit              = index_limit
         reverse            = params[:reverse].present? ?
                                params[:reverse].to_s.to_boolean(false) : nil
         with_group_members = params[:with_group_members].present? || params[:without_grouping].present? ? params[:with_group_members].to_s.to_boolean(false) || params[:without_grouping].to_s.to_boolean(false) : nil
@@ -180,6 +182,21 @@ module ActivityNotification
                                    .merge(limit: limit, reverse: reverse, with_group_members: with_group_members)
       end
 
+      # Validates ISO 8601 time parameters and returns HTTP 400 when they are invalid.
+      # @api protected
+      # @return [void]
+      def validate_time_params
+        [:later_than, :earlier_than].each do |param_name|
+          next unless params.key?(param_name)
+          begin
+            Time.iso8601(params[param_name].to_s)
+          rescue ArgumentError
+            render_invalid_parameter("Parameter is not ISO 8601 time: #{param_name}")
+            return
+          end
+        end
+      end
+
       # Loads notification index with request parameters.
       # @api protected
       # @return [Array] Array of notification index

data/app/controllers/activity_notification/subscriptions_api_controller.rb

@@ -5,7 +5,6 @@ module ActivityNotification
     include Swagger::SubscriptionsApi
     # Include CommonApiController to select target and define common methods
     include CommonApiController
-    protect_from_forgery except: [:create]
     before_action :set_subscription, except: [:index, :create, :find, :optional_target_names]
     before_action ->{ validate_param(:key) }, only: [:find, :optional_target_names]
 

data/app/controllers/activity_notification/subscriptions_controller.rb

@@ -198,7 +198,7 @@ module ActivityNotification
       # @api protected
       # @return [Hash] options to load subscription index
       def set_index_options
-        limit          = params[:limit].to_i > 0 ? params[:limit].to_i : nil
+        limit          = index_limit
         reverse        = params[:reverse].present? ? params[:reverse].to_s.to_boolean(false) : nil
         @index_options = params.permit(:filter, :filtered_by_key, :routing_scope, :devise_default_routes)
                                .to_h.symbolize_keys.merge(limit: limit, reverse: reverse)

data/app/views/activity_notification/notifications/default/index.html.erb

@@ -40,7 +40,7 @@
 </style>
 
 <% if @target.notification_action_cable_allowed? %>
-  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js"></script>
+  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js" integrity="sha512-eiqtDDb4GUVCSqOSOTz/s/eiU4B31GrdSb17aPAA4Lv/Cjc8o+hnDvuNkgXhSI5yHuDvYkuojMaQmrB5JB31XQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   <script>
     App.activity_notification = App.cable.subscriptions.create(
       {

data/docs/Functions.md

@@ -336,6 +336,8 @@ You can also add conditions to filter notifications, like this:
 User.send_batch_unopened_notification_email(batch_key: 'batch.comment.post', filtered_by_key: 'comment.post', custom_filter: ["created_at >= ?", time.hour.ago])
 ```
 
+*custom_filter* accepts an array of a SQL fragment with bind parameters or a hash of conditions. Write it in your application code and never build it from request parameters, since it is passed to the ORM query layer as is. A raw SQL string, an array without bind parameters and MongoDB JavaScript operators (`$where`, `$function` and `$accumulator`) are rejected with `ArgumentError`.
+
 #### Batch sender configuration
 
 *activity_notification* uses same sender configuration of real-time email notification as batch email sender.
@@ -1007,7 +1009,7 @@ Then, *activity_notification* will broadcast configured notifications to target
 You can simply create subscriptions for the specified target in your view like this:
 
 ```js
-<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js"></script>
+<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js" integrity="sha512-eiqtDDb4GUVCSqOSOTz/s/eiU4B31GrdSb17aPAA4Lv/Cjc8o+hnDvuNkgXhSI5yHuDvYkuojMaQmrB5JB31XQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
 <script>
   App.activity_notification = App.cable.subscriptions.create(
     {
@@ -1045,7 +1047,7 @@ You can simply create subscriptions for the specified target in your view like t
 or create subscriptions in your single page application with API channels like this:
 
 ```js
-// Vue.js implementation with actioncable-vue
+// Vue.js implementation with a small Action Cable plugin (see spec/rails_app/app/javascript/plugins/action-cable.js)
 export default {
   // ...
   mounted () {

data/lib/activity_notification/apis/notification_api.rb

@@ -707,6 +707,23 @@ module ActivityNotification
       unopened_member_count + 1
     end
 
+    # Returns a token to open the notification by HTTP GET request to move action.
+    # GET requests are not protected from CSRF, so move action opens the notification only with this token.
+    # move_notification_path_for and move_notification_url_for helpers add this token when open: true is specified.
+    #
+    # @return [String] Token to open the notification by move action
+    def open_token
+      ActivityNotification.open_token_verifier.generate(id.to_s, purpose: :open_notification)
+    end
+
+    # Returns if the token is valid to open the notification by move action.
+    #
+    # @param [String] token Token to verify
+    # @return [Boolean] If the token is valid to open the notification
+    def valid_open_token?(token)
+      token.is_a?(String) && ActivityNotification.open_token_verifier.verified(token, purpose: :open_notification) == id.to_s
+    end
+
     # Returns if the notification is unopened.
     #
     # @return [Boolean] If the notification is unopened

data/lib/activity_notification/common.rb

@@ -47,24 +47,57 @@ module ActivityNotification
     end
   end
 
+  # MongoDB query operators which execute JavaScript on the database server.
+  JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
   # Validates a :custom_filter value before it is passed to the ORM query layer.
-  # A String is rejected because ActiveRecord's where treats a String as a raw
-  # SQL fragment, which allows SQL injection when the value originates from
-  # untrusted input. The documented and supported forms are an Array of a SQL
-  # fragment with bind parameters (e.g. ["created_at >= ?", time]) or a Hash of
-  # conditions, both of which are safe.
+  # custom_filter is a trusted input written by the application developer and
+  # must not be built from request parameters. This validation rejects the forms
+  # that run raw SQL or server-side JavaScript:
+  # - A String, since ActiveRecord's where treats it as a raw SQL fragment
+  # - An Array without bind parameters (e.g. ["1=1"]), which is also a raw SQL fragment
+  # - A Hash containing MongoDB JavaScript operators ($where, $function and $accumulator)
+  # The supported forms are an Array of a SQL fragment with bind parameters
+  # (e.g. ["created_at >= ?", time]) or a Hash of conditions.
   # @param [Array, Hash] custom_filter Custom filter value
   # @return [Array, Hash] The same value when it is safe to use
-  # @raise [ArgumentError] When custom_filter is a raw SQL String
+  # @raise [ArgumentError] When custom_filter is not in the supported forms
   def self.validate_custom_filter(custom_filter)
-    if custom_filter.is_a?(String)
+    valid =
+      case custom_filter
+      when Array then custom_filter.size >= 2 && custom_filter.first.is_a?(String)
+      when Hash  then !contains_javascript_query_operator?(custom_filter)
+      else false
+      end
+    unless valid
       raise ArgumentError,
         ":custom_filter must be an array of a SQL fragment and bind parameters " \
-        "(e.g. [\"created_at >= ?\", time]) or a hash of conditions, not a raw SQL string"
+        "(e.g. [\"created_at >= ?\", time]) or a hash of conditions without JavaScript operators"
     end
     custom_filter
   end
 
+  # Returns whether the value contains MongoDB query operators which execute JavaScript.
+  # @param [Object] value Value to check
+  # @return [Boolean] Whether the value contains JavaScript query operators
+  def self.contains_javascript_query_operator?(value)
+    case value
+    when Hash
+      value.any? { |k, v| JAVASCRIPT_QUERY_OPERATORS.include?(k.to_s) || contains_javascript_query_operator?(v) }
+    when Array
+      value.any? { |v| contains_javascript_query_operator?(v) }
+    else
+      false
+    end
+  end
+  private_class_method :contains_javascript_query_operator?
+
+  # Returns message verifier to generate and verify tokens to open notifications by move action.
+  # @return [ActiveSupport::MessageVerifier] Message verifier for open tokens
+  def self.open_token_verifier
+    Rails.application.message_verifier("activity_notification_open_token")
+  end
+
   # Casts to indifferent hash
   # @param [ActionController::Parameters, Hash] hash
   # @return [HashWithIndifferentAccess] Converted indifferent hash

data/lib/activity_notification/config.rb

@@ -249,6 +249,15 @@ module ActivityNotification
     #   @return [Boolean] Whether the REST API restricts embedded associated records to their id and printable_* method values.
     attr_accessor :restrict_api_response_fields
 
+    # @overload max_index_limit
+    #   Returns maximum number of records that notification and subscription index actions of the controllers return
+    #   @return [Integer, nil] Maximum number of records that index actions return.
+    # @overload max_index_limit=(value)
+    #   Sets maximum number of records that notification and subscription index actions of the controllers return. The limit request parameter is capped by this value, and this value is used when the limit parameter is not specified. Set nil to remove the cap.
+    #   @param [Integer, nil] max_index_limit The new max_index_limit
+    #   @return [Integer, nil] Maximum number of records that index actions return.
+    attr_accessor :max_index_limit
+
     # Initialize configuration for ActivityNotification.
     # These configuration can be overridden in initializer.
     # @return [Config] A new instance of Config
@@ -282,6 +291,7 @@ module ActivityNotification
       @notification_api_channel_prefix          = 'activity_notification_api_channel'
       @rescue_optional_target_errors            = true
       @restrict_api_response_fields             = false
+      @max_index_limit                          = 1000
     end
 
     # Sets ORM name for ActivityNotification (:active_record, :mongoid or :dynamodb)

data/lib/activity_notification/controllers/common_controller.rb

@@ -103,6 +103,15 @@ module ActivityNotification
         render status: 400, json: error_response(code: 400, message: "Invalid parameter", type: message)
       end
 
+      # Returns limit for index actions from request parameter, capped by ActivityNotification.config.max_index_limit.
+      # @api protected
+      # @return [Integer, nil] Limit for index actions
+      def index_limit
+        limit     = params[:limit].to_i > 0 ? params[:limit].to_i : nil
+        max_limit = ActivityNotification.config.max_index_limit
+        max_limit ? [limit || max_limit, max_limit].min : limit
+      end
+
       # Validate param and return HTTP 400 unless it presents.
       # @api protected
       # @param [String, Symbol] param_name Parameter name to validate

data/lib/activity_notification/controllers/concerns/swagger/notifications_api.rb

@@ -294,11 +294,18 @@ module ActivityNotification
           parameter do
             key :name, :open
             key :in, :query
-            key :description, "Whether the notification will be opened"
+            key :description, "Whether the notification will be opened. The notification is opened only with a valid open_token, since GET requests are not protected from CSRF. Use PUT /{target_type}/{target_id}/notifications/{id}/open with move parameter to open and move without a token."
             key :required, false
             key :type, :boolean
             key :default, false
           end
+          parameter do
+            key :name, :open_token
+            key :in, :query
+            key :description, "Token to open the notification with open parameter, which is generated by Notification#open_token and added by move_notification_path_for and move_notification_url_for helpers"
+            key :required, false
+            key :type, :string
+          end
 
           response 302 do
             key :description, "Redirection to notifiable path"

data/lib/activity_notification/helpers/view_helpers.rb

@@ -21,7 +21,7 @@ module ActivityNotification
         notifications.render self, options
       elsif notifications.respond_to?(:map)
         return nil if (notifications.respond_to?(:empty?) ? notifications.empty? : notifications.to_a.empty?)
-        notifications.map {|notification| notification.render self, options.dup }.join.html_safe
+        safe_join(notifications.map {|notification| notification.render self, options.dup })
       end
     end
     alias_method :render_notifications, :render_notification
@@ -111,7 +111,7 @@ module ActivityNotification
     # @todo Needs any other better implementation
     # @todo Must handle devise namespace
     def move_notification_path_for(notification, params = {})
-      options = params.dup
+      options = move_notification_options(notification, params)
       options.delete(:devise_default_routes) ?
         send("move_#{routing_scope(options)}notification_path", notification, options) :
         send("move_#{routing_scope(options)}#{notification.target.to_resource_name}_notification_path", notification.target, notification, options)
@@ -195,7 +195,7 @@ module ActivityNotification
     # @todo Needs any other better implementation
     # @todo Must handle devise namespace
     def move_notification_url_for(notification, params = {})
-      options = params.dup
+      options = move_notification_options(notification, params)
       options.delete(:devise_default_routes) ?
         send("move_#{routing_scope(options)}notification_url", notification, options) :
         send("move_#{routing_scope(options)}#{notification.target.to_resource_name}_notification_url", notification.target, notification, options)
@@ -553,6 +553,14 @@ module ActivityNotification
         [root, path].map(&:to_s).join('/')
       end
 
+      # Prepare options for move_notification path with token to open the notification
+      # @api private
+      def move_notification_options(notification, params)
+        options = params.dup
+        options[:open_token] = notification.open_token if options[:open].to_s.to_boolean(false)
+        options
+      end
+
       # Prepare routing scope from options
       # @api private
       def routing_scope(options = {})

data/lib/activity_notification/version.rb

@@ -1,3 +1,3 @@
 module ActivityNotification
-  VERSION = "2.7.0"
+  VERSION = "2.7.2"
 end

data/lib/generators/templates/activity_notification.rb

@@ -129,4 +129,9 @@ ActivityNotification.configure do |config|
   # your application (see the :with_devise routing option). Default value is false.
   # config.restrict_api_response_fields = false
 
+  # Configure maximum number of records that notification and subscription index actions of the controllers return.
+  # The limit request parameter is capped by this value, and this value is used when the limit parameter is not specified.
+  # Set nil to remove the cap. Default value is 1000.
+  # config.max_index_limit = 1000
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activity_notification
 version: !ruby/object:Gem::Version
-  version: 2.7.0
+  version: 2.7.2
 platform: ruby
 authors:
 - Shota Yamazaki