api-auth 1.2.4 → 1.2.5

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+# 1.2.5 (2014-09-09)
+- Fix a bug where ApiAuth.authentic? would cause an ArgumentError when given a
+  request with an invalid date in the date header. It will now return false
+  instead. (#51 Nakort)
+
 # 1.2.4 (2014-08-27)
 - Fix a bug in the Net::HTTP request driver where the md5 isn't calculated
   correctly when the content of the request is set with the `.body_stream`

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    api-auth (1.2.4)
+    api-auth (1.2.5)
 
 GEM
   remote: https://rubygems.org/

data/VERSION

@@ -1 +1 @@
-1.2.4
+1.2.5

data/gemfiles/rails_23.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    api-auth (1.2.4)
+    api-auth (1.2.5)
 
 GEM
   remote: https://rubygems.org/

data/gemfiles/rails_30.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    api-auth (1.2.4)
+    api-auth (1.2.5)
 
 GEM
   remote: https://rubygems.org/

data/gemfiles/rails_31.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    api-auth (1.2.4)
+    api-auth (1.2.5)
 
 GEM
   remote: https://rubygems.org/

data/gemfiles/rails_32.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    api-auth (1.2.4)
+    api-auth (1.2.5)
 
 GEM
   remote: https://rubygems.org/

data/gemfiles/rails_4.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    api-auth (1.2.4)
+    api-auth (1.2.5)
 
 GEM
   remote: https://rubygems.org/

data/gemfiles/rails_41.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    api-auth (1.2.4)
+    api-auth (1.2.5)
 
 GEM
   remote: https://rubygems.org/

data/lib/api_auth/base.rb

@@ -1,4 +1,5 @@
-# api-auth is Ruby gem designed to be used both in your client and server
+# encoding: UTF-8
+# api-auth is a Ruby gem designed to be used both in your client and server
 # HTTP-based applications. It implements the same authentication methods (HMAC)
 # used by Amazon Web Services.
 
@@ -60,7 +61,11 @@ module ApiAuth
     def request_too_old?(request)
       headers = Headers.new(request)
       # 900 seconds is 15 minutes
-      Time.parse(headers.timestamp).utc < (Time.now.utc - 900)
+      begin 
+        Time.httpdate(headers.timestamp).utc < (Time.now.utc - 900)
+      rescue ArgumentError
+        true
+      end
     end
 
     def md5_mismatch?(request)

data/spec/api_auth_spec.rb

@@ -1,3 +1,4 @@
+# encoding: UTF-8
 require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
 
 describe "ApiAuth" do
@@ -109,6 +110,12 @@ describe "ApiAuth" do
         ApiAuth.authentic?(signed_request, @secret_key).should be_false
       end
 
+      it "should NOT authenticate a request with an invalid date" do
+        @request['Date'] = "٢٠١٤-٠٩-٠٨ ١٦:٣١:١٤ +٠٣٠٠"
+        signed_request = ApiAuth.sign!(@request, @access_id, @secret_key)
+        ApiAuth.authentic?(signed_request, @secret_key).should be_false
+      end
+
       it "should retrieve the access_id" do
         ApiAuth.access_id(@signed_request).should == "1044"
       end
@@ -229,6 +236,12 @@ describe "ApiAuth" do
         ApiAuth.authentic?(signed_request, @secret_key).should be_false
       end
 
+      it "should NOT authenticate a request with an invalid date" do
+        @request.headers['Date'] = "٢٠١٤-٠٩-٠٨ ١٦:٣١:١٤ +٠٣٠٠"
+        signed_request = ApiAuth.sign!(@request, @access_id, @secret_key)
+        ApiAuth.authentic?(signed_request, @secret_key).should be_false
+      end
+
       it "should retrieve the access_id" do
         ApiAuth.access_id(@signed_request).should == "1044"
       end
@@ -285,6 +298,12 @@ describe "ApiAuth" do
         ApiAuth.authentic?(signed_request, @secret_key).should be_false
       end
 
+      it "should NOT authenticate a request with an invalid date" do
+        @request.headers['Date'] = "٢٠١٤-٠٩-٠٨ ١٦:٣١:١٤ +٠٣٠٠"
+        signed_request = ApiAuth.sign!(@request, @access_id, @secret_key)
+        ApiAuth.authentic?(signed_request, @secret_key).should be_false
+      end
+
       it "should retrieve the access_id" do
         ApiAuth.access_id(@signed_request).should == "1044"
       end
@@ -373,6 +392,12 @@ describe "ApiAuth" do
         ApiAuth.authentic?(signed_request, @secret_key).should be_false
       end
 
+      it "should NOT authenticate a request with an invalid date" do
+        @request.env['Date'] = "٢٠١٤-٠٩-٠٨ ١٦:٣١:١٤ +٠٣٠٠"
+        signed_request = ApiAuth.sign!(@request, @access_id, @secret_key)
+        ApiAuth.authentic?(signed_request, @secret_key).should be_false
+      end
+
       it "should retrieve the access_id" do
         ApiAuth.access_id(@signed_request).should == "1044"
       end
@@ -446,6 +471,12 @@ describe "ApiAuth" do
         ApiAuth.authentic?(signed_request, @secret_key).should be_false
       end
 
+      it "should NOT authenticate a request with an invalid date" do
+        @request.env['Date'] = "٢٠١٤-٠٩-٠٨ ١٦:٣١:١٤ +٠٣٠٠"
+        signed_request = ApiAuth.sign!(@request, @access_id, @secret_key)
+        ApiAuth.authentic?(signed_request, @secret_key).should be_false
+      end
+
       it "should retrieve the access_id" do
         ApiAuth.access_id(@signed_request).should == "1044"
       end
@@ -521,6 +552,12 @@ describe "ApiAuth" do
         ApiAuth.authentic?(signed_request, @secret_key).should be_false
       end
 
+      it "should NOT authenticate a request with an invalid date" do
+        @request.headers['Date'] = "٢٠١٤-٠٩-٠٨ ١٦:٣١:١٤ +٠٣٠٠"
+        signed_request = ApiAuth.sign!(@request, @access_id, @secret_key)
+        ApiAuth.authentic?(signed_request, @secret_key).should be_false
+      end
+
       it "should retrieve the access_id" do
         ApiAuth.access_id(@signed_request).should == "1044"
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: api-auth
 version: !ruby/object:Gem::Version
-  version: 1.2.4
+  version: 1.2.5
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-08-27 00:00:00.000000000 Z
+date: 2014-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: appraisal
@@ -254,7 +254,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -2860665435517215427
+      hash: -2923652677947194929
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -263,7 +263,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -2860665435517215427
+      hash: -2923652677947194929
 requirements: []
 rubyforge_project: 
 rubygems_version: 1.8.23.2