aspera-cli 4.27.0 → 4.27.2

data/lib/aspera/log.rb

@@ -20,13 +20,13 @@ class Logger
 
   # Add custom level to logger severity, below debug level
   module Severity
-    1.upto(TRACE_MAX).each{ |level| const_set(:"TRACE#{level}", - level)}
+    1.upto(TRACE_MAX).each { |level| const_set(:"TRACE#{level}", - level) }
   end
 
   # Hash
   # key   [Integer] Log level (e.g. 0 for DEBUG)
   # value [Symbol]  Uppercase log level label (e.g. :DEBUG)
-  SEVERITY_LABEL = Severity.constants.to_h{ |name| [Severity.const_get(name), name]}
+  SEVERITY_LABEL = Severity.constants.to_h { |name| [Severity.const_get(name), name] }
 
   # Override
   # @param severity [Integer] Log severity as int
@@ -42,14 +42,14 @@ class Logger
     def make_methods(str_level)
       int_level = ::Logger.const_get(str_level.upcase)
       method_base = str_level.downcase
-      define_method(method_base, ->(message = nil, &block){add(int_level, message, &block)})
-      define_method("#{method_base}?", ->{level <= int_level})
-      define_method("#{method_base}!", ->{self.level = int_level})
+      define_method(method_base, ->(message = nil, &block) { add(int_level, message, &block) })
+      define_method("#{method_base}?", -> { level <= int_level })
+      define_method("#{method_base}!", -> { self.level = int_level })
       nil
     end
   end
   # Declare methods for all levels
-  Logger::Severity.constants.each{ |severity| make_methods(severity)}
+  Logger::Severity.constants.each { |severity| make_methods(severity) }
 end
 
 # Restore warnings
@@ -68,7 +68,7 @@ module Aspera
     LOG_TYPES = %i[stderr stdout syslog].freeze
 
     # Levels are :trace2,:trace1,:debug,:info,:warn,:error,fatal,:unknown
-    LEVELS = Logger::Severity.constants.sort{ |a, b| Logger::Severity.const_get(a) <=> Logger::Severity.const_get(b)}.map{ |c| c.downcase.to_sym}.freeze
+    LEVELS = Logger::Severity.constants.sort { |a, b| Logger::Severity.const_get(a) <=> Logger::Severity.const_get(b) }.map { |c| c.downcase.to_sym }.freeze
 
     # Class methods
     class << self
@@ -100,7 +100,7 @@ module Aspera
             JSON.pretty_generate(object) rescue PP.pp(object, +'')
           when :ruby
             PP.pp(object, +'')
-          else Aspera.error_unexpected_value(instance.dump_format){'dump format'}
+          else Aspera.error_unexpected_value(instance.dump_format) { 'dump format' }
           end
         "#{name.to_s.green}(#{instance.dump_format})#{object.class}=\n#{dump_text}"
       end
@@ -119,7 +119,7 @@ module Aspera
       # Returns the last 2 containers (module/class) and method caller
       def caller_method
         stack = caller
-        i = stack.rindex{ |line| line.include?('Logger')}
+        i = stack.rindex { |line| line.include?('Logger') }
         frame = stack[i + 1] if i && stack[i + 1]
         return '???' unless frame
         # Extract the "Class::Module::Method" or "Class#method" part
@@ -166,7 +166,7 @@ module Aspera
     # @return [nil]
     def formatter=(formatter)
       if formatter.is_a?(String)
-        Aspera.assert(FORMATTER_LAMBDAS.key?(formatter.to_sym), type: Error){"Unknown formatter #{formatter}, use one of: #{FORMATTERS.join(', ')}"}
+        Aspera.assert(FORMATTER_LAMBDAS.key?(formatter.to_sym), type: Error) { "Unknown formatter #{formatter}, use one of: #{FORMATTERS.join(', ')}" }
         formatter = FORMATTER_LAMBDAS[formatter.to_sym]
       elsif !formatter.respond_to?(:call) && !formatter.is_a?(Logger::Formatter)
         raise Error, 'Formatter must be a String, a Logger::Formatter or a Proc'
@@ -210,7 +210,7 @@ module Aspera
         end
         # Use `local2` facility, like other Aspera components
         @logger = Syslog::Logger.new(@program_name, Syslog::LOG_LOCAL2)
-      else Aspera.error_unexpected_value(new_log_type){"log type (#{LOG_TYPES.join(', ')})"}
+      else Aspera.error_unexpected_value(new_log_type) { "log type (#{LOG_TYPES.join(', ')})" }
       end
       @logger.level = current_severity_integer
       @logger_type = new_log_type
@@ -247,13 +247,13 @@ module Aspera
       [k, short_levl(k).apply(*v)]
     end.freeze
 
-    DEFAULT_FORMATTER = ->(s, _d, _p, m){"#{LVL_COLOR[s]} #{m}\n"}
+    DEFAULT_FORMATTER = ->(s, _d, _p, m) { "#{LVL_COLOR[s]} #{m}\n" }
 
     # pre-defined formatters
     FORMATTER_LAMBDAS = {
       standard: Logger::Formatter.new,
       default:  DEFAULT_FORMATTER,
-      caller:   ->(s, _d, _p, m){"#{LVL_COLOR[s]} #{Log.caller_method}\n#{m}\n"}
+      caller:   ->(s, _d, _p, m) { "#{LVL_COLOR[s]} #{Log.caller_method}\n#{m}\n" }
     }.freeze
 
     FORMATTERS = FORMATTER_LAMBDAS.keys

data/lib/aspera/markdown.rb

@@ -80,12 +80,12 @@ module Aspera
       def table(table)
         # get max width of each columns
         col_widths = table.transpose.map do |col|
-          [col.flat_map{ |c| c.to_s.delete('`').split(HTML_BREAK).map(&:size)}.max, COL_WIDTH].min
+          [col.flat_map { |c| c.to_s.delete('`').split(HTML_BREAK).map(&:size) }.max, COL_WIDTH].min
         end
         headings = table.shift
-        table.unshift(col_widths.map{ |col_width| '-' * col_width})
+        table.unshift(col_widths.map { |col_width| '-' * col_width })
         table.unshift(headings)
-        lines = table.map{ |line| "| #{line.map{ |i| i.to_s.gsub('\\', '\\\\').gsub('|', '\|')}.join(' | ')} |\n"}
+        lines = table.map { |line| "| #{line.map { |i| i.to_s.gsub('\\', '\\\\').gsub('|', '\|') }.join(' | ')} |\n" }
         lines[1] = lines[1].tr(' ', '-')
         return lines.join.chomp
       end
@@ -94,7 +94,7 @@ module Aspera
       # @param items [Array<String>] list of items
       # @return [String] markdown unordered list
       def list(items)
-        items.map{ |i| "- #{i}"}.join("\n")
+        items.map { |i| "- #{i}" }.join("\n")
       end
 
       # Generate a markdown heading
@@ -110,7 +110,7 @@ module Aspera
       # @param type [String] admonition type: NOTE, CAUTION, WARNING, IMPORTANT, TIP, INFO
       # @return [String] markdown admonition block
       def admonition(lines, type: 'INFO')
-        "> [!#{type}]\n#{lines.map{ |l| "> #{l}"}.join("\n")}\n\n"
+        "> [!#{type}]\n#{lines.map { |l| "> #{l}" }.join("\n")}\n\n"
       end
 
       # Generate a fenced code block

data/lib/aspera/nagios.rb

@@ -17,7 +17,7 @@ module Aspera
     # add methods to add nagios error levels, each take component name and message
     LEVELS.each_index do |code|
       name = "#{ADD_PREFIX}#{LEVELS[code]}".to_sym
-      define_method(name){ |comp, msg| @data.push({code: code, comp: comp, msg: msg})}
+      define_method(name) { |comp, msg| @data.push({code: code, comp: comp, msg: msg}) }
     end
 
     class << self
@@ -26,18 +26,18 @@ module Aspera
         Aspera.assert_type(data, Array)
         Aspera.assert(!data.empty?, 'data is empty')
         %w[status component message].each do |c|
-          Aspera.assert(data.first.key?(c)){"result must have #{c}"}
+          Aspera.assert(data.first.key?(c)) { "result must have #{c}" }
         end
-        res_errors = data.reject{ |s| s['status'].eql?('ok')}
+        res_errors = data.reject { |s| s['status'].eql?('ok') }
         # keep only errors in case of problem, other ok are assumed so
         data = res_errors unless res_errors.empty?
         # first is most critical
-        data.sort!{ |a, b| LEVELS.index(a['status'].to_sym) <=> LEVELS.index(b['status'].to_sym)}
+        data.sort! { |a, b| LEVELS.index(a['status'].to_sym) <=> LEVELS.index(b['status'].to_sym) }
         # build message: if multiple components: concatenate
         # message = data.map{|i|"#{i['component']}:#{i['message']}"}.join(', ').gsub("\n",' ')
         message = data
-          .group_by{ |d| d['component']}
-          .map{ |comp, items| "#{comp}:#{items.map{ |d| d['message']}.join(',')}"}
+          .group_by { |d| d['component'] }
+          .map { |comp, items| "#{comp}:#{items.map { |d| d['message'] }.join(',')}" }
           .join(', ')
           .tr("\n", ' ')
         status = data.first['status'].upcase
@@ -60,7 +60,7 @@ module Aspera
       remote_time = Time.parse(remote_date)
       diff_time = (remote_time - Time.now).abs
       diff_rounded = diff_time.round(-2)
-      Log.log.debug{"DATE: #{remote_date} #{remote_time} diff=#{diff_rounded}"}
+      Log.log.debug { "DATE: #{remote_date} #{remote_time} diff=#{diff_rounded}" }
       msg = "offset #{diff_rounded} sec"
       if diff_time >= DATE_CRIT_OFFSET
         add_critical(component, msg)
@@ -80,7 +80,7 @@ module Aspera
     # @return [Array] of Hash
     def status_list
       Aspera.assert(!@data.empty?, 'missing result')
-      @data.map{ |i| {'status' => LEVELS[i[:code]].to_s, 'component' => i[:comp], 'message' => i[:msg]}}
+      @data.map { |i| {'status' => LEVELS[i[:code]].to_s, 'component' => i[:comp], 'message' => i[:msg]} }
     end
   end
 end

data/lib/aspera/node_simulator.rb

@@ -10,7 +10,7 @@ require 'json'
 module Aspera
   class NodeSimulator
     def initialize
-      @agent = Agent::Direct.new(management_cb: ->(event){process_event(event)})
+      @agent = Agent::Direct.new(management_cb: ->(event) { process_event(event) })
       @sessions = {}
     end
 
@@ -19,7 +19,7 @@ module Aspera
     end
 
     def all_sessions
-      @agent.sessions.map{ |session| session[:job_id]}.uniq.each.map{ |job_id| job_to_transfer(job_id)}
+      @agent.sessions.map { |session| session[:job_id] }.uniq.each.map { |job_id| job_to_transfer(job_id) }
     end
 
     # status: ('waiting', 'partially_completed', 'unknown', 'waiting(read error)',] 'running', 'completed', 'failed'
@@ -131,27 +131,27 @@ module Aspera
     def process_event(event)
       # Code duplicated on purpose, as implementation goes, blocks will be replaced
       case event['Type']
-      when 'NOP' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
+      when 'NOP' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
       # rubocop:disable Lint/DuplicateBranch
-      when 'START' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'QUERY' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'QUERYRSP' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'STATS' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'STOP' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'ERROR' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'CANCEL' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'DONE' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'RATE' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'FILEERROR' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'SESSION' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'NOTIFICATION' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'INIT' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'VLINK' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'PUT' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'WRITE' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'CLOSE' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'SKIP' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
-      when 'ARGSTOP' then Aspera.Log.debug{"event not managed: #{event['Type']}"}
+      when 'START' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'QUERY' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'QUERYRSP' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'STATS' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'STOP' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'ERROR' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'CANCEL' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'DONE' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'RATE' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'FILEERROR' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'SESSION' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'NOTIFICATION' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'INIT' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'VLINK' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'PUT' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'WRITE' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'CLOSE' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'SKIP' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
+      when 'ARGSTOP' then Aspera.Log.debug { "event not managed: #{event['Type']}" }
       # rubocop:enable Lint/DuplicateBranch
       else Aspera.error_unreachable_line
       end
@@ -164,19 +164,25 @@ module Aspera
     PATH_TRANSFERS = '/ops/transfers'
     PATH_ONE_TRANSFER = %r{/ops/transfers/(.+)$}
     PATH_BROWSE = '/files/browse'
-    # @param app_api [Api::AoC]
-    # @param app_context [String]
+    # @param credentials [Hash]
+    # @param simulator   [NodeSimulator]
     def initialize(server, credentials, simulator)
       super(server)
       @credentials = credentials
       @simulator = simulator
+      # Resolve once at startup; default to current working directory
+      @browse_root = File.realpath(credentials[:browse_root] || Dir.pwd)
     end
 
     require 'json'
     require 'time'
 
     def folder_to_structure(folder_path)
-      Aspera.assert(Dir.exist?(folder_path)){"Path does not exist or is not a directory: #{folder_path}"}
+      # Resolve and confine to browse_root (prevents path traversal via client-supplied path)
+      resolved = File.realpath(folder_path)
+      Aspera.assert(resolved.start_with?("#{@browse_root}/") || resolved.eql?(@browse_root)) { 'Browse path traversal attempt detected' }
+      Aspera.assert(Dir.exist?(resolved)) { "Path does not exist or is not a directory: #{resolved}" }
+      folder_path = resolved
 
       # Build self structure
       folder_stat = File.stat(folder_path)
@@ -242,7 +248,7 @@ module Aspera
       when PATH_BROWSE
         req = JSON.parse(request.body)
         # req['count']
-        set_json_response(request, response, folder_to_structure(req['path']))
+        set_json_response(request, response, folder_to_structure(req['path'] || @browse_root))
       else
         set_json_response(request, response, [{error: 'Bad request'}], code: 400)
       end
@@ -332,7 +338,7 @@ module Aspera
       response.status = code
       response['Content-Type'] = Mime::JSON
       response.body = json.to_json
-      Log.log.trace1{Log.obj_dump("response for #{request.request_method} #{request.path}", json)}
+      Log.log.trace1 { Log.obj_dump("response for #{request.request_method} #{request.path}", json) }
     end
   end
 end

data/lib/aspera/oauth/base.rb

@@ -51,7 +51,7 @@ module Aspera
       # @return [Net::HTTPResponse] raw HTTP response with token
       # @raise [RestCallError] if not 2XX code
       def create_token_call(creation_params)
-        Log.log.debug{'Generating a new token'.bg_green}
+        Log.log.debug { 'Generating a new token'.bg_green }
         return @api.create(@path_token, nil, query: creation_params, ret: :resp) if @use_query
         return @api.create(@path_token, creation_params, content_type: Mime::WWW, ret: :resp)
       end
@@ -87,7 +87,7 @@ module Aspera
           # `direct` agent is equipped with refresh code
           # an API was already called, but failed, we need to regenerate or refresh
           if refresh || token_info[:expired]
-            Log.log.trace1{"refresh: #{refresh} expired: #{token_info[:expired]}"}
+            Log.log.trace1 { "refresh: #{refresh} expired: #{token_info[:expired]}" }
             refresh_token = nil
             if token_data.key?('refresh_token') && !token_data['refresh_token'].eql?('not_supported')
               # save possible refresh token, before deleting the cache
@@ -99,7 +99,6 @@ module Aspera
             # lets try the existing refresh token
             # NOTE: AoC admin token has no refresh, and lives by default 1800secs
             if !refresh_token.nil?
-              Log.log.debug{"refresh token=[#{refresh_token}]"}
               begin
                 http = create_token_call(base_params(add_secret: true).merge(grant_type: 'refresh_token', refresh_token: refresh_token))
                 # Save only if success
@@ -108,7 +107,7 @@ module Aspera
                 Factory.instance.persist_mgr.put(@token_cache_id, json_data)
               rescue StandardError => e
                 # Refresh token can fail.
-                Log.log.warn{"Refresh failed: #{e}"}
+                Log.log.warn { "Refresh failed: #{e}" }
               end
             end
           end
@@ -122,7 +121,7 @@ module Aspera
           token_data = JSON.parse(json_data)
           Factory.instance.persist_mgr.put(@token_cache_id, json_data)
         end
-        Aspera.assert(token_data.key?(@token_field)){"API error: No such field in answer: #{@token_field}"} unless token_data.nil?
+        Aspera.assert(token_data.key?(@token_field)) { "API error: No such field in answer: #{@token_field}" } unless token_data.nil?
         # ok we shall have a token here
         return token_data[@token_field]
       end

data/lib/aspera/oauth/boot.rb

@@ -19,13 +19,13 @@ module Aspera
           Aspera.assert(username, 'Provide --password (cookie) on first use, or --username for cache lookup', type: ParameterError)
           super(**base_params, cache_ids: [username])
         else
-          cookies = cookie.split('; ').map{ |p| p.split('=', 2)}.to_h
+          cookies = cookie.split('; ').map { |p| p.split('=', 2) }.to_h
           Aspera.assert(cookies.key?('aoc.token'), '--password cookie does not contain aoc.token', type: ParameterError)
           token = cookies['aoc.token']
           decoded = Factory.instance.decode_token(token)
-          Aspera.assert_type(decoded, Hash){'Boot: token is not a decodable JWT'}
+          Aspera.assert_type(decoded, Hash) { 'Boot: token is not a decodable JWT' }
           sub = decoded['sub']
-          Aspera.assert(username.nil? || username.eql?(sub)){"Boot: --username #{username} does not match token subject #{sub}"}
+          Aspera.assert(username.nil? || username.eql?(sub)) { "Boot: --username #{username} does not match token subject #{sub}" }
           super(**base_params, cache_ids: [sub])
           token_data = {Factory::TOKEN_FIELD => token}
           token_data['refresh_token'] = cookies['aoc.refresh'] if cookies.key?('aoc.refresh')

data/lib/aspera/oauth/factory.rb

@@ -41,7 +41,7 @@ module Aspera
         # @param authorization [String] The authorization header value
         # @return [String] The bearer token without the scheme prefix
         def bearer_token(authorization)
-          Aspera.assert(bearer_auth?(authorization)){'not a bearer token, wrong prefix scheme'}
+          Aspera.assert(bearer_auth?(authorization)) { 'not a bearer token, wrong prefix scheme' }
           return authorization.delete_prefix(SPACE_BEARER_AUTH_SCHEME)
         end
 
@@ -178,7 +178,7 @@ module Aspera
       def register_token_creator(creator_class)
         Aspera.assert_type(creator_class, Class)
         id = Factory.class_to_id(creator_class)
-        Log.log.debug{"registering creator for #{id}"}
+        Log.log.debug { "registering creator for #{id}" }
         @token_type_classes[id] = creator_class
         nil
       end
@@ -189,12 +189,12 @@ module Aspera
       def create(**parameters)
         Aspera.assert_type(parameters, Hash)
         id = parameters[:grant_method]
-        Aspera.assert(@token_type_classes.key?(id)){"token grant method unknown: '#{id}'"}
-        create_parameters = parameters.reject{ |k, _v| k.eql?(:grant_method)}
+        Aspera.assert(@token_type_classes.key?(id)) { "token grant method unknown: '#{id}'" }
+        create_parameters = parameters.reject { |k, _v| k.eql?(:grant_method) }
         @token_type_classes[id].new(**create_parameters)
       end
     end
     # JSON Web Signature (JWS) compact serialization: https://datatracker.ietf.org/doc/html/rfc7515
-    Factory.instance.register_decoder(lambda{ |token| parts = token.split('.'); Aspera.assert_values(parts.length, [3]){'JWS token parts'}; JSON.parse(Base64.decode64(parts[1]))}) # rubocop:disable Style/Semicolon
+    Factory.instance.register_decoder(lambda { |token| parts = token.split('.'); Aspera.assert_values(parts.length, [3]) { 'JWS token parts' }; JSON.parse(Base64.decode64(parts[1])) }) # rubocop:disable Style/Semicolon
   end
 end

data/lib/aspera/oauth/jwt.rb

@@ -36,10 +36,10 @@ module Aspera
         cache_ids: [],
         **base_params
       )
-        Aspera.assert_type(private_key_obj, OpenSSL::PKey::RSA){'private_key_obj'}
-        Aspera.assert_type(payload, Hash){'payload'}
-        Aspera.assert_type(headers, Hash){'headers'}
-        Aspera.assert_type(cache_ids, Array){'cache ids'}
+        Aspera.assert_type(private_key_obj, OpenSSL::PKey::RSA) { 'private_key_obj' }
+        Aspera.assert_type(payload, Hash) { 'payload' }
+        Aspera.assert_type(headers, Hash) { 'headers' }
+        Aspera.assert_type(cache_ids, Array) { 'cache ids' }
         new_cache_ids = cache_ids.clone.push(payload[:sub])
         super(**base_params, cache_ids: new_cache_ids)
         @private_key_obj = private_key_obj
@@ -50,7 +50,7 @@ module Aspera
       def create_token
         require 'jwt'
         seconds_since_epoch = Time.now.to_i
-        Log.log.debug{"seconds_since_epoch=#{seconds_since_epoch}"}
+        Log.log.debug { "seconds_since_epoch=#{seconds_since_epoch}" }
         jwt_payload = {
           exp: seconds_since_epoch + OAuth::Factory.instance.parameters[:jwt_expiry_offset_sec], # expiration time
           nbf: seconds_since_epoch - OAuth::Factory.instance.parameters[:jwt_accepted_offset_sec], # not before
@@ -58,9 +58,7 @@ module Aspera
           jti: SecureRandom.uuid # JWT id
         }.merge(@additional_payload)
         Log.dump(:jwt_payload, jwt_payload)
-        Log.log.debug{"private=[#{@private_key_obj}]"}
         assertion = JWT.encode(jwt_payload, @private_key_obj, 'RS256', @headers)
-        Log.log.debug{"assertion=[#{assertion}]"}
         return create_token_call(base_params.merge(grant_type: GRANT_TYPE, assertion: assertion))
       end
     end

data/lib/aspera/oauth/web.rb

@@ -22,9 +22,9 @@ module Aspera
         @redirect_uri = redirect_uri
         @path_authorize = path_authorize
         uri = URI.parse(@redirect_uri)
-        Aspera.assert_values(uri.scheme, %w[http https]){'redirect_uri scheme must be http or https'}
+        Aspera.assert_values(uri.scheme, %w[http https]) { 'redirect_uri scheme must be http or https' }
         Aspera.assert(!uri.port.nil?, 'redirect_uri must have a port')
-        # TODO: we could check that host is localhost or local address, as we are going to listen locally
+        Aspera.assert(%w[127.0.0.1 ::1 localhost].include?(uri.host)) { 'redirect_uri host must be localhost or loopback address' }
       end
 
       def create_token
@@ -35,14 +35,14 @@ module Aspera
           base_params.merge(response_type: 'code', redirect_uri: @redirect_uri, state: random_state)
         )
         # here, we need a human to authorize on a web page
-        Log.log.debug{"login_page_url=#{login_page_url}"}
+        Log.log.debug { "login_page_url=#{login_page_url}" }
         # start a web server to receive request code
         web_server = WebAuth.new(@redirect_uri, self.class.additional_info)
         # start browser on login page
         Environment.instance.open_uri(login_page_url)
         # wait for code in request
         received_params = web_server.received_request
-        Aspera.assert(random_state.eql?(received_params['state'])){'wrong received state'}
+        Aspera.assert(random_state.eql?(received_params['state'])) { 'wrong received state' }
         # exchange code for token
         return create_token_call(base_params(add_secret: true).merge(
           grant_type:   'authorization_code',

data/lib/aspera/persistency_action_once.rb

@@ -8,9 +8,9 @@ module Aspera
   # Persist data on file system
   class PersistencyActionOnce
     DELETE_DEFAULT = lambda(&:empty?)
-    PARSE_DEFAULT = lambda{ |t| JSON.parse(t)}
-    FORMAT_DEFAULT = lambda{ |h| JSON.generate(h)}
-    MERGE_DEFAULT = lambda{ |current, file| current.concat(file).uniq rescue current}
+    PARSE_DEFAULT = lambda { |t| JSON.parse(t) }
+    FORMAT_DEFAULT = lambda { |h| JSON.generate(h) }
+    MERGE_DEFAULT = lambda { |current, file| current.concat(file).uniq rescue current }
     MANAGER_METHODS = %i[get put delete]
     private_constant :DELETE_DEFAULT, :PARSE_DEFAULT, :FORMAT_DEFAULT, :MERGE_DEFAULT, :MANAGER_METHODS
 
@@ -22,7 +22,7 @@ module Aspera
     # @param format  [Proc]    Optional dump method (default to JSON)
     # @param merge   [Proc]    Optional merge data from file to current data
     def initialize(manager:, data:, id:, delete: DELETE_DEFAULT, parse: PARSE_DEFAULT, format: FORMAT_DEFAULT, merge: MERGE_DEFAULT)
-      Aspera.assert(MANAGER_METHODS.all?{ |i| manager.respond_to?(i)}){"Manager must answer to #{MANAGER_METHODS}"}
+      Aspera.assert(MANAGER_METHODS.all? { |i| manager.respond_to?(i) }) { "Manager must answer to #{MANAGER_METHODS}" }
       Aspera.assert(!data.nil?, 'data must not be nil')
       Aspera.assert_type(id, String)
       Aspera.assert(!id.empty?, 'id must not be empty')

data/lib/aspera/persistency_folder.rb

@@ -15,19 +15,19 @@ module Aspera
     def initialize(folder)
       @cache = {}
       @folder = folder
-      Log.log.debug{"persistency folder: #{@folder}"}
+      Log.log.debug { "persistency folder: #{@folder}" }
     end
 
     # Get value of persisted item
     # @param object_id [String] Identifier of persisted item
     # @return [String, nil] Persisted value, or nil if not found
     def get(object_id)
-      Log.log.debug{"persistency get: #{object_id}"}
+      Log.log.debug { "persistency get: #{object_id}" }
       if @cache.key?(object_id)
         Log.log.debug('got from memory cache')
       else
         persist_filepath = id_to_filepath(object_id)
-        Log.log.debug{"persistency = #{persist_filepath}"}
+        Log.log.debug { "persistency = #{persist_filepath}" }
         if File.exist?(persist_filepath)
           Log.log.debug('got from file cache')
           @cache[object_id] = File.read(persist_filepath)
@@ -43,7 +43,7 @@ module Aspera
     def put(object_id, value)
       Aspera.assert_type(value, String)
       persist_filepath = id_to_filepath(object_id)
-      Log.log.debug{"persistency saving: #{persist_filepath}"}
+      Log.log.debug { "persistency saving: #{persist_filepath}" }
       FileUtils.rm_f(persist_filepath)
       File.write(persist_filepath, value)
       Environment.restrict_file_access(persist_filepath)
@@ -55,7 +55,7 @@ module Aspera
     # @param object_id [String] Identifier of persisted item
     def delete(object_id)
       persist_filepath = id_to_filepath(object_id)
-      Log.log.debug{"persistency deleting: #{persist_filepath}"}
+      Log.log.debug { "persistency deleting: #{persist_filepath}" }
       FileUtils.rm_f(persist_filepath)
       @cache.delete(object_id)
     end
@@ -68,11 +68,11 @@ module Aspera
       garbage_files = current_files(persist_category)
       if !max_age_seconds.nil?
         current_time = Time.now
-        garbage_files.select!{ |filepath| (current_time - File.stat(filepath).mtime).to_i > max_age_seconds}
+        garbage_files.select! { |filepath| (current_time - File.stat(filepath).mtime).to_i > max_age_seconds }
       end
       garbage_files.each do |filepath|
         File.delete(filepath)
-        Log.log.debug{"persistency deleted expired: #{filepath}"}
+        Log.log.debug { "persistency deleted expired: #{filepath}" }
       end
       @cache.clear
       return garbage_files
@@ -86,7 +86,7 @@ module Aspera
     end
 
     def current_items(persist_category)
-      current_files(persist_category).to_h{ |i| [File.basename(i, FILE_SUFFIX), File.read(i)]}
+      current_files(persist_category).to_h { |i| [File.basename(i, FILE_SUFFIX), File.read(i)] }
     end
 
     private

data/lib/aspera/preview/file_types.rb

@@ -81,15 +81,15 @@ module Aspera
       # @return [Symbol] file type, one of enum CONVERSION_TYPES
       # @raise [RuntimeError] if no conversion type found
       def conversion_type(filepath, mimetype)
-        Log.log.debug{"conversion_type(#{filepath},mime=#{mimetype},magic=#{@use_mimemagic})"}
+        Log.log.debug { "conversion_type(#{filepath},mime=#{mimetype},magic=#{@use_mimemagic})" }
         # Default type or empty means no type
         mimetype = TYPE_NOT_FOUND if mimetype.nil? || (mimetype.is_a?(String) && mimetype.empty?)
         mimetype = Marcel::MimeType.for(Pathname.new(filepath), name: File.basename(filepath), declared_type: mimetype)
         mimetype = 'text/plain' if mimetype.eql?(TYPE_NOT_FOUND) && ascii_text_file?(filepath)
-        Aspera.assert(!mimetype.eql?(TYPE_NOT_FOUND)){"no MIME type found for #{File.basename(filepath)}"}
+        Aspera.assert(!mimetype.eql?(TYPE_NOT_FOUND)) { "no MIME type found for #{File.basename(filepath)}" }
         conversion_type = mime_to_type(mimetype)
-        Aspera.assert(!conversion_type.nil?){"no conversion type found for #{File.basename(filepath)}"}
-        Log.log.trace1{"conversion_type(#{File.basename(filepath)}): #{conversion_type.class.name} [#{conversion_type}]"}
+        Aspera.assert(!conversion_type.nil?) { "no conversion type found for #{File.basename(filepath)}" }
+        Log.log.trace1 { "conversion_type(#{File.basename(filepath)}): #{conversion_type.class.name} [#{conversion_type}]" }
         return conversion_type
       end