attr_encrypted 1.4.0 → 3.0.3

data/test/legacy_compatibility_test.rb

@@ -1,5 +1,5 @@
 # -*- encoding: utf-8 -*-
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 
 # Test to ensure that existing representations in database do not break on
 # migrating to new versions of this gem. This ensures that future versions of
@@ -12,10 +12,14 @@ class LegacyCompatibilityTest < Minitest::Test
     PET_BIRTHDATE_SALT = Digest::SHA256.hexdigest('my-really-really-secret-pet-birthdate-salt')
     PET_BIRTHDATE_KEY = 'my-really-really-secret-pet-birthdate-key'
 
+    self.attr_encrypted_options[:insecure_mode] = true
+    self.attr_encrypted_options[:algorithm] = 'aes-256-cbc'
+    self.attr_encrypted_options[:mode] = :single_iv_and_salt
+
     attr_encrypted :nickname,
-      :key => proc { Encryptor.encrypt(:value => PET_NICKNAME_SALT, :key => PET_NICKNAME_KEY) }
+      :key => proc { Encryptor.encrypt(:value => PET_NICKNAME_SALT, :key => PET_NICKNAME_KEY, insecure_mode: true, algorithm: 'aes-256-cbc') }
     attr_encrypted :birthdate,
-      :key => proc { Encryptor.encrypt(:value => PET_BIRTHDATE_SALT, :key => PET_BIRTHDATE_KEY) }
+      :key => proc { Encryptor.encrypt(:value => PET_BIRTHDATE_SALT, :key => PET_BIRTHDATE_KEY, insecure_mode: true, algorithm: 'aes-256-cbc') }
   end
 
   class LegacyMarshallingPet < ActiveRecord::Base
@@ -24,12 +28,16 @@ class LegacyCompatibilityTest < Minitest::Test
     PET_BIRTHDATE_SALT = Digest::SHA256.hexdigest('my-really-really-secret-pet-birthdate-salt')
     PET_BIRTHDATE_KEY = 'my-really-really-secret-pet-birthdate-key'
 
+    self.attr_encrypted_options[:insecure_mode] = true
+    self.attr_encrypted_options[:algorithm] = 'aes-256-cbc'
+    self.attr_encrypted_options[:mode] = :single_iv_and_salt
+
     attr_encrypted :nickname,
-      :key => proc { Encryptor.encrypt(:value => PET_NICKNAME_SALT, :key => PET_NICKNAME_KEY) },
-      :marshal => true
+                   :key => proc { Encryptor.encrypt(:value => PET_NICKNAME_SALT, :key => PET_NICKNAME_KEY, insecure_mode: true, algorithm: 'aes-256-cbc') },
+                   :marshal => true
     attr_encrypted :birthdate,
-      :key => proc { Encryptor.encrypt(:value => PET_BIRTHDATE_SALT, :key => PET_BIRTHDATE_KEY) },
-      :marshal => true
+                   :key => proc { Encryptor.encrypt(:value => PET_BIRTHDATE_SALT, :key => PET_BIRTHDATE_KEY, insecure_mode: true, algorithm: 'aes-256-cbc') },
+                   :marshal => true
   end
 
   def setup
@@ -50,55 +58,36 @@ class LegacyCompatibilityTest < Minitest::Test
   end
 
   def test_marshalling_backwards_compatibility
-    # Marshalling formats changed significantly from Ruby 1.8.7 to 1.9.3.
-    # Also, Date class did not correctly support marshalling pre-1.9.3, so here
-    # we just marshal it as a string in the Ruby 1.8.7 case.
-    if RUBY_VERSION < '1.9.3'
-      pet = LegacyMarshallingPet.create!(
-        :name => 'Fido',
-        :encrypted_nickname => 'xhayxWxfkfbNyOS2w1qBMPV49Gfvs6dcZFBopMK2zQA=',
-        :encrypted_birthdate => 'f4ufXun4GXzahH4MQ1eTBQ=='
-      )
-    else
-      pet = LegacyMarshallingPet.create!(
-        :name => 'Fido',
-        :encrypted_nickname => '7RwoT64in4H+fGVBPYtRcN0K4RtriIy1EP4nDojUa8g=',
-        :encrypted_birthdate => 'bSp9sJhXQSp2QlNZHiujtcK4lRVBE8HQhn1y7moQ63bGJR20hvRSZ73ePAmm+wc5'
-      )
-    end
+    pet = LegacyMarshallingPet.create!(
+      :name => 'Fido',
+      :encrypted_nickname => '7RwoT64in4H+fGVBPYtRcN0K4RtriIy1EP4nDojUa8g=',
+      :encrypted_birthdate => 'bSp9sJhXQSp2QlNZHiujtcK4lRVBE8HQhn1y7moQ63bGJR20hvRSZ73ePAmm+wc5'
+    )
 
     assert_equal 'Fido', pet.name
     assert_equal 'Mummy\'s little helper', pet.nickname
 
-    # See earlier comment.
-    if RUBY_VERSION < '1.9.3'
-      assert_equal '2011-07-09', pet.birthdate
-    else
-      assert_equal Date.new(2011, 7, 9), pet.birthdate
-    end
+    assert_equal Date.new(2011, 7, 9), pet.birthdate
   end
 
   private
 
   def create_tables
-    silence_stream(STDOUT) do
-      ActiveRecord::Schema.define(:version => 1) do
-        create_table :legacy_nonmarshalling_pets do |t|
-          t.string :name
-          t.string :encrypted_nickname
-          t.string :encrypted_birthdate
-          t.string :salt
-        end
-        create_table :legacy_marshalling_pets do |t|
-          t.string :name
-          t.string :encrypted_nickname
-          t.string :encrypted_birthdate
-          t.string :salt
-        end
+    ActiveRecord::Schema.define(:version => 1) do
+      create_table :legacy_nonmarshalling_pets do |t|
+        t.string :name
+        t.string :encrypted_nickname
+        t.string :encrypted_birthdate
+        t.string :salt
+      end
+      create_table :legacy_marshalling_pets do |t|
+        t.string :name
+        t.string :encrypted_nickname
+        t.string :encrypted_birthdate
+        t.string :salt
       end
     end
   end
 end
 
 ActiveRecord::Base.establish_connection :adapter => 'sqlite3', :database => ':memory:'
-

data/test/legacy_data_mapper_test.rb

@@ -1,17 +1,20 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 
 DataMapper.setup(:default, 'sqlite3::memory:')
 
 class LegacyClient
   include DataMapper::Resource
+  self.attr_encrypted_options[:insecure_mode] = true
+  self.attr_encrypted_options[:algorithm] = 'aes-256-cbc'
+  self.attr_encrypted_options[:mode] = :single_iv_and_salt
 
   property :id, Serial
   property :encrypted_email, String
   property :encrypted_credentials, Text
   property :salt, String
 
-  attr_encrypted :email, :key => 'a secret key'
-  attr_encrypted :credentials, :key => Proc.new { |client| Encryptor.encrypt(:value => client.salt, :key => 'some private key') }, :marshal => true
+  attr_encrypted :email, :key => 'a secret key', mode: :single_iv_and_salt
+  attr_encrypted :credentials, :key => Proc.new { |client| Encryptor.encrypt(:value => client.salt, :key => 'some private key', insecure_mode: true, algorithm: 'aes-256-cbc') }, :marshal => true, mode: :single_iv_and_salt
 
   def initialize(attrs = {})
     super attrs

data/test/legacy_sequel_test.rb

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 
 DB.create_table :legacy_humans do
   primary_key :id
@@ -8,9 +8,13 @@ DB.create_table :legacy_humans do
   column :salt, :string
 end
 
-class LegacyHuman < Sequel::Model(:legacy_humans)  
-  attr_encrypted :email, :key => 'a secret key'
-  attr_encrypted :credentials, :key => Proc.new { |human| Encryptor.encrypt(:value => human.salt, :key => 'some private key') }, :marshal => true
+class LegacyHuman < Sequel::Model(:legacy_humans)
+  self.attr_encrypted_options[:insecure_mode] = true
+  self.attr_encrypted_options[:algorithm] = 'aes-256-cbc'
+  self.attr_encrypted_options[:mode] = :single_iv_and_salt
+
+  attr_encrypted :email, :key => 'a secret key', mode: :single_iv_and_salt
+  attr_encrypted :credentials, :key => Proc.new { |human| Encryptor.encrypt(:value => human.salt, :key => 'some private key', insecure_mode: true, algorithm: 'aes-256-cbc') }, :marshal => true, mode: :single_iv_and_salt
 
   def after_initialize(attrs = {})
     self.salt ||= Digest::SHA1.hexdigest((Time.now.to_i * rand(5)).to_s)

data/test/run.sh

@@ -1,52 +1,12 @@
-#!/bin/sh
-
-set -e
-
-export RBENV_VERSION=ree-1.8.7-2012.02
-rbenv version
-
-export ACTIVERECORD=2.3.8
-bundle
-bundle exec rake
-export ACTIVERECORD=3.0.0
-bundle
-bundle exec rake
-export ACTIVERECORD=3.1.0
-bundle
-bundle exec rake
-export ACTIVERECORD=3.2.0
-bundle
-bundle exec rake
-
-export RBENV_VERSION=1.9.3-p484
-rbenv version
-
-export ACTIVERECORD=3.0.0
-bundle
-bundle exec rake
-export ACTIVERECORD=3.1.0
-bundle
-bundle exec rake
-export ACTIVERECORD=3.2.0
-bundle
-bundle exec rake
-export ACTIVERECORD=4.0.0
-bundle
-bundle exec rake
-
-export RBENV_VERSION=2.0.0-p353
-rbenv version
-
-export ACTIVERECORD=3.2.0
-bundle
-bundle exec rake
-export ACTIVERECORD=4.0.0
-bundle
-bundle exec rake
-
-export RBENV_VERSION=2.1.0
-rbenv version
-
-export ACTIVERECORD=4.0.0
-bundle
-bundle exec rake
+#!/usr/bin/env sh -e
+
+for RUBY in 1.9.3 2.0.0 2.1 2.2
+do
+  for RAILS in 2.3.8 3.0.0 3.1.0 3.2.0 4.0.0 4.1.0 4.2.0
+  do
+    if [[ $RUBY -gt 1.9.3 && $RAILS -lt 4.0.0 ]]; then
+      continue
+    fi
+    RBENV_VERSION=$RUBY ACTIVERECORD=$RAILS bundle && bundle exec rake
+  done
+done

data/test/sequel_test.rb

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 
 DB.create_table :humans do
   primary_key :id

data/test/test_helper.rb

@@ -1,35 +1,42 @@
-if RUBY_VERSION >= '1.9.3'
-  require 'simplecov'
-  require 'simplecov-rcov'
+require 'simplecov'
+require 'simplecov-rcov'
+require "codeclimate-test-reporter"
 
-  SimpleCov.formatter = SimpleCov::Formatter::MultiFormatter[
+SimpleCov.formatter = SimpleCov::Formatter::MultiFormatter.new(
+  [
     SimpleCov::Formatter::HTMLFormatter,
     SimpleCov::Formatter::RcovFormatter,
+    CodeClimate::TestReporter::Formatter
   ]
+)
 
-  SimpleCov.start do
-    add_filter 'test'
-  end
+SimpleCov.start do
+  add_filter 'test'
 end
 
+CodeClimate::TestReporter.start
+
 require 'minitest/autorun'
-require 'digest/sha2'
-require 'rubygems'
-gem 'activerecord', ENV['ACTIVE_RECORD_VERSION'] if ENV['ACTIVE_RECORD_VERSION']
+
+# Rails 4.0.x pins to an old minitest
+unless defined?(MiniTest::Test)
+  MiniTest::Test = MiniTest::Unit::TestCase
+end
+
 require 'active_record'
 require 'data_mapper'
+require 'digest/sha2'
 require 'sequel'
-require 'mocha/test_unit'
 
 $:.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
 $:.unshift(File.dirname(__FILE__))
 require 'attr_encrypted'
 
-puts "\nTesting with ActiveRecord #{ActiveRecord::VERSION::STRING rescue ENV['ACTIVE_RECORD_VERSION']}"
-
-Minitest::Test = Minitest::Unit::TestCase if ActiveRecord::VERSION::STRING >= '4.0.0'
-
-DB = Sequel.sqlite
+DB = if defined?(RUBY_ENGINE) && RUBY_ENGINE.to_sym == :jruby
+  Sequel.jdbc('jdbc:sqlite::memory:')
+else
+  Sequel.sqlite
+end
 
 # The :after_initialize hook was removed in Sequel 4.0
 # and had been deprecated for a while before that:
@@ -37,5 +44,8 @@ DB = Sequel.sqlite
 # This plugin re-enables it.
 Sequel::Model.plugin :after_initialize
 
-SECRET_KEY = 4.times.map { Digest::SHA256.hexdigest((Time.now.to_i * rand(5)).to_s) }.join
+SECRET_KEY = SecureRandom.random_bytes(32)
 
+def base64_encoding_regex
+  /^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$/
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: attr_encrypted
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 3.0.3
 platform: ruby
 authors:
 - Sean Huber
@@ -10,8 +10,30 @@ authors:
 - Stephen Aghaulor
 autorequire: 
 bindir: bin
-cert_chain: []
-date: 2016-02-23 00:00:00.000000000 Z
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIDdDCCAlygAwIBAgIBATANBgkqhkiG9w0BAQUFADBAMRIwEAYDVQQDDAlzYWdo
+  YXVsb3IxFTATBgoJkiaJk/IsZAEZFgVnbWFpbDETMBEGCgmSJomT8ixkARkWA2Nv
+  bTAeFw0xNjAxMTEyMjQyMDFaFw0xNzAxMTAyMjQyMDFaMEAxEjAQBgNVBAMMCXNh
+  Z2hhdWxvcjEVMBMGCgmSJomT8ixkARkWBWdtYWlsMRMwEQYKCZImiZPyLGQBGRYD
+  Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx0xdQYk2GwCpQ1n/
+  n2mPVYHLYqU5TAn/82t5kbqBUWjbcj8tHAi41tJ19+fT/hH0dog8JHvho1zmOr71
+  ZIqreJQo60TqP6oE9a5HncUpjqbRp7tOmHo9E+mOW1yT4NiXqFf1YINExQKy2XND
+  WPQ+T50ZNUsGMfHFWB4NAymejRWXlOEY3bvKW0UHFeNmouP5he51TjoP8uCc9536
+  4AIWVP/zzzjwrFtC7av7nRw4Y+gX2bQjrkK2k2JS0ejiGzKBIEMJejcI2B+t79zT
+  kUQq9SFwp2BrKSIy+4kh4CiF20RT/Hfc1MbvTxSIl/bbIxCYEOhmtHExHi0CoCWs
+  YCGCXQIDAQABo3kwdzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU
+  SCpVzSBvYbO6B3oT3n3RCZmurG8wHgYDVR0RBBcwFYETc2FnaGF1bG9yQGdtYWls
+  LmNvbTAeBgNVHRIEFzAVgRNzYWdoYXVsb3JAZ21haWwuY29tMA0GCSqGSIb3DQEB
+  BQUAA4IBAQAeiGdC3e0WiZpm0cF/b7JC6hJYXC9Yv9VsRAWD9ROsLjFKwOhmonnc
+  +l/QrmoTjMakYXBCai/Ca3L+k5eRrKilgyITILsmmFxK8sqPJXUw2Jmwk/dAky6x
+  hHKVZAofT1OrOOPJ2USoZyhR/VI8epLaD5wUmkVDNqtZWviW+dtRa55aPYjRw5Pj
+  wuj9nybhZr+BbEbmZE//2nbfkM4hCuMtxxxilPrJ22aYNmeWU0wsPpDyhPYxOUgU
+  ZjeLmnSDiwL6doiP5IiwALH/dcHU67ck3NGf6XyqNwQrrmtPY0mv1WVVL4Uh+vYE
+  kHoFzE2no0BfBg78Re8fY69P5yES5ncC
+  -----END CERTIFICATE-----
+date: 2016-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: encryptor
@@ -19,14 +41,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: 3.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: 3.0.0
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
@@ -42,19 +64,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 2.0.0
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 2.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 2.0.0
 - !ruby/object:Gem::Dependency
   name: datamapper
   requirement: !ruby/object:Gem::Requirement
@@ -70,33 +92,33 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: addressable
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.3.7
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.3.7
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: mocha
+  name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: sequel
   requirement: !ruby/object:Gem::Requirement
@@ -140,21 +162,21 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.2.2
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.2.2
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: simplecov
+  name: simplecov-rcov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -168,7 +190,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: simplecov-rcov
+  name: codeclimate-test-reporter
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -183,7 +205,7 @@ dependencies:
         version: '0'
 description: Generates attr_accessors that encrypt and decrypt attributes transparently
 email:
-- shuber@huberry.com
+- seah@shuber.io
 - sbfaulkner@gmail.com
 - billy.monk@gmail.com
 - saghaulor@gmail.com
@@ -191,9 +213,21 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".gitignore"
+- ".travis.yml"
+- CHANGELOG.md
+- Gemfile
 - MIT-LICENSE
-- README.rdoc
+- README.md
 - Rakefile
+- attr_encrypted.gemspec
+- certs/saghaulor.pem
+- checksum/attr_encrypted-3.0.0.gem.sha256
+- checksum/attr_encrypted-3.0.0.gem.sha512
+- checksum/attr_encrypted-3.0.1.gem.sha256
+- checksum/attr_encrypted-3.0.1.gem.sha512
+- checksum/attr_encrypted-3.0.2.gem.sha256
+- checksum/attr_encrypted-3.0.2.gem.sha512
 - lib/attr_encrypted.rb
 - lib/attr_encrypted/adapters/active_record.rb
 - lib/attr_encrypted/adapters/data_mapper.rb
@@ -214,7 +248,19 @@ files:
 homepage: http://github.com/attr-encrypted/attr_encrypted
 licenses: []
 metadata: {}
-post_install_message: 
+post_install_message: |2+
+
+
+
+  WARNING: Several insecure default options and features were deprecated in attr_encrypted v2.0.0.
+
+  Additionally, there was a bug in Encryptor v2.0.0 that insecurely encrypted data when using an AES-*-GCM algorithm.
+
+  This bug was fixed but introduced breaking changes between v2.x and v3.x.
+
+  Please see the README for more information regarding upgrading to attr_encrypted v3.0.0.
+
+
 rdoc_options:
 - "--line-numbers"
 - "--inline-source"
@@ -226,7 +272,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="