breach-mitigation-rails 0.0.4 → 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 74c1a7de9636f721f2e92b041b3ed08a937ad32a
+  data.tar.gz: ae23af3cbc57389c803b998e632b0e58fc53d289
+SHA512:
+  metadata.gz: ee4194896a9732748dedbbebc9fab2d0b1a4a882c5e67c7f2994cb9408697096408edd6a59baa56712ea74791a4a58d0a0a92e95591f65b1341f87ecd3c8a582
+  data.tar.gz: 2a9d8009430cb46d7597c406b71ca70d68f5a06ffbb207c1cac2870e3f1eb381205c21985c2268a52dd33574420b8cb217cf6a83cc201a924c21914184e42070

data/breach-mitigation-rails.gemspec

@@ -18,6 +18,8 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
+  spec.add_dependency "active_support"
+  spec.add_dependency "rack"
   spec.add_development_dependency "bundler", "~> 1.3"
   spec.add_development_dependency "rspec"
   spec.add_development_dependency "rake"

data/lib/breach_mitigation/length_hiding.rb

@@ -1,3 +1,5 @@
+require 'active_support/core_ext/string/output_safety'
+
 module BreachMitigation
   class LengthHiding
     def initialize(app)

data/lib/breach_mitigation/masking_secrets.rb

@@ -1,3 +1,6 @@
+require 'base64'
+require 'rack/utils'
+
 module BreachMitigation
   class MaskingSecrets
     class << self
@@ -30,9 +33,10 @@ module BreachMitigation
         # tokens that we've issued without error.
 
         if masked_token.length == AUTHENTICITY_TOKEN_LENGTH
-          # This is actually an unmasked token
-          Rails.logger.warn "WARNING: the client is using an unmasked authenticity token. This is expected if you have just upgraded to masked tokens, but if these messages continue long after the upgrade, then something fishy is going on."
-          masked_token == real_csrf_token(session)
+          # This is actually an unmasked token. This is expected if
+          # you have just upgraded to masked tokens, but should stop
+          # happening shortly after installing this gem
+          compare_with_real_token masked_token, session
 
         elsif masked_token.length == AUTHENTICITY_TOKEN_LENGTH * 2
           # Split the token into the one-time pad and the encrypted
@@ -41,7 +45,7 @@ module BreachMitigation
           encrypted_csrf_token = masked_token[AUTHENTICITY_TOKEN_LENGTH..-1]
           csrf_token = xor_byte_strings(one_time_pad, encrypted_csrf_token)
 
-          csrf_token == real_csrf_token(session)
+          compare_with_real_token csrf_token, session
 
         else
           false # Token is malformed
@@ -50,6 +54,11 @@ module BreachMitigation
 
       private
 
+      def compare_with_real_token(token, session)
+        # Borrow a constant-time comparison from Rack
+        Rack::Utils.secure_compare(token, real_csrf_token(session))
+      end
+
       def real_csrf_token(session)
         session[:_csrf_token] ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
         Base64.strict_decode64(session[:_csrf_token])

data/lib/breach_mitigation/version.rb

@@ -1,3 +1,3 @@
 module BreachMitigation
-  VERSION = "0.0.4"
+  VERSION = "0.1.0"
 end

data/spec/masking_secrets_spec.rb

@@ -0,0 +1,49 @@
+require "spec_helper"
+require "breach_mitigation/masking_secrets"
+
+describe BreachMitigation::MaskingSecrets do
+  let(:masking_secrets) { BreachMitigation::MaskingSecrets }
+
+  describe ".masked_authenticity_token" do
+    it "puts :_csrf_token into the supplied session" do
+      session = {}
+      masking_secrets.masked_authenticity_token(session)
+      session[:_csrf_token].should_not be_nil
+    end
+
+    it "returns a byte string" do
+      masking_secrets.masked_authenticity_token({}).should_not be nil
+    end
+  end
+
+  describe ".valid_authenticity_token?" do
+    let(:session) do
+      # Seed a session with a :_csrf_token
+      Hash.new.tap do |session|
+        masking_secrets.masked_authenticity_token(session)
+      end
+    end
+
+    it "returns true for a valid unmasked token" do
+      valid_unmasked = session[:_csrf_token]
+      masking_secrets.valid_authenticity_token?(session, valid_unmasked).should == true
+    end
+
+    it "returns false for an invalid unmasked token" do
+      masking_secrets.valid_authenticity_token?(session, SecureRandom.base64(32)).should == false
+    end
+
+    it "returns true for a valid masked token" do
+      valid_masked = masking_secrets.masked_authenticity_token(session)
+      masking_secrets.valid_authenticity_token?(session, valid_masked).should == true
+    end
+
+    it "returns false for an invalid masked token" do
+      masking_secrets.valid_authenticity_token?(session, SecureRandom.base64(64)).should == false
+    end
+
+    it "returns false for a token of the wrong length" do
+      masking_secrets.valid_authenticity_token?(session, SecureRandom.base64(2)).should == false
+    end
+  end
+end

metadata

@@ -1,64 +1,85 @@
 --- !ruby/object:Gem::Specification
 name: breach-mitigation-rails
 version: !ruby/object:Gem::Version
-  prerelease: 
-  version: 0.0.4
+  version: 0.1.0
 platform: ruby
 authors:
 - Bradley Buda
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-09 00:00:00.000000000 Z
+date: 2013-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
+  name: active_support
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '1.3'
-    none: false
-  name: bundler
   type: :development
   prerelease: false
-  requirement: !ruby/object:Gem::Requirement
+  version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '1.3'
-    none: false
 - !ruby/object:Gem::Dependency
-  version_requirements: !ruby/object:Gem::Requirement
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
-    none: false
-  name: rspec
   type: :development
   prerelease: false
-  requirement: !ruby/object:Gem::Requirement
+  version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
-    none: false
 - !ruby/object:Gem::Dependency
-  version_requirements: !ruby/object:Gem::Requirement
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
-    none: false
-  name: rake
   type: :development
   prerelease: false
-  requirement: !ruby/object:Gem::Requirement
+  version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
-    none: false
 description: Mitigates the BREACH and CRIME attacks on TLS in Rails applications
 email:
 - bradleybuda@gmail.com
@@ -79,34 +100,35 @@ files:
 - lib/breach_mitigation/railtie.rb
 - lib/breach_mitigation/version.rb
 - spec/length_hiding_spec.rb
+- spec/masking_secrets_spec.rb
 - spec/spec_helper.rb
 homepage: https://github.com/meldium/breach-mitigation-rails
 licenses:
 - MIT
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
-  none: false
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
-  none: false
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.23
+rubygems_version: 2.0.3
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: Uses length-hiding and CSRF token masking to make it more difficult for an
   attacker to recover plaintext from HTTP responses. See README.md for details.
 test_files:
 - spec/length_hiding_spec.rb
+- spec/masking_secrets_spec.rb
 - spec/spec_helper.rb
 has_rdoc: