cf-uaa-lib 1.3.3 → 1.3.4

data/lib/uaa/scim.rb

@@ -94,7 +94,8 @@ class Scim
   #   authorization header. For OAuth2 with JWT tokens this would be something
   #   like "bearer xxxx.xxxx.xxxx". The {TokenInfo} class provides
   #   {TokenInfo#auth_header} for this purpose.
-  # @param style (see Util.hash_key)
+  # @param [Hash] options can be
+  #   * +:symbolize_keys+, if true, returned hash keys are symbols.
   def initialize(target, auth_header, options = {})
     @target, @auth_header = target, auth_header
     @key_style = options[:symbolize_keys] ? :downsym : :down

data/lib/uaa/token_coder.rb

@@ -41,6 +41,8 @@ class TokenCoder
     opts[:audience_ids] = Util.arglist(opts[:audience_ids])
     opts[:algorithm] = 'HS256' unless opts[:algorithm]
     opts[:verify] = true unless opts.key?(:verify)
+    opts[:accept_algorithms] = Util.arglist(opts[:accept_algorithms],
+        ["HS256", "HS384", "HS512", "RS256", "RS384", "RS512"])
     opts
   end
 
@@ -93,7 +95,10 @@ class TokenCoder
     signing_input = [header_segment, payload_segment].join('.')
     header = Util.json_decode64(header_segment)
     payload = Util.json_decode64(payload_segment, (:sym if options[:symbolize_keys]))
-    return payload if !options[:verify] || (algo = header["alg"]) == "none"
+    return payload unless options[:verify]
+    raise DecodeError, "Signature algorithm not accepted" unless
+        options[:accept_algorithms].include?(algo = header["alg"])
+    return payload if algo == 'none'
     signature = Util.decode64(crypto_segment)
     if ["HS256", "HS384", "HS512"].include?(algo)
       raise DecodeError, "Signature verification failed" unless
@@ -125,6 +130,9 @@ class TokenCoder
   #     HS384, HS512, RS256, RS384, RS512, or none.
   #   * :verify [String] -- Verifies signatures when decoding tokens. Defaults
   #     to +true+.
+  #   * :accept_algorithms [String, Array<String>] -- An Array or space separated
+  #     string of values which list what algorthms are accepted for token
+  #     signatures. Defaults to all possible values of :algorithm except 'none'.
   # @note the TokenCoder instance must be configured with the appropriate
   #   key material to support particular algorithm families and operations
   #   -- i.e. :pkey must include a private key in order to sign tokens with

data/lib/uaa/version.rb

@@ -14,6 +14,6 @@
 # Cloud Foundry namespace
 module CF
   module UAA
-    VERSION = "1.3.3"
+    VERSION = "1.3.4"
   end
 end

data/spec/token_coder_spec.rb

@@ -64,13 +64,18 @@ describe TokenCoder do
     result["foo"].should == "bar"
   end
 
-  it "encodes/decodes with 'none' signature" do
+  it "encodes/decodes with 'none' signature if explicitly accepted" do
     tkn = subject.encode(@tkn_body, 'none')
-    result = subject.decode("bEaReR #{tkn}")
+    result = TokenCoder.decode(tkn, :accept_algorithms => "none")
     result.should_not be_nil
     result["foo"].should == "bar"
   end
 
+  it "rejects a token with 'none' signature by default" do
+    tkn = subject.encode(@tkn_body, 'none')
+    expect { TokenCoder.decode(tkn) }.to raise_exception(DecodeError)
+  end
+
   it "raises an error if the signing algorithm is not supported" do
     expect { subject.encode(@tkn_body, 'baz') }.to raise_exception(ArgumentError)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-uaa-lib
 version: !ruby/object:Gem::Version
-  version: 1.3.3
+  version: 1.3.4
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-21 00:00:00.000000000 Z
+date: 2013-01-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json
@@ -195,7 +195,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1871594390469590559
+      hash: -2055415488226018803
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -204,10 +204,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1871594390469590559
+      hash: -2055415488226018803
 requirements: []
 rubyforge_project: cf-uaa-lib
-rubygems_version: 1.8.24
+rubygems_version: 1.8.23
 signing_key: 
 specification_version: 3
 summary: Client library for CloudFoundry UAA