cider_ci-open_session 1.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 88ffdf09f7840a851e98c1180eb9c6ac2cc9a880
-  data.tar.gz: 0e79bd7bf770b7e93e32c36c70c3382953f21bd5
+  metadata.gz: 1c6710fa1241c8a5bf742a235516658147b1ff97
+  data.tar.gz: e502de6c5e3040a2e50d3e08e74a095bc29d3af1
 SHA512:
-  metadata.gz: 62755c098713f484117a8e53a4d033de527b54debdd5c99e00a55eb37a85b95bde574aaa714a4d2dc67fb858ae88a719bd02848e0ab0fd4db9f1411c3f765ac3
-  data.tar.gz: 5ff7da8bc05280e5efd5c76ad7b8d9d3dbb6cd4fc4213c41244461844218c7af8891377a2a78049a1b2d7f981ee49acd56c46aa4242ea87d9e9290f4824af77e
+  metadata.gz: d10cd0c89f1627ee451b1bee407fcce2163d0bfaddef5ee0358341f5db5e2d78110ee2fe5e94f3dfa7399cfeb0f2bd41e99fcb69631421c6cffdadb25200f48d
+  data.tar.gz: 489086b799cb68c9c72c95c1e5af765b0e6252e12360256acdfbe16a85a7903a66a97c7391b3b69e20bd2ed6456cfe2317b19fd82a8fb00697a0cd12749eccf7

data/README.md

@@ -3,7 +3,7 @@
 
 The Cider-CI Open-Session projects provide platform and language agnostic
 encoding, encryption and signatures. They are used for session handling in
-Cider-CI itself. 
+Cider-CI itself.
 
 
 ## Installation
@@ -11,7 +11,7 @@ Cider-CI itself.
 Add this line to your application's Gemfile:
 
 ```ruby
-gem 'cider_ci-open_session', '>= 1.0.0', '< 2.0.0'
+gem 'cider_ci-open_session', '>= 2.0.0', '< 3.0.0'
 ```
 
 And then execute:

data/lib/cider_ci/open_session/encoder.rb

@@ -5,19 +5,11 @@ module CiderCi
     module Encoder
       extend self
       def encode(msg)
-        ::Base64.urlsafe_encode64(msg).gsub(/[=]+$/, '')
+        ::Base64.urlsafe_encode64(msg)
       end
 
       def decode(msg)
-        ::Base64.urlsafe_decode64(
-          case msg.length % 4
-          when 2
-            msg + '=='
-          when 3
-            msg + '='
-          else
-            msg
-          end)
+        ::Base64.urlsafe_decode64(msg)
       end
     end
   end

data/lib/cider_ci/open_session/encryptor.rb

@@ -1,7 +1,6 @@
 require 'cider_ci/open_session/encoder'
+require 'cider_ci/open_session/signature'
 require 'openssl'
-require 'digest/sha1'
-require 'digest/sha2'
 require 'json'
 
 module CiderCi
@@ -11,8 +10,9 @@ module CiderCi
       extend self
 
       def decrypt(secret, encrypted_message)
+        iv, encrypted_data, sig = encrypted_message.split('~').map { |m| decode(m) }
+        CiderCi::OpenSession::Signature.validate! sig, secret, encrypted_data
         cipher = create_cipher :decrypt, secret
-        iv, encrypted_data = encrypted_message.split('~').map { |m| decode(m) }
         cipher.iv = iv
         decrypted_data = cipher.update(encrypted_data)
         decrypted_data << cipher.final
@@ -24,7 +24,8 @@ module CiderCi
         iv = cipher.random_iv
         encrypted_data = cipher.update(message_object.to_json)
         encrypted_data << cipher.final
-        "#{encode iv}~#{encode encrypted_data}"
+        sig = CiderCi::OpenSession::Signature.create secret, encrypted_data
+        "#{encode iv}~#{encode encrypted_data}~#{encode sig}"
       end
 
       private

data/lib/cider_ci/open_session/signature.rb

@@ -1,3 +1,5 @@
+require 'openssl'
+
 module CiderCi
   module OpenSession
     module Signature
@@ -7,8 +9,8 @@ module CiderCi
       extend self
 
       def create(secret, message)
-        OpenSSL::HMAC.hexdigest(
-          OpenSSL::Digest.new('sha1'),
+        OpenSSL::HMAC.digest(
+          OpenSSL::Digest.new('sha256'),
           secret, message)
       end
 

data/lib/cider_ci/open_session/version.rb

@@ -1,5 +1,5 @@
 module CiderCi
   module OpenSession
-    VERSION = '1.0.0'
+    VERSION = '2.0.1'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cider_ci-open_session
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Thomas Schank
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2015-04-04 00:00:00.000000000 Z
+date: 2017-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -135,7 +135,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: Platform and language agnostic encoding, encryption and signatures for session