clearance 2.4.0 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf42dbdfbd60820a6690813fef30b305ffa76ca93852ad6183ce499d1fa51413
-  data.tar.gz: 9832b513dcc54672a809b326334d0967266113027d35f4a57add919a7f222201
+  metadata.gz: d60bf1a6126821259c777a4d6c34169e0ac643d4c88f74133b13400b99c9140f
+  data.tar.gz: 42a4077da0d6bca303752a3ef9b224167b3510f3ea9649c3439148c6242591d5
 SHA512:
-  metadata.gz: 6a4921201ae474f99af273a1cf524e63a76e868b4470bcf8972ea4ed368bfdd62ae7597c8a8d9b9bffe08803b62d2725fa49737b6b66319eb8b877719bf26d45
-  data.tar.gz: 9f38b6e9870112874cabe5c4402bd22984d90713d2ac2b18b157893ba7787777783452528948877e5bcf3bfe5549abce78f8e0f85877f1661a1ea11adb66248f
+  metadata.gz: a62015195770da36e79c06e228a9e368d20fb3c2e91c92f3bf168f5a2706bbaef4fc98c28bcde3cb5a80bf3eb16f2acc589cb7da920e151cb0060290cea5cc44
+  data.tar.gz: cec9f3ce0c48cadd04b43b0a5280fd34db24c532ea1f01e92b76b7acd3413220fb568f7d4e3f180b4aa80669264af0d0216da3c4806bc2d24af59276e4d50635

data/.github/workflows/tests.yml

@@ -2,7 +2,7 @@ name: CI Tests
 
 on:
   push:
-    branches: "master"
+    branches: "main"
   pull_request:
     branches: "*"
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    clearance (2.4.0)
+    clearance (2.5.0)
       actionmailer (>= 5.0)
       activemodel (>= 5.0)
       activerecord (>= 5.0)
@@ -84,7 +84,7 @@ GEM
     crass (1.0.6)
     database_cleaner (1.8.5)
     diff-lcs (1.4.4)
-    email_validator (2.2.2)
+    email_validator (2.2.3)
       activemodel
     erb_lint (0.0.34)
       activesupport
@@ -99,12 +99,12 @@ GEM
     factory_bot_rails (6.1.0)
       factory_bot (~> 6.1.0)
       railties (>= 5.0.0)
-    ffi (1.14.2)
+    ffi (1.15.4)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
       rake
-    globalid (0.4.2)
-      activesupport (>= 4.2.0)
+    globalid (0.5.2)
+      activesupport (>= 5.0)
     html_tokenizer (0.0.7)
     i18n (1.8.9)
       concurrent-ruby (~> 1.0)
@@ -149,7 +149,7 @@ GEM
     rainbow (3.0.0)
     rake (13.0.3)
     regexp_parser (1.7.1)
-    rexml (3.2.4)
+    rexml (3.2.5)
     rspec-core (3.9.2)
       rspec-support (~> 3.9.3)
     rspec-expectations (3.9.2)

data/NEWS.md

@@ -3,6 +3,18 @@
 The noteworthy changes for each Clearance version are included here. For a
 complete changelog, see the git history for each version via the version links.
 
+## [2.5.0] - September 10, 2021
+
+### Fixed
+
+- Fix open redirect vulnerability
+
+### Changed
+
+- Rename default branch to `main`
+
+[2.4.0]: https://github.com/thoughtbot/clearance/compare/v2.3.1...v2.4.0
+
 ## [2.4.0] - March 5, 2021
 
 ### Added

data/README.md

@@ -1,8 +1,8 @@
 # Clearance
 
-[![Build Status](https://secure.travis-ci.org/thoughtbot/clearance.svg)](http://travis-ci.org/thoughtbot/clearance?branch=master)
+[![Build Status](https://github.com/thoughtbot/clearance/actions/workflows/tests.yml/badge.svg)]( https://github.com/thoughtbot/clearance/actions/workflows/tests.yml?query=branch%3Amain)
 [![Code Climate](https://codeclimate.com/github/thoughtbot/clearance.svg)](https://codeclimate.com/github/thoughtbot/clearance)
-[![Documentation Quality](https://inch-ci.org/github/thoughtbot/clearance.svg?branch=master)](https://inch-ci.org/github/thoughtbot/clearance)
+[![Documentation Quality](https://inch-ci.org/github/thoughtbot/clearance.svg?branch=main)](https://inch-ci.org/github/thoughtbot/clearance)
 [![Reviewed by Hound](https://img.shields.io/badge/Reviewed_by-Hound-8E64B0.svg)](https://houndci.com)
 
 Rails authentication with email & password.
@@ -55,7 +55,7 @@ Clearance.configure do |config|
   config.cookie_name = "remember_token"
   config.cookie_path = "/"
   config.routes = true
-  config.httponly = false
+  config.httponly = true
   config.mailer_sender = "reply@example.com"
   config.password_strategy = Clearance::PasswordStrategies::BCrypt
   config.redirect_url = "/"
@@ -299,7 +299,7 @@ Clearance.configure do |config|
 end
 ```
 
-If you are currently not using unsigned cookies but would like to migrate your
+If you are currently not using signed cookies but would like to migrate your
 users over to them without breaking current sessions, you can do so by passing
 in `:migrate` rather than `true` as so:
 

data/lib/clearance/authorization.rb

@@ -86,10 +86,16 @@ module Clearance
     def return_to
       if return_to_url
         uri = URI.parse(return_to_url)
-        "#{uri.path}?#{uri.query}".chomp("?") + "##{uri.fragment}".chomp("#")
+        path = path_without_leading_slashes(uri)
+        "#{path}?#{uri.query}".chomp("?") + "##{uri.fragment}".chomp("#")
       end
     end
 
+    # @api private
+    def path_without_leading_slashes(uri)
+      uri.path.sub(/\A\/+/, "/")
+    end
+
     # @api private
     def return_to_url
       session[:return_to]

data/lib/clearance/version.rb

@@ -1,3 +1,3 @@
 module Clearance
-  VERSION = "2.4.0".freeze
+  VERSION = "2.5.0".freeze
 end

data/lib/generators/clearance/install/templates/db/migrate/add_clearance_to_users.rb.erb

@@ -21,7 +21,11 @@ class AddClearanceToUsers < ActiveRecord::Migration<%= migration_version %>
     end
   end
 
-  def self.down
+  def self.down                     
+<% config[:new_indexes].values.each do |index| -%>
+    <%= index.gsub("add_index", "remove_index") %>
+<% end -%>
+           
     change_table :users do |t|
 <% if config[:new_columns].any? -%>
       t.remove <%= new_columns.keys.map { |column| ":#{column}" }.join(", ") %>

data/spec/controllers/sessions_controller_spec.rb

@@ -58,6 +58,19 @@ describe Clearance::SessionsController do
     end
 
     context "with good credentials and a session return url" do
+      it "redirects to the return URL removing leading slashes" do
+        user = create(:user)
+        url = "/url_in_the_session?foo=bar#baz"
+        return_url = "//////#{url}"
+        request.session[:return_to] = return_url
+
+        post :create, params: {
+          session: { email: user.email, password: user.password },
+        }
+
+        should redirect_to(url)
+      end
+
       it "redirects to the return URL maintaining query and fragment" do
         user = create(:user)
         return_url = "/url_in_the_session?foo=bar#baz"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clearance
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.5.0
 platform: ruby
 authors:
 - Dan Croak
@@ -22,10 +22,10 @@ authors:
 - Jason Morrison
 - Galen Frechette
 - Josh Steiner
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-04-09 00:00:00.000000000 Z
+date: 2021-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt
@@ -295,7 +295,7 @@ homepage: https://github.com/thoughtbot/clearance
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options:
 - "--charset=UTF-8"
 require_paths:
@@ -311,8 +311,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: Rails authentication & authorization with email & password.
 test_files: []