cloudflare-turnstile-rails 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a86ed02899dc2410a686143de9c188b3d15cfef8e4928bc87cc00bd1741fb58
-  data.tar.gz: 566026c1569d205f3a91beec381ec29729e6afe78084b9a6fb60ef4ceb0b3fad
+  metadata.gz: 7bdf250ea2814264e89921898dcc1c38b968596fe59e9423914b2d245ee8607c
+  data.tar.gz: e72026fff680a00cccfdb6134fbe9dafe0658abc8c135b0c5a4bc73404a1a104
 SHA512:
-  metadata.gz: 5a5a699a90fcb1a704de8a46ec57571c5219794d853d94a0d7bbac05e3e91dfa7ee20ddefaa1245d246a8b64bba082f58800821db4e2d4accc3ac16252eca204
-  data.tar.gz: e3655f9b725839b328f3699fd7dfb8def8f91d8011bd10dd4c8e4904cc6a12c61453a85bde4c666cd8d26185cb623da406ec634828785ff27d5833b6e5854594
+  metadata.gz: dfe05337cc155cd855b9297c8512d1c173069862a33f3061b685e41db3ec4ac7c20e86466d2c90d82d10795ccb0560b64177a344a5098885506efc53f614872d
+  data.tar.gz: aa3d5dacc7e140dedf475881f61522480b30c87e39bf1b228999ed5244fbe33cf1f02af3ffa6575bc2e0a09acb78221375b2fe82863dfcf13274398bac631d3d

data/README.md

@@ -11,6 +11,9 @@ Cloudflare Turnstile gem for Ruby on Rails with built-in Turbo and Turbolinks su
 
 Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rails/Ruby matrix tested daily in CI.
 
+> [!TIP]
+> **Using Devise?** [devise-cloudflare-turnstile](https://github.com/vkononov/devise-cloudflare-turnstile) protects every Devise form (sign in, sign up, password reset, and more) with no changes to your Devise views or controllers. It is built on this gem and shares its configuration, so you can use both to protect Devise and non-Devise forms in the same app.
+
 [!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
 
 ## Features
@@ -184,6 +187,16 @@ Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rai
   end
   ```
 
+* Requests to Cloudflare time out after 5 seconds to connect, read, or write, so a slow Cloudflare can't tie up your app's request threads for long. A timeout raises `Cloudflare::Turnstile::Rails::ConfigurationError`. To change the limits:
+
+  ```ruby
+  Cloudflare::Turnstile::Rails.configure do |config|
+    config.open_timeout = 5  # connecting to siteverify
+    config.read_timeout = 5  # reading the response
+    config.write_timeout = 5 # sending the verification POST
+  end
+  ```
+
 #### Advanced Validation
 
 * To inspect the entire verification payload, use `verify_turnstile`. It returns a `VerificationResponse` object with detailed information:
@@ -203,6 +216,8 @@ Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rai
   end
   ```
 
+* A missing, malformed, or oversized token fails immediately with `missing-input-response` or `invalid-input-response`, without a request to Cloudflare. The `VerificationResponse` for these failures only has `success` and `error-codes`; it doesn't carry `hostname`, `challenge_ts`, or the other fields a real siteverify call returns.
+
 * The `VerificationResponse` object contains the raw response from Cloudflare:
 
   ```ruby

data/lib/cloudflare/turnstile/rails/configuration.rb

@@ -3,7 +3,8 @@ module Cloudflare
     module Rails
       class Configuration
         attr_writer :script_url
-        attr_accessor :site_key, :secret_key, :render, :onload, :default_data, :auto_populate_response_in_test_env
+        attr_accessor :site_key, :secret_key, :render, :onload, :default_data, :auto_populate_response_in_test_env,
+                      :open_timeout, :read_timeout, :write_timeout
 
         def initialize
           @script_url = Cloudflare::SCRIPT_URL
@@ -13,6 +14,9 @@ module Cloudflare
           @onload = nil
           @default_data = {}
           @auto_populate_response_in_test_env = true
+          @open_timeout = 5
+          @read_timeout = 5
+          @write_timeout = 5
         end
 
         # Dynamically build the URL every time, so that

data/lib/cloudflare/turnstile/rails/constants/cloudflare.rb

@@ -11,6 +11,9 @@ module Cloudflare
         # Default hidden input field name for Turnstile token submission
         RESPONSE_FIELD_NAME = 'cf-turnstile-response'.freeze
 
+        # Longest token siteverify accepts; anything longer is rejected without a request
+        MAX_RESPONSE_LENGTH = 2048
+
         # Default CSS class applied to Turnstile widget containers
         WIDGET_CLASS = 'cf-turnstile'.freeze
       end

data/lib/cloudflare/turnstile/rails/verification.rb

@@ -2,6 +2,7 @@ require 'net/http'
 require 'openssl'
 
 require_relative 'constants/cloudflare'
+require_relative 'constants/error_code'
 
 module Cloudflare
   module Turnstile
@@ -48,6 +49,10 @@ module Cloudflare
 
       module Verification
         def self.verify(response: nil, secret: nil, remoteip: nil, idempotency_key: nil) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+          if response.is_a?(String) && !response.valid_encoding?
+            return VerificationResponse.new('success' => false, 'error-codes' => [ErrorCode::INVALID_INPUT_RESPONSE])
+          end
+
           response = 'dummy-response' if auto_populate_test_response?(response)
 
           secret ||= Rails.configuration.secret_key
@@ -55,6 +60,14 @@ module Cloudflare
             raise ConfigurationError, ErrorMessage.for(ErrorCode::MISSING_INPUT_SECRET)
           end
 
+          local_error = if missing_response?(response)
+                          ErrorCode::MISSING_INPUT_RESPONSE
+                        elsif invalid_response?(response)
+                          ErrorCode::INVALID_INPUT_RESPONSE
+                        end
+
+          return VerificationResponse.new('success' => false, 'error-codes' => [local_error]) if local_error
+
           body = { 'secret' => secret, 'response' => response }
           body['remoteip'] = remoteip if remoteip
           body['idempotency_key'] = idempotency_key if idempotency_key
@@ -65,17 +78,20 @@ module Cloudflare
 
           http = Net::HTTP.new(uri.host, uri.port)
           http.use_ssl = true
+          http.open_timeout = Rails.configuration.open_timeout
+          http.read_timeout = Rails.configuration.read_timeout
+          http.write_timeout = Rails.configuration.write_timeout
           http.verify_mode = OpenSSL::SSL::VERIFY_PEER
           http.cert_store = OpenSSL::X509::Store.new
           http.cert_store.set_default_paths
 
           begin
             res = http.request(request)
-          rescue Net::OpenTimeout, Net::ReadTimeout => e
+          rescue Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout, Errno::ETIMEDOUT => e
             raise ConfigurationError, "Turnstile verification timed out: #{e.message}"
           rescue OpenSSL::SSL::SSLError => e
             raise ConfigurationError, "SSL verification failed: #{e.message}"
-          rescue SocketError, Errno::ECONNREFUSED => e
+          rescue SocketError, EOFError, Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EHOSTUNREACH => e
             raise ConfigurationError, "Network error during Turnstile verification: #{e.message}"
           end
 
@@ -89,11 +105,21 @@ module Cloudflare
         end
 
         def self.auto_populate_test_response?(response)
-          (response.nil? || response.strip.empty?) &&
+          (response.nil? || (response.is_a?(String) && response.strip.empty?)) &&
             ::Rails.env.test? &&
             Rails.configuration.auto_populate_response_in_test_env
         end
         private_class_method :auto_populate_test_response?
+
+        def self.missing_response?(response)
+          response.nil? || response == ''
+        end
+        private_class_method :missing_response?
+
+        def self.invalid_response?(response)
+          !response.is_a?(String) || response.strip.empty? || response.length > Cloudflare::MAX_RESPONSE_LENGTH
+        end
+        private_class_method :invalid_response?
       end
     end
   end

data/lib/cloudflare/turnstile/rails/version.rb

@@ -1,7 +1,7 @@
 module Cloudflare
   module Turnstile
     module Rails
-      VERSION = '1.2.0'.freeze
+      VERSION = '1.3.0'.freeze
     end
   end
 end

data/lib/generators/cloudflare_turnstile/templates/cloudflare_turnstile.rb

@@ -25,6 +25,12 @@ Cloudflare::Turnstile::Rails.configure do |config|
   #   language: -> { I18n.locale }
   # }
 
+  # Optional: Seconds to wait when connecting to, and reading from, Cloudflare's siteverify endpoint.
+  # Keep these short so a slow Cloudflare can't hold your app's request threads for long.
+  # config.open_timeout = 5  # connecting to siteverify
+  # config.read_timeout = 5  # reading the response
+  # config.write_timeout = 5 # sending the verification POST
+
   # In the Rails Test environment, automatically fill in a dummy response if none was provided.
   # This lets you keep existing controller tests without having to add
   # params["cf-turnstile-response"] manually in every test.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-turnstile-rails
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -23,8 +23,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
-description: Integrates Cloudflare Turnstile into Ruby on Rails applications, transparently
-  reloads on Turbo and Turbolinks events, and embeds CSP-nonce-compliant scripts.
+description: Cloudflare Turnstile CAPTCHA, a reCAPTCHA alternative, for Ruby on Rails.
+  View and controller helpers with Turbo, Turbo Streams, Turbolinks, CSP nonce and
+  i18n support.
 email:
 - vadim@konoson.com
 executables: []
@@ -83,8 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.20
 specification_version: 4
-summary: Cloudflare Turnstile gem for Rails with built-in Turbo and Turbolinks support
-  and CSP compliance
+summary: Cloudflare Turnstile CAPTCHA for Rails with Turbo, Turbolinks and CSP support
 test_files: []