cubits 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8949b7a2569642b35ee5fc65b2be3fdbec72e192
-  data.tar.gz: 111fa99d8f2ffcfb6b8c3f63626a07475e46cd7b
+  metadata.gz: 3e681c887f584d39661aeadad10c1e297abad0ab
+  data.tar.gz: 1cc90230a6bfae073d6ec6ba23a314fcf518f4f6
 SHA512:
-  metadata.gz: b73fc2b6b9397db6af35561893e82fa3b36a61db81f97b5240554fa639bef7ecf0d80f9c653623090f00ec0adbcaa03330205e6f295bbfc57630672a21e595cc
-  data.tar.gz: 7a4bed20e2d5cd036aa654e154bbcbfccd1c579c99651ce4e58a0f625db478aaeb5e4c5c55305db00cdac6b3b9fc1e31ff54f22245cef8ccf82de0268686ef9a
+  metadata.gz: ef1a5b930c12ab8dc276eeb8a56552c2a616fd88f773b1d0711cb2318d1a4ff496d1ea4b9a8d63c759a7241a61b582b2354c184f13305b40181ebb4d2b53323d
+  data.tar.gz: acc7922ad9ed67ccba6a1c5525cc0459525dc75a8c7531a07b62032d4893063bfcba361e3f4c38b862ab396b14a39bb609eb966fcccb39f665015d3ebb7cd75b

data/CHANGES.md

@@ -1,3 +1,7 @@
+# 0.4.0
+
+Enforcing strict server SSL certificate checks, to prevent MitM attacks
+
 # 0.3.1
 
 Changed API base URL to: https://api.cubits.com/

data/README.md

@@ -58,7 +58,7 @@ invoice.address # => "3QJmV3qfvL9SuYo34YihAf3sRCW3qSinyC"
 
 Creates a new invoice.
 
-For a list of accepted and returned parameters, see the `POST /api/v1/invoices` page in the [Cubits Help Center](https://cubits.com/help) Developer's section.
+For a list of accepted and returned parameters, see the `POST /api/v1/invoices` page in the [Cubits Help Center](https://cubits.com) Developer's section.
 
 
 ```ruby

data/cubits.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'http', '~> 0.7'
+  spec.add_dependency 'http', '~> 0.7', '>= 0.7.3'
   spec.add_dependency 'hashie', '~> 3.3'
 
   spec.add_development_dependency 'bundler', '~> 1.7'

data/lib/cubits/connection.rb

@@ -19,6 +19,7 @@ module Cubits
       fail ArgumentError, 'String is expected as :secret' unless params[:secret].is_a?(String)
       @key = params[:key]
       @secret = params[:secret]
+      @params = params.dup
     end
 
     # Executes a GET request
@@ -42,12 +43,17 @@ module Cubits
     # Sends a request to the API
     #
     def request(method, path, encoded_data)
+      Cubits.logger.warn 'Connecting to Cubits using insecure connection!' if insecure?
       url = URI.join(Cubits.base_url, path)
-      url.query = encoded_data if method == :get && !encoded_data.empty?
       params = {}
       http = HTTP.with(cubits_headers(path, encoded_data))
-      http = http.with('Content-Type' => CONTENT_TYPE) unless method == :get
-      params[:body] = encoded_data unless method == :get
+      if method == :get
+        url.query = encoded_data unless encoded_data.empty?
+      else
+        http = http.with('Content-Type' => CONTENT_TYPE)
+        params[:body] = encoded_data
+      end
+      params[:ssl_context] = ssl_context unless insecure?
       Cubits.logger.debug "> #{method.to_s.upcase}: #{url}"
       response = http.send(method, url, params)
       Cubits.logger.debug "< #{response.code} #{response.reason}"
@@ -118,5 +124,23 @@ module Cubits
         "path=#{path} nonce=#{nonce} request_data=#{request_data} msg=#{msg} signature=#{signature}"
       signature
     end
+
+    # Returns configured SSLContext
+    #
+    def ssl_context
+      return @ssl_context if @ssl_context
+      @ssl_context = OpenSSL::SSL::SSLContext.new
+      @ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      cert_store = OpenSSL::X509::Store.new
+      cert_store.set_default_paths
+      @ssl_context.cert_store = cert_store
+      @ssl_context
+    end
+
+    # Returns true if an insecure connection is requested (do NOT use in production)
+    #
+    def insecure?
+      @insecure ||= @params[:insecure] || Cubits.base_url.scheme != 'https'
+    end
   end # class Connection
 end # module Cubits

data/lib/cubits/helpers.rb

@@ -8,7 +8,8 @@ module Cubits
       Cubits.connection.get('/api/v1/test', foo: 'bar')
       Cubits.connection.post('/api/v1/test', foo: 'bar')
       true
-    rescue StandardError
+    rescue StandardError => e
+      Cubits.logger.error "Test connection to Cubits failed: #{e}"
       false
     end
 

data/lib/cubits/version.rb

@@ -1,3 +1,3 @@
 module Cubits
-  VERSION = '0.3.1'
+  VERSION = '0.4.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cubits
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Alex Kukushkin
@@ -17,6 +17,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.7.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -24,6 +27,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.7.3
 - !ruby/object:Gem::Dependency
   name: hashie
   requirement: !ruby/object:Gem::Requirement