devise-pwned_password 0.1.4 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9034d6a6d49339f92023d27ef40b8633a2332ded
-  data.tar.gz: 1e429adc52ffb2aff28985d9a1636aec657b686a
+  metadata.gz: a5cc8c72047671f8be965dcc4e94322e9292fbcc
+  data.tar.gz: 4ae9d2cd36c87f8fd9ab2f344fcd17bc7045828a
 SHA512:
-  metadata.gz: 75aede6ba1404dc2065db2d404467071d1d00397da09ad141f760edb8d74617e750d8707e287ab2ebf088bb85cc1038acb36c7b6099c5dc73bc8372ebb66b067
-  data.tar.gz: 0ca55ec7326ed19bde60f5bc4d5cc55ffaf09b68a65a7162372078641668f743134b1267940e5ecfe5a5263cbb3b39078f93a3a0b9fa912b4fee6dca8bceb4fc
+  metadata.gz: 9114747a1908818faa62153ba123eed62dfdbc9b013934b921558ce9ed529d5a2e998fdced6d5622d3b60926b7745bbac7c3c38b11902c5379a4e03a63c0fc36
+  data.tar.gz: 11fcd7b49313b6688ca3da6c73a51ffe2fc8a5e87115ad70f894e63c11684b7c029ddd6a022f593b02efa2f8e8e51e62f3ad0d8ddf5fe935653bfc47c6722274

data/lib/devise/pwned_password/model.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "net/http"
+require "pwned"
 require "devise/pwned_password/hooks/pwned_password"
 
 module Devise
@@ -31,22 +31,16 @@ module Devise
       # Implement retry behaviour described here https://haveibeenpwned.com/API/v2#RateLimiting
       def password_pwned?(password)
         @pwned = false
-        hash = Digest::SHA1.hexdigest(password.to_s).upcase
-        prefix, suffix = hash.slice!(0..4), hash
-
-        userAgent = "devise_pwned_password"
-
-        uri = URI.parse("https://api.pwnedpasswords.com/range/#{prefix}")
-
+        options = {
+          "User-Agent" => "devise_pwned_password",
+          read_timeout: self.class.pwned_password_read_timeout,
+          open_timeout: self.class.pwned_password_open_timeout
+        }
+        pwned_password = Pwned::Password.new(password.to_s, options)
         begin
-          Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: self.class.pwned_password_open_timeout, read_timeout: self.class.pwned_password_read_timeout) do |http|
-            request = Net::HTTP::Get.new(uri.request_uri, "User-Agent" => userAgent)
-            response = http.request request
-            return false unless response.is_a?(Net::HTTPSuccess)
-            @pwned = usage_count(response.read_body, suffix) >= self.class.min_password_matches
-            return @pwned
-          end
-        rescue StandardError
+          @pwned = pwned_password.pwned_count >= self.class.min_password_matches
+          return @pwned
+        rescue Pwned::Error
           return false
         end
 
@@ -55,17 +49,6 @@ module Devise
 
       private
 
-        def usage_count(response, suffix)
-          count = 0
-          response.each_line do |line|
-            if line.start_with? suffix
-              count = line.strip.split(":").last.to_i
-              break
-            end
-          end
-          count
-        end
-
         def not_pwned_password
           # This deliberately fails silently on 500's etc. Most apps wont want to tie the ability to sign up customers to the availability of a third party API
           if password_pwned?(password)

data/lib/devise/pwned_password/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module PwnedPassword
-    VERSION = "0.1.4"
+    VERSION = "0.1.5"
   end
 end

metadata

@@ -1,43 +1,57 @@
 --- !ruby/object:Gem::Specification
 name: devise-pwned_password
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.5
 platform: ruby
 authors:
 - Michael Banfield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-03-12 00:00:00.000000000 Z
+date: 2018-03-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: devise
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.1.2
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.1.2
+        version: '4'
 - !ruby/object:Gem::Dependency
-  name: devise
+  name: pwned
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4'
+        version: 1.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4'
+        version: 1.2.1
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 5.1.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 5.1.2
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement