doorkeeper 5.0.2 → 5.1.0.rc2

data/lib/doorkeeper/models/application_mixin.rb

@@ -6,8 +6,10 @@ module Doorkeeper
 
     include OAuth::Helpers
     include Models::Orderable
+    include Models::SecretStorable
     include Models::Scopes
 
+    # :nodoc
     module ClassMethods
       # Returns an instance of the Doorkeeper::Application with
       # specific UID and secret.
@@ -25,7 +27,7 @@ module Doorkeeper
         app = by_uid(uid)
         return unless app
         return app if secret.blank? && !app.confidential?
-        return unless app.secret == secret
+        return unless app.secret_matches?(secret)
         app
       end
 
@@ -39,6 +41,20 @@ module Doorkeeper
       def by_uid(uid)
         find_by(uid: uid.to_s)
       end
+
+      ##
+      # Determines the secret storing transformer
+      # Unless configured otherwise, uses the plain secret strategy
+      def secret_strategy
+        ::Doorkeeper.configuration.application_secret_strategy
+      end
+
+      ##
+      # Determine the fallback storing strategy
+      # Unless configured, there will be no fallback
+      def fallback_secret_strategy
+        ::Doorkeeper.configuration.application_secret_fallback_strategy
+      end
     end
 
     # Set an application's valid redirect URIs.
@@ -49,5 +65,30 @@ module Doorkeeper
     def redirect_uri=(uris)
       super(uris.is_a?(Array) ? uris.join("\n") : uris)
     end
+
+    # Check whether the given plain text secret matches our stored secret
+    #
+    # @param input [#to_s] Plain secret provided by user
+    #        (any object that responds to `#to_s`)
+    #
+    # @return [true] Whether the given secret matches the stored secret
+    #                of this application.
+    #
+    def secret_matches?(input)
+      # return false if either is nil, since secure_compare depends on strings
+      # but Application secrets MAY be nil depending on confidentiality.
+      return false if input.nil? || secret.nil?
+
+      # When matching the secret by comparer function, all is well.
+      return true if secret_strategy.secret_matches?(input, secret)
+
+      # When fallback lookup is enabled, ensure applications
+      # with plain secrets can still be found
+      if fallback_secret_strategy
+        fallback_secret_strategy.secret_matches?(input, secret)
+      else
+        false
+      end
+    end
   end
 end

data/lib/doorkeeper/models/concerns/expirable.rb

@@ -24,10 +24,11 @@ module Doorkeeper
 
       # Expiration time (date time of creation + TTL).
       #
-      # @return [Time] expiration time in UTC
+      # @return [Time, nil] expiration time in UTC
+      #   or nil if the object never expires.
       #
       def expires_at
-        created_at + expires_in.seconds
+        expires_in && created_at + expires_in.seconds
       end
     end
   end

data/lib/doorkeeper/models/concerns/reusable.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Models
+    module Reusable
+      # Indicates whether the object is reusable (i.e. It is not expired and
+      # has not crossed reuse_limit).
+      #
+      # @return [Boolean] true if can be reused and false in other case
+      def reusable?
+        return false if expired?
+        return true unless expires_in
+
+        threshold_limit = 100 - Doorkeeper.configuration.token_reuse_limit
+        expires_in_seconds >= threshold_limit * expires_in / 100
+      end
+    end
+  end
+end

data/lib/doorkeeper/models/concerns/scopes.rb

@@ -4,7 +4,11 @@ module Doorkeeper
   module Models
     module Scopes
       def scopes
-        OAuth::Scopes.from_string(self[:scopes])
+        OAuth::Scopes.from_string(scopes_string)
+      end
+
+      def scopes=(value)
+        super Array(value).join(' ')
       end
 
       def scopes_string

data/lib/doorkeeper/models/concerns/secret_storable.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Models
+    ##
+    # Storable finder to provide lookups for input plaintext values which are
+    # mapped to their stored versions (e.g., hashing, encryption) before lookup.
+    module SecretStorable
+      extend ActiveSupport::Concern
+
+      delegate :secret_strategy,
+               :fallback_secret_strategy,
+               to: :class
+
+      # :nodoc
+      module ClassMethods
+        # Compare the given plaintext with the secret
+        #
+        # @param input [String]
+        #   The plain input to compare.
+        #
+        # @param secret [String]
+        #   The secret value to compare with.
+        #
+        # @return [Boolean]
+        #   Whether input matches secret as per the secret strategy
+        #
+        def secret_matches?(input, secret)
+          secret_strategy.secret_matches?(input, secret)
+        end
+
+        # Returns an instance of the Doorkeeper::AccessToken with
+        # specific token value.
+        #
+        # @param attr [Symbol]
+        #   The token attribute we're looking with.
+        #
+        # @param token [#to_s]
+        #   token value (any object that responds to `#to_s`)
+        #
+        # @return [Doorkeeper::AccessToken, nil] AccessToken object or nil
+        #   if there is no record with such token
+        #
+        def find_by_plaintext_token(attr, token)
+          token = token.to_s
+
+          find_by(attr => secret_strategy.transform_secret(token)) ||
+            find_by_fallback_token(attr, token)
+        end
+
+        # Allow looking up previously plain tokens as a fallback
+        # IFF a fallback strategy has been defined
+        #
+        # @param attr [Symbol]
+        #   The token attribute we're looking with.
+        #
+        # @param plain_secret [#to_s]
+        #   plain secret value (any object that responds to `#to_s`)
+        #
+        # @return [Doorkeeper::AccessToken, nil] AccessToken object or nil
+        #   if there is no record with such token
+        #
+        def find_by_fallback_token(attr, plain_secret)
+          return nil unless fallback_secret_strategy
+
+          # Use the previous strategy to look up
+          stored_token = fallback_secret_strategy.transform_secret(plain_secret)
+          find_by(attr => stored_token).tap do |resource|
+            upgrade_fallback_value resource, attr, plain_secret
+          end
+        end
+
+        # Allow implementations in ORMs to replace a plain
+        # value falling back to to avoid it remaining as plain text.
+        #
+        # @param instance
+        #   An instance of this model with a plain value token.
+        #
+        # @param attr
+        #   The secret attribute name to upgrade.
+        #
+        # @param plain_secret
+        #   The plain secret to upgrade.
+        #
+        def upgrade_fallback_value(instance, attr, plain_secret)
+          upgraded = secret_strategy.store_secret(instance, attr, plain_secret)
+          instance.update(attr => upgraded)
+        end
+
+        ##
+        # Determines the secret storing transformer
+        # Unless configured otherwise, uses the plain secret strategy
+        def secret_strategy
+          ::Doorkeeper::SecretStoring::Plain
+        end
+
+        ##
+        # Determine the fallback storing strategy
+        # Unless configured, there will be no fallback
+        def fallback_secret_strategy
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -16,7 +16,7 @@ module Doorkeeper
         end
 
         def native_redirect
-          { action: :show, code: token.token }
+          { action: :show, code: token.plaintext_token }
         end
 
         def configuration

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -8,7 +8,9 @@ module Doorkeeper
 
         class << self
           def build_context(pre_auth_or_oauth_client, grant_type, scopes)
-            oauth_client = if pre_auth_or_oauth_client.respond_to?(:client)
+            oauth_client = if pre_auth_or_oauth_client.respond_to?(:application)
+                             pre_auth_or_oauth_client.application
+                           elsif pre_auth_or_oauth_client.respond_to?(:client)
                              pre_auth_or_oauth_client.client
                            else
                              pre_auth_or_oauth_client
@@ -62,7 +64,7 @@ module Doorkeeper
           {
             controller: controller,
             action: :show,
-            access_token: token.token
+            access_token: token.plaintext_token
           }
         end
 

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -49,7 +49,7 @@ module Doorkeeper
       end
 
       def validate_client
-        !client.nil?
+        client.present?
       end
 
       def validate_grant

data/lib/doorkeeper/oauth/client.rb

@@ -18,7 +18,7 @@ module Doorkeeper
       end
 
       def self.authenticate(credentials, method = Application.method(:by_uid_and_secret))
-        return false if credentials.blank?
+        return if credentials.blank?
 
         if (application = method.call(credentials.uid, credentials.secret))
           new(application)

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -34,9 +34,10 @@ module Doorkeeper
                                end
 
           ScopeChecker.valid?(
-            @request.scopes.to_s,
-            @server.scopes,
-            application_scopes
+            scope_str: @request.scopes.to_s,
+            server_scopes: @server.scopes,
+            app_scopes: application_scopes,
+            grant_type: Doorkeeper::OAuth::CLIENT_CREDENTIALS
           )
         end
       end

data/lib/doorkeeper/oauth/code_response.rb

@@ -23,7 +23,7 @@ module Doorkeeper
         elsif response_on_fragment
           Authorization::URIBuilder.uri_with_fragment(
             pre_auth.redirect_uri,
-            access_token: auth.token.token,
+            access_token: auth.token.plaintext_token,
             token_type: auth.token.token_type,
             expires_in: auth.token.expires_in_seconds,
             state: pre_auth.state
@@ -31,7 +31,7 @@ module Doorkeeper
         else
           Authorization::URIBuilder.uri_with_query(
             pre_auth.redirect_uri,
-            code: auth.token.token,
+            code: auth.token.plaintext_token,
             state: pre_auth.state
           )
         end

data/lib/doorkeeper/oauth/error_response.rb

@@ -32,7 +32,11 @@ module Doorkeeper
       end
 
       def status
-        :unauthorized
+        if name == :invalid_client
+          :unauthorized
+        else
+          :bad_request
+        end
       end
 
       def redirectable?

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -7,31 +7,46 @@ module Doorkeeper
         class Validator
           attr_reader :parsed_scopes, :scope_str
 
-          def initialize(scope_str, server_scopes, application_scopes)
+          def initialize(scope_str, server_scopes, app_scopes, grant_type)
             @parsed_scopes = OAuth::Scopes.from_string(scope_str)
             @scope_str = scope_str
-            @valid_scopes = valid_scopes(server_scopes, application_scopes)
+            @valid_scopes = valid_scopes(server_scopes, app_scopes)
+
+            if grant_type
+              @scopes_by_grant_type = Doorkeeper.configuration.scopes_by_grant_type[grant_type.to_sym]
+            end
           end
 
           def valid?
             scope_str.present? &&
               scope_str !~ /[\n\r\t]/ &&
-              @valid_scopes.has_scopes?(parsed_scopes)
+              @valid_scopes.has_scopes?(parsed_scopes) &&
+              permitted_to_grant_type?
           end
 
           private
 
-          def valid_scopes(server_scopes, application_scopes)
-            if application_scopes.present?
-              application_scopes
+          def valid_scopes(server_scopes, app_scopes)
+            if app_scopes.present?
+              app_scopes
             else
               server_scopes
             end
           end
+
+          def permitted_to_grant_type?
+            return true unless @scopes_by_grant_type
+
+            OAuth::Scopes.from_array(@scopes_by_grant_type)
+                         .has_scopes?(parsed_scopes)
+          end
         end
 
-        def self.valid?(scope_str, server_scopes, application_scopes = nil)
-          Validator.new(scope_str, server_scopes, application_scopes).valid?
+        def self.valid?(scope_str:, server_scopes:, app_scopes: nil, grant_type: nil)
+          Validator.new(scope_str,
+                        server_scopes,
+                        app_scopes,
+                        grant_type).valid?
         end
       end
     end

data/lib/doorkeeper/oauth/helpers/unique_token.rb

@@ -5,10 +5,21 @@ module Doorkeeper
     module Helpers
       module UniqueToken
         def self.generate(options = {})
-          generator_method = options.delete(:generator) || SecureRandom.method(:hex)
+          # Access Token value must be 1*VSCHAR or 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) *"="
+          #
+          # @see https://tools.ietf.org/html/rfc6749#appendix-A.12
+          # @see https://tools.ietf.org/html/rfc6750#section-2.1
+          #
+          generator_method = options.delete(:generator) || SecureRandom.method(self.generator_method)
           token_size       = options.delete(:size)      || 32
           generator_method.call(token_size)
         end
+
+        # Generator method for default generator class (SecureRandom)
+        #
+        def self.generator_method
+          Doorkeeper.configuration.default_generator_method
+        end
       end
     end
   end

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -1,6 +1,25 @@
 # frozen_string_literal: true
+require 'ipaddr'
 
 module Doorkeeper
+  module IPAddrLoopback
+    def loopback?
+      case @family
+      when Socket::AF_INET
+        @addr & 0xff000000 == 0x7f000000
+      when Socket::AF_INET6
+        @addr == 1
+      else
+        raise AddressFamilyError, "unsupported address family"
+      end
+    end
+  end
+
+  # For backward compatibility with old rubies
+  if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("2.5.0")
+    IPAddr.send(:include, Doorkeeper::IPAddrLoopback)
+  end
+
   module OAuth
     module Helpers
       module URIChecker
@@ -23,10 +42,23 @@ module Doorkeeper
             client_url.query = nil
           end
 
+          # RFC8252, Paragraph 7.3
+          # @see https://tools.ietf.org/html/rfc8252#section-7.3
+          if loopback_uri?(url) && loopback_uri?(client_url)
+            url.port = nil
+            client_url.port = nil
+          end
+
           url.query = nil
           url == client_url
         end
 
+        def self.loopback_uri?(uri)
+          IPAddr.new(uri.host).loopback?
+        rescue IPAddr::Error
+          false
+        end
+
         def self.valid_for_authorization?(url, client_url)
           valid?(url) && client_url.split.any? { |other_url| matches?(url, other_url) }
         end

data/lib/doorkeeper/oauth/invalid_token_response.rb

@@ -22,6 +22,10 @@ module Doorkeeper
         @reason = attributes[:reason] || :unknown
       end
 
+      def status
+        :unauthorized
+      end
+
       def description
         scope = { scope: %i[doorkeeper errors messages invalid_token] }
         @description ||= I18n.translate @reason, scope

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -32,7 +32,12 @@ module Doorkeeper
         client_scopes = client.try(:scopes)
         return true if scopes.blank?
 
-        ScopeChecker.valid?(scopes.to_s, server.scopes, client_scopes)
+        ScopeChecker.valid?(
+          scope_str: scopes.to_s,
+          server_scopes: server.scopes,
+          app_scopes: client_scopes,
+          grant_type: grant_type
+        )
       end
 
       def validate_resource_owner
@@ -40,7 +45,7 @@ module Doorkeeper
       end
 
       def validate_client
-        !parameters[:client_id] || !client.nil?
+        !parameters[:client_id] || client.present?
       end
     end
   end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -77,12 +77,17 @@ module Doorkeeper
         return true if scope.blank?
 
         Helpers::ScopeChecker.valid?(
-          scope,
-          server.scopes,
-          client.application.scopes
+          scope_str: scope,
+          server_scopes: server.scopes,
+          app_scopes: client.application.scopes,
+          grant_type: grant_type
         )
       end
 
+      def grant_type
+        response_type == 'code' ? AUTHORIZATION_CODE : IMPLICIT
+      end
+
       def validate_redirect_uri
         return false if redirect_uri.blank?
 

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -99,7 +99,10 @@ module Doorkeeper
 
       def validate_scope
         if @original_scopes.present?
-          ScopeChecker.valid?(@original_scopes, refresh_token.scopes)
+          ScopeChecker.valid?(
+            scope_str: @original_scopes,
+            server_scopes: refresh_token.scopes
+          )
         else
           true
         end

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -20,6 +20,16 @@ module Doorkeeper
         @error.blank?
       end
 
+      def error_response
+        return if @error.blank?
+
+        if @error == :invalid_token
+          OAuth::InvalidTokenResponse.from_access_token(authorized_token)
+        else
+          OAuth::ErrorResponse.new(name: @error)
+        end
+      end
+
       def to_json
         active? ? success_response : failure_response
       end
@@ -37,13 +47,29 @@ module Doorkeeper
       #
       # @see https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
       #
+      # To prevent token scanning attacks, the endpoint MUST also require
+      # some form of authorization to access this endpoint, such as client
+      # authentication as described in OAuth 2.0 [RFC6749] or a separate
+      # OAuth 2.0 access token such as the bearer token described in OAuth
+      # 2.0 Bearer Token Usage [RFC6750].
+      #
       def authorize!
         # Requested client authorization
         if server.credentials
           @error = :invalid_client unless authorized_client
-        else
+        elsif authorized_token
           # Requested bearer token authorization
-          @error = :invalid_request unless authorized_token
+          #
+          #  If the protected resource uses an OAuth 2.0 bearer token to authorize
+          #  its call to the introspection endpoint and the token used for
+          #  authorization does not contain sufficient privileges or is otherwise
+          #  invalid for this request, the authorization server responds with an
+          #  HTTP 401 code as described in Section 3 of OAuth 2.0 Bearer Token
+          #  Usage [RFC6750].
+          #
+          @error = :invalid_token if authorized_token_matches_introspected? || !authorized_token.accessible?
+        else
+          @error = :invalid_request
         end
       end
 
@@ -60,14 +86,14 @@ module Doorkeeper
 
       # 2.2. Introspection Response
       def success_response
-        {
+        customize_response(
           active: true,
           scope: @token.scopes_string,
           client_id: @token.try(:application).try(:uid),
           token_type: @token.token_type,
           exp: @token.expires_at.to_i,
           iat: @token.created_at.to_i
-        }
+        )
       end
 
       # If the introspection call is properly authorized but the token is not
@@ -103,6 +129,25 @@ module Doorkeeper
       # * The token expired
       # * The token was issued to a different client than is making this request
       #
+      # Since resource servers using token introspection rely on the
+      # authorization server to determine the state of a token, the
+      # authorization server MUST perform all applicable checks against a
+      # token's state.  For instance, these tests include the following:
+      #
+      #    o  If the token can expire, the authorization server MUST determine
+      #       whether or not the token has expired.
+      #    o  If the token can be issued before it is able to be used, the
+      #       authorization server MUST determine whether or not a token's valid
+      #       period has started yet.
+      #    o  If the token can be revoked after it was issued, the authorization
+      #       server MUST determine whether or not such a revocation has taken
+      #       place.
+      #    o  If the token has been signed, the authorization server MUST
+      #       validate the signature.
+      #    o  If the token can be used only at certain resource servers, the
+      #       authorization server MUST determine whether or not the token can
+      #       be used at the resource server making the introspection call.
+      #
       def active?
         if authorized_client
           valid_token? && authorized_for_client?
@@ -113,18 +158,39 @@ module Doorkeeper
 
       # Token can be valid only if it is not expired or revoked.
       def valid_token?
-        @token.present? && @token.accessible?
+        @token && @token.accessible?
+      end
+
+      # RFC7662 Section 2.1
+      def authorized_token_matches_introspected?
+        authorized_token.token == @token.token
       end
 
       # If token doesn't belong to some client, then it is public.
       # Otherwise in it required for token to be connected to the same client.
       def authorized_for_client?
-        if @token.application.present?
+        if @token.application
           @token.application == authorized_client.application
         else
           true
         end
       end
+
+      # Allows to customize introspection response.
+      # Provides context (controller) and token for generating developer-specific
+      # response.
+      #
+      # @see https://tools.ietf.org/html/rfc7662#section-2.2
+      #
+      def customize_response(response)
+        customized_response = Doorkeeper.configuration.custom_introspection_response.call(
+          token,
+          server.context
+        )
+        return response if customized_response.blank?
+
+        response.merge(customized_response)
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/token_response.rb

@@ -11,10 +11,10 @@ module Doorkeeper
 
       def body
         {
-          'access_token'  => token.token,
+          'access_token'  => token.plaintext_token,
           'token_type'    => token.token_type,
           'expires_in'    => token.expires_in_seconds,
-          'refresh_token' => token.refresh_token,
+          'refresh_token' => token.plaintext_refresh_token,
           'scope'         => token.scopes_string,
           'created_at'    => token.created_at.to_i
         }.reject { |_, value| value.blank? }