doorkeeper 5.0.3 → 5.1.0

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -7,31 +7,46 @@ module Doorkeeper
         class Validator
           attr_reader :parsed_scopes, :scope_str
 
-          def initialize(scope_str, server_scopes, application_scopes)
+          def initialize(scope_str, server_scopes, app_scopes, grant_type)
             @parsed_scopes = OAuth::Scopes.from_string(scope_str)
             @scope_str = scope_str
-            @valid_scopes = valid_scopes(server_scopes, application_scopes)
+            @valid_scopes = valid_scopes(server_scopes, app_scopes)
+
+            if grant_type
+              @scopes_by_grant_type = Doorkeeper.configuration.scopes_by_grant_type[grant_type.to_sym]
+            end
           end
 
           def valid?
             scope_str.present? &&
               scope_str !~ /[\n\r\t]/ &&
-              @valid_scopes.has_scopes?(parsed_scopes)
+              @valid_scopes.has_scopes?(parsed_scopes) &&
+              permitted_to_grant_type?
           end
 
           private
 
-          def valid_scopes(server_scopes, application_scopes)
-            if application_scopes.present?
-              application_scopes
+          def valid_scopes(server_scopes, app_scopes)
+            if app_scopes.present?
+              app_scopes
             else
               server_scopes
             end
           end
+
+          def permitted_to_grant_type?
+            return true unless @scopes_by_grant_type
+
+            OAuth::Scopes.from_array(@scopes_by_grant_type)
+              .has_scopes?(parsed_scopes)
+          end
         end
 
-        def self.valid?(scope_str, server_scopes, application_scopes = nil)
-          Validator.new(scope_str, server_scopes, application_scopes).valid?
+        def self.valid?(scope_str:, server_scopes:, app_scopes: nil, grant_type: nil)
+          Validator.new(scope_str,
+                        server_scopes,
+                        app_scopes,
+                        grant_type).valid?
         end
       end
     end

data/lib/doorkeeper/oauth/helpers/unique_token.rb

@@ -5,10 +5,22 @@ module Doorkeeper
     module Helpers
       module UniqueToken
         def self.generate(options = {})
-          generator_method = options.delete(:generator) || SecureRandom.method(:hex)
+          # Access Token value must be 1*VSCHAR or
+          # 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) *"="
+          #
+          # @see https://tools.ietf.org/html/rfc6749#appendix-A.12
+          # @see https://tools.ietf.org/html/rfc6750#section-2.1
+          #
+          generator_method = options.delete(:generator) || SecureRandom.method(self.generator_method)
           token_size       = options.delete(:size)      || 32
           generator_method.call(token_size)
         end
+
+        # Generator method for default generator class (SecureRandom)
+        #
+        def self.generator_method
+          Doorkeeper.configuration.default_generator_method
+        end
       end
     end
   end

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -1,11 +1,32 @@
 # frozen_string_literal: true
 
+require "ipaddr"
+
 module Doorkeeper
+  module IPAddrLoopback
+    def loopback?
+      case @family
+      when Socket::AF_INET
+        @addr & 0xff000000 == 0x7f000000
+      when Socket::AF_INET6
+        @addr == 1
+      else
+        raise AddressFamilyError, "unsupported address family"
+      end
+    end
+  end
+
+  # For backward compatibility with old rubies
+  if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("2.5.0")
+    IPAddr.send(:include, Doorkeeper::IPAddrLoopback)
+  end
+
   module OAuth
     module Helpers
       module URIChecker
         def self.valid?(url)
           return true if native_uri?(url)
+
           uri = as_uri(url)
           uri.fragment.nil? && !uri.host.nil? && !uri.scheme.nil?
         rescue URI::InvalidURIError
@@ -18,15 +39,29 @@ module Doorkeeper
 
           unless client_url.query.nil?
             return false unless query_matches?(url.query, client_url.query)
+
             # Clear out queries so rest of URI can be tested. This allows query
             # params to be in the request but order not mattering.
             client_url.query = nil
           end
 
+          # RFC8252, Paragraph 7.3
+          # @see https://tools.ietf.org/html/rfc8252#section-7.3
+          if loopback_uri?(url) && loopback_uri?(client_url)
+            url.port = nil
+            client_url.port = nil
+          end
+
           url.query = nil
           url == client_url
         end
 
+        def self.loopback_uri?(uri)
+          IPAddr.new(uri.host).loopback?
+        rescue IPAddr::Error
+          false
+        end
+
         def self.valid_for_authorization?(url, client_url)
           valid?(url) && client_url.split.any? { |other_url| matches?(url, other_url) }
         end
@@ -38,8 +73,9 @@ module Doorkeeper
         def self.query_matches?(query, client_query)
           return true if client_query.blank? && query.blank?
           return false if client_query.nil? || query.nil?
+
           # Will return true independent of query order
-          client_query.split('&').sort == query.split('&').sort
+          client_query.split("&").sort == query.split("&").sort
         end
 
         def self.native_uri?(url)

data/lib/doorkeeper/oauth/invalid_token_response.rb

@@ -22,6 +22,10 @@ module Doorkeeper
         @reason = attributes[:reason] || :unknown
       end
 
+      def status
+        :unauthorized
+      end
+
       def description
         scope = { scope: %i[doorkeeper errors messages invalid_token] }
         @description ||= I18n.translate @reason, scope
@@ -39,7 +43,7 @@ module Doorkeeper
         {
           expired: Doorkeeper::Errors::TokenExpired,
           revoked: Doorkeeper::Errors::TokenRevoked,
-          unknown: Doorkeeper::Errors::TokenUnknown
+          unknown: Doorkeeper::Errors::TokenUnknown,
         }
       end
     end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -32,7 +32,12 @@ module Doorkeeper
         client_scopes = client.try(:scopes)
         return true if scopes.blank?
 
-        ScopeChecker.valid?(scopes.to_s, server.scopes, client_scopes)
+        ScopeChecker.valid?(
+          scope_str: scopes.to_s,
+          server_scopes: server.scopes,
+          app_scopes: client_scopes,
+          grant_type: grant_type
+        )
       end
 
       def validate_resource_owner
@@ -40,7 +45,7 @@ module Doorkeeper
       end
 
       def validate_client
-        !parameters[:client_id] || !client.nil?
+        !parameters[:client_id] || client.present?
       end
     end
   end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -50,7 +50,7 @@ module Doorkeeper
           response_type: response_type,
           scope: scope,
           client_name: client.name,
-          status: I18n.t('doorkeeper.pre_authorization.status')
+          status: I18n.t("doorkeeper.pre_authorization.status"),
         }
       end
 
@@ -77,12 +77,17 @@ module Doorkeeper
         return true if scope.blank?
 
         Helpers::ScopeChecker.valid?(
-          scope,
-          server.scopes,
-          client.application.scopes
+          scope_str: scope,
+          server_scopes: server.scopes,
+          app_scopes: client.application.scopes,
+          grant_type: grant_type
         )
       end
 
+      def grant_type
+        response_type == "code" ? AUTHORIZATION_CODE : IMPLICIT
+      end
+
       def validate_redirect_uri
         return false if redirect_uri.blank?
 
@@ -93,7 +98,8 @@ module Doorkeeper
       end
 
       def validate_code_challenge_method
-        !code_challenge.present? || (code_challenge_method.present? && code_challenge_method =~ /^plain$|^S256$/)
+        code_challenge.blank? ||
+          (code_challenge_method.present? && code_challenge_method =~ /^plain$|^S256$/)
       end
     end
   end

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -58,7 +58,7 @@ module Doorkeeper
           resource_owner_id: refresh_token.resource_owner_id,
           scopes: scopes.to_s,
           expires_in: access_token_expires_in,
-          use_refresh_token: true
+          use_refresh_token: true,
         }.tap do |attributes|
           if refresh_token_revoked_on_use?
             attributes[:previous_refresh_token] = refresh_token.refresh_token
@@ -99,7 +99,10 @@ module Doorkeeper
 
       def validate_scope
         if @original_scopes.present?
-          ScopeChecker.valid?(@original_scopes, refresh_token.scopes)
+          ScopeChecker.valid?(
+            scope_str: @original_scopes,
+            server_scopes: refresh_token.scopes
+          )
         else
           true
         end

data/lib/doorkeeper/oauth/scopes.rb

@@ -7,7 +7,7 @@ module Doorkeeper
       include Comparable
 
       def self.from_string(string)
-        string ||= ''
+        string ||= ""
         new.tap do |scope|
           scope.add(*string.split)
         end
@@ -39,13 +39,15 @@ module Doorkeeper
       end
 
       def to_s
-        @scopes.join(' ')
+        @scopes.join(" ")
       end
 
-      def has_scopes?(scopes)
+      def scopes?(scopes)
         scopes.all? { |scope| exists?(scope) }
       end
 
+      alias has_scopes? scopes?
+
       def +(other)
         self.class.from_array(all + to_array(other))
       end

data/lib/doorkeeper/oauth/token.rb

@@ -55,11 +55,11 @@ module Doorkeeper
         end
 
         def token_from_header(header, pattern)
-          header.gsub pattern, ''
+          header.gsub pattern, ""
         end
 
         def match?(header, pattern)
-          header && header.match(pattern)
+          header&.match(pattern)
         end
       end
     end

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -20,7 +20,17 @@ module Doorkeeper
         @error.blank?
       end
 
-      def to_json
+      def error_response
+        return if @error.blank?
+
+        if @error == :invalid_token
+          OAuth::InvalidTokenResponse.from_access_token(authorized_token)
+        else
+          OAuth::ErrorResponse.new(name: @error)
+        end
+      end
+
+      def to_json(*)
         active? ? success_response : failure_response
       end
 
@@ -37,13 +47,29 @@ module Doorkeeper
       #
       # @see https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
       #
+      # To prevent token scanning attacks, the endpoint MUST also require
+      # some form of authorization to access this endpoint, such as client
+      # authentication as described in OAuth 2.0 [RFC6749] or a separate
+      # OAuth 2.0 access token such as the bearer token described in OAuth
+      # 2.0 Bearer Token Usage [RFC6750].
+      #
       def authorize!
         # Requested client authorization
         if server.credentials
           @error = :invalid_client unless authorized_client
-        else
+        elsif authorized_token
           # Requested bearer token authorization
-          @error = :invalid_request unless authorized_token
+          #
+          #  If the protected resource uses an OAuth 2.0 bearer token to authorize
+          #  its call to the introspection endpoint and the token used for
+          #  authorization does not contain sufficient privileges or is otherwise
+          #  invalid for this request, the authorization server responds with an
+          #  HTTP 401 code as described in Section 3 of OAuth 2.0 Bearer Token
+          #  Usage [RFC6750].
+          #
+          @error = :invalid_token if authorized_token_matches_introspected? || !authorized_token.accessible?
+        else
+          @error = :invalid_request
         end
       end
 
@@ -60,14 +86,14 @@ module Doorkeeper
 
       # 2.2. Introspection Response
       def success_response
-        {
+        customize_response(
           active: true,
           scope: @token.scopes_string,
           client_id: @token.try(:application).try(:uid),
           token_type: @token.token_type,
           exp: @token.expires_at.to_i,
           iat: @token.created_at.to_i
-        }
+        )
       end
 
       # If the introspection call is properly authorized but the token is not
@@ -83,7 +109,7 @@ module Doorkeeper
       #
       def failure_response
         {
-          active: false
+          active: false,
         }
       end
 
@@ -103,6 +129,25 @@ module Doorkeeper
       # * The token expired
       # * The token was issued to a different client than is making this request
       #
+      # Since resource servers using token introspection rely on the
+      # authorization server to determine the state of a token, the
+      # authorization server MUST perform all applicable checks against a
+      # token's state.  For instance, these tests include the following:
+      #
+      #    o  If the token can expire, the authorization server MUST determine
+      #       whether or not the token has expired.
+      #    o  If the token can be issued before it is able to be used, the
+      #       authorization server MUST determine whether or not a token's valid
+      #       period has started yet.
+      #    o  If the token can be revoked after it was issued, the authorization
+      #       server MUST determine whether or not such a revocation has taken
+      #       place.
+      #    o  If the token has been signed, the authorization server MUST
+      #       validate the signature.
+      #    o  If the token can be used only at certain resource servers, the
+      #       authorization server MUST determine whether or not the token can
+      #       be used at the resource server making the introspection call.
+      #
       def active?
         if authorized_client
           valid_token? && authorized_for_client?
@@ -113,18 +158,39 @@ module Doorkeeper
 
       # Token can be valid only if it is not expired or revoked.
       def valid_token?
-        @token.present? && @token.accessible?
+        @token&.accessible?
+      end
+
+      # RFC7662 Section 2.1
+      def authorized_token_matches_introspected?
+        authorized_token.token == @token&.token
       end
 
       # If token doesn't belong to some client, then it is public.
       # Otherwise in it required for token to be connected to the same client.
       def authorized_for_client?
-        if @token.application.present?
+        if @token.application
           @token.application == authorized_client.application
         else
           true
         end
       end
+
+      # Allows to customize introspection response.
+      # Provides context (controller) and token for generating developer-specific
+      # response.
+      #
+      # @see https://tools.ietf.org/html/rfc7662#section-2.2
+      #
+      def customize_response(response)
+        customized_response = Doorkeeper.configuration.custom_introspection_response.call(
+          token,
+          server.context
+        )
+        return response if customized_response.blank?
+
+        response.merge(customized_response)
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/token_response.rb

@@ -11,12 +11,12 @@ module Doorkeeper
 
       def body
         {
-          'access_token'  => token.token,
-          'token_type'    => token.token_type,
-          'expires_in'    => token.expires_in_seconds,
-          'refresh_token' => token.refresh_token,
-          'scope'         => token.scopes_string,
-          'created_at'    => token.created_at.to_i
+          "access_token" => token.plaintext_token,
+          "token_type" => token.token_type,
+          "expires_in" => token.expires_in_seconds,
+          "refresh_token" => token.plaintext_refresh_token,
+          "scope" => token.scopes_string,
+          "created_at" => token.created_at.to_i,
         }.reject { |_, value| value.blank? }
       end
 
@@ -26,9 +26,9 @@ module Doorkeeper
 
       def headers
         {
-          'Cache-Control' => 'no-store',
-          'Pragma' => 'no-cache',
-          'Content-Type' => 'application/json; charset=utf-8'
+          "Cache-Control" => "no-store",
+          "Pragma" => "no-cache",
+          "Content-Type" => "application/json; charset=utf-8",
         }
       end
     end

data/lib/doorkeeper/oauth.rb

@@ -3,11 +3,11 @@
 module Doorkeeper
   module OAuth
     GRANT_TYPES = [
-      AUTHORIZATION_CODE = 'authorization_code'.freeze,
-      IMPLICIT = 'implicit'.freeze,
-      PASSWORD = 'password'.freeze,
-      CLIENT_CREDENTIALS = 'client_credentials'.freeze,
-      REFRESH_TOKEN = 'refresh_token'.freeze
+      AUTHORIZATION_CODE = "authorization_code",
+      IMPLICIT = "implicit",
+      PASSWORD = "password",
+      CLIENT_CREDENTIALS = "client_credentials",
+      REFRESH_TOKEN = "refresh_token",
     ].freeze
   end
 end

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -1,26 +1,39 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AccessGrant < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}"
 
     include AccessGrantMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    belongs_to_options = {
-      class_name: 'Doorkeeper::Application',
-      inverse_of: :access_grants
-    }
 
-    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-      belongs_to_options[:optional] = true
-    end
+    belongs_to :application, class_name: "Doorkeeper::Application",
+                             optional: true, inverse_of: :access_grants
 
-    belongs_to :application, belongs_to_options
+    validates :resource_owner_id,
+              :application_id,
+              :token,
+              :expires_in,
+              :redirect_uri,
+              presence: true
 
-    validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, presence: true
     validates :token, uniqueness: true
 
     before_validation :generate_token, on: :create
 
+    # We keep a volatile copy of the raw token for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
+    #
+    # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+    # while hashing strategies do not, so you cannot rely on this value
+    # returning a present value for persisted tokens.
+    def plaintext_token
+      if secret_strategy.allows_restoring_secrets?
+        secret_strategy.restore_secret(self, :token)
+      else
+        @raw_token
+      end
+    end
+
     private
 
     # Generates token value with UniqueToken class.
@@ -28,7 +41,8 @@ module Doorkeeper
     # @return [String] token value
     #
     def generate_token
-      self.token = UniqueToken.generate
+      @raw_token = UniqueToken.generate
+      secret_strategy.store_secret(self, :token, @raw_token)
     end
   end
 end

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -1,20 +1,13 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AccessToken < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}"
 
     include AccessTokenMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    belongs_to_options = {
-      class_name: 'Doorkeeper::Application',
-      inverse_of: :access_tokens
-    }
-
-    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-      belongs_to_options[:optional] = true
-    end
 
-    belongs_to :application, belongs_to_options
+    belongs_to :application, class_name: "Doorkeeper::Application",
+                             inverse_of: :access_tokens, optional: true
 
     validates :token, presence: true, uniqueness: true
     validates :refresh_token, uniqueness: true, if: :use_refresh_token?
@@ -41,7 +34,7 @@ module Doorkeeper
     end
 
     def self.refresh_token_revoked_on_use?
-      column_names.include?('previous_refresh_token')
+      column_names.include?("previous_refresh_token")
     end
   end
 end