doorkeeper 5.3.1 → 5.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb82e22e68fdc6c80e3cb7b65d8a280e9893222a6bf3390f216f7bb534195682
-  data.tar.gz: 9299736f29bce52700adeb7dde05d9669294ce03457c683c0a80d6f98ac73346
+  metadata.gz: 2a2e558c16d91012fda8543a405ee8e107ec3e100edc255ef9c0453e15fee34b
+  data.tar.gz: 0e9ffe0268ccfb370ec23cd5c5b124e8febdec591cd0d5443974bd73942079f2
 SHA512:
-  metadata.gz: 7e951c0a2ebaa747f03afb968fc8750c166beb8cb73600fcf1ce47546e25528daf815d424b85c8ac723f9ba83b100bbf9f55acf9e3240f21db43bd463ae0838f
-  data.tar.gz: f4e0bc0bf47e60407aae249b6d2eb7b485fe324e688caa43bb5db473c7b1393f973e00707edab007ddf5aee75007e1e6fcf4d2de8aa049ec16fa69cbbd082c7b
+  metadata.gz: 11b2350bfbe3e18b7500b9a159096dda35fc2307f66ab5ccec9e1266c18a4fc34e1ac9a8ffa763f713cd431dbb9a5fee7734bcd9d6576b41749101e3f149e969
+  data.tar.gz: 7fdb1df4a142ac870a3a37838c4131a7514f81571319339c115754bf92ad3ed97c9e5a543008b94da6117e854104e418052bb634a5e5fcfb460063ecb83c6b5d

data/CHANGELOG.md

@@ -5,6 +5,16 @@ upgrade guides.
 
 User-visible changes worth mentioning.
 
+## 5.3.2
+
+- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
+  Fixes information disclosure vulnerability (CVE-2020-10187).
+  
+  **[IMPORTANT]** you need to re-implement `#as_json` method for Doorkeeper Application model
+  if you previously used `#to_json` serialization with custom options or attributes or rely on
+  JSON response from /oauth/applications.json or /oauth/authorized_applications.json. This change
+  is a breaking change which restricts serialized attributes to a very small set of columns.
+
 ## 5.3.1
 
 - [#1360] Backport: Increase `matching_token_for` batch lookup size to 10 000 and make it configurable.

data/app/controllers/doorkeeper/applications_controller.rb

@@ -19,7 +19,7 @@ module Doorkeeper
     def show
       respond_to do |format|
         format.html
-        format.json { render json: @application }
+        format.json { render json: @application, as_owner: true }
       end
     end
 
@@ -36,7 +36,7 @@ module Doorkeeper
 
         respond_to do |format|
           format.html { redirect_to oauth_application_url(@application) }
-          format.json { render json: @application }
+          format.json { render json: @application, as_owner: true }
         end
       else
         respond_to do |format|
@@ -58,7 +58,7 @@ module Doorkeeper
 
         respond_to do |format|
           format.html { redirect_to oauth_application_url(@application) }
-          format.json { render json: @application }
+          format.json { render json: @application, as_owner: true }
         end
       else
         respond_to do |format|

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -9,7 +9,7 @@ module Doorkeeper
 
       respond_to do |format|
         format.html
-        format.json { render json: @applications }
+        format.json { render json: @applications, current_resource_owner: current_resource_owner }
       end
     end
 

data/lib/doorkeeper/orm/active_record/mixins/application.rb

@@ -61,15 +61,27 @@ module Doorkeeper::Orm::ActiveRecord::Mixins
         end
       end
 
-      # This is the right way how we want to override ActiveRecord #to_json
+      # Represents client as set of it's attributes in JSON format.
+      # This is the right way how we want to override ActiveRecord #to_json.
       #
-      # @return [String] entity attributes as JSON
+      # Respects privacy settings and serializes minimum set of attributes
+      # for public/private clients and full set for authorized owners.
+      #
+      # @return [Hash] entity attributes for JSON
       #
       def as_json(options = {})
-        hash = super
-
-        hash["secret"] = plaintext_secret if hash.key?("secret")
-        hash
+        # if application belongs to some owner we need to check if it's the same as
+        # the one passed in the options or check if we render the client as an owner
+        if (respond_to?(:owner) && owner && owner == options[:current_resource_owner]) ||
+           options[:as_owner]
+          # Owners can see all the client attributes, fallback to ActiveModel serialization
+          super
+        else
+          # if application has no owner or it's owner doesn't match one from the options
+          # we render only minimum set of attributes that could be exposed to a public
+          only = extract_serializable_attributes(options)
+          super(options.merge(only: only))
+        end
       end
 
       private
@@ -96,6 +108,49 @@ module Doorkeeper::Orm::ActiveRecord::Mixins
       def enforce_scopes?
         Doorkeeper.config.enforce_configured_scopes?
       end
+
+      # Helper method to extract collection of serializable attribute names
+      # considering serialization options (like `only`, `except` and so on).
+      #
+      # @param options [Hash] serialization options
+      #
+      # @return [Array<String>]
+      #   collection of attributes to be serialized using #as_json
+      #
+      def extract_serializable_attributes(options = {})
+        opts = options.try(:dup) || {}
+        only = Array.wrap(opts[:only]).map(&:to_s)
+
+        only = if only.blank?
+                 serializable_attributes
+               else
+                 only & serializable_attributes
+               end
+
+        only -= Array.wrap(opts[:except]).map(&:to_s) if opts.key?(:except)
+        only.uniq
+      end
+
+      # We need to hook into this method to allow serializing plan-text secrets
+      # when secrets hashing enabled.
+      #
+      # @param key [String] attribute name
+      #
+      def read_attribute_for_serialization(key)
+        return super unless key.to_s == "secret"
+
+        plaintext_secret || secret
+      end
+
+      # Collection of attributes that could be serialized for public.
+      # Override this method if you need additional attributes to be serialized.
+      #
+      # @return [Array<String>] collection of serializable attributes
+      def serializable_attributes
+        attributes = %w[id name created_at]
+        attributes << "uid" unless confidential?
+        attributes
+      end
     end
 
     class_methods do

data/lib/doorkeeper/version.rb

@@ -9,7 +9,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 3
-    TINY = 1
+    TINY = 2
     PRE = nil
 
     # Full version number

data/spec/models/doorkeeper/application_spec.rb

@@ -3,402 +3,480 @@
 require "spec_helper"
 require "bcrypt"
 
-module Doorkeeper
-  describe Application do
-    let(:clazz) { Doorkeeper::Application }
-    let(:require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", true) }
-    let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", false) }
-    let(:new_application) { FactoryBot.build(:application) }
+describe Doorkeeper::Application do
+  let(:require_owner) { Doorkeeper.config.instance_variable_set("@confirm_application_owner", true) }
+  let(:unset_require_owner) { Doorkeeper.config.instance_variable_set("@confirm_application_owner", false) }
+  let(:new_application) { FactoryBot.build(:application) }
 
-    let(:uid) { SecureRandom.hex(8) }
-    let(:secret) { SecureRandom.hex(8) }
+  let(:uid) { SecureRandom.hex(8) }
+  let(:secret) { SecureRandom.hex(8) }
 
-    it "is invalid without a name" do
-      new_application.name = nil
-      expect(new_application).not_to be_valid
-    end
+  it "is invalid without a name" do
+    new_application.name = nil
+    expect(new_application).not_to be_valid
+  end
 
-    it "is invalid without determining confidentiality" do
-      new_application.confidential = nil
-      expect(new_application).not_to be_valid
-    end
+  it "is invalid without determining confidentiality" do
+    new_application.confidential = nil
+    expect(new_application).not_to be_valid
+  end
 
-    it "generates uid on create" do
-      expect(new_application.uid).to be_nil
-      new_application.save
-      expect(new_application.uid).not_to be_nil
-    end
+  it "generates uid on create" do
+    expect(new_application.uid).to be_nil
+    new_application.save
+    expect(new_application.uid).not_to be_nil
+  end
 
-    it "generates uid on create if an empty string" do
-      new_application.uid = ""
-      new_application.save
-      expect(new_application.uid).not_to be_blank
-    end
+  it "generates uid on create if an empty string" do
+    new_application.uid = ""
+    new_application.save
+    expect(new_application.uid).not_to be_blank
+  end
 
-    it "generates uid on create unless one is set" do
-      new_application.uid = uid
-      new_application.save
-      expect(new_application.uid).to eq(uid)
-    end
+  it "generates uid on create unless one is set" do
+    new_application.uid = uid
+    new_application.save
+    expect(new_application.uid).to eq(uid)
+  end
 
-    it "is invalid without uid" do
-      new_application.save
-      new_application.uid = nil
-      expect(new_application).not_to be_valid
-    end
+  it "is invalid without uid" do
+    new_application.save
+    new_application.uid = nil
+    expect(new_application).not_to be_valid
+  end
 
-    it "checks uniqueness of uid" do
-      app1 = FactoryBot.create(:application)
-      app2 = FactoryBot.create(:application)
-      app2.uid = app1.uid
-      expect(app2).not_to be_valid
-    end
+  it "checks uniqueness of uid" do
+    app1 = FactoryBot.create(:application)
+    app2 = FactoryBot.create(:application)
+    app2.uid = app1.uid
+    expect(app2).not_to be_valid
+  end
 
-    it "expects database to throw an error when uids are the same" do
-      app1 = FactoryBot.create(:application)
-      app2 = FactoryBot.create(:application)
-      app2.uid = app1.uid
-      expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
-    end
+  it "expects database to throw an error when uids are the same" do
+    app1 = FactoryBot.create(:application)
+    app2 = FactoryBot.create(:application)
+    app2.uid = app1.uid
+    expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
+  end
 
-    it "generate secret on create" do
-      expect(new_application.secret).to be_nil
-      new_application.save
-      expect(new_application.secret).not_to be_nil
-    end
+  it "generate secret on create" do
+    expect(new_application.secret).to be_nil
+    new_application.save
+    expect(new_application.secret).not_to be_nil
+  end
 
-    it "generate secret on create if is blank string" do
-      new_application.secret = ""
-      new_application.save
-      expect(new_application.secret).not_to be_blank
-    end
+  it "generate secret on create if is blank string" do
+    new_application.secret = ""
+    new_application.save
+    expect(new_application.secret).not_to be_blank
+  end
 
-    it "generate secret on create unless one is set" do
-      new_application.secret = secret
-      new_application.save
-      expect(new_application.secret).to eq(secret)
-    end
+  it "generate secret on create unless one is set" do
+    new_application.secret = secret
+    new_application.save
+    expect(new_application.secret).to eq(secret)
+  end
 
-    it "is invalid without secret" do
-      new_application.save
-      new_application.secret = nil
-      expect(new_application).not_to be_valid
-    end
+  it "is invalid without secret" do
+    new_application.save
+    new_application.secret = nil
+    expect(new_application).not_to be_valid
+  end
 
-    context "application_owner is enabled" do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          enable_application_owner
-        end
+  context "application_owner is enabled" do
+    before do
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        enable_application_owner
       end
+    end
 
-      context "application owner is not required" do
-        before(:each) do
-          unset_require_owner
-        end
+    context "application owner is not required" do
+      before(:each) do
+        unset_require_owner
+      end
 
-        it "is valid given valid attributes" do
-          expect(new_application).to be_valid
-        end
+      it "is valid given valid attributes" do
+        expect(new_application).to be_valid
       end
+    end
 
-      context "application owner is required" do
-        before(:each) do
-          require_owner
-          @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
-        end
+    context "application owner is required" do
+      before do
+        require_owner
+        @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
+      end
 
-        it "is invalid without an owner" do
-          expect(new_application).not_to be_valid
-        end
+      it "is invalid without an owner" do
+        expect(new_application).not_to be_valid
+      end
 
-        it "is valid with an owner" do
-          new_application.owner = @owner
-          expect(new_application).to be_valid
-        end
+      it "is valid with an owner" do
+        new_application.owner = @owner
+        expect(new_application).to be_valid
       end
     end
+  end
 
-    context "redirect URI" do
-      context "when grant flows allow blank redirect URI" do
-        before do
-          Doorkeeper.configure do
-            grant_flows %w[password client_credentials]
-          end
+  context "redirect URI" do
+    context "when grant flows allow blank redirect URI" do
+      before do
+        Doorkeeper.configure do
+          grant_flows %w[password client_credentials]
         end
+      end
 
-        it "is valid without redirect_uri" do
-          new_application.save
-          new_application.redirect_uri = nil
-          expect(new_application).to be_valid
-        end
+      it "is valid without redirect_uri" do
+        new_application.save
+        new_application.redirect_uri = nil
+        expect(new_application).to be_valid
       end
+    end
 
-      context "when grant flows require redirect URI" do
-        before do
-          Doorkeeper.configure do
-            grant_flows %w[password client_credentials authorization_code]
-          end
+    context "when grant flows require redirect URI" do
+      before do
+        Doorkeeper.configure do
+          grant_flows %w[password client_credentials authorization_code]
         end
+      end
 
-        it "is invalid without redirect_uri" do
-          new_application.save
-          new_application.redirect_uri = nil
-          expect(new_application).not_to be_valid
-        end
+      it "is invalid without redirect_uri" do
+        new_application.save
+        new_application.redirect_uri = nil
+        expect(new_application).not_to be_valid
       end
+    end
 
-      context "when blank URI option disabled" do
-        before do
-          Doorkeeper.configure do
-            grant_flows %w[password client_credentials]
-            allow_blank_redirect_uri false
-          end
+    context "when blank URI option disabled" do
+      before do
+        Doorkeeper.configure do
+          grant_flows %w[password client_credentials]
+          allow_blank_redirect_uri false
         end
+      end
 
-        it "is invalid without redirect_uri" do
-          new_application.save
-          new_application.redirect_uri = nil
-          expect(new_application).not_to be_valid
-        end
+      it "is invalid without redirect_uri" do
+        new_application.save
+        new_application.redirect_uri = nil
+        expect(new_application).not_to be_valid
       end
     end
+  end
 
-    context "with hashing enabled" do
-      include_context "with application hashing enabled"
-      let(:app) { FactoryBot.create :application }
-      let(:default_strategy) { Doorkeeper::SecretStoring::Sha256Hash }
+  context "with hashing enabled" do
+    include_context "with application hashing enabled"
+    let(:app) { FactoryBot.create :application }
+    let(:default_strategy) { Doorkeeper::SecretStoring::Sha256Hash }
 
-      it "uses SHA256 to avoid additional dependencies" do
-        # Ensure token was generated
-        app.validate
-        expect(app.secret).to eq(default_strategy.transform_secret(app.plaintext_secret))
-      end
+    it "uses SHA256 to avoid additional dependencies" do
+      # Ensure token was generated
+      app.validate
+      expect(app.secret).to eq(default_strategy.transform_secret(app.plaintext_secret))
+    end
 
-      context "when bcrypt strategy is configured" do
-        # In this text context, we have bcrypt loaded so `bcrypt_present?`
-        # will always be true
-        before do
-          Doorkeeper.configure do
-            hash_application_secrets using: "Doorkeeper::SecretStoring::BCrypt"
-          end
+    context "when bcrypt strategy is configured" do
+      # In this text context, we have bcrypt loaded so `bcrypt_present?`
+      # will always be true
+      before do
+        Doorkeeper.configure do
+          hash_application_secrets using: "Doorkeeper::SecretStoring::BCrypt"
         end
+      end
 
-        it "holds a volatile plaintext and BCrypt secret" do
-          expect(app.secret_strategy).to eq Doorkeeper::SecretStoring::BCrypt
-          expect(app.plaintext_secret).to be_a(String)
-          expect(app.secret).not_to eq(app.plaintext_secret)
-          expect { ::BCrypt::Password.create(app.secret) }.not_to raise_error
-        end
+      it "holds a volatile plaintext and BCrypt secret" do
+        expect(app.secret_strategy).to eq Doorkeeper::SecretStoring::BCrypt
+        expect(app.plaintext_secret).to be_a(String)
+        expect(app.secret).not_to eq(app.plaintext_secret)
+        expect { ::BCrypt::Password.create(app.secret) }.not_to raise_error
       end
+    end
 
-      it "does not fallback to plain lookup by default" do
-        lookup = clazz.by_uid_and_secret(app.uid, app.secret)
-        expect(lookup).to eq(nil)
+    it "does not fallback to plain lookup by default" do
+      lookup = described_class.by_uid_and_secret(app.uid, app.secret)
+      expect(lookup).to eq(nil)
 
-        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
-        expect(lookup).to eq(app)
-      end
+      lookup = described_class.by_uid_and_secret(app.uid, app.plaintext_secret)
+      expect(lookup).to eq(app)
+    end
 
-      context "with fallback enabled" do
-        include_context "with token hashing and fallback lookup enabled"
+    context "with fallback enabled" do
+      include_context "with token hashing and fallback lookup enabled"
 
-        it "provides plain and hashed lookup" do
-          lookup = clazz.by_uid_and_secret(app.uid, app.secret)
-          expect(lookup).to eq(app)
+      it "provides plain and hashed lookup" do
+        lookup = described_class.by_uid_and_secret(app.uid, app.secret)
+        expect(lookup).to eq(app)
 
-          lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
-          expect(lookup).to eq(app)
-        end
+        lookup = described_class.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup).to eq(app)
       end
+    end
 
-      it "does not provide access to secret after loading" do
-        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
-        expect(lookup.plaintext_secret).to be_nil
-      end
+    it "does not provide access to secret after loading" do
+      lookup = described_class.by_uid_and_secret(app.uid, app.plaintext_secret)
+      expect(lookup.plaintext_secret).to be_nil
     end
+  end
 
-    describe "destroy related models on cascade" do
-      before(:each) do
-        new_application.save
-      end
+  describe "destroy related models on cascade" do
+    before(:each) do
+      new_application.save
+    end
 
-      it "should destroy its access grants" do
-        FactoryBot.create(:access_grant, application: new_application)
-        expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
-      end
+    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
 
-      it "should destroy its access tokens" do
-        FactoryBot.create(:access_token, application: new_application)
-        FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
-        expect do
-          new_application.destroy
-        end.to change { Doorkeeper::AccessToken.count }.by(-2)
-      end
+    it "should destroy its access grants" do
+      FactoryBot.create(
+        :access_grant,
+        application: new_application,
+        resource_owner_id: resource_owner.id,
+      )
+
+      expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
     end
 
-    describe "#ordered_by" do
-      let(:applications) { FactoryBot.create_list(:application, 5) }
+    it "should destroy its access tokens" do
+      FactoryBot.create(:access_token, application: new_application)
+      FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
+      expect do
+        new_application.destroy
+      end.to change { Doorkeeper::AccessToken.count }.by(-2)
+    end
+  end
 
-      context "when a direction is not specified" do
-        it "calls order with a default order of asc" do
-          names = applications.map(&:name).sort
-          expect(Application.ordered_by(:name).map(&:name)).to eq(names)
-        end
+  describe "#ordered_by" do
+    let(:applications) { FactoryBot.create_list(:application, 5) }
+
+    context "when a direction is not specified" do
+      it "calls order with a default order of asc" do
+        names = applications.map(&:name).sort
+        expect(described_class.ordered_by(:name).map(&:name)).to eq(names)
       end
+    end
 
-      context "when a direction is specified" do
-        it "calls order with specified direction" do
-          names = applications.map(&:name).sort.reverse
-          expect(Application.ordered_by(:name, :desc).map(&:name)).to eq(names)
-        end
+    context "when a direction is specified" do
+      it "calls order with specified direction" do
+        names = applications.map(&:name).sort.reverse
+        expect(described_class.ordered_by(:name, :desc).map(&:name)).to eq(names)
       end
     end
+  end
 
-    describe "#redirect_uri=" do
-      context "when array of valid redirect_uris" do
-        it "should join by newline" do
-          new_application.redirect_uri = ["http://localhost/callback1", "http://localhost/callback2"]
-          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
-        end
+  describe "#redirect_uri=" do
+    context "when array of valid redirect_uris" do
+      it "should join by newline" do
+        new_application.redirect_uri = ["http://localhost/callback1", "http://localhost/callback2"]
+        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
       end
-      context "when string of valid redirect_uris" do
-        it "should store as-is" do
-          new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
-          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
-        end
+    end
+    context "when string of valid redirect_uris" do
+      it "should store as-is" do
+        new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
+        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
       end
     end
+  end
 
-    describe "#renew_secret" do
-      let(:app) { FactoryBot.create :application }
+  describe "#renew_secret" do
+    let(:app) { FactoryBot.create :application }
 
-      it "should generate a new secret" do
-        old_secret = app.secret
-        app.renew_secret
-        expect(old_secret).not_to eq(app.secret)
-      end
+    it "should generate a new secret" do
+      old_secret = app.secret
+      app.renew_secret
+      expect(old_secret).not_to eq(app.secret)
     end
+  end
 
-    describe "#authorized_for" do
-      let(:resource_owner) { double(:resource_owner, id: 10) }
+  describe "#authorized_for" do
+    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
+    let(:other_resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
 
-      it "is empty if the application is not authorized for anyone" do
-        expect(Application.authorized_for(resource_owner)).to be_empty
-      end
+    it "is empty if the application is not authorized for anyone" do
+      expect(described_class.authorized_for(resource_owner)).to be_empty
+    end
 
-      it "returns only application for a specific resource owner" do
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id + 1)
-        token = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
-        expect(Application.authorized_for(resource_owner)).to eq([token.application])
-      end
+    it "returns only application for a specific resource owner" do
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: other_resource_owner.id,
+      )
+      token = FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+      )
+      expect(described_class.authorized_for(resource_owner)).to eq([token.application])
+    end
 
-      it "excludes revoked tokens" do
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
-        expect(Application.authorized_for(resource_owner)).to be_empty
-      end
+    it "excludes revoked tokens" do
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+        revoked_at: 2.days.ago,
+      )
+      expect(described_class.authorized_for(resource_owner)).to be_empty
+    end
 
-      it "returns all applications that have been authorized" do
-        token1 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
-        token2 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
-        expect(Application.authorized_for(resource_owner)).to eq([token1.application, token2.application])
-      end
+    it "returns all applications that have been authorized" do
+      token1 = FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+      )
+      token2 = FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+      )
+      expect(described_class.authorized_for(resource_owner))
+        .to eq([token1.application, token2.application])
+    end
 
-      it "returns only one application even if it has been authorized twice" do
-        application = FactoryBot.create(:application)
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
-        expect(Application.authorized_for(resource_owner)).to eq([application])
-      end
+    it "returns only one application even if it has been authorized twice" do
+      application = FactoryBot.create(:application)
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+        application: application,
+      )
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+        application: application,
+      )
+      expect(described_class.authorized_for(resource_owner)).to eq([application])
     end
+  end
 
-    describe "#revoke_tokens_and_grants_for" do
-      it "revokes all access tokens and access grants" do
-        application_id = 42
-        resource_owner = double
-        expect(Doorkeeper::AccessToken)
-          .to receive(:revoke_all_for).with(application_id, resource_owner)
-        expect(Doorkeeper::AccessGrant)
-          .to receive(:revoke_all_for).with(application_id, resource_owner)
+  describe "#revoke_tokens_and_grants_for" do
+    it "revokes all access tokens and access grants" do
+      application_id = 42
+      resource_owner = double
+      expect(Doorkeeper::AccessToken)
+        .to receive(:revoke_all_for).with(application_id, resource_owner)
+      expect(Doorkeeper::AccessGrant)
+        .to receive(:revoke_all_for).with(application_id, resource_owner)
 
-        Application.revoke_tokens_and_grants_for(application_id, resource_owner)
-      end
+      described_class.revoke_tokens_and_grants_for(application_id, resource_owner)
     end
+  end
 
-    describe "#by_uid_and_secret" do
-      context "when application is private/confidential" do
-        it "finds the application via uid/secret" do
+  describe "#by_uid_and_secret" do
+    context "when application is private/confidential" do
+      it "finds the application via uid/secret" do
+        app = FactoryBot.create :application
+        authenticated = described_class.by_uid_and_secret(app.uid, app.secret)
+        expect(authenticated).to eq(app)
+      end
+      context "when secret is wrong" do
+        it "should not find the application" do
           app = FactoryBot.create :application
-          authenticated = Application.by_uid_and_secret(app.uid, app.secret)
-          expect(authenticated).to eq(app)
-        end
-        context "when secret is wrong" do
-          it "should not find the application" do
-            app = FactoryBot.create :application
-            authenticated = Application.by_uid_and_secret(app.uid, "bad")
-            expect(authenticated).to eq(nil)
-          end
+          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
+          expect(authenticated).to eq(nil)
         end
       end
+    end
 
-      context "when application is public/non-confidential" do
-        context "when secret is blank" do
-          it "should find the application" do
-            app = FactoryBot.create :application, confidential: false
-            authenticated = Application.by_uid_and_secret(app.uid, nil)
-            expect(authenticated).to eq(app)
-          end
+    context "when application is public/non-confidential" do
+      context "when secret is blank" do
+        it "should find the application" do
+          app = FactoryBot.create :application, confidential: false
+          authenticated = described_class.by_uid_and_secret(app.uid, nil)
+          expect(authenticated).to eq(app)
         end
-        context "when secret is wrong" do
-          it "should not find the application" do
-            app = FactoryBot.create :application, confidential: false
-            authenticated = Application.by_uid_and_secret(app.uid, "bad")
-            expect(authenticated).to eq(nil)
-          end
+      end
+      context "when secret is wrong" do
+        it "should not find the application" do
+          app = FactoryBot.create :application, confidential: false
+          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
+          expect(authenticated).to eq(nil)
         end
       end
     end
+  end
 
-    describe "#confidential?" do
-      subject { FactoryBot.create(:application, confidential: confidential).confidential? }
+  describe "#confidential?" do
+    subject { FactoryBot.create(:application, confidential: confidential).confidential? }
 
-      context "when application is private/confidential" do
-        let(:confidential) { true }
-        it { expect(subject).to eq(true) }
-      end
+    context "when application is private/confidential" do
+      let(:confidential) { true }
+      it { expect(subject).to eq(true) }
+    end
 
-      context "when application is public/non-confidential" do
-        let(:confidential) { false }
-        it { expect(subject).to eq(false) }
-      end
+    context "when application is public/non-confidential" do
+      let(:confidential) { false }
+      it { expect(subject).to eq(false) }
     end
+  end
 
-    describe "#as_json" do
-      let(:app) { FactoryBot.create :application, secret: "123123123" }
+  describe "#as_json" do
+    let(:app) { FactoryBot.create :application, secret: "123123123" }
 
-      before do
-        allow(Doorkeeper.configuration)
-          .to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Plain)
+    before do
+      allow(Doorkeeper.configuration)
+        .to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Plain)
+    end
+
+    # AR specific feature
+    if DOORKEEPER_ORM == :active_record
+      it "correctly works with #to_json" do
+        ActiveRecord::Base.include_root_in_json = true
+        expect(app.to_json(include_root_in_json: true)).to match(/application.+?:\{/)
+        ActiveRecord::Base.include_root_in_json = false
       end
+    end
 
-      it "includes plaintext secret" do
-        expect(app.as_json).to include("secret" => "123123123")
+    context "when called without authorized resource owner" do
+      it "includes minimal set of attributes" do
+        expect(app.as_json).to match(
+          "id" => app.id,
+          "name" => app.name,
+          "created_at" => an_instance_of(String),
+        )
+      end
+
+      it "includes application UID if it's public" do
+        app = FactoryBot.create :application, secret: "123123123", confidential: false
+
+        expect(app.as_json).to match(
+          "id" => app.id,
+          "name" => app.name,
+          "created_at" => an_instance_of(String),
+          "uid" => app.uid,
+        )
       end
 
       it "respects custom options" do
-        expect(app.as_json(except: :secret)).not_to include("secret")
-        expect(app.as_json(only: :id)).to match("id" => app.id)
+        expect(app.as_json(except: :id)).not_to include("id")
+        expect(app.as_json(only: %i[name created_at secret]))
+          .to match(
+            "name" => app.name,
+            "created_at" => an_instance_of(String),
+          )
       end
+    end
 
-      # AR specific
-      if DOORKEEPER_ORM == :active_record
-        it "correctly works with #to_json" do
-          ActiveRecord::Base.include_root_in_json = true
-          expect(app.to_json(include_root_in_json: true)).to match(/application.+?:\{/)
-          ActiveRecord::Base.include_root_in_json = false
+    context "when called with authorized resource owner" do
+      let(:owner) { FactoryBot.create(:doorkeeper_testing_user) }
+      let(:other_owner) { FactoryBot.create(:doorkeeper_testing_user) }
+      let(:app) { FactoryBot.create(:application, secret: "123123123", owner: owner) }
+
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          enable_application_owner confirmation: false
         end
       end
+
+      it "includes all the attributes" do
+        expect(app.as_json(current_resource_owner: owner))
+          .to include(
+            "secret" => "123123123",
+            "redirect_uri" => app.redirect_uri,
+            "uid" => app.uid,
+          )
+      end
+
+      it "doesn't include unsafe attributes if current owner isn't the same as owner" do
+        expect(app.as_json(current_resource_owner: other_owner))
+          .not_to include("redirect_uri")
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.3.1
+  version: 5.3.2
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-09 00:00:00.000000000 Z
+date: 2020-05-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties