doorkeeper 5.4.0.rc1 → 5.4.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c9e55b1b52c75ecb1dc18678a2fb5e7683e85859f9a955c27a3197548c2b146
-  data.tar.gz: 59f5eafd45d8a85b7f84c7553f1084ed31c8a7ede3b61d00382b8110aea5e63f
+  metadata.gz: 4bd9636505ce9c77f93c052d721fb3dad5fb6e135375a3fd3cc6f492e211c7df
+  data.tar.gz: 967a846ecfe1713842133555b9fd793c2f8600c9382aa13ffc209b7448a9aabd
 SHA512:
-  metadata.gz: 1d64979c31b76f5f36671bfdea039da232aefdcb590a5fdf154740bb6968ec939cd5b883e163217431f38c6539017c01eb7d8518302f7b769c8a56857f16eab2
-  data.tar.gz: 62e2bae23f51b365d2aab4c8ba10a8efbd5ac860f68b481a2d41b193a5df2576ba08ec4700ab9b8def2a59a4494709dd628c9b9ec7d5a10ddb709ab4466a5ce1
+  metadata.gz: a45ad0f893f9c47dc3a50672e668b9b3519db22bd6a6a05dfaf57d7f00c4d5bb228c4913ad6ab5886a063a4fdea4fe435eb886ad2b61f7274cbbf1c2d7be5166
+  data.tar.gz: c8fd9f47a74bc6735802ee90a3d63e266e928a59801e13becc8b345dc46902e80bfeb6b6830c9c44d7b90093a0cd4727f6d67e5519b137dd31cc9339d42901ec

data/CHANGELOG.md

@@ -7,7 +7,24 @@ User-visible changes worth mentioning.
 
 ## master
 
-- [#PR number] Your changes description.
+- [#PR ID] Your PR description.
+
+## 5.4.0.rc2
+
+- [#1371] Add `#as_json` method and attributes serialization restriction for Application model.
+  Fixes information disclosure vulnerability (CVE-2020-10187).
+  
+  **[IMPORTANT]** you need to re-implement `#as_json` method for Doorkeeper Application model
+  if you previously used `#to_json` serialization with custom options or attributes or rely on
+  JSON response from /oauth/applications.json or /oauth/authorized_applications.json. This change
+  is a breaking change which restricts serialized attributes to a very small set of columns.
+
+- [#1395] Fix `NameError: uninitialized constant Doorkeeper::AccessToken` for Rake tasks.
+- [#1397] Add `as: :doorkeeper_application` on Doorkeeper application form in order to support
+  custom configured application model.
+- [#1400] Correctly yield the application instance to `allow_grant_flow_for_client?` config
+  option (fixes #1398).
+- [#1402] Handle trying authorization with client credentials.
 
 ## 5.4.0.rc1
 - [#1366] Sets expiry of token generated using `refresh_token` to that of original token. (Fixes #1364) 
@@ -41,6 +58,11 @@ User-visible changes worth mentioning.
 - [#1393] Improve Applications #show page with more informative data on client secret and scopes.
 - [#1394] Use Ruby `autoload` feature to load Doorkeeper files.
 
+## 5.3.2
+
+- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
+  Fixes information disclosure vulnerability (CVE-2020-10187).
+
 ## 5.3.1
 
 - [#1360] Backport: Increase `matching_token_for` batch lookup size to 10 000 and make it configurable.
@@ -59,6 +81,11 @@ User-visible changes worth mentioning.
   If you were relying on access tokens being revoked once the same client
   requested a new access token, reenable it with `revoke_previous_client_credentials_token` in Doorkeeper
   initialization file.
+
+## 5.2.5
+
+- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
+  Fixes information disclosure vulnerability (CVE-2020-10187).
   
 ## 5.2.4
   

data/app/controllers/doorkeeper/applications_controller.rb

@@ -19,7 +19,7 @@ module Doorkeeper
     def show
       respond_to do |format|
         format.html
-        format.json { render json: @application }
+        format.json { render json: @application, as_owner: true }
       end
     end
 
@@ -36,7 +36,7 @@ module Doorkeeper
 
         respond_to do |format|
           format.html { redirect_to oauth_application_url(@application) }
-          format.json { render json: @application }
+          format.json { render json: @application, as_owner: true }
         end
       else
         respond_to do |format|
@@ -58,7 +58,7 @@ module Doorkeeper
 
         respond_to do |format|
           format.html { redirect_to oauth_application_url(@application) }
-          format.json { render json: @application }
+          format.json { render json: @application, as_owner: true }
         end
       else
         respond_to do |format|

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -9,7 +9,7 @@ module Doorkeeper
 
       respond_to do |format|
         format.html
-        format.json { render json: @applications }
+        format.json { render json: @applications, current_resource_owner: current_resource_owner }
       end
     end
 

data/app/views/doorkeeper/applications/_form.html.erb

@@ -1,4 +1,4 @@
-<%= form_for application, url: doorkeeper_submit_path(application), html: { role: 'form' } do |f| %>
+<%= form_for application, url: doorkeeper_submit_path(application), as: :doorkeeper_application, html: { role: 'form' } do |f| %>
   <% if application.errors.any? %>
     <div class="alert alert-danger" data-alert><p><%= t('doorkeeper.applications.form.error') %></p></div>
   <% end %>

data/lib/doorkeeper.rb

@@ -6,8 +6,8 @@ require "doorkeeper/engine"
 # Main Doorkeeper namespace.
 #
 module Doorkeeper
-  autoload :OAuth, "doorkeeper/oauth"
   autoload :Errors, "doorkeeper/errors"
+  autoload :OAuth, "doorkeeper/oauth"
   autoload :Rake, "doorkeeper/rake"
   autoload :Request, "doorkeeper/request"
   autoload :Server, "doorkeeper/server"

data/lib/doorkeeper/config.rb

@@ -134,15 +134,6 @@ module Doorkeeper
         @config.instance_variable_set(:@reuse_access_token, true)
       end
 
-      # Sets the token_reuse_limit
-      # It will be used only when reuse_access_token option in enabled
-      # By default it will be 100
-      # It will be used for token reusablity to some threshold percentage
-      # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
-      def token_reuse_limit(percentage)
-        @config.instance_variable_set(:@token_reuse_limit, percentage)
-      end
-
       # TODO: maybe make it more generic for other flows too?
       # Only allow one valid access token obtained via client credentials
       # per client. If a new access token is obtained before the old one
@@ -277,6 +268,13 @@ module Doorkeeper
     option :handle_auth_errors,             default: :render
     option :token_lookup_batch_size,        default: 10_000
 
+    # Sets the token_reuse_limit
+    # It will be used only when reuse_access_token option in enabled
+    # By default it will be 100
+    # It will be used for token reusablity to some threshold percentage
+    # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
+    option :token_reuse_limit,              default: 100
+
     option :active_record_options,
            default: {},
            deprecated: { message: "Customize Doorkeeper models instead" }
@@ -426,20 +424,32 @@ module Doorkeeper
                 :application_secret_fallback_strategy
 
     # Return the valid subset of this configuration
-    def validate
+    def validate!
       validate_reuse_access_token_value
       validate_token_reuse_limit
       validate_secret_strategies
     end
 
+    # Doorkeeper Access Token model class.
+    #
+    # @return [ActiveRecord::Base, Mongoid::Document, Sequel::Model]
+    #
     def access_token_model
       @access_token_model ||= access_token_class.constantize
     end
 
+    # Doorkeeper Access Grant model class.
+    #
+    # @return [ActiveRecord::Base, Mongoid::Document, Sequel::Model]
+    #
     def access_grant_model
       @access_grant_model ||= access_grant_class.constantize
     end
 
+    # Doorkeeper Application model class.
+    #
+    # @return [ActiveRecord::Base, Mongoid::Document, Sequel::Model]
+    #
     def application_model
       @application_model ||= application_class.constantize
     end
@@ -460,14 +470,6 @@ module Doorkeeper
       end
     end
 
-    def token_reuse_limit
-      @token_reuse_limit ||= 100
-    end
-
-    def revoke_previous_client_credentials_token
-      @revoke_previous_client_credentials_token || false
-    end
-
     def resolve_controller(name)
       config_option = public_send(:"#{name}_controller")
       controller_name = if config_option.respond_to?(:call)
@@ -479,6 +481,10 @@ module Doorkeeper
       controller_name.constantize
     end
 
+    def revoke_previous_client_credentials_token?
+      option_set? :revoke_previous_client_credentials_token
+    end
+
     def enforce_configured_scopes?
       option_set? :enforce_configured_scopes
     end

data/lib/doorkeeper/config/abstract_builder.rb

@@ -20,7 +20,7 @@ module Doorkeeper
       # @return [Doorkeeper::Config] config instance
       #
       def build
-        @config.validate if @config.respond_to?(:validate)
+        @config.validate! if @config.respond_to?(:validate!)
         @config
       end
     end

data/lib/doorkeeper/helpers/controller.rb

@@ -36,7 +36,7 @@ module Doorkeeper
 
       # :doc:
       def doorkeeper_token
-        @doorkeeper_token ||= OAuth::Token.authenticate request, *config_methods
+        @doorkeeper_token ||= OAuth::Token.authenticate(request, *config_methods)
       end
 
       def config_methods
@@ -58,10 +58,10 @@ module Doorkeeper
       end
 
       def handle_token_exception(exception)
-        error = get_error_response_from_exception exception
-        headers.merge! error.headers
+        error = get_error_response_from_exception(exception)
+        headers.merge!(error.headers)
         self.response_body = error.body.to_json
-        self.status        = error.status
+        self.status = error.status
       end
 
       def skip_authorization?

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -13,7 +13,7 @@ module Doorkeeper
     include Models::Scopes
     include Models::ResourceOwnerable
 
-    # never uses pkce, if pkce migrations were not generated
+    # Never uses PKCE if PKCE migrations were not generated
     def uses_pkce?
       self.class.pkce_supported? && code_challenge.present?
     end
@@ -24,8 +24,8 @@ module Doorkeeper
       #
       # @param token [#to_s] token value (any object that responds to `#to_s`)
       #
-      # @return [Doorkeeper::AccessGrant, nil] AccessGrant object or nil
-      #   if there is no record with such token
+      # @return [Doorkeeper::AccessGrant, nil]
+      #   AccessGrant object or nil if there is no record with such token
       #
       def by_token(token)
         find_by_plaintext_token(:token, token)
@@ -36,8 +36,8 @@ module Doorkeeper
       #
       # @param application_id [Integer]
       #   ID of the Application
-      # @param resource_owner [ActiveRecord::Base]
-      #   instance of the Resource Owner model
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   instance of the Resource Owner model or it's ID
       #
       def revoke_all_for(application_id, resource_owner, clock = Time)
         by_resource_owner(resource_owner)
@@ -100,6 +100,9 @@ module Doorkeeper
       ##
       # Determines the secret storing transformer
       # Unless configured otherwise, uses the plain secret strategy
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
       def secret_strategy
         ::Doorkeeper.config.token_secret_strategy
       end
@@ -107,6 +110,9 @@ module Doorkeeper
       ##
       # Determine the fallback storing strategy
       # Unless configured, there will be no fallback
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
       def fallback_secret_strategy
         ::Doorkeeper.config.token_secret_fallback_strategy
       end

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -61,8 +61,8 @@ module Doorkeeper
       #
       # @param application_id [Integer]
       #   ID of the Application
-      # @param resource_owner [ActiveRecord::Base]
-      #   instance of the Resource Owner model
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   instance of the Resource Owner model or it's ID
       #
       def revoke_all_for(application_id, resource_owner, clock = Time)
         by_resource_owner(resource_owner)
@@ -230,10 +230,11 @@ module Doorkeeper
       #
       # @param application_id [Integer]
       #   ID of the Application model instance
-      # @param resource_owner [Integer]
-      #   ID of the Resource Owner model instance
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   Resource Owner model instance or it's ID
       #
-      # @return [Doorkeeper::AccessToken] array of matching AccessToken objects
+      # @return [ActiveRecord::Relation]
+      #   collection of matching AccessToken objects
       #
       def authorized_tokens_for(application_id, resource_owner)
         by_resource_owner(resource_owner).where(
@@ -262,6 +263,9 @@ module Doorkeeper
       ##
       # Determines the secret storing transformer
       # Unless configured otherwise, uses the plain secret strategy
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
       def secret_strategy
         ::Doorkeeper.config.token_secret_strategy
       end

data/lib/doorkeeper/models/application_mixin.rb

@@ -20,8 +20,8 @@ module Doorkeeper
       # @param uid [#to_s] UID (any object that responds to `#to_s`)
       # @param secret [#to_s] secret (any object that responds to `#to_s`)
       #
-      # @return [Doorkeeper::Application, nil] Application instance or nil
-      #   if there is no record with such credentials
+      # @return [Doorkeeper::Application, nil]
+      #   Application instance or nil if there is no record with such credentials
       #
       def by_uid_and_secret(uid, secret)
         app = by_uid(uid)
@@ -60,9 +60,10 @@ module Doorkeeper
 
     # Set an application's valid redirect URIs.
     #
-    # @param uris [String, Array] Newline-separated string or array the URI(s)
+    # @param uris [String, Array<String>] Newline-separated string or array the URI(s)
+    #
+    # @return [String] The redirect URI(s) separated by newlines.
     #
-    # @return [String] The redirect URI(s) seperated by newlines.
     def redirect_uri=(uris)
       super(uris.is_a?(Array) ? uris.join("\n") : uris)
     end

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -25,7 +25,7 @@ module Doorkeeper
         private
 
         def with_revocation(existing_token:)
-          if existing_token && server_config.revoke_previous_client_credentials_token
+          if existing_token && server_config.revoke_previous_client_credentials_token?
             existing_token.with_lock do
               raise Errors::DoorkeeperError, :invalid_token_reuse if existing_token.revoked?
 
@@ -39,7 +39,7 @@ module Doorkeeper
         end
 
         def lookup_existing_token?
-          server_config.reuse_access_token || server_config.revoke_previous_client_credentials_token
+          server_config.reuse_access_token || server_config.revoke_previous_client_credentials_token?
         end
 
         def find_existing_token_for(client, scopes)

data/lib/doorkeeper/oauth/client_credentials/validator.rb

@@ -26,9 +26,11 @@ module Doorkeeper
         end
 
         def validate_client_supports_grant_flow
+          return if @client.blank?
+
           Doorkeeper.config.allow_grant_flow_for_client?(
             Doorkeeper::OAuth::CLIENT_CREDENTIALS,
-            @client,
+            @client.application,
           )
         end
 

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -48,7 +48,7 @@ module Doorkeeper
       end
 
       def validate_client_supports_grant_flow
-        server_config.allow_grant_flow_for_client?(grant_type, client)
+        server_config.allow_grant_flow_for_client?(grant_type, client&.application)
       end
     end
   end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -7,16 +7,16 @@ module Doorkeeper
 
       validate :client_id, error: :invalid_request
       validate :client, error: :invalid_client
+      validate :client_supports_grant_flow, error: :unauthorized_client
       validate :resource_owner_authorize_for_client, error: :invalid_client
       validate :redirect_uri, error: :invalid_redirect_uri
       validate :params, error: :invalid_request
       validate :response_type, error: :unsupported_response_type
       validate :scopes, error: :invalid_scope
       validate :code_challenge_method, error: :invalid_code_challenge_method
-      validate :client_supports_grant_flow, error: :unauthorized_client
 
-      attr_reader :server, :client_id, :client, :redirect_uri, :response_type, :state,
-                  :code_challenge, :code_challenge_method, :missing_param, :resource_owner
+      attr_reader :client, :code_challenge, :code_challenge_method, :missing_param,
+                  :redirect_uri, :resource_owner, :response_type, :state
 
       def initialize(server, parameters = {}, resource_owner = nil)
         @server                = server
@@ -59,6 +59,8 @@ module Doorkeeper
 
       private
 
+      attr_reader :client_id, :server
+
       def build_scopes
         client_scopes = client.scopes
         if client_scopes.blank?
@@ -70,7 +72,6 @@ module Doorkeeper
 
       def validate_client_id
         @missing_param = :client_id if client_id.blank?
-
         @missing_param.nil?
       end
 

data/lib/doorkeeper/oauth/token.rb

@@ -15,8 +15,7 @@ module Doorkeeper
         def authenticate(request, *methods)
           if (token = from_request(request, *methods))
             access_token = Doorkeeper.config.access_token_model.by_token(token)
-            refresh_token_enabled = Doorkeeper.config.refresh_token_enabled?
-            if access_token.present? && refresh_token_enabled
+            if access_token.present? && Doorkeeper.config.refresh_token_enabled?
               access_token.revoke_previous_refresh_token!
             end
             access_token

data/lib/doorkeeper/orm/active_record.rb

@@ -33,12 +33,20 @@ module Doorkeeper
         lazy_load do
           require "doorkeeper/models/concerns/ownership"
 
-          Doorkeeper.config.application_model.send :include, Doorkeeper::Models::Ownership
+          Doorkeeper.config.application_model.include(Doorkeeper::Models::Ownership)
         end
       end
 
       def self.lazy_load(&block)
-        ActiveSupport.on_load(:active_record, {}, &block)
+        # ActiveSupport has no public interface to check if something
+        # already lazy-loaded :(
+        loaded = ActiveSupport.instance_variable_get(:"@loaded") || {}
+
+        if loaded.key?(:active_record)
+          block.call
+        else
+          ActiveSupport.on_load(:active_record, {}, &block)
+        end
       end
 
       def self.models