eat 0.1.0 → 0.1.1

data/CHANGELOG

@@ -1,3 +1,5 @@
+0.1.1
+* SSL certificates are now verified by default (use :openssl_verify_mode => 'none' to disable) per @codahale http://bit.ly/kZr9Jc
 0.1.0
 * no longer tries to open file with sudo if it gets a permission error
 * remove Eat::Config.timeout global option

data/README.rdoc

@@ -15,19 +15,22 @@ Try <tt>#eat</tt>, which ALWAYS returns a <tt>String</tt>:
 
 ==Options
 
-    eat('http://yahoo.com', :timeout => 10)  # timeout after 10 seconds
-    eat('http://yahoo.com', :limit => 1024)  # only read the first 1024 chars
+    eat('http://yahoo.com', :timeout => 10)                  # timeout after 10 seconds
+    eat('http://yahoo.com', :limit => 1024)                  # only read the first 1024 chars
+    eat('https://yahoo.com', :openssl_verify_mode => 'none)  # don't bother verifying SSL certificate
 
-==Warning: doesn't verify SSL certs
+==Warning: DOES verify SSL certs
 
-If you need to check SSL certificates, please don't use this gem. It always sets
+If you want to disable verification of SSL certificates, use
 
-    http.verify_mode = ::OpenSSL::SSL::VERIFY_NONE
+  :openssl_verify_mode => 'none'
+
+Thanks @codahale and @peterc for their suggestions.
 
 ==Supported schemas
 
 * local filesystem
 * http
-* https (it won't check the SSL certificate... if you want security, don't use this!)
+* https
 
 Copyright 2011 Seamus Abshere

data/lib/eat.rb

@@ -13,6 +13,7 @@ module Eat
     # Options:
     # * <tt>:timeout</tt> in seconds
     # * <tt>:limit</tt> is characters (bytes in Ruby 1.8)
+    # * <tt>:openssl_verify_mode</tt> set to 'none' if you don't want to verify SSL certificates
     #
     # Example:
     #    eat('http://brighterplanet.com')                 #=> '...'
@@ -21,6 +22,8 @@ module Eat
     def eat(url, options = {})
       timeout = options[:timeout] || options['timeout'] || 2
       limit = options[:limit] || options['limit'] || ::Infinity
+      openssl_verify_mode = options[:openssl_verify_mode] || options['openssl_verify_mode']
+      
       uri = ::URI.parse url.to_s
 
       body = []
@@ -45,8 +48,7 @@ module Eat
           http = ::Net::HTTP.new uri.host, uri.port
           if uri.scheme == 'https'
             http.use_ssl = true
-            # if you were trying to be real safe, you wouldn't use this library
-            http.verify_mode = ::OpenSSL::SSL::VERIFY_NONE
+            http.verify_mode = ::OpenSSL::SSL::VERIFY_NONE if openssl_verify_mode.to_s == 'none'
           end
           http.start do |session|
             catch :stop do

data/lib/eat/version.rb

@@ -1,3 +1,3 @@
 module Eat
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/test/test_eat.rb

@@ -52,4 +52,22 @@ class TestEat < Test::Unit::TestCase
     assert_equal 'Use', eat(::URI.parse('http://brighterplanet.com/robots.txt'), :timeout => 10, :limit => 3)
     assert_equal 'User-', eat(::URI.parse('http://brighterplanet.com/robots.txt'), :timeout => 10, :limit => 5)
   end
+  
+  def test_ssl
+    assert_nothing_raised do
+      eat 'https://brighterplanet.com'
+    end    
+  end
+  
+  def test_openssl_verify_on_by_default
+    assert_raises(OpenSSL::SSL::SSLError) do
+      eat 'https://foo.bar.brighterplanet.com'
+    end
+  end
+  
+  def test_disable_openssl_verify
+    assert_nothing_raised do
+      eat 'https://foo.bar.brighterplanet.com', :openssl_verify_mode => 'none'
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: eat
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-06-27 00:00:00.000000000Z
+date: 2011-06-30 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: test-unit
-  requirement: &2153835220 !ruby/object:Gem::Requirement
+  requirement: &2164601920 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,7 +21,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2153835220
+  version_requirements: *2164601920
 description: Lets you open local and remote files by immediately returning their contents
   as a string.
 email: