encrypted_cookie_store-instructure 1.1.12 → 1.2.0

checksums.yaml

@@ -1,15 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    NWIxYmNmOGZjZDM1NjA5ODZkMDU5ZTZmYTdkZDdjMTRmYTkxNDI2Yg==
-  data.tar.gz: !binary |-
-    YzdkYzAwNjU5NDY2ZjRmOGFlMjIxYWE2ZjhmYmEyMjUwY2ZkMDkxZA==
+SHA1:
+  metadata.gz: c0f577b66b03c658dd1ce0636ab19c211ea3353a
+  data.tar.gz: 43b1d3d42a3a3fad97dd4fe93fe205c0ec9bea92
 SHA512:
-  metadata.gz: !binary |-
-    YWFiYjRiYzMzYjc1N2Q2OTA0YTI3MjJlNDc4Nzc2NmQwZDZlZGRiYzcyNTRk
-    N2RmNjk2OTIwOGQ5YmMxZGU1OGYxZTM0MzA4ZGZlMmY0ZmQxMTA1NTNkZTlh
-    ZTBjZjMwMTdjMDM5ODExNjIxMGFlYTczMzVmMTNjYzRjZWM3ZmI=
-  data.tar.gz: !binary |-
-    ZDkxMjAyZDA0ZTc4MzlkYjY0Nzk0YjE0MmZkZDBhM2MzZDIzMjU5NTc3NjMw
-    NzVjNzA2NWM4Yzk1OTdjNWIxNTFmYjk1OGQ1MmY0ZDBlNzM3MWNlOTE0OWUx
-    OWYyY2E1Y2FjMzI5MTY4Y2E2NmFhZGVhZGVjZjcwZTdjYjA0NDM=
+  metadata.gz: 2b0f740fac10688184e2f6466b96ab29f50d80e37b71b6a5f9e6813b7ae7c5fe51983d9cd1ca1742cacd68bf5a6c9208890847afbb94c7e9cb9369a3eb23a20b
+  data.tar.gz: 82a7784a9ac88f7ae73bc5b809d3f763f2941e98f3feb23a39bb12609fe411ae952a3a71c21cbd039211b08586835ea7c82549210e8051d7467355cdb8f48a9c

data/encrypted_cookie_store-instructure.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = %q{encrypted_cookie_store-instructure}
-  s.version = "1.1.12"
+  s.version = "1.2.0"
 
   s.authors = ["Cody Cutrer", "Jacob Fugal", "James Williams"]
   s.date = %q{2013-12-20}
@@ -15,12 +15,12 @@ Gem::Specification.new do |s|
   ]
   s.homepage = %q{http://github.com/ccutrer/encrypted_cookie_store}
   s.require_paths = ["lib"]
-  s.summary = %q{EncryptedCookieStore for Ruby on Rails 3.2}
+  s.summary = %q{EncryptedCookieStore for Ruby on Rails 4.2}
   s.description = %q{A secure version of Rails' built in CookieStore}
 
-  s.add_dependency "actionpack", ">= 3.2", "< 4.3"
-  s.add_development_dependency "bundler", "~> 1.3"
+  s.add_dependency "actionpack", "~> 5.0.0"
+
   s.add_development_dependency "rake"
-  s.add_development_dependency "rspec-rails", "~> 2.0"
-  s.add_development_dependency "debugger"
+  s.add_development_dependency "rspec-rails", "~> 3.5"
+  s.add_development_dependency "byebug"
 end

data/lib/encrypted_cookie_store.rb

@@ -1,11 +1,7 @@
 require 'openssl'
 require 'zlib'
 
-if ActiveSupport::VERSION::STRING >= '4.0'
-  require 'active_support/core_ext/object/deep_dup'
-else
-  require 'active_support/core_ext/hash/deep_dup'
-end
+require 'active_support/core_ext/object/deep_dup'
 require 'active_support/core_ext/numeric/time'
 require 'action_dispatch'
 
@@ -17,10 +13,6 @@ module ActionDispatch
       end
       self.data_cipher_type = "aes-128-cbc".freeze
 
-      EXPIRE_AFTER_KEY = "encrypted_cookie_store.session_expire_after"
-
-      OpenSSLCipherError = OpenSSL::Cipher.const_defined?(:CipherError) ? OpenSSL::Cipher::CipherError : OpenSSL::CipherError
-
       def initialize(app, options = {})
         @logger = options.delete(:logger)
         @digest = options.delete(:digest) || 'SHA1'
@@ -34,83 +26,103 @@ module ActionDispatch
         @encryption_key = unhex(@secret).freeze
         ensure_encryption_key_secure
 
-        @allow_legacy_hmac = options[:allow_legacy_hmac]
-
         @data_cipher = OpenSSL::Cipher::Cipher.new(EncryptedCookieStore.data_cipher_type)
         options[:refresh_interval] ||= 5.minutes
 
         super(app, options)
       end
 
-      def call(env)
-        @expire_after = env[EXPIRE_AFTER_KEY]
-        super
+      if Rack.release >= '2'
+        def get_header(req, key)
+          req.get_header(key)
+        end
+
+        def fetch_header(req, key, &block)
+          req.fetch_header(key, &block)
+        end
+
+        def set_header(req, key, value)
+          req.set_header(key, value)
+        end
+
+        # overrides method in ActionDispatch::Session::CookieStore
+        def cookie_jar(request)
+          request.cookie_jar
+        end
+
+        write_session = 'write_session'
+      else
+        def get_header(env, key)
+          env[key]
+        end
+
+        def fetch_header(env, key, &block)
+          env.fetch(key, &block)
+        end
+
+        def set_header(env, key, value)
+          env[key] = value
+        end
+
+        # overrides method in ActionDispatch::Session::CookieStore
+        def cookie_jar(env)
+          request = ActionDispatch::Request.new(env)
+          request.cookie_jar
+        end
+
+        write_session = 'set_session'
       end
 
       # overrides method in Rack::Session::Cookie
-      def load_session(env)
-        if time = timestamp(env)
-          env['encrypted_cookie_store.session_refreshed_at'] ||= Time.at(time).utc
+      def load_session(req)
+        if time = timestamp(req)
+          fetch_header(req, 'encrypted_cookie_store.session_refreshed_at') { |k| set_header(req, k, Time.at(time).utc) }
         end
         super
       end
 
       private
 
-      def expire_after(options={})
-        @expire_after || options[:expire_after]
-      end
-
       # overrides method in ActionDispatch::Session::CookieStore
-      def unpacked_cookie_data(env)
-        env['encrypted_cookie_store.cookie'] ||= begin
-          stale_session_check! do
-            request = ActionDispatch::Request.new(env)
-            if data = unmarshal(request.cookie_jar[@key])
+      def unpacked_cookie_data(req)
+        fetch_header(req, "action_dispatch.request.unsigned_session_cookie") do |k|
+          v = stale_session_check! do
+            if data = unmarshal(get_cookie(req))
               data.stringify_keys!
             end
             data ||= {}
-            env['encrypted_cookie_store.original_cookie'] = data.deep_dup.except(:timestamp)
+            set_header(req, 'encrypted_cookie_store.original_cookie', data.deep_dup.except(:timestamp))
             data
           end
+          set_header(req, k, v)
         end
       end
 
       # overrides method in ActionDispatch::Session::CookieStore
-      def set_cookie(env, session_id, cookie)
-        request = ActionDispatch::Request.new(env)
-        request.cookie_jar[@key] = cookie
-      end
-
-      # overrides method in ActionDispatch::Session::CookieStore
-      def set_session(env, sid, session_data, options)
-        session_data = super
-        session_data.delete(:timestamp)
-        marshal(session_data, options)
-      end
+      class_eval <<-RUBY, __FILE__, __LINE__ + 1
+        def #{write_session}(req, sid, session_data, options)
+          session_data = super
+          session_data.delete(:timestamp)
+          marshal(session_data, options)
+        end
+      RUBY
 
       # overrides method in Rack::Session::Abstract::ID
-      def commit_session?(env, session, options)
+      def commit_session?(req, session, options)
         can_commit = super
-        can_commit && (session_changed?(env, session) || refresh_session?(env, options))
+        can_commit && (session_changed?(req, session) || refresh_session?(req, options))
       end
 
-      def destroy_session(env, session_id, options)
-        env.delete('encrypted_cookie_store.cookie')
-        ActionDispatch::Request.new(env).cookie_jar.delete(@key)
-        super
-      end
-
-      def timestamp(env)
-        unpacked_cookie_data(env)["timestamp"]
+      def timestamp(req)
+        unpacked_cookie_data(req)["timestamp"]
       end
 
-      def session_changed?(env, session)
-        (session || {}).to_hash.stringify_keys.except(:timestamp) != (env['encrypted_cookie_store.original_cookie'] || {})
+      def session_changed?(req, session)
+        (session || {}).to_hash.stringify_keys.except(:timestamp) != (get_header(req, 'encrypted_cookie_store.original_cookie') || {})
       end
 
-      def refresh_session?(env, options)
-        if expire_after(options) && options[:refresh_interval] && time = timestamp(env)
+      def refresh_session?(req, options)
+        if options[:expire_after] && options[:refresh_interval] && time = timestamp(req)
           Time.now.utc.to_i > time + options[:refresh_interval]
         else
           false
@@ -130,11 +142,11 @@ module ActionDispatch
           compressed_session_data = session_data
         end
         encrypted_session_data = @data_cipher.update(compressed_session_data) << @data_cipher.final
-        timestamp        = Time.now.utc.to_i if expire_after(options)
+        timestamp        = Time.now.utc.to_i if options[:expire_after]
         digest           = hmac_digest(iv, session_data, timestamp)
 
         result = "#{base64(iv)}#{compressed_session_data == session_data ? '.' : ' '}#{base64(encrypted_session_data)}.#{base64(digest)}"
-        result << ".#{base64([timestamp].pack('N'))}" if expire_after(options)
+        result << ".#{base64([timestamp].pack('N'))}" if options[:expire_after]
         result
       end
 
@@ -153,11 +165,9 @@ module ActionDispatch
           @data_cipher.iv = iv
           session_data = @data_cipher.update(encrypted_session_data) << @data_cipher.final
           session_data = inflate(session_data) if compressed
-          unless digest == hmac_digest(iv, session_data, timestamp)
-            return nil unless @allow_legacy_hmac && digest == hmac_digest(nil, session_data, timestamp)
-          end
-          if expire_after(options)
-            return nil unless timestamp && Time.now.utc.to_i <= timestamp + expire_after(options)
+          return nil unless digest == hmac_digest(iv, session_data, timestamp)
+          if options[:expire_after]
+            return nil unless timestamp && Time.now.utc.to_i <= timestamp + options[:expire_after]
           end
 
           loaded_data = nil
@@ -172,7 +182,7 @@ module ActionDispatch
         else
           nil
         end
-      rescue Zlib::DataError, OpenSSLCipherError
+      rescue Zlib::DataError, OpenSSL::Cipher::CipherError
         nil
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: encrypted_cookie_store-instructure
 version: !ruby/object:Gem::Version
-  version: 1.1.12
+  version: 1.2.0
 platform: ruby
 authors:
 - Cody Cutrer
@@ -16,76 +16,56 @@ dependencies:
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.2'
-    - - <
-      - !ruby/object:Gem::Version
-        version: '4.3'
+        version: 5.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '3.2'
-    - - <
-      - !ruby/object:Gem::Version
-        version: '4.3'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '1.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: 5.0.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.5'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.5'
 - !ruby/object:Gem::Dependency
-  name: debugger
+  name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: A secure version of Rails' built in CookieStore
@@ -108,19 +88,18 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
-summary: EncryptedCookieStore for Ruby on Rails 3.2
+summary: EncryptedCookieStore for Ruby on Rails 4.2
 test_files: []
-has_rdoc: