faye-authentication 1.12 → 1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e267e9258a90f6c713835fa6f1f17409d717258f2e6b0d8c7aaed6b085c857b
-  data.tar.gz: 0c358ecf0dc7f03e21d61af1b172d7a3d9335f4fc9dc4a39d6499d8db8d1be71
+  metadata.gz: 7df2f00525686219899b087a97cd26dda4d0beb817de711c7009e0b1f2d73172
+  data.tar.gz: 87ed8fcf147384cf3c2a2f43ef32488e0592cac79e00f5360b4dd4b95d40bde6
 SHA512:
-  metadata.gz: d4a7e752c492860afb8fb7cda7e52a1a33be80a4db3f004526b35e5a4c0cb62b596248ec288c74d346b559048a425d2e62f65ca6edaca56344208c22ac0e57c5
-  data.tar.gz: 3fe4f26c9ad2a1a83e8b8902ed60e55f3edbd46460b43a805390f28ecb61a684d2680ed729146448ce87260153b73d341604e6a33bde580fff63e9b6ad9a9eb3
+  metadata.gz: 4b3cd29b0f5384af09976d723a30d2878e172ff15a9c125b109b27ff3592ce684446474799f8e035664cdc9af0458d005143ef05fed3539b31347a3eed627a5a
+  data.tar.gz: fba06b490b06c432ea3fdd7bd897c55f75f1ee2e20c7e68f59e8900037a454d007a1665ec251d04fc83387540e152ee459cfae4c1296909fa3b68db697ba07b2

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 1.13
+  - Fix [CVE-2020-11020](https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5)
+
 ## 1.12
   - No longer retry and fetch a new signature after errors unrelated to `Faye::Authentication` (#15)
   - Internal:

data/README.md

@@ -1,4 +1,4 @@
-# Faye::Authentication [![Build Status](https://travis-ci.org/jarthod/faye-authentication.svg?branch=master)](https://travis-ci.org/dimelo/faye-authentication)
+# Faye::Authentication [![Build Status](https://travis-ci.org/jarthod/faye-authentication.svg?branch=master)](https://travis-ci.org/jarthod/faye-authentication)
 
 Authentification implementation for faye
 

data/VERSION

@@ -1 +1 @@
-1.12
+1.13

data/app/assets/javascripts/faye-authentication.js

@@ -92,7 +92,7 @@ FayeAuthentication.prototype.outgoing = function(message, callback) {
 
 FayeAuthentication.prototype.authentication_required = function(message) {
   var subscription_or_channel = message.subscription || message.channel;
-  if (message.channel == '/meta/subscribe' || message.channel.lastIndexOf('/meta/', 0) !== 0) {
+  if (message.channel.lastIndexOf('/meta/subscribe') === 0 || message.channel.lastIndexOf('/meta/', 0) !== 0) {
     if(this._options.whitelist) {
       try {
         return (!this._options.whitelist(subscription_or_channel));

data/lib/faye/authentication.rb

@@ -42,7 +42,7 @@ module Faye
     def self.authentication_required?(message, options = {})
       subscription_or_channel = message['subscription'] || message['channel']
       return false if message['channel'].nil?
-      return false unless (message['channel'] == '/meta/subscribe' || (!(message['channel'].start_with?('/meta/'))))
+      return false unless (message['channel'].start_with?('/meta/subscribe') || (!(message['channel'].start_with?('/meta/'))))
       whitelist_proc = options[:whitelist]
       if whitelist_proc
         begin

data/spec/javascripts/faye-authentication_spec.js

@@ -94,6 +94,14 @@ describe('faye-authentication', function() {
       sharedExamplesForSubscribeAndPublish();
     });
 
+    describe('subscribe with prefix', function() {
+      beforeEach(function() {
+        this.message = {'channel': '/meta/subscribe/x', 'subscription': '/foobar'};
+      });
+
+      sharedExamplesForSubscribeAndPublish();
+    });
+
     describe('handshake', function() {
       beforeEach(function() {
         this.message = {'channel': '/meta/handshake'};

data/spec/lib/faye/authentication_spec.rb

@@ -132,6 +132,11 @@ describe Faye::Authentication do
       it_behaves_like 'subscribe_and_publish'
     end
 
+    context 'subscribe with prefix' do
+      let(:message) { {'channel' => '/meta/subscribe/x', 'subscription' => '/foobar'} }
+      it_behaves_like 'subscribe_and_publish'
+    end
+
     context 'handshake' do
       let(:message) { {'channel' => '/meta/handshake'} }
       it_behaves_like 'meta_except_subscribe'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: faye-authentication
 version: !ruby/object:Gem::Version
-  version: '1.12'
+  version: '1.13'
 platform: ruby
 authors:
 - Adrien Siami
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-21 00:00:00.000000000 Z
+date: 2020-05-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt