firebase_id_token 2.4.0 → 2.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +16 -0
  3. data/README.md +1 -1
  4. data/firebase_id_token.gemspec +1 -1
  5. data/lib/firebase_id_token/signature.rb +16 -3
  6. data/lib/firebase_id_token/testing/certificates.rb +4 -0
  7. data/lib/firebase_id_token/version.rb +1 -1
  8. metadata +34 -34
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: eef2d227ba8e21f033a7d4c68f7d973a6d25b26e1c1900f43784606f1020332c
4
- data.tar.gz: 2899b73b48998f8e14337eada01a76980e02fd1994821afd8a902f23ec40dfd5
3
+ metadata.gz: d323f3f19f0e2cfa9f511adac526f38261ee28386d4abc210a22e26358008143
4
+ data.tar.gz: 82095062bbd88ebfe9ddbee3f769f2bc9e4fb0b9289fa673f4bf81d6a24132d0
5
5
  SHA512:
6
- metadata.gz: 7f64121a625def6dd48f7090fd5bfe25ed3ca754510a993b3dc9124b865e92c5610010a156c5520359c9c93d7301e8dfe9c4a46630f99df50b84742a61129fbf
7
- data.tar.gz: 6b0fd92129b034f482fe8ed910a23e9f7201d42d510b03100f974e7adc919d9125915885c5211cf1c1cbf42363c72a987e3a1b493047aec27193317e2569d4f8
6
+ metadata.gz: 5d056894ee1051fb9ccb0984624282805f153aca7e9bb41b5d3b39a93b749150311e45e11f7e182fdb4ee1814bea722a5fc49ddb975394f319edb3bbea7424d6
7
+ data.tar.gz: 998d1b74cdf9b036892e12ab9e7c271417ead8d18c6bbb8dcea04ea555c4fe6a856b79840872676c4aa530726132826f795c686ba5096502004a22ab7df82751
data/CHANGELOG.md CHANGED
@@ -6,6 +6,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
6
6
 
7
7
  ## [Unreleased]
8
8
 
9
+ ## [2.5.0] - 2022-04-13
10
+
11
+ ### Fixed
12
+ - Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile [CVE-2021-43809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43809).
13
+ - Dependency Confusion in Bundler [CVE-2020-36327](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36327).
14
+ - Insecure path handling in Bundler [CVE-2019-3881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3881).
15
+
16
+ ### Changed
17
+ - Using Bundler 2.3.11.
18
+ - Using `Time.current` instead of `Time.now` to work with timezones [PR 34](https://github.com/fschuindt/firebase_id_token/pull/34).
19
+ - Caching certificates on memory using `Thread` to avoid unnecessary calls into Redis [PR 33](https://github.com/fschuindt/firebase_id_token/pull/33).
20
+
21
+ ## [2.4.0] - 2020-05-02
22
+
9
23
  ### Fixed
10
24
  - Rake development dependency vulnerability [CVE-2020-8130](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8130).
11
25
 
@@ -95,6 +109,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
95
109
  ## [0.1.0] - 2017-04-23
96
110
  *Version removed.*
97
111
 
112
+ [2.5.0]: https://github.com/fschuindt/firebase_id_token/compare/2.4.0...2.5.0
113
+ [2.4.0]: https://github.com/fschuindt/firebase_id_token/compare/2.3.2...2.4.0
98
114
  [2.3.2]: https://github.com/fschuindt/firebase_id_token/compare/2.3.1...2.3.2
99
115
  [2.3.1]: https://github.com/fschuindt/firebase_id_token/compare/2.3.0...2.3.1
100
116
  [2.3.0]: https://github.com/fschuindt/firebase_id_token/compare/2.0.0...2.3.0
data/README.md CHANGED
@@ -29,7 +29,7 @@ gem install firebase_id_token
29
29
 
30
30
  or in your Gemfile
31
31
  ```
32
- gem 'firebase_id_token', '~> 2.4.0'
32
+ gem 'firebase_id_token', '~> 2.5.0'
33
33
  ```
34
34
  then
35
35
  ```
data/firebase_id_token.gemspec CHANGED
@@ -22,7 +22,7 @@ Gem::Specification.new do |spec|
22
22
  spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
23
23
  spec.require_paths = ['lib']
24
24
 
25
- spec.add_development_dependency 'bundler', '~> 1.17', '>= 1.17.2'
25
+ spec.add_development_dependency 'bundler', '~> 2.3', '>= 2.3.11'
26
26
  spec.add_development_dependency 'rake', '~> 12.3', '>= 12.3.3'
27
27
  spec.add_development_dependency 'rspec', '~> 3.0'
28
28
  spec.add_development_dependency 'redcarpet', '~> 3.4', '>= 3.4.0'
data/lib/firebase_id_token/signature.rb CHANGED
@@ -78,7 +78,20 @@ module FirebaseIdToken
78
78
 
79
79
  # @see Signature.verify
80
80
  def verify
81
- certificate = firebase_id_token_certificates.find(@kid, raise_error: @raise_error)
81
+ var_name = :_firebase_id_token_cert
82
+ Thread.current[var_name] ||= {
83
+ cert: nil,
84
+ expires_at: Time.now.utc - 1
85
+ }
86
+
87
+ if Thread.current[var_name][:expires_at] <= Time.now.utc
88
+ Thread.current[var_name] = {
89
+ cert: firebase_id_token_certificates.find(@kid, raise_error: @raise_error),
90
+ expires_at: Time.now.utc + firebase_id_token_certificates.ttl
91
+ }
92
+ end
93
+
94
+ certificate = Thread.current[var_name][:cert]
82
95
  return unless certificate
83
96
 
84
97
  payload = decode_jwt_payload(@jwt_token, certificate.public_key)
@@ -117,8 +130,8 @@ module FirebaseIdToken
117
130
  end
118
131
 
119
132
  def still_valid?(payload)
120
- payload['exp'].to_i > Time.now.to_i &&
121
- payload['iat'].to_i <= Time.now.to_i
133
+ payload['exp'].to_i > Time.current.to_i &&
134
+ payload['iat'].to_i <= Time.current.to_i
122
135
  end
123
136
 
124
137
  def issuer_authorized?(payload)
data/lib/firebase_id_token/testing/certificates.rb CHANGED
@@ -80,6 +80,10 @@ module FirebaseIdToken
80
80
  )
81
81
  )
82
82
  end
83
+
84
+ def self.ttl
85
+ 10
86
+ end
83
87
  end
84
88
  end
85
89
  end
data/lib/firebase_id_token/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module FirebaseIdToken
2
- VERSION = '2.4.0'
2
+ VERSION = '2.5.0'
3
3
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: firebase_id_token
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.4.0
4
+ version: 2.5.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Fernando Schuindt
8
- autorequire:
8
+ autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2020-05-02 00:00:00.000000000 Z
11
+ date: 2022-04-13 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -16,20 +16,20 @@ dependencies:
16
16
  requirements:
17
17
  - - "~>"
18
18
  - !ruby/object:Gem::Version
19
- version: '1.17'
19
+ version: '2.3'
20
20
  - - ">="
21
21
  - !ruby/object:Gem::Version
22
- version: 1.17.2
22
+ version: 2.3.11
23
23
  type: :development
24
24
  prerelease: false
25
25
  version_requirements: !ruby/object:Gem::Requirement
26
26
  requirements:
27
27
  - - "~>"
28
28
  - !ruby/object:Gem::Version
29
- version: '1.17'
29
+ version: '2.3'
30
30
  - - ">="
31
31
  - !ruby/object:Gem::Version
32
- version: 1.17.2
32
+ version: 2.3.11
33
33
  - !ruby/object:Gem::Dependency
34
34
  name: rake
35
35
  requirement: !ruby/object:Gem::Requirement
@@ -68,22 +68,22 @@ dependencies:
68
68
  name: redcarpet
69
69
  requirement: !ruby/object:Gem::Requirement
70
70
  requirements:
71
- - - ">="
72
- - !ruby/object:Gem::Version
73
- version: 3.4.0
74
71
  - - "~>"
75
72
  - !ruby/object:Gem::Version
76
73
  version: '3.4'
74
+ - - ">="
75
+ - !ruby/object:Gem::Version
76
+ version: 3.4.0
77
77
  type: :development
78
78
  prerelease: false
79
79
  version_requirements: !ruby/object:Gem::Requirement
80
80
  requirements:
81
- - - ">="
82
- - !ruby/object:Gem::Version
83
- version: 3.4.0
84
81
  - - "~>"
85
82
  - !ruby/object:Gem::Version
86
83
  version: '3.4'
84
+ - - ">="
85
+ - !ruby/object:Gem::Version
86
+ version: 3.4.0
87
87
  - !ruby/object:Gem::Dependency
88
88
  name: simplecov
89
89
  requirement: !ruby/object:Gem::Requirement
@@ -102,22 +102,22 @@ dependencies:
102
102
  name: codeclimate-test-reporter
103
103
  requirement: !ruby/object:Gem::Requirement
104
104
  requirements:
105
- - - ">="
106
- - !ruby/object:Gem::Version
107
- version: 1.0.0
108
105
  - - "~>"
109
106
  - !ruby/object:Gem::Version
110
107
  version: '1.0'
108
+ - - ">="
109
+ - !ruby/object:Gem::Version
110
+ version: 1.0.0
111
111
  type: :development
112
112
  prerelease: false
113
113
  version_requirements: !ruby/object:Gem::Requirement
114
114
  requirements:
115
- - - ">="
116
- - !ruby/object:Gem::Version
117
- version: 1.0.0
118
115
  - - "~>"
119
116
  - !ruby/object:Gem::Version
120
117
  version: '1.0'
118
+ - - ">="
119
+ - !ruby/object:Gem::Version
120
+ version: 1.0.0
121
121
  - !ruby/object:Gem::Dependency
122
122
  name: pry
123
123
  requirement: !ruby/object:Gem::Requirement
@@ -156,22 +156,22 @@ dependencies:
156
156
  name: redis-namespace
157
157
  requirement: !ruby/object:Gem::Requirement
158
158
  requirements:
159
- - - ">="
160
- - !ruby/object:Gem::Version
161
- version: 1.6.0
162
159
  - - "~>"
163
160
  - !ruby/object:Gem::Version
164
161
  version: '1.6'
162
+ - - ">="
163
+ - !ruby/object:Gem::Version
164
+ version: 1.6.0
165
165
  type: :runtime
166
166
  prerelease: false
167
167
  version_requirements: !ruby/object:Gem::Requirement
168
168
  requirements:
169
- - - ">="
170
- - !ruby/object:Gem::Version
171
- version: 1.6.0
172
169
  - - "~>"
173
170
  - !ruby/object:Gem::Version
174
171
  version: '1.6'
172
+ - - ">="
173
+ - !ruby/object:Gem::Version
174
+ version: 1.6.0
175
175
  - !ruby/object:Gem::Dependency
176
176
  name: httparty
177
177
  requirement: !ruby/object:Gem::Requirement
@@ -196,22 +196,22 @@ dependencies:
196
196
  name: jwt
197
197
  requirement: !ruby/object:Gem::Requirement
198
198
  requirements:
199
- - - ">="
200
- - !ruby/object:Gem::Version
201
- version: 2.1.0
202
199
  - - "~>"
203
200
  - !ruby/object:Gem::Version
204
201
  version: '2.1'
202
+ - - ">="
203
+ - !ruby/object:Gem::Version
204
+ version: 2.1.0
205
205
  type: :runtime
206
206
  prerelease: false
207
207
  version_requirements: !ruby/object:Gem::Requirement
208
208
  requirements:
209
- - - ">="
210
- - !ruby/object:Gem::Version
211
- version: 2.1.0
212
209
  - - "~>"
213
210
  - !ruby/object:Gem::Version
214
211
  version: '2.1'
212
+ - - ">="
213
+ - !ruby/object:Gem::Version
214
+ version: 2.1.0
215
215
  description: A Ruby gem to verify the signature of Firebase ID Tokens. It uses Redis
216
216
  to store Google's x509 certificates and manage their expiration time, so you don't
217
217
  need to request Google's API in every execution and can access it as fast as reading
@@ -260,7 +260,7 @@ homepage: https://github.com/fschuindt/firebase_id_token
260
260
  licenses:
261
261
  - MIT
262
262
  metadata: {}
263
- post_install_message:
263
+ post_install_message:
264
264
  rdoc_options: []
265
265
  require_paths:
266
266
  - lib
@@ -275,8 +275,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
275
275
  - !ruby/object:Gem::Version
276
276
  version: '0'
277
277
  requirements: []
278
- rubygems_version: 3.0.3
279
- signing_key:
278
+ rubygems_version: 3.1.4
279
+ signing_key:
280
280
  specification_version: 4
281
281
  summary: A Firebase ID Token verifier.
282
282
  test_files: []