forest_admin_rpc_agent 1.30.4 → 1.30.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7b87f32904f9a2d19ae17c3fc4a072fdd9b9507295650aad7b37f5f5422158e0
|
|
4
|
+
data.tar.gz: 98ebfb88b77d5d27a1012e734d27d05c4626bf96530e0515e6fe25a38c3593a3
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 9e80b93723b13efccc4c5e6682b3336024915354ade50cebae5044e166e4187334c4db35627ca184e0e78db05a3fb6ad7270889fadadd5049ba6db0de43d4f8e
|
|
7
|
+
data.tar.gz: 6eaefdd80f3b2dfc96764f111773304f0adc5575e3b2e0376d7f1824b06b0426ba8b3d3483cfa517148a7370e44b2968f03fc64019e62478bef08f200b772302
|
|
@@ -4,9 +4,6 @@ module ForestAdminRpcAgent
|
|
|
4
4
|
module Middleware
|
|
5
5
|
class Authentication
|
|
6
6
|
ALLOWED_TIME_DIFF = 300
|
|
7
|
-
SIGNATURE_REUSE_WINDOW = 5
|
|
8
|
-
@@used_signatures = {}
|
|
9
|
-
@@signatures_mutex = Mutex.new
|
|
10
7
|
|
|
11
8
|
def initialize(app)
|
|
12
9
|
@app = app
|
|
@@ -41,25 +38,7 @@ module ForestAdminRpcAgent
|
|
|
41
38
|
|
|
42
39
|
expected_signature = OpenSSL::HMAC.hexdigest('SHA256', auth_secret, timestamp)
|
|
43
40
|
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
# check if this signature has already been used (replay attack)
|
|
47
|
-
# Reject if signature was used recently (within SIGNATURE_REUSE_WINDOW seconds)
|
|
48
|
-
# Use mutex to prevent race conditions in multi-threaded environments
|
|
49
|
-
now = current_time_in_seconds
|
|
50
|
-
|
|
51
|
-
@@signatures_mutex.synchronize do
|
|
52
|
-
if @@used_signatures.key?(signature)
|
|
53
|
-
last_used = @@used_signatures[signature]
|
|
54
|
-
time_since_last_use = now - last_used
|
|
55
|
-
return false if time_since_last_use <= SIGNATURE_REUSE_WINDOW
|
|
56
|
-
end
|
|
57
|
-
@@used_signatures[signature] = now
|
|
58
|
-
|
|
59
|
-
cleanup_old_signatures
|
|
60
|
-
end
|
|
61
|
-
|
|
62
|
-
true
|
|
41
|
+
Rack::Utils.secure_compare(signature, expected_signature)
|
|
63
42
|
end
|
|
64
43
|
|
|
65
44
|
def valid_timestamp?(timestamp)
|
|
@@ -73,12 +52,6 @@ module ForestAdminRpcAgent
|
|
|
73
52
|
(current_time_in_seconds - time.to_i).abs <= ALLOWED_TIME_DIFF
|
|
74
53
|
end
|
|
75
54
|
|
|
76
|
-
def cleanup_old_signatures
|
|
77
|
-
# Should be called within mutex synchronize block
|
|
78
|
-
now = current_time_in_seconds
|
|
79
|
-
@@used_signatures.delete_if { |_signature, last_used| now - last_used > ALLOWED_TIME_DIFF }
|
|
80
|
-
end
|
|
81
|
-
|
|
82
55
|
def current_time_in_seconds
|
|
83
56
|
defined?(Time.current) ? Time.current.to_i : Time.now.utc.to_i
|
|
84
57
|
end
|