gds-sso 21.1.0 → 22.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72938e39cf2466b8a2dc2d22aca03d64ff33ab2a8c5d11c0c57f3710a2935205
-  data.tar.gz: 042b5c966919ab345d9ea3dc9e47197947fdd75e51ad263b0f0f038397c09fa9
+  metadata.gz: cc434aa156074fb389c79d10a05993a5493d692a06af85e7d1409b6329ad296e
+  data.tar.gz: 2a4625eae41416c741ed0c0288eb7f4f4d4cb19d78338e5e967ea2761149e6f1
 SHA512:
-  metadata.gz: fdca3de72981e79aa420da0b3d6c4d689fba034d3d3cda4874082efe58bcf056128242ab09a4266b8d11f91da500d47b665e434ccb805a3f6a799d6d29f765f4
-  data.tar.gz: ad252eb2aeaf3986b68b54a15f7f4622f4d56e730d509690e1e80c77be6411201ebf618ba68efebaff825fe731a111de186b439b6834a4c1de91782745658335
+  metadata.gz: 35c3637ecf9de2b951b2367924f4b4aff1538a84e2ba0c318ef79dc95eccdd075d9f1c176feaed71dc60a03f8b2d6891bcf08148d85571cfadff303ccaf904ae
+  data.tar.gz: f9c2193558be493ce2f58414c72cb9ec240f835e2e3d5005cfa271716d9b504bbfbba080e487443b4905071209876acd5886f0280ce83630305ae1d2d254d7ae

data/lib/gds-sso/failure_app.rb

@@ -6,6 +6,8 @@ require "rails"
 module GDS
   module SSO
     class FailureApp < ActionController::Metal
+      MAX_RETURN_TO_PATH_SIZE = 2048
+
       include ActionController::Redirecting
       include AbstractController::Rendering
       include ActionController::Rendering
@@ -44,7 +46,12 @@ module GDS
 
       # TOTALLY NOT DOING THE SCOPE THING. PROBABLY SHOULD.
       def store_location!
-        session["return_to"] = request.env["warden.options"][:attempted_path] if request.get?
+        return unless request.get?
+
+        attempted_path = request.env["warden.options"][:attempted_path]
+        return if attempted_path.bytesize > MAX_RETURN_TO_PATH_SIZE
+
+        session["return_to"] = attempted_path
       end
 
     private

data/lib/gds-sso/version.rb

@@ -1,5 +1,5 @@
 module GDS
   module SSO
-    VERSION = "21.1.0".freeze
+    VERSION = "22.0.0".freeze
   end
 end

data/spec/unit/failure_app_spec.rb

@@ -0,0 +1,31 @@
+require "spec_helper"
+
+describe GDS::SSO::FailureApp, type: :request do
+  describe "#redirect" do
+    before do
+      Rails.application.routes.draw do
+        get "redirect", to: GDS::SSO::FailureApp.action(:redirect)
+      end
+    end
+
+    after { Rails.application.reload_routes! }
+
+    it "should store the return_to path in session when it is reasonably short" do
+      attempted_path = "some-reasonably-short-path"
+
+      get "/redirect", env: { "warden.options" => { attempted_path: } }
+
+      expect(response).to redirect_to("/auth/gds")
+      expect(session["return_to"]).to eq(attempted_path)
+    end
+
+    it "should not attempt to store the return_to path in session when it is very long" do
+      attempted_path = "some-#{'very-' * 1000}-long-path"
+
+      get "/redirect", env: { "warden.options" => { attempted_path: } }
+
+      expect(response).to redirect_to("/auth/gds")
+      expect(session["return_to"]).to be_nil
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gds-sso
 version: !ruby/object:Gem::Version
-  version: 21.1.0
+  version: 22.0.0
 platform: ruby
 authors:
 - GOV.UK Dev
@@ -169,28 +169,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '6'
+        version: '8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '6'
+        version: '8'
 - !ruby/object:Gem::Dependency
   name: rubocop-govuk
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.18
+        version: 5.1.19
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.18
+        version: 5.1.19
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -272,6 +272,7 @@ files:
 - spec/unit/bearer_token_spec.rb
 - spec/unit/config_spec.rb
 - spec/unit/controller_methods_spec.rb
+- spec/unit/failure_app_spec.rb
 - spec/unit/gds_sso_spec.rb
 - spec/unit/mock_bearer_token_spec.rb
 - spec/unit/railtie_spec.rb
@@ -321,6 +322,7 @@ test_files:
 - spec/unit/bearer_token_spec.rb
 - spec/unit/config_spec.rb
 - spec/unit/controller_methods_spec.rb
+- spec/unit/failure_app_spec.rb
 - spec/unit/gds_sso_spec.rb
 - spec/unit/mock_bearer_token_spec.rb
 - spec/unit/railtie_spec.rb