gds-sso 22.3.0 → 23.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '092e673d09d581f6032548857228e22f041e6c7cb51de00bb623bf3d907c5c2e'
-  data.tar.gz: 0d5d69b1490123d751d6a17e04d215df17f3515d3fdcc257bfebbb72de3d90b2
+  metadata.gz: 620c8f21e86429c4a35f325a47451e554e359845c3e680bfa2c1add771b72bd3
+  data.tar.gz: 34cee6af9fdc9e5ff976c1f9388f0578d5de74e0d621f1a20fb9a077a0178049
 SHA512:
-  metadata.gz: c8aa534e8e4640ca89c8a05e975714bb8af671796d45fd408fd53029c48d25265500bcb4cb1d485b9726406c0a87c45cc80049ae927185be965d0daff7c74d10
-  data.tar.gz: c3db836c9f9546d00a8d993286a212a60273f20f178f51ff426e086aa6c16ecd7c8dc3431aa6085d8a4b33d583c985ab56c7186b7f3f95cf2afe98cf7d8bccfc
+  metadata.gz: 45dfe6138c1b0fa85adef3f89e874bb7dd6e28597c4c36092729012e05f9d1eb6ae9e336968c21aff61d689e51b87d5911b6ce002b8c4820160a1d71a6e5e371
+  data.tar.gz: dcf2803364d61e31bddb3d55d64c212fe389b4351c7143646353ee4bb3836c2deb54181b288a37ff60571b3dc93621064e4ed4474a17b39afdbd4a37ccd270e7

data/lib/gds-sso/failure_app.rb

@@ -6,8 +6,6 @@ require "rails"
 module GDS
   module SSO
     class FailureApp < ActionController::Metal
-      MAX_RETURN_TO_PATH_SIZE = 2048
-
       include ActionController::Redirecting
       include AbstractController::Rendering
       include ActionController::Rendering
@@ -43,7 +41,6 @@ module GDS
         return unless request.get?
 
         attempted_path = request.env["warden.options"][:attempted_path]
-        return if attempted_path.bytesize > MAX_RETURN_TO_PATH_SIZE
 
         session["return_to"] = attempted_path
       end

data/lib/gds-sso/limit_session_data.rb

@@ -0,0 +1,66 @@
+module GDS
+  module SSO
+    class LimitSessionData
+      MAX_SESSION_DATA_SIZE = 2048
+      MANAGED_KEYS = %w[return_to].freeze
+      MANAGED_KEY_PREFIXES = %w[omniauth. warden.].freeze
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        status, headers, body = @app.call(env)
+
+        session = env["rack.session"]
+        return [status, headers, body] unless session.respond_to?(:to_hash)
+
+        if gds_sso_session_bytesize(session) > MAX_SESSION_DATA_SIZE
+          Rails.logger.warn("[gds-sso] Rejecting request: data added to the session by gds-sso exceeds #{MAX_SESSION_DATA_SIZE} bytes")
+          purge_gds_sso_session_data!(session)
+          return bad_request
+        end
+
+        [status, headers, body]
+      end
+
+    private
+
+      def gds_sso_session_bytesize(session)
+        session.to_hash.sum do |key, value|
+          managed_key?(key) ? key.bytesize + serialized_bytesize(value) : 0
+        end
+      end
+
+      def serialized_bytesize(value)
+        JSON.generate(value).bytesize
+      rescue StandardError
+        # If we can't serialise it to measure it, assume it's too large
+        Float::INFINITY
+      end
+
+      def managed_key?(key)
+        MANAGED_KEYS.include?(key) || MANAGED_KEY_PREFIXES.any? { |prefix| key.start_with?(prefix) }
+      end
+
+      def purge_gds_sso_session_data!(session)
+        session.to_hash.each_key do |key|
+          session.delete(key) if managed_key?(key)
+        end
+      end
+
+      def bad_request
+        body = "Bad Request"
+        [
+          400,
+          {
+            "content-type" => "text/plain; charset=utf-8",
+            "content-length" => body.bytesize.to_s,
+            "cache-control" => "no-cache",
+          },
+          [body],
+        ]
+      end
+    end
+  end
+end

data/lib/gds-sso/version.rb

@@ -1,5 +1,5 @@
 module GDS
   module SSO
-    VERSION = "22.3.0".freeze
+    VERSION = "23.0.0".freeze
   end
 end

data/lib/gds-sso.rb

@@ -12,6 +12,7 @@ module GDS
   module SSO
     autoload :FailureApp,               "gds-sso/failure_app"
     autoload :ControllerMethods,        "gds-sso/controller_methods"
+    autoload :LimitSessionData,         "gds-sso/limit_session_data"
     autoload :User,                     "gds-sso/user"
     autoload :ApiAccess,                "gds-sso/api_access"
     autoload :AuthoriseUser,            "gds-sso/authorise_user"
@@ -38,6 +39,7 @@ module GDS
 
       OmniAuth.config.allowed_request_methods = %i[post get]
 
+      config.app_middleware.use GDS::SSO::LimitSessionData
       config.app_middleware.use ::OmniAuth::Builder do
         next if GDS::SSO::Config.api_only
 

data/spec/internal/app/controllers/example_controller.rb

@@ -1,5 +1,5 @@
 class ExampleController < ApplicationController
-  before_action :authenticate_user!, except: :not_restricted
+  before_action :authenticate_user!, except: %i[not_restricted stuff_session]
   before_action -> { authorise_user!("execute") }, only: :this_requires_execute_permission
   def not_restricted
     render body: "jabberwocky"
@@ -16,4 +16,9 @@ class ExampleController < ApplicationController
   def constraint_restricted
     render body: "constraint restricted"
   end
+
+  def stuff_session
+    session["app_data"] = "A" * params.fetch(:size, 6000).to_i
+    render body: "ok"
+  end
 end

data/spec/internal/app/models/user.rb

@@ -1,5 +1,5 @@
 class User < ActiveRecord::Base
   include GDS::SSO::User
 
-  serialize :permissions, type: Array
+  serialize :permissions, type: Array, coder: YAML
 end

data/spec/internal/config/routes.rb

@@ -3,6 +3,7 @@
 Rails.application.routes.draw do
   get "/not-restricted" => "example#not_restricted"
   get "/restricted" => "example#restricted"
+  get "/stuff-session" => "example#stuff_session"
   get "/this-requires-execute-permission" => "example#this_requires_execute_permission"
 
   constraints(GDS::SSO::AuthorisedUserConstraint.new("constraint")) do

data/spec/request/limit_session_data_spec.rb

@@ -0,0 +1,98 @@
+require "spec_helper"
+
+RSpec.describe "GDS-SSO session data limitation", type: :request do
+  context "when a request would overflow the session cookie" do
+    it "responds with 400 when the query string is oversized" do
+      get "/auth/gds?payload=#{'A' * 6000}"
+
+      expect(response).to have_http_status(:bad_request)
+    end
+
+    it "responds with 400 when the Referer header is oversized" do
+      get "/auth/gds", headers: { "HTTP_REFERER" => "https://example.com/#{'A' * 6000}" }
+
+      expect(response).to have_http_status(:bad_request)
+    end
+
+    it "responds with 400 when the origin param is oversized" do
+      get "/auth/gds?origin=#{'A' * 6000}"
+
+      expect(response).to have_http_status(:bad_request)
+    end
+
+    it "responds with 400 when several individually small values together exceed the limit" do
+      get "/auth/gds?payload=#{'A' * 1300}", headers: { "HTTP_REFERER" => "https://example.com/#{'A' * 1300}" }
+
+      expect(response).to have_http_status(:bad_request)
+    end
+
+    it "responds with 400 to oversized return_to paths" do
+      get "/restricted?payload=#{'A' * 3000}"
+
+      expect(response).to have_http_status(:bad_request)
+    end
+
+    it "does not write the oversized data into the session cookie" do
+      get "/auth/gds?payload=#{'A' * 6000}"
+
+      expect(response).to have_http_status(:bad_request)
+      expect(response.headers["Set-Cookie"].to_s.bytesize).to be < ActionDispatch::Cookies::MAX_COOKIE_SIZE
+
+      # Regular request; no replay of oversized session data
+      get "/auth/gds"
+      expect(response).to have_http_status(:redirect)
+      expect(response.location).to start_with("http://signon/oauth/authorize")
+    end
+  end
+
+  context "when a request does not overflow the session cookie" do
+    it "redirects to signon, storing the query string, origin and state" do
+      get "/auth/gds?app_param=1", headers: { "HTTP_REFERER" => "https://example.com/some-page" }
+
+      expect(response).to have_http_status(:redirect)
+      expect(URI.parse(response.location).path).to eq("/oauth/authorize")
+      expect(session["omniauth.params"]).to eq("app_param" => "1")
+      expect(session["omniauth.origin"]).to eq("https://example.com/some-page")
+      expect(session["omniauth.state"]).to be_present
+    end
+
+    it "stores reasonably short return_to paths and redirects back to them" do
+      get "/restricted"
+
+      expect(response).to redirect_to("/auth/gds")
+      expect(session["return_to"]).to eq("/restricted")
+
+      state = request_to_establish_oauth_state
+      stub_signon_oauth_token_request
+      stub_successful_signon_user_request
+
+      get "/auth/gds/callback?code=code&state=#{state}"
+
+      expect(response).to redirect_to("/restricted")
+    end
+
+    it "does not limit the host applications's own session data" do
+      get "/stuff-session", params: { size: 1500 }
+
+      expect(response).to have_http_status(:success)
+      expect(session["app_data"].bytesize).to eq(1500)
+    end
+  end
+
+  context "when the host application causes an overflow" do
+    it "responds with 500 when the app itself overflows the cookie" do
+      get "/stuff-session", params: { size: 6000 }
+
+      expect(response).to have_http_status(:internal_server_error)
+    end
+  end
+
+  context "when the middleware is part of the stack" do
+    it "wraps OmniAuth and Warden so it sees all session writes" do
+      middlewares = Rails.application.middleware.middlewares.map(&:name)
+
+      expect(middlewares.index("GDS::SSO::LimitSessionData")).to be < middlewares.index("OmniAuth::Builder")
+      expect(middlewares.index("OmniAuth::Builder")).to be < middlewares.index("Warden::Manager")
+    end
+  end
+end

data/spec/unit/failure_app_spec.rb

@@ -18,14 +18,5 @@ describe GDS::SSO::FailureApp, type: :request do
       expect(response).to redirect_to("/auth/gds")
       expect(session["return_to"]).to eq(attempted_path)
     end
-
-    it "should not attempt to store the return_to path in session when it is very long" do
-      attempted_path = "some-#{'very-' * 1000}-long-path"
-
-      get "/redirect", env: { "warden.options" => { attempted_path: } }
-
-      expect(response).to redirect_to("/auth/gds")
-      expect(session["return_to"]).to be_nil
-    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gds-sso
 version: !ruby/object:Gem::Version
-  version: 22.3.0
+  version: 23.0.0
 platform: ruby
 authors:
 - GOV.UK Dev
@@ -197,14 +197,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.0
+        version: 5.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.0
+        version: 5.2.1
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -257,6 +257,7 @@ files:
 - lib/gds-sso/config.rb
 - lib/gds-sso/controller_methods.rb
 - lib/gds-sso/failure_app.rb
+- lib/gds-sso/limit_session_data.rb
 - lib/gds-sso/lint/user_spec.rb
 - lib/gds-sso/lint/user_test.rb
 - lib/gds-sso/railtie.rb
@@ -275,6 +276,7 @@ files:
 - spec/request/api/user_spec.rb
 - spec/request/authentication_spec.rb
 - spec/request/demo_app_spec.rb
+- spec/request/limit_session_data_spec.rb
 - spec/spec_helper.rb
 - spec/support/controller_spy.rb
 - spec/support/request_helpers.rb
@@ -310,7 +312,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Client for GDS' OAuth 2-based SSO
 test_files:
@@ -325,6 +327,7 @@ test_files:
 - spec/request/api/user_spec.rb
 - spec/request/authentication_spec.rb
 - spec/request/demo_app_spec.rb
+- spec/request/limit_session_data_spec.rb
 - spec/spec_helper.rb
 - spec/support/controller_spy.rb
 - spec/support/request_helpers.rb