hanami 1.3.5 → 2.0.0.alpha4

data/lib/hanami/action/csrf_protection.rb

@@ -1,211 +0,0 @@
-require 'securerandom'
-
-module Hanami
-  # @api private
-  module Action
-    # Invalid CSRF Token
-    #
-    # @since 0.4.0
-    class InvalidCSRFTokenError < ::StandardError
-    end
-
-    # CSRF Protection
-    #
-    # This security mechanism is enabled automatically if sessions are turned on.
-    #
-    # It stores a "challenge" token in session. For each "state changing request"
-    # (eg. <tt>POST</tt>, <tt>PATCH</tt> etc..), we should send a special param:
-    # <tt>_csrf_token</tt>.
-    #
-    # If the param matches with the challenge token, the flow can continue.
-    # Otherwise the application detects an attack attempt, it reset the session
-    # and <tt>Hanami::Action::InvalidCSRFTokenError</tt> is raised.
-    #
-    # We can specify a custom handling strategy, by overriding <tt>#handle_invalid_csrf_token</tt>.
-    #
-    # Form helper (<tt>#form_for</tt>) automatically sets a hidden field with the
-    # correct token. A special view method (<tt>#csrf_token</tt>) is available in
-    # case the form markup is manually crafted.
-    #
-    # We can disable this check on action basis, by overriding <tt>#verify_csrf_token?</tt>.
-    #
-    # @since 0.4.0
-    #
-    # @see https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
-    # @see https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
-    #
-    # @example Custom Handling
-    #   module Web::Controllers::Books
-    #     class Create
-    #       include Web::Action
-    #
-    #       def call(params)
-    #         # ...
-    #       end
-    #
-    #       private
-    #
-    #       def handle_invalid_csrf_token
-    #         Web::Logger.warn "CSRF attack: expected #{ session[:_csrf_token] }, was #{ params[:_csrf_token] }"
-    #         # manual handling
-    #       end
-    #     end
-    #   end
-    #
-    # @example Bypass Security Check
-    #   module Web::Controllers::Books
-    #     class Create
-    #       include Web::Action
-    #
-    #       def call(params)
-    #         # ...
-    #       end
-    #
-    #       private
-    #
-    #       def verify_csrf_token?
-    #         false
-    #       end
-    #     end
-    #   end
-    module CSRFProtection
-      # Session and params key for CSRF token.
-      #
-      # This key is shared with <tt>hanami-controller</tt> and <tt>hanami-helpers</tt>
-      #
-      # @since 0.4.0
-      # @api private
-      CSRF_TOKEN = :_csrf_token
-
-      # Idempotent HTTP methods
-      #
-      # By default, the check isn't performed if the request method is included
-      # in this list.
-      #
-      # @since 0.4.0
-      # @api private
-      IDEMPOTENT_HTTP_METHODS = Hash[
-        'GET'     => true,
-        'HEAD'    => true,
-        'TRACE'   => true,
-        'OPTIONS' => true
-      ].freeze
-
-      # @since 0.4.0
-      # @api private
-      def self.included(action)
-        action.class_eval do
-          before :set_csrf_token, :verify_csrf_token
-        end unless Hanami.env?(:test)
-      end
-
-      private
-      # Set CSRF Token in session
-      #
-      # @since 0.4.0
-      # @api private
-      def set_csrf_token
-        session[CSRF_TOKEN] ||= generate_csrf_token
-      end
-
-      # Verify if CSRF token from params, matches the one stored in session.
-      # If not, it raises an error.
-      #
-      # Don't override this method.
-      #
-      # To bypass the security check, please override <tt>#verify_csrf_token?</tt>.
-      # For custom handling of an attack, please override <tt>#handle_invalid_csrf_token</tt>.
-      #
-      # @since 0.4.0
-      # @api private
-      def verify_csrf_token
-        handle_invalid_csrf_token if invalid_csrf_token?
-      end
-
-      # Verify if CSRF token from params, matches the one stored in session.
-      #
-      # Don't override this method.
-      #
-      # @since 0.4.0
-      # @api private
-      def invalid_csrf_token?
-        return false unless verify_csrf_token?
-
-        missing_csrf_token? ||
-          !::Rack::Utils.secure_compare(session[CSRF_TOKEN], params[CSRF_TOKEN])
-      end
-
-      # Verify the CSRF token was passed in params.
-      #
-      # @api private
-      def missing_csrf_token?
-        Hanami::Utils::Blank.blank?(params[CSRF_TOKEN])
-      end
-
-      # Generates a random CSRF Token
-      #
-      # @since 0.4.0
-      # @api private
-      def generate_csrf_token
-        SecureRandom.hex(32)
-      end
-
-      # Decide if perform the check or not.
-      #
-      # Override and return <tt>false</tt> if you want to bypass security check.
-      #
-      # @since 0.4.0
-      #
-      # @example
-      #   module Web::Controllers::Books
-      #     class Create
-      #       include Web::Action
-      #
-      #       def call(params)
-      #         # ...
-      #       end
-      #
-      #       private
-      #
-      #       def verify_csrf_token?
-      #         false
-      #       end
-      #     end
-      #   end
-      def verify_csrf_token?
-        !IDEMPOTENT_HTTP_METHODS[request_method]
-      end
-
-      # Handle CSRF attack.
-      #
-      # The default policy resets the session and raises an exception.
-      #
-      # Override this method, for custom handling.
-      #
-      # @raise [Hanami::Action::InvalidCSRFTokenError]
-      #
-      # @since 0.4.0
-      #
-      # @example
-      #   module Web::Controllers::Books
-      #     class Create
-      #       include Web::Action
-      #
-      #       def call(params)
-      #         # ...
-      #       end
-      #
-      #       private
-      #
-      #       def handle_invalid_csrf_token
-      #         # custom invalid CSRF management goes here
-      #       end
-      #     end
-      #   end
-      def handle_invalid_csrf_token
-        session.clear
-        raise InvalidCSRFTokenError.new
-      end
-    end
-  end
-end

data/lib/hanami/action/routing_helpers.rb

@@ -1,40 +0,0 @@
-require 'hanami/utils/string'
-
-module Hanami
-  module Action
-    # Routing helper for full stack Hanami web applications.
-    #
-    # For a given application called <tt>Web::Application</tt>, at runtime
-    # Hanami creates a routes factory called <tt>Web::Routes</tt>.
-    #
-    # Included by default in every controller.
-    #
-    # @since 0.3.2
-    #
-    # @example Usage in controller
-    #   require 'hanami'
-    #
-    #   module Web::Controllers::Protected
-    #     class Index
-    #       include Web::Action
-    #
-    #       def call(params)
-    #         redirect_to routes.root_path
-    #       end
-    #     end
-    #   end
-    module RoutingHelpers
-      def self.included(base)
-        factory = "#{Utils::String.namespace(base)}.routes"
-
-        base.class_eval <<-END_EVAL, __FILE__, __LINE__
-          private
-
-          def routes
-            #{factory}
-          end
-        END_EVAL
-      end
-    end
-  end
-end

data/lib/hanami/app.rb

@@ -1,96 +0,0 @@
-require 'rack'
-require 'rack/builder'
-require 'hanami/router'
-require 'hanami/components'
-require 'hanami/common_logger'
-
-module Hanami
-  # Main application that mounts many Rack and/or Hanami applications.
-  #
-  # @see Hanami.app
-  #
-  # @since 0.9.0
-  # @api private
-  class App
-    # Initialize a new instance
-    #
-    # @param configuration [Hanami::Configuration] general configuration
-    # @param environment [Hanami::Environment] current environment
-    #
-    # @since 0.9.0
-    # @api private
-    def initialize(configuration, environment)
-      Components.resolve('apps')
-
-      @builder = Rack::Builder.new
-      @routes  = Hanami::Router.new
-
-      mount(configuration)
-      middleware(configuration, environment)
-      builder.run(routes)
-
-      @app = builder.to_app
-    end
-
-    # Implements Rack SPEC
-    #
-    # @param env [Hash] a Rack env
-    #
-    # @return [Array] a serialized Rack response
-    #
-    # @since 0.9.0
-    # @api private
-    def call(env)
-      app.call(env)
-    end
-
-    private
-
-    # @since 1.2.0
-    # @api private
-    attr_reader :app
-
-    # @since 0.9.0
-    # @api private
-    attr_reader :builder
-
-    # @since 0.9.0
-    # @api private
-    attr_reader :routes
-
-    # @since 0.9.0
-    # @api private
-    def mount(configuration)
-      configuration.mounted.each do |klass, app|
-        routes.mount(klass, at: app.path_prefix, host: app.host)
-      end
-    end
-
-    # @since 0.9.0
-    # @api private
-    #
-    # rubocop:disable Metrics/AbcSize
-    # rubocop:disable Metrics/MethodLength
-    def middleware(configuration, environment)
-      builder.use Hanami::CommonLogger, Hanami.logger unless Hanami.logger.nil?
-      builder.use Rack::ContentLength
-
-      configuration.middleware.each do |m, args, blk|
-        builder.use(m, *args, &blk)
-      end
-
-      if configuration.early_hints
-        require 'hanami/early_hints'
-        builder.use Hanami::EarlyHints
-      end
-
-      if middleware = environment.static_assets_middleware # rubocop:disable Lint/AssignmentInCondition
-        builder.use middleware
-      end
-
-      builder.use Rack::MethodOverride
-    end
-    # rubocop:enable Metrics/MethodLength
-    # rubocop:enable Metrics/AbcSize
-  end
-end