have-i-been-pwned 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf2d0f01619b0226af72c96fc839a43a55310ca27ece15b09f16503d57dfd7e0
-  data.tar.gz: 39635247af8ac211a54acd86bd861948674cda813ac865bc948329b504cc6bd1
+  metadata.gz: 4499b60218687b62e447a57c6942bd86f1d924ed2d330dea67382357de80a0c5
+  data.tar.gz: 37392cbb2e17412aa5baf742feb998a1c885e40457f310a163b3caa24b8e04f6
 SHA512:
-  metadata.gz: e4a0a974ebba91ab0b9f14c84e59a7789e9738b7ca363035a65ba6cc71cac7241c5a07c2cd670cb3ac9494d5f1505196f8469d3c0e129d3f8bc84c63bee445d1
-  data.tar.gz: fddc8e3d3c22711457bc16bfdc08f64b4495001c01f9898e6703af92db4e80530f97a0f39640f3a8c1d73b151811900c33e5d6b199578b533a34f1a91d7a95d7
+  metadata.gz: bfec05fb4004c1ed692c9be17c794b5c877ae93701a61582f197ba9494e03e9bd8a104be971306d8b404138918759a9654bd44770a03140d5d82313f18d67077
+  data.tar.gz: 4ef2fbe0eeca0901c3aee39e92c49887b0ca7c287b6f88f3380a9274fef1b2cf653c273c54de2756822076a779ecf1e6c020320b63215a5af5799f12b6a11e5e

data/.travis.yml

@@ -1,7 +1,10 @@
 language: ruby
 rvm:
 - 2.0.0
+- 2.2.0
 - 2.3.1
+- 2.5.0
+- 2.6.1
 script:
 - bundle exec rake
 deploy:
@@ -16,3 +19,6 @@ notification:
   slack:
     rooms:
       secure: YtIdbbN6Fflga3zJI9mN6OLmz6+8fxcJuvHlQO77NIea2CvBUP9jvJ5b2nc2aBxw8MJjJtVwvc0p5DlnA2w3tMSrk5KTJuoGNQa83LgzZEBNZOrvwSTwXoHRVWP+KoSnMwdhzknzZqC7dbskku/1MAfVnEvgpJxdrjeGF4z6/lDMb2GPHhRyYOaIiTLM8Ig/j8TeGAB5Javt4MbrQOgmhl76lNzNb6BhHUgVice4HNAEJKnYB+aKElGdVC1L+gy1Qqf7bGBpciz0omODo0UXxADV+KA2NzApFctEiElarvb2MN+K9PAu70ouz5q9GQ97KbGuVQzzpNJ2R5WHxrYTj4tRsAkhjHeUnv1Otues6Uhnc6jYLGZZHtQs5qyC3sFJz2bVMqJd0VIUl9BLnBPhRaZ2pOHYHJoLpVgNUX2WurEDew46MwnvojBnxOQ1A4/PLttH/n8ApYSQVM2Ynrgr7ZRdPCm14YfCrG6jDZylL6RqX5NsJFUKLP5wl5q8siESDVgecyMBFcTSitKI+BF7asIAth4Mw/Q3IUEPT8LwcQqVvvzssYbMUsJayhOC5aNXBQbadJeFRDZBdMeL1buNuZnITtBQTOdkkTxnf2DbK3eb5rBz9MDaUICm01QArADbANDrIl8qugnKta7o7xgn3yxa8FghmoklC9z+QCyYHSM=
+env:
+  matrix:
+    secure: N8raPga/MVy7t/QTxGpgYCqS8DzeDZxIkVa2jovcaHDc0Ul3v1oPnmlMbeE5dOHi2K9iiLnIH3Pe+u62Km4Vxp4xx7zS7Vm6yeMQyswUSkBGnMU75h3kaXGoaCIXR9b8yuJZajmME3fm5QH/rXBIOFQOCYEqLRpQzJgrGnHdgUGXm+QRL/anfFLcQGlH44Oyv1R4dAs0SFWZRcap3bnZLp04sSmvV5vG3pmca1YqSmMnUpptwP3UxIyTofwGbcDBHr86wxnaeUQYY/6ql52Di/yGhaswszJiKlQbI59beLhO/CGWQBrvjKyQR6Zk7YpX1pzfksQy/JWL8GW4ayB3qqifohRNChLH0/vD/EX219Cd02YXAXVVCAFvcAxRMab1Fct7rv/QHhzMfpsR6xazcFS+w6GBGcx1HtUvnPQXvt6kZ7oaQ1bTJ+5s02pz3BAJe5NoAYvxls12ou/ca6/B8pmCNDwwLzzO1XeiztKt0xE8tPpCYROeI4nel99i4nnYMMpoSUWqjwR4YKmoqkXlvMcKSCznHV7PhfXLF3h8vlK6dJWxJAo7iYcjcT2gRVt7biRt0K61zBRa/HF1zVSSfF/xpDkhSfV3nqu+UFlm9YIOri+2YSpvH4Az7sJPq8M2gaCasQUSevNEQ9BII/ouVvZK77vzUM+8LHo/X43fi0s=

data/README.md

@@ -14,7 +14,14 @@ gem install have-i-been-pwned
 require 'have-i-been-pwned'
 ...
 # returns true if the password is found, false otherwise
-result = HaveIBeenPwned::pwned 'abc123'
+result = HaveIBeenPwned.pwned 'abc123'
+```
+
+```
+require 'have-i-been-pwned'
+...
+# returns an array with symbolized hashs of breachers (ie. [ { :name => 'Adobe' } ]) for that account, nil if none are found
+result = HaveIBeenPwned.pwned_account 'some-email@gmail.com'
 ```
 
 #### Rails
@@ -26,7 +33,7 @@ gem 'have-i-been-pwned'
 ```
 # some controller
 # check the password
-if !HaveIBeenPwned::pwned params[:password]
+if !HaveIBeenPwned.pwned params[:password]
    puts "Yay! You can use this password!"
 else
    puts "No! Bad!!"

data/have-i-been-pwned.gemspec

@@ -16,7 +16,7 @@ Gem::Specification.new do |s|
 
   s.required_ruby_version = '>= 2.0.0'
 
-  s.add_runtime_dependency "httparty"
+  s.add_runtime_dependency "httparty", ">= 0.17.0"
 
   s.add_development_dependency "simplecov"
   s.add_development_dependency "codecov", ">= 0.1.10"

data/lib/have-i-been-pwned.rb

@@ -3,18 +3,23 @@ require 'digest'
 
 module HaveIBeenPwned
   class << self
+    # Check to see if a given password has been pwned/compromised by a breach.
+    # @param [String] password The *password* you want to check.
+    # @return [Boolean] True if the password has been compromised, false otherwise
     def pwned password
       # if password is not nil
       if password
         # get a digest of the password
         digest = Digest::SHA1.hexdigest password
+        # make sure we nil the password
+        password = nil
         # get the first 5 characters of the hash
         first_five = digest[0..4]
         # make the API call
         results = HTTParty.get("https://api.pwnedpasswords.com/range/#{first_five}")
 
         # guard: if we dont get something back
-        return unless results.code == 200
+        return false unless results.code == 200
 
         # split the string based on line breaks into an array
         res_array = results.split("\n")
@@ -23,16 +28,45 @@ module HaveIBeenPwned
           # hashes are formatted hash:count
           # ex. 0018A45C4D1DEF81644B54AB7F969B88D65:1
           # return true if we find a match
-          return true if "#{first_five}#{partial_hash.split(":")[0]}".upcase == digest.upcase
+          return true if "#{first_five}#{partial_hash.split(':')[0]}".upcase == digest.upcase
         end
 
         # return false if we dont find anything
         return false
       end
     end
+
+    # Check to see if the given *account* was involved in a data breach
+    # @param [String] email The email address you want to check
+    # @param [String] api_key The v3 API required a paid key from haveibeenpwned.com. Can also be specified as a ENV VAR 'HIBP_API_KEY' {More Information}[https://www.troyhunt.com/authentication-and-the-have-i-been-pwned-api/]
+    # @param [String] user_agent Provide a custom user agent. (default: haveibeenpwned-ruby-sdk)
+    # @return [[Hash], nil] Returns a array of hashes containing the [:name] of places the email was compromised by.
+    def pwned_account email, api_key = nil, user_agent = 'haveibeenpwned-ruby-sdk'
+      api_key ||= ENV['HIBP_API_KEY'] # for testing
+      throw 'You must provide a paid API key from haveibeenpwned.com to use this feature.' if api_key.nil?
+      headers = {
+        'user-agent' => user_agent,
+        'Hibp-Api-Key' => api_key
+      }
+      results = HTTParty.get("https://haveibeenpwned.com/api/v3/breachedaccount/#{email}", headers: headers)
+      return if results.nil?
+      error_check = Hash[results.map { |(k, v)| [k.downcase.to_sym, v] }] rescue nil
+
+      if !error_check
+        results.map! { |item| Hash[item.map { |(k, v)| [k.downcase.to_sym, v] }] }
+        results
+      else
+        throw error_check[:message]
+      end
+    end
   end
 end
 
 # Uncomment and call directly if you want to test this locally
 # results = HaveIBeenPwned::pwned 'abc123'
 # puts results
+
+# results = HaveIBeenPwned.pwned_account('dale@daleslab.com', 'not_a_valid_api_key')
+# results.each do |result|
+#   puts result[:name]
+# end

data/lib/version.rb

@@ -1,3 +1,3 @@
 module HaveIBeenPwned
-  VERSION = '1.0.0'.freeze
+  VERSION = '1.1.0'.freeze
 end

data/test/test_have_i_been_pwned_account.rb

@@ -0,0 +1,24 @@
+require 'helper'
+
+class PwnedTest < Test::Unit::TestCase
+
+  def test_my_email_is_found
+    assert_not_nil HaveIBeenPwned.pwned_account('john@gmail.com') # just a very generic email that does fail
+  end
+
+  def test_my_email_is_not_found
+    assert_nil HaveIBeenPwned.pwned_account('major.monkey.ha.not.been.hacked@gmail.com')
+  end
+
+  def test_bad_api_key_gives_error
+    assert_raise("UncaughtThrowError") {
+      assert_equal false, HaveIBeenPwned.pwned_account('major.monkey.ha.not.been.hacked@gmail.com', 'not_a_valid_api_key')
+    }    
+  end
+
+  def test_no_password_at_all_raises
+    assert_raise("ArgumentError") {
+      HaveIBeenPwned.pwned
+    }
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: have-i-been-pwned
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Dale Myszewski
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.17.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.17.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -116,7 +116,8 @@ files:
 - lib/have-i-been-pwned.rb
 - lib/version.rb
 - test/helper.rb
-- test/test_have_i_been_pwned.rb
+- test/test_have_i_been_pwned_account.rb
+- test/test_have_i_been_pwned_password.rb
 - test/test_version.rb
 homepage: https://github.com/Dales-Lab/haveibeenpwned-ruby-sdk
 licenses:
@@ -137,7 +138,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.4
+rubyforge_project: 
+rubygems_version: 2.7.7
 signing_key: 
 specification_version: 4
 summary: Check to see if your passwords are safe