heroic-sns 1.1.3 → 1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: eee6831c04d011c9161d134748559f3eafb8be77
-  data.tar.gz: bfc5b96361e45564efc1855dd9681fa1a7ac7feb
+SHA256:
+  metadata.gz: 061bb44887daecae4a05c0a3c75debc2d59c55b7e0a733bc783cc665de9d7a3f
+  data.tar.gz: e0f2aed506a0ebae75e408376a2c102f7825a6a9123f529286be92d6535c7416
 SHA512:
-  metadata.gz: 25215f8ef74c6186384e12a2ec3d3198f6b5a8cec196f7e71eb42e4fd5d337d46d8e447d6d93b964c600b3967cf2d20cc48e5d02d5dd815f2f89be4ae2971966
-  data.tar.gz: 2b411b716ec99e1de2a3a9f862f77588dd367c92d33b09c9f38f3863f6cf013ccbea283c477bddfd7c7eb66ac4639bae5a393bfb2e807ad68057fcddc991d480
+  metadata.gz: 2007d432d0585597cb35e35cb68af3c82c9d9210b31ec227d432b481228973e25aa8c17410ac9ca6ea487cec698ea56842986c42964f88e6c3cd7c5a22ad6dba
+  data.tar.gz: d6c83fd48d0f59bc5194bca39773c24eae90c34384251dcd5af8ee8656d4f9794d6e08154c40d39327b91d4713ef9370dccd8873d0d274d63ce5943af898ccec

data/.gitignore

@@ -3,3 +3,4 @@
 /pkg
 /tmp
 /Gemfile.lock
+/gemfiles/*.lock

data/.travis.yml

@@ -1,23 +1,22 @@
 language: ruby
 rvm:
-  - "2.3.1"
-  - "2.2.5"
-  - "2.1.9"
-  - "2.0.0"
-  - "1.9.3"
-  - "1.8.7"
+  - "2.7"
+  - "2.6"
+  - "2.5"
+  - "2.4"
+  - "2.3"
+  - "2.2"
+  - "2.1"
+  - "2.0"
 gemfile:
+  - Gemfile
   - gemfiles/Gemfile.rack-1.x
-  - gemfiles/Gemfile.rack-2.x
 before_install:
   - gem update bundler
 matrix:
   exclude:
-    - rvm: 2.1.9
-      gemfile: gemfiles/Gemfile.rack-2.x
-    - rvm: 2.0.0
-      gemfile: gemfiles/Gemfile.rack-2.x
-    - rvm: 1.9.3
-      gemfile: gemfiles/Gemfile.rack-2.x
-    - rvm: 1.8.7
-      gemfile: gemfiles/Gemfile.rack-2.x
+    - { rvm: "2.1", gemfile: Gemfile }
+    - { rvm: "2.0", gemfile: Gemfile }
+  include:
+    - { rvm: "1.8.7", dist: precise, gemfile: gemfiles/Gemfile.ruby-1.8 }
+    - { rvm: "1.9.3", dist: trusty,  gemfile: gemfiles/Gemfile.rack-1.x }

data/CHANGELOG.md

@@ -1,11 +1,17 @@
+### 1.2
+
+* Add Ruby 2.4, 2.5, 2.6. 2.7 to the Travis CI tests
+* Relax json gem dependency - [@biinari]
+* Stricter signing URL check - [@biinari]
+* Show age when raising 'time is in the future' error - [@mamedov]
+
 ### 1.1.3 (July 7, 2016)
 
 * Relax rack version requirement to allow usage with rack 2.x - [@fschwahn]
 
 ### 1.1.2 (March 23, 2016)
 
-* Rewind the request body, in case the application wants to read it again.
-  [@cobbr2]
+* Rewind the request body, in case the application wants to read it again - [@cobbr2]
 
 ### 1.1.1 (August 9, 2013)
 
@@ -24,7 +30,11 @@
 
 * Initial public release - [@benzado]
 
-[@benzado]: http://github.com/benzado
-[@sbeckeriv]: http://github.com/sbeckeriv
-[@dblock]: http://github.com/dblock
-[@speedmanly]: http://github.com/speedmanly
+[@benzado]: https://github.com/benzado
+[@biinari]: https://github.com/biinari
+[@cobbr2]: https://github.com/cobbr2
+[@dblock]: https://github.com/dblock
+[@fschwahn]: https://github.com/fschwahn
+[@mamedov]: https://github.com/mamedov
+[@sbeckeriv]: https://github.com/sbeckeriv
+[@speedmanly]: https://github.com/speedmanly

data/Gemfile

@@ -2,4 +2,6 @@ source "http://rubygems.org"
 
 gemspec
 
-gem "rake", '~> 10.3'
+gem "rake"
+gem "rack", "~> 2.0"
+gem "test-unit", "~> 3.3"

data/README.md

@@ -163,7 +163,7 @@ SNS notification.
 
 ## Copyright and License
 
-Copyright 2013, Heroic Software Inc and Contributors.
+Copyright 2013, 2016, 2020, Benjamin Ragheb and Contributors.
 
 This project [is licensed under the Apache license](LICENSE).
 

data/gemfiles/Gemfile.rack-1.x

@@ -4,3 +4,4 @@ gemspec :path => ".."
 
 gem "rake", "~> 10.3"
 gem "rack", "~> 1.0"
+gem "json", "~> 1.7"

data/gemfiles/Gemfile.ruby-1.8

@@ -0,0 +1,8 @@
+source "http://rubygems.org"
+
+gemspec :path => ".."
+
+gem "rake", "~> 10.3"
+gem "rack", "~> 1.0"
+gem "json", "~> 1.7"
+gem "test-unit", "1.2.3"

data/heroic-sns.gemspec

@@ -27,7 +27,7 @@ EOD
   s.platform = Gem::Platform::RUBY
   s.required_ruby_version = '>= 1.8.7'
   s.add_development_dependency 'rdoc', '~> 4.0'
-  s.add_development_dependency 'test-unit', '1.2.3'
+  s.add_development_dependency 'test-unit', '>= 1.2.3'
   s.add_runtime_dependency 'rack', '>= 1.4'
-  s.add_runtime_dependency 'json', '~> 1.7'
+  s.add_runtime_dependency 'json', '>= 1.7'
 end

data/lib/heroic/sns/endpoint.rb

@@ -115,10 +115,10 @@ module Heroic
           message.verify!
           case message.type
           when 'SubscriptionConfirmation'
-            open(message.subscribe_url) if @auto_confirm
+            URI.parse(message.subscribe_url).open if @auto_confirm
             return OK_RESPONSE unless @auto_confirm.nil?
           when 'UnsubscribeConfirmation'
-            open(message.subscribe_url) if @auto_resubscribe
+            URI.parse(message.subscribe_url).open if @auto_resubscribe
             return OK_RESPONSE unless @auto_resubscribe.nil?
           end
           env['sns.message'] = message
@@ -139,7 +139,7 @@ module Heroic
           begin
             message = Message.new(env['rack.input'].read)
             message.verify!
-            open(message.unsubscribe_url)
+            URI.parse(message.unsubscribe_url).open
           rescue => e
             raise Error.new("error handling off-topic notification: #{e.message}", message)
           end

data/lib/heroic/sns/message.rb

@@ -1,5 +1,6 @@
 require 'json'
 require 'base64'
+require 'open-uri'
 require 'heroic/lru_cache'
 
 module Heroic
@@ -10,7 +11,7 @@ module Heroic
 
     CERTIFICATE_CACHE = Heroic::LRUCache.new(MAXIMUM_ALLOWED_CERTIFICATES) do |cert_url|
       begin
-        cert_data = open(cert_url)
+        cert_data = URI.parse(cert_url).open
         OpenSSL::X509::Certificate.new(cert_data.read)
       rescue OpenSSL::X509::CertificateError => e
         raise SNS::Error.new("unable to parse signing certificate: #{e.message}; URL: #{cert_url}")
@@ -19,6 +20,8 @@ module Heroic
       end
     end
 
+    VALID_AWS_URL_PATTERN = %r{\Ahttps://sns\.[a-z]{2}(?:-gov)?-(?:north|south|east|west|central){1,2}-\d+\.amazonaws\.com(?:\.cn)?/}
+
     # Encapsulates an SNS message. Since Endpoint takes care of authenticating
     # the message, most of the time you will simply be interested in retrieving
     # the +subject+ and +body+ from the message and acting on it.
@@ -120,12 +123,12 @@ module Heroic
       # See: http://docs.aws.amazon.com/sns/latest/gsg/SendMessageToHttp.verify.signature.html
       def verify!
         age = Time.now - timestamp
-        raise Error.new("timestamp is in the future", self) if age < 0
+        raise Error.new("timestamp is in the future, age: #{age}", self) if age < 0
         raise Error.new("timestamp is too old", self) if age > MAXIMUM_ALLOWED_AGE
         if signature_version != '1'
           raise Error.new("unknown signature version: #{signature_version}", self)
         end
-        if signing_cert_url !~ %r[^https://.*amazonaws\.com/]
+        if signing_cert_url !~ VALID_AWS_URL_PATTERN
           raise Error.new("signing certificate is not from amazonaws.com", self)
         end
         text = string_to_sign # will warn of invalid Type

data/lib/heroic/sns/version.rb

@@ -1,5 +1,5 @@
 module Heroic
   module SNS
-    VERSION = '1.1.3'
+    VERSION = '1.2'
   end
 end

data/test/fixtures/aws-sns-endpoints.txt

@@ -0,0 +1,27 @@
+sns.af-south-1.amazonaws.com
+sns.ap-east-1.amazonaws.com
+sns.ap-northeast-1.amazonaws.com
+sns.ap-northeast-2.amazonaws.com
+sns.ap-northeast-3.amazonaws.com
+sns.ap-south-1.amazonaws.com
+sns.ap-southeast-1.amazonaws.com
+sns.ap-southeast-2.amazonaws.com
+sns.ca-central-1.amazonaws.com
+sns.cn-north-1.amazonaws.com
+sns.cn-northwest-1.amazonaws.com
+sns.eu-central-1.amazonaws.com
+sns.eu-north-1.amazonaws.com
+sns.eu-south-1.amazonaws.com
+sns.eu-west-1.amazonaws.com
+sns.eu-west-2.amazonaws.com
+sns.eu-west-3.amazonaws.com
+sns.me-south-1.amazonaws.com
+sns.sa-east-1.amazonaws.com
+sns.us-east-1.amazonaws.com
+sns.us-east-2.amazonaws.com
+sns.us-west-1.amazonaws.com
+sns.us-west-2.amazonaws.com
+sns.us-gov-east-1.amazonaws.com
+sns.us-gov-west-1.amazonaws.com
+sns.cn-north-1.amazonaws.com.cn
+sns.cn-northwest-1.amazonaws.com.cn

data/test/helper.rb

@@ -5,30 +5,34 @@
 
 module Heroic
   module SNS
+    # Use a fake certificate cache so tests aren't dependent on
+    # network access, or the fact that the certificate is also fake.
+    CERTIFICATE_CACHE = Class.new do
+      def cert_data
+        File.read('test/fixtures/sns.crt')
+      end
 
-    TEST_CERT_URL = 'https://sns.test.amazonaws.com/self-signed.pem'
-    TEST_CERT_KEY = OpenSSL::PKey::RSA.new(File.read('test/fixtures/sns.key'))
+      def get(_)
+        @cert ||= OpenSSL::X509::Certificate.new(cert_data)
+      end
+    end.new
 
-    begin
-      # Insert the certificate in the cache so that these tests aren't dependent
-      # on network access (or the fact that the certificate is fake).
-      cert_data = File.read('test/fixtures/sns.crt')
-      CERTIFICATE_CACHE.put(TEST_CERT_URL, OpenSSL::X509::Certificate.new(cert_data))
-    end
+    TEST_CERT_URL = 'https://sns.xx-east-1.amazonaws.com/self-signed.pem'
+    TEST_CERT_KEY = OpenSSL::PKey::RSA.new(File.read('test/fixtures/sns.key'))
 
     class Message
-
       def update_timestamp!(t = Time.now)
         @msg['Timestamp'] = t.utc.xmlschema(3)
       end
 
+      def update_signing_cert_url!(url = nil)
+        @msg['SigningCertURL'] = url || TEST_CERT_URL
+      end
+
       def sign!
-        @msg['SigningCertURL'] = TEST_CERT_URL
         signature = TEST_CERT_KEY.sign(OpenSSL::Digest::SHA1.new, string_to_sign)
         @msg['Signature'] = Base64::encode64(signature)
       end
-
     end
-
   end
 end

data/test/test_endpoint.rb

@@ -10,6 +10,7 @@ class EndpointTest < Test::Unit::TestCase
     json = File.read("test/fixtures/#{name}.json")
     @msg = Heroic::SNS::Message.new(json)
     @msg.update_timestamp!
+    @msg.update_signing_cert_url!
     @msg.sign!
     @env = {
       'HTTP_X_AMZ_SNS_MESSAGE_TYPE' => @msg.type,

data/test/test_message.rb

@@ -3,11 +3,11 @@ require 'heroic/sns'
 require 'helper'
 
 class MessageTest < Test::Unit::TestCase
-
-  def sns(name, timestamp = Time.now)
+  def sns(name, options = {})
     json = File.read("test/fixtures/#{name}.json")
     msg = Heroic::SNS::Message.new(json)
-    msg.update_timestamp!(timestamp)
+    msg.update_timestamp!(options[:timestamp] || Time.now)
+    msg.update_signing_cert_url!(options[:signing_cert_url])
     msg.sign!
     return msg
   end
@@ -51,13 +51,41 @@ class MessageTest < Test::Unit::TestCase
     end
   end
 
+  def test_untrusted_cert_url_s3
+    cert_url = 'https://sns.s3.amazonaws.com/self-signed.pem'
+    msg = sns("notification", :signing_cert_url => cert_url)
+    assert_equal cert_url, msg.signing_cert_url
+    assert_raises Heroic::SNS::Error do
+      msg.verify!
+    end
+  end
+
+  def test_untrusted_cert_url_other
+    cert_url = 'https://example.com/sns.us-east-1.amazonaws.com/self-signed.pem'
+    msg = sns("subscription", :signing_cert_url => cert_url)
+    assert_equal cert_url, msg.signing_cert_url
+    assert_raises Heroic::SNS::Error do
+      msg.verify!
+    end
+  end
+
+  # Generate tests for every known AWS SNS endpoint.
+  # https://docs.aws.amazon.com/general/latest/gr/sns.html
+  File.read('test/fixtures/aws-sns-endpoints.txt').split(/\n/).each do |domain|
+    define_method("test_trusted_cert_url_#{domain}") do
+      cert_url = "https://#{domain}/certificate.pem"
+      msg = sns("notification", :signing_cert_url => cert_url)
+      assert_equal cert_url, msg.signing_cert_url
+      assert_nothing_raised { msg.verify! }
+    end
+  end
+
   def test_expired
     t = Time.utc(1984, 5)
-    msg = sns("notification", t)
+    msg = sns("notification", :timestamp => t)
     assert_equal t, msg.timestamp
     assert_raises Heroic::SNS::Error do
       msg.verify!
     end
   end
-
 end

metadata

@@ -1,69 +1,69 @@
 --- !ruby/object:Gem::Specification
 name: heroic-sns
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: '1.2'
 platform: ruby
 authors:
 - Benjamin Ragheb
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-13 00:00:00.000000000 Z
+date: 2020-06-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '4.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '4.0'
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.3
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.4'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.7'
 description: |
@@ -78,8 +78,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .travis.yml
+- ".gitignore"
+- ".travis.yml"
 - CHANGELOG.md
 - Gemfile
 - LICENSE
@@ -89,13 +89,14 @@ files:
 - demo/config.ru
 - demo/demo.erb
 - gemfiles/Gemfile.rack-1.x
-- gemfiles/Gemfile.rack-2.x
+- gemfiles/Gemfile.ruby-1.8
 - heroic-sns.gemspec
 - lib/heroic/lru_cache.rb
 - lib/heroic/sns.rb
 - lib/heroic/sns/endpoint.rb
 - lib/heroic/sns/message.rb
 - lib/heroic/sns/version.rb
+- test/fixtures/aws-sns-endpoints.txt
 - test/fixtures/notification.json
 - test/fixtures/sns.crt
 - test/fixtures/sns.key
@@ -115,17 +116,16 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: 1.8.7
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.0.14.1
+rubygems_version: 3.0.8
 signing_key: 
 specification_version: 4
 summary: Lightweight Rack middleware for AWS SNS endpoints

data/gemfiles/Gemfile.rack-2.x

@@ -1,5 +0,0 @@
-source "http://rubygems.org"
-
-gemspec path: ".."
-
-gem "rack", "~> 2.0"