heroku-bouncer 0.4.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. checksums.yaml +4 -4
  2. data/lib/heroku/bouncer/middleware.rb +10 -1
  3. metadata +31 -31
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 03abaeaa8715d6bcd3f72fad85fa58dd8f0645c0
4
- data.tar.gz: 0debdadff5ca498f87a3f2d90a37b80dd00c84ce
3
+ metadata.gz: 561e884f024ac6a325bb3b923da047eb4e1093a2
4
+ data.tar.gz: 693c9b580e04067aff895f73b74124b55ca9c96c
5
5
  SHA512:
6
- metadata.gz: e1d4d8f927f12a89f3d4f2d6855129a14ac623a08b99e2e1cb81d9d82810e57b6cf727fdb99f3398696f19b3ba827f96af8e817c230f70a56d9dd5db80fe85ab
7
- data.tar.gz: c018b6dc635a21cfeb88da1fb57869c40e8ef8d5eaa411b091ffea5fe0e2f3e453e110255d8777d89d91021c597e7fd03dfdba852c2692b599ad7d13f24e9de4
6
+ metadata.gz: f4191578a75d18970863267576af3f1427d36d8663231ea1b86bf5f6fa74cfb5ca72dc1034c04729ebcd1f2c4cd6dd9c9e61e35d3da521bc087fc18c12211896
7
+ data.tar.gz: d3089222610ba125714dd08f1b9457ad9727a7c9bfabcaa25ea3adcdc4386036381072e6fc59a20a3cb5612ac73cba2d7560df104762fcf620aa1f6998246d35
data/lib/heroku/bouncer/middleware.rb CHANGED
@@ -78,7 +78,9 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
78
78
  store_write(@session_sync_nonce.to_sym, session_nonce_cookie) if @session_sync_nonce
79
79
  store_write(:token, token) if @expose_token
80
80
  store_write(:expires_at, Time.now.to_i + 3600 * 8)
81
- redirect to(store_delete(:return_to) || '/')
81
+
82
+ return_to = store_delete(:return_to) || '/'
83
+ redirect to(enforce_host(request.host, return_to))
82
84
  end
83
85
 
84
86
  # something went wrong
@@ -198,4 +200,11 @@ private
198
200
  end
199
201
  end
200
202
 
203
+ # Prevent open redirect vulnerabilities by setting the current host
204
+ def enforce_host(host, url)
205
+ return_to = URI.parse(url) rescue '/'
206
+ return_to.host = request.host
207
+ return_to.to_s
208
+ end
209
+
201
210
  end
metadata CHANGED
@@ -1,153 +1,153 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: heroku-bouncer
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.4.0
4
+ version: 0.4.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Jonathan Dance
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2014-01-29 00:00:00.000000000 Z
11
+ date: 2014-03-20 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: omniauth-heroku
15
15
  requirement: !ruby/object:Gem::Requirement
16
16
  requirements:
17
- - - '>='
17
+ - - ">="
18
18
  - !ruby/object:Gem::Version
19
19
  version: 0.1.0
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
- - - '>='
24
+ - - ">="
25
25
  - !ruby/object:Gem::Version
26
26
  version: 0.1.0
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: sinatra
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
- - - ~>
31
+ - - "~>"
32
32
  - !ruby/object:Gem::Version
33
33
  version: '1.0'
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
- - - ~>
38
+ - - "~>"
39
39
  - !ruby/object:Gem::Version
40
40
  version: '1.0'
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: faraday
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
- - - ~>
45
+ - - "~>"
46
46
  - !ruby/object:Gem::Version
47
47
  version: '0.8'
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
- - - ~>
52
+ - - "~>"
53
53
  - !ruby/object:Gem::Version
54
54
  version: '0.8'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: rack
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
- - - ~>
59
+ - - "~>"
60
60
  - !ruby/object:Gem::Version
61
61
  version: '1.0'
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
- - - ~>
66
+ - - "~>"
67
67
  - !ruby/object:Gem::Version
68
68
  version: '1.0'
69
69
  - !ruby/object:Gem::Dependency
70
70
  name: rake
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
- - - '>='
73
+ - - ">="
74
74
  - !ruby/object:Gem::Version
75
75
  version: '0'
76
76
  type: :development
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
- - - '>='
80
+ - - ">="
81
81
  - !ruby/object:Gem::Version
82
82
  version: '0'
83
83
  - !ruby/object:Gem::Dependency
84
84
  name: minitest
85
85
  requirement: !ruby/object:Gem::Requirement
86
86
  requirements:
87
- - - ~>
87
+ - - "~>"
88
88
  - !ruby/object:Gem::Version
89
89
  version: '5.0'
90
90
  type: :development
91
91
  prerelease: false
92
92
  version_requirements: !ruby/object:Gem::Requirement
93
93
  requirements:
94
- - - ~>
94
+ - - "~>"
95
95
  - !ruby/object:Gem::Version
96
96
  version: '5.0'
97
97
  - !ruby/object:Gem::Dependency
98
98
  name: minitest-spec-context
99
99
  requirement: !ruby/object:Gem::Requirement
100
100
  requirements:
101
- - - '>='
101
+ - - ">="
102
102
  - !ruby/object:Gem::Version
103
103
  version: '0'
104
104
  type: :development
105
105
  prerelease: false
106
106
  version_requirements: !ruby/object:Gem::Requirement
107
107
  requirements:
108
- - - '>='
108
+ - - ">="
109
109
  - !ruby/object:Gem::Version
110
110
  version: '0'
111
111
  - !ruby/object:Gem::Dependency
112
112
  name: rack-test
113
113
  requirement: !ruby/object:Gem::Requirement
114
114
  requirements:
115
- - - '>='
115
+ - - ">="
116
116
  - !ruby/object:Gem::Version
117
117
  version: '0'
118
118
  type: :development
119
119
  prerelease: false
120
120
  version_requirements: !ruby/object:Gem::Requirement
121
121
  requirements:
122
- - - '>='
122
+ - - ">="
123
123
  - !ruby/object:Gem::Version
124
124
  version: '0'
125
125
  - !ruby/object:Gem::Dependency
126
126
  name: mocha
127
127
  requirement: !ruby/object:Gem::Requirement
128
128
  requirements:
129
- - - '>='
129
+ - - ">="
130
130
  - !ruby/object:Gem::Version
131
131
  version: '0'
132
132
  type: :development
133
133
  prerelease: false
134
134
  version_requirements: !ruby/object:Gem::Requirement
135
135
  requirements:
136
- - - '>='
136
+ - - ">="
137
137
  - !ruby/object:Gem::Version
138
138
  version: '0'
139
139
  - !ruby/object:Gem::Dependency
140
140
  name: delorean
141
141
  requirement: !ruby/object:Gem::Requirement
142
142
  requirements:
143
- - - '>='
143
+ - - ">="
144
144
  - !ruby/object:Gem::Version
145
145
  version: '0'
146
146
  type: :development
147
147
  prerelease: false
148
148
  version_requirements: !ruby/object:Gem::Requirement
149
149
  requirements:
150
- - - '>='
150
+ - - ">="
151
151
  - !ruby/object:Gem::Version
152
152
  version: '0'
153
153
  description: ID please.
@@ -158,15 +158,15 @@ extensions: []
158
158
  extra_rdoc_files:
159
159
  - README.md
160
160
  files:
161
- - lib/heroku/bouncer/lockbox.rb
162
- - lib/heroku/bouncer/decrypted_hash.rb
161
+ - Gemfile
162
+ - README.md
163
+ - Rakefile
164
+ - lib/heroku/bouncer.rb
163
165
  - lib/heroku/bouncer/builder.rb
166
+ - lib/heroku/bouncer/decrypted_hash.rb
164
167
  - lib/heroku/bouncer/json_parser.rb
168
+ - lib/heroku/bouncer/lockbox.rb
165
169
  - lib/heroku/bouncer/middleware.rb
166
- - lib/heroku/bouncer.rb
167
- - README.md
168
- - Gemfile
169
- - Rakefile
170
170
  homepage: https://github.com/heroku/heroku-bouncer
171
171
  licenses:
172
172
  - MIT
@@ -177,17 +177,17 @@ require_paths:
177
177
  - lib
178
178
  required_ruby_version: !ruby/object:Gem::Requirement
179
179
  requirements:
180
- - - '>='
180
+ - - ">="
181
181
  - !ruby/object:Gem::Version
182
182
  version: '0'
183
183
  required_rubygems_version: !ruby/object:Gem::Requirement
184
184
  requirements:
185
- - - '>='
185
+ - - ">="
186
186
  - !ruby/object:Gem::Version
187
187
  version: '0'
188
188
  requirements: []
189
189
  rubyforge_project:
190
- rubygems_version: 2.0.14
190
+ rubygems_version: 2.2.2
191
191
  signing_key:
192
192
  specification_version: 4
193
193
  summary: Rapidly add Heroku OAuth to your Ruby app.