heroku-bouncer 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 561e884f024ac6a325bb3b923da047eb4e1093a2
-  data.tar.gz: 693c9b580e04067aff895f73b74124b55ca9c96c
+  metadata.gz: 828f65b68c8ed42f82cf523ab3748a16263fe5d2
+  data.tar.gz: 6b53e6ef3efb5f53bd35af410e0fd0501a3a9722
 SHA512:
-  metadata.gz: f4191578a75d18970863267576af3f1427d36d8663231ea1b86bf5f6fa74cfb5ca72dc1034c04729ebcd1f2c4cd6dd9c9e61e35d3da521bc087fc18c12211896
-  data.tar.gz: d3089222610ba125714dd08f1b9457ad9727a7c9bfabcaa25ea3adcdc4386036381072e6fc59a20a3cb5612ac73cba2d7560df104762fcf620aa1f6998246d35
+  metadata.gz: 0b317ac658086d8ebe4157ab5b85b93fd23b61569d0ac5b41c7426a9514c4b490d06ffabc2daed835a40fcd2a33bd33812afe95d4d0843b6438d6d17b0894c4a
+  data.tar.gz: 12fd8a29894b24568fbfd0ed6d236b640cb4658084692e61f5900e7dc32ca69ebab3570d3760c76cef8ddf3f88ca6b45d27d6cbb6ef0fb5a6af75451b41d9c44

data/lib/heroku/bouncer/middleware.rb

@@ -80,7 +80,7 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
     store_write(:expires_at, Time.now.to_i + 3600 * 8)
 
     return_to = store_delete(:return_to) || '/'
-    redirect to(enforce_host(request.host, return_to))
+    redirect to(enforce_host(request.scheme, request.host, return_to))
   end
 
   # something went wrong
@@ -109,7 +109,9 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
 
   # login, setting the URL to return to
   get '/auth/login' do
-    store_write(:return_to, params['return_to'])
+    if params['return_to'] && params['return_to'].length <= 255
+      store_write(:return_to, params['return_to'])
+    end
     redirect to('/auth/heroku')
   end
 
@@ -201,9 +203,10 @@ private
   end
 
   # Prevent open redirect vulnerabilities by setting the current host
-  def enforce_host(host, url)
+  def enforce_host(scheme, host, url)
     return_to = URI.parse(url) rescue '/'
-    return_to.host = request.host
+    return_to.scheme = scheme
+    return_to.host = host
     return_to.to_s
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heroku-bouncer
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Jonathan Dance
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-20 00:00:00.000000000 Z
+date: 2014-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-heroku