hestia 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 10feace28dda56911b32013d3fb9b41c85e3b101
-  data.tar.gz: 4e8e5c002fe8102089b2c8f1745b96d2a235cde0
+  metadata.gz: b0f6ffbc2dc06c7139b927a99e5f477395d1802b
+  data.tar.gz: 414c8a89a1886f14f86f10431b2a4909ce07ff46
 SHA512:
-  metadata.gz: 83cc7fd6f3d6ec36b8c14558254b9b35e2b9825e1fb12c2cbd97067139de47ab8c8722cb016232b5a61dc89e1306d0deeb9414246d548e8484a5082b5eb3a916
-  data.tar.gz: 0f252f5d0324503808dfd62da05af883b94bff63d7f4eeab79120e72dd3616fb919c326c4d24e17b479183f4f0e3a206a4ec4966790c8413bf635ef70f8ac32a
+  metadata.gz: 3ec6e236bcda0203191b22bd4e5535684365c6bbf2d564a26e8126191a333fb6c419f5f6f03dbaddbfa3d0bb5b6e1cfb9dbab4a2985fa60c039ff342dc097cc0
+  data.tar.gz: 7dfe2db894bf9c5f194319f0a3a1d95851b932a0434fa7630bed2c9da23e35f9b6cbe0bc35aa9bbcf070f583b4a563f81fbc864f3abc262b0c4b310c216e6c67

data/.travis.yml

@@ -8,3 +8,11 @@ gemfile:
   - Gemfile.rails3
   - Gemfile.rails41
   - Gemfile.rails42
+  - Gemfile.rails50
+  - Gemfile.rails51
+matrix:
+  allow_failures:
+    - gemfile: Gemfile.rails50
+      rvm: 2.1
+    - gemfile: Gemfile.rails51
+      rvm: 2.1

data/Gemfile.rails50

@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in hestia.gemspec
+gemspec
+
+gem "actionpack", "~> 5.0"

data/Gemfile.rails51

@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in hestia.gemspec
+gemspec
+
+gem "actionpack", "~> 5.1"

data/README.md

@@ -37,6 +37,8 @@ We currently support (& test against):
 * Rails 3.2
 * Rails 4.1
 * Rails 4.2
+* Rails 5.0
+* Rails 5.1
 
 Pull requests always welcome to support other versions!
 
@@ -61,7 +63,7 @@ You should already have `Rails.application.config.secret_token` set to a value (
 
 *You can also set `config.deprecated_secret_token` to an array of strings to allow incoming cookies to be valid when signed with any of the secrets.*
 
-### Rails 4.1, 4.2
+### Rails 4.1, 4.2, 5.0, 5.1
 
 Following the instructions for Rails 3.2 should work, but make sure you haven't set `config.secret_key_base` to a value otherwise Rails will take over and upgrade your cookies from signed to encrypted ones.
 

data/hestia.gemspec

@@ -21,7 +21,7 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = '>= 2.0'
 
   spec.add_runtime_dependency "rack"
-  spec.add_runtime_dependency "actionpack", ">= 3.2.21", "< 5.0.0"
+  spec.add_runtime_dependency "actionpack", ">= 3.2.21", "< 5.2.0"
 
   spec.add_development_dependency "bundler", "~> 1.7"
   spec.add_development_dependency "rake", "~> 10.0"

data/lib/hestia.rb

@@ -2,4 +2,10 @@ module Hestia
   autoload :MessageMultiVerifier, "hestia/message_multi_verifier"
   autoload :SignedCookieJarExtension, "hestia/signed_cookie_jar_extension"
   autoload :VERSION, "hestia/version"
+
+  def self.check_secret_key_base
+    if Rails.application.config.respond_to?(:secret_key_base) && Rails.application.config.secret_key_base
+      fail "Having `config.secret_token' and `config.secret_key_base' defined is not allowed in Hestia. Please refer to Hestia's Readme for more information."
+    end
+  end
 end

data/lib/hestia/message_multi_verifier.rb

@@ -1,4 +1,5 @@
 require "active_support/message_verifier"
+require "active_support/message_encryptor"
 
 module Hestia
   class MessageMultiVerifier
@@ -40,6 +41,10 @@ module Hestia
     # Returns deserialized value
     # Raises ActiveSupport::MessageVerifier::InvalidSignature
     def verify(signed_message)
+      verified(signed_message)
+    end
+
+    def verified(signed_message)
       errored_verifier_count = 0
 
       # Make sure we check *all* verifiers, every time we're called, to prevent timing attacks.

data/lib/hestia/railtie.rb

@@ -11,13 +11,11 @@ module Hestia
       when 3
         Hestia::SignedCookieJarExtension::ActionPack3
       when 4
-        if Rails.application.config.respond_to?(:secret_key_base) && Rails.application.config.secret_key_base
-          fail "Having `config.secret_token' and `config.secret_key_base' defined is not allowed in Hestia. Please refer to Hestia's Readme for more information."
-        end
-
+        Hestia.check_secret_key_base
         Hestia::SignedCookieJarExtension::ActionPack4
-      else
-        raise "Unsupported version of action_pack: #{ActionPack::VERSION::STRING.inspect}"
+      when 5
+        Hestia.check_secret_key_base
+        Hestia::SignedCookieJarExtension::ActionPack5
       end
 
       ActionDispatch::Cookies::SignedCookieJar.prepend(extension)

data/lib/hestia/signed_cookie_jar_extension.rb

@@ -2,5 +2,6 @@ module Hestia
   module SignedCookieJarExtension
     autoload :ActionPack3, "hestia/signed_cookie_jar_extension/action_pack_3"
     autoload :ActionPack4, "hestia/signed_cookie_jar_extension/action_pack_4"
+    autoload :ActionPack5, "hestia/signed_cookie_jar_extension/action_pack_5"
   end
 end

data/lib/hestia/signed_cookie_jar_extension/action_pack_5.rb

@@ -0,0 +1,41 @@
+require 'active_support/version'
+
+module Hestia
+  module SignedCookieJarExtension
+    module ActionPack5
+      # Public: overridden #initialize method
+      #
+      # In rails, `secrets' will be given the value of `Rails.application.config.secret_token'. That's the current secret token.
+      # This also reads from `Rails.application.config.deprecated_secret_token` for deprecated token(s) to use. It can be undefined, a
+      # string or an array of string.
+      #
+      # parent_jar [ActionDispatch::Cookies] the parent jar creating this signed cookie jar
+      # secret [String] current secret token. Used to verify & sign cookies.
+      #
+      def initialize(parent_jar)
+        super
+
+        # Find the deprecated secrets, if there are any
+        deprecated_secrets = if Rails.application.config.respond_to?(:deprecated_secret_token)
+          # This could be a single string!
+          Array(Rails.application.config.deprecated_secret_token)
+        else
+          []
+        end
+
+        # Grab the `config.secret_token` value from its generator
+        active_secret = key_generator.generate_key(request.signed_cookie_salt)
+
+        # Take the deprecated secrets through the same generator code
+        deprecated_secrets.map do |secret|
+          ActiveSupport::LegacyKeyGenerator.new(secret).generate_key(request.signed_cookie_salt)
+        end
+
+        serializer = ActiveSupport.version.to_s > "4.1" ? ActiveSupport::MessageEncryptor::NullSerializer : ActionDispatch::Cookies::NullSerializer
+
+        # Finally, override @verifier with our own multi verifier containing all the secrets
+        @verifier = Hestia::MessageMultiVerifier.new(current_secret: active_secret, deprecated_secrets: deprecated_secrets, options: {serializer: serializer})
+      end
+    end
+  end
+end

data/lib/hestia/version.rb

@@ -1,3 +1,3 @@
 module Hestia
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/spec/hestia/message_multi_verifier_spec.rb

@@ -1,4 +1,5 @@
 require_relative "../spec_helper"
+require "action_pack/version"
 
 module Hestia
   describe MessageMultiVerifier do
@@ -91,11 +92,13 @@ module Hestia
         multi_verifier.verify(legacy_cookie).must_equal "cookie dough"
       end
 
-      it "verifies a message of `nil' successfully" do
-        nil_cookie = singular_verifier.generate(nil)
+      if ActionPack::VERSION::MAJOR < 5
+        it "verifies a message of `nil' successfully" do
+          nil_cookie = singular_verifier.generate(nil)
 
-        singular_verifier.verify(nil_cookie).must_equal(nil)
-        multi_verifier.verify(nil_cookie).must_equal(nil)
+          singular_verifier.verify(nil_cookie).must_equal(nil)
+          multi_verifier.verify(nil_cookie).must_equal(nil)
+        end
       end
 
       it "verifies successfully when using custom digest" do

data/spec/hestia/signed_cookie_jar_extension/action_pack_5_spec.rb

@@ -0,0 +1,103 @@
+require_relative "../../spec_helper"
+require_relative "../../support/fake_rails"
+require_relative "../../support/fake_cookie_jar"
+require "action_dispatch/middleware/cookies"
+
+# Call our railtie block to setup the initializers array
+require "hestia/railtie"
+
+module Hestia
+  if ActionPack::VERSION::MAJOR == 5
+    describe SignedCookieJarExtension::ActionPack5 do
+      before do
+        Rails.clean
+        load_railtie
+      end
+
+      it "is prepended into signed cookie jar ancestors" do
+        ActionDispatch::Cookies::SignedCookieJar.ancestors.first.must_equal SignedCookieJarExtension::ActionPack5
+      end
+
+      it "defines initialize" do
+        # #initialize doesn't show up in {instance_,}methods({false,true}) for some reason, so do this instead
+        # This will throw a NameError if we don't define it
+        SignedCookieJarExtension::ActionPack5.instance_method(:initialize)
+      end
+
+      describe "signed cookie jar instance with no deprecated token" do
+        before do
+          @secret = "a" * 30
+          @parent_jar = FakeCookieJar.new(@secret)
+          @jar = ActionDispatch::Cookies::SignedCookieJar.new(@parent_jar)
+        end
+
+        it "calls the original initialize method" do
+          @jar.instance_variable_get(:@parent_jar).must_equal @parent_jar
+        end
+
+        describe "validator" do
+          before do
+            @verifier = @jar.instance_variable_get(:@verifier)
+          end
+          it "is a multi message validator" do
+            @verifier.must_be_kind_of(MessageMultiVerifier)
+          end
+
+          it "has the correct secrets stored" do
+            secrets = @verifier.instance_variable_get(:@verifiers).map { |x| x.instance_variable_get(:@secret) }
+            secrets.must_equal [@secret]
+          end
+        end
+      end
+
+      describe "signed cookie jar instance with deprecated token" do
+        before do
+          @secret = "a" * 30
+          @parent_jar = FakeCookieJar.new(@secret)
+          @deprecated_secret = "b" * 30
+          Rails.application.config.deprecated_secret_token = @deprecated_secret
+          @jar = ActionDispatch::Cookies::SignedCookieJar.new(@parent_jar)
+        end
+
+        it "calls the original initialize method" do
+          @jar.instance_variable_get(:@parent_jar).must_equal @parent_jar
+        end
+
+        describe "validator" do
+          before do
+            @verifier = @jar.instance_variable_get(:@verifier)
+          end
+          it "is a multi message validator" do
+            @verifier.must_be_kind_of(MessageMultiVerifier)
+          end
+
+          it "has the correct secrets stored" do
+            secrets = @verifier.instance_variable_get(:@verifiers).map { |x| x.instance_variable_get(:@secret) }
+            secrets.must_equal [@secret, @deprecated_secret]
+          end
+        end
+      end
+
+      describe "with secret_key_base defined in config" do
+        it "blows up" do
+          Rails.clean
+
+          Rails.application.config.secret_token = "a" * 64
+          Rails.application.config.secret_key_base = "b" * 64
+
+          -> { load_railtie }.must_raise(RuntimeError)
+        end
+      end
+
+      private
+
+      def load_railtie
+        if (init = Rails::Railtie.initializers.first)
+          _, _, block = init
+          block.call
+        end
+      end
+
+    end
+  end
+end

data/spec/support/fake_cookie_jar.rb

@@ -0,0 +1,11 @@
+class FakeCookieJar
+  attr_reader :request, :key_generator, :signed_cookie_salt, :cookies_digest
+
+  def initialize(secret)
+    @secret = secret
+    @request = self
+    @signed_cookie_salt = nil
+    @cookies_digest = nil
+    @key_generator = ActiveSupport::LegacyKeyGenerator.new(@secret)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hestia
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Caius Durling
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-08-02 00:00:00.000000000 Z
+date: 2017-11-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -33,7 +33,7 @@ dependencies:
         version: 3.2.21
     - - "<"
       - !ruby/object:Gem::Version
-        version: 5.0.0
+        version: 5.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -43,7 +43,7 @@ dependencies:
         version: 3.2.21
     - - "<"
       - !ruby/object:Gem::Version
-        version: 5.0.0
+        version: 5.2.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -100,6 +100,8 @@ files:
 - Gemfile.rails3
 - Gemfile.rails41
 - Gemfile.rails42
+- Gemfile.rails50
+- Gemfile.rails51
 - LICENSE.txt
 - README.md
 - Rakefile
@@ -111,12 +113,15 @@ files:
 - lib/hestia/signed_cookie_jar_extension.rb
 - lib/hestia/signed_cookie_jar_extension/action_pack_3.rb
 - lib/hestia/signed_cookie_jar_extension/action_pack_4.rb
+- lib/hestia/signed_cookie_jar_extension/action_pack_5.rb
 - lib/hestia/version.rb
 - spec/hestia/message_multi_verifier_spec.rb
 - spec/hestia/railtie_spec.rb
 - spec/hestia/signed_cookie_jar_extension/action_pack_3_spec.rb
 - spec/hestia/signed_cookie_jar_extension/action_pack_4_spec.rb
+- spec/hestia/signed_cookie_jar_extension/action_pack_5_spec.rb
 - spec/spec_helper.rb
+- spec/support/fake_cookie_jar.rb
 - spec/support/fake_rails.rb
 homepage: https://github.com/fac/hestia
 licenses:
@@ -138,7 +143,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.6
+rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
 summary: Support for deprecating/rotating signed cookie secret tokens in rails
@@ -147,5 +152,7 @@ test_files:
 - spec/hestia/railtie_spec.rb
 - spec/hestia/signed_cookie_jar_extension/action_pack_3_spec.rb
 - spec/hestia/signed_cookie_jar_extension/action_pack_4_spec.rb
+- spec/hestia/signed_cookie_jar_extension/action_pack_5_spec.rb
 - spec/spec_helper.rb
+- spec/support/fake_cookie_jar.rb
 - spec/support/fake_rails.rb