hibp-client 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84ccd66e330884154b8984ffe576d04a352c949927ca20620dde9a16c1951bc2
-  data.tar.gz: 727b750b4507f5db31f2640b1f7802f5486a2092ecd3829ae4a5de80aac8bc85
+  metadata.gz: 0b684e158e498990a310f602b8f5f9eceb0526189653e8e3b3ca905b48f10692
+  data.tar.gz: 9064ef148bf0d92595de8850148e08b9ba073604e7dc913c7c4e1494b8ec601f
 SHA512:
-  metadata.gz: 4c061ecaaf20e07a69169517b848d4cdf515723d45508120c89de9f552fa0e23e658c0a52ab7ac39f8715ad1a74745ef002528102bf6f6ff5bd30eb2861f1350
-  data.tar.gz: 8d0562c84adf765357b5e532311ccd685a22de1842754cbc4b832213d09f0fb075bf5a14a6156d752cd5b9b6cb9250dcb035091937ed9743f06aa79c10d0f2e1
+  metadata.gz: ef6f3da27a13279651d58fb1145b12284a7ba62f168a4d1cec1928425e0491a592dc74647449f4eea5bc682b0478907b4abbf857f787d81ad7c34cff8f5237da
+  data.tar.gz: 9ae9e0aff64820ab709ebd8b32c265d7991fda280fc62ebe918837198b4807db5516273221c2381db6362e185e14b4e18984b475407610777a352f398f3be968

data/README.md

@@ -282,6 +282,12 @@ client.passwords('password').fetch
 
 ```
 
+You can optionally pass in a second boolean parameter to the `passwords` command, to enable response padding. This will add a random number of fake password hashes to the response, preventing anyone analysing the encrypted response from guessing the password. The fake data is removed prior to returning the array of password models so there is no additional filtering you need to do.
+```ruby
+client = Hibp::Client.new
+client.passwords('password', add_padding: true).fetch
+```
+
 ### Errors
 
 This gem will throw custom exception if an API error occurred.

data/lib/hibp/client.rb

@@ -114,23 +114,29 @@ module Hibp
     # @param password [String] -
     #   The value of the source password being searched for
     #
+    # @param add_padding [Boolean] -
+    #   Pads out the response with a random number of fake requests, to prevent
+    #   anyone looking at the responses from guessing what the hash prefix was.
+    #   
+    #
     # @note The API will respond with include the suffix of every hash beginning
     #       with the specified password prefix(five first chars of the password hash),
     #       and with a count of how many times it appears in the data set.
     #
     # @return [Hibp::Query]
     #
-    def passwords(password)
-      configure_password_query(password)
+    def passwords(password, add_padding: false)
+      configure_password_query(password, add_padding)
     end
 
     private
 
-    def configure_password_query(password)
+    def configure_password_query(password, add_padding)
       pwd_hash = ::Digest::SHA1.hexdigest(password).upcase
       endpoint = "#{PASSWORD_API_HOST}/#{pwd_hash[0..4]}"
+      headers = add_padding ? {'Add-Padding' => 'true'} : {}
 
-      Query.new(endpoint: endpoint, parser: Parsers::Password.new)
+      Query.new(endpoint: endpoint, headers: headers, parser: Parsers::Password.new)
     end
 
     def configure_core_query(service, parameter = nil)

data/lib/hibp/parsers/password.rb

@@ -10,7 +10,8 @@ module Hibp
       ROWS_SPLITTER = "\r\n"
       ATTRIBUTES_SPLITTER = ':'
 
-      # Convert API response raw data to the passwords models.
+      # Convert API response raw data to the passwords models. If occurrences of
+      # a hash suffix are 0 then it's fake data added by the add_padding option
       #
       # @param response [] -
       #   Contains the suffix of every hash beginning with the specified prefix,
@@ -21,15 +22,15 @@ module Hibp
       def parse_response(response)
         data = response.body
 
-        data.split(ROWS_SPLITTER).map(&method(:convert_to_password))
-      end
-
-      private
+        data.split(ROWS_SPLITTER).inject([]) do |array, row|
+          suffix, occurrences = row.split(ATTRIBUTES_SPLITTER)
 
-      def convert_to_password(row)
-        suffix, occurrences = row.split(ATTRIBUTES_SPLITTER)
+          if occurrences.to_i > 0
+            array <<  Models::Password.new(suffix: suffix, occurrences: occurrences.to_i)
+          end
 
-        Models::Password.new(suffix: suffix, occurrences: occurrences.to_i)
+          array
+        end
       end
     end
   end

data/lib/hibp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Hibp
-  VERSION = '0.1.1'
+  VERSION = '0.2.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hibp-client
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Warshavski
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-13 00:00:00.000000000 Z
+date: 2020-08-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday