hooks-ruby 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8cd5b56450a97783c263526f9a1a9e3003f1ed587a0da12bfb7a21b428091d2b
-  data.tar.gz: 67954e277623e99daafc8b3d86c9bdfa62b871319f4bff759789cd32048e752f
+  metadata.gz: 1f6bca4c82b0d3c507e2f772257a0e6ed5a30a072bb51b61da45d1c2688d99ba
+  data.tar.gz: c0d8a9f0aea0b3c5f039b7cb3354d418b79fab87aa14a4738ffb7ee04b554a2d
 SHA512:
-  metadata.gz: 41cbc5a653f452e9c6da4ffd526a1b7ea37532712ae820223ccbdb93809789e949d4370fe5ba18036a0a08b8446280ff44471088703c296f769d8c83b6003cfa
-  data.tar.gz: 99619a010a1fca90a1bda4f78850c66f705390be9677a1006cfdf72904e9ae0443bd1c0fed02dbbe014515c4df707a84b305460e111eb086fca76af3dec1ad61
+  metadata.gz: 0afe8a3b475163b154d7016b939fcf4fcdd40312534ea732018cc8cfe407823b3266d7c31881d010725bfa670927dfe6e6fd84663ca68ccb54dc27179fb01293
+  data.tar.gz: '04844e2020cc32371f889986c1eadc5c4cbd83bcac06a566466784ff306525e02713eb7f75838a304aa283b230b08b61760dc80f1e4fef993b2d163aaf587fbd'

data/lib/hooks/core/plugin_loader.rb

@@ -205,7 +205,11 @@ module Hooks
           require file_path
 
           # Get the class and validate it
-          auth_plugin_class = Object.const_get("Hooks::Plugins::Auth::#{class_name}")
+          auth_plugin_class = begin
+            Hooks::Plugins::Auth.const_get(class_name, false) # false = don't inherit from ancestors
+          rescue NameError
+            raise StandardError, "Auth plugin class not found in Hooks::Plugins::Auth namespace: #{class_name}"
+          end
           unless auth_plugin_class < Hooks::Plugins::Auth::Base
             raise StandardError, "Auth plugin class must inherit from Hooks::Plugins::Auth::Base: #{class_name}"
           end
@@ -239,8 +243,13 @@ module Hooks
           # Load the file
           require file_path
 
-          # Get the class and validate it
-          handler_class = Object.const_get(class_name)
+          # Get the class and validate it - use safe constant lookup
+          handler_class = begin
+            # Check if the constant exists in the global namespace for handlers
+            Object.const_get(class_name, false) # false = don't inherit from ancestors
+          rescue NameError
+            raise StandardError, "Handler class not found: #{class_name}"
+          end
           unless handler_class < Hooks::Plugins::Handlers::Base
             raise StandardError, "Handler class must inherit from Hooks::Plugins::Handlers::Base: #{class_name}"
           end
@@ -274,8 +283,12 @@ module Hooks
           # Load the file
           require file_path
 
-          # Get the class and validate it
-          lifecycle_class = Object.const_get(class_name)
+          # Get the class and validate it - use safe constant lookup
+          lifecycle_class = begin
+            Object.const_get(class_name, false) # false = don't inherit from ancestors
+          rescue NameError
+            raise StandardError, "Lifecycle plugin class not found: #{class_name}"
+          end
           unless lifecycle_class < Hooks::Plugins::Lifecycle
             raise StandardError, "Lifecycle plugin class must inherit from Hooks::Plugins::Lifecycle: #{class_name}"
           end
@@ -309,8 +322,12 @@ module Hooks
           # Load the file
           require file_path
 
-          # Get the class and validate it
-          instrument_class = Object.const_get(class_name)
+          # Get the class and validate it - use safe constant lookup
+          instrument_class = begin
+            Object.const_get(class_name, false) # false = don't inherit from ancestors
+          rescue NameError
+            raise StandardError, "Instrument plugin class not found: #{class_name}"
+          end
 
           # Determine instrument type based on inheritance
           if instrument_class < Hooks::Plugins::Instruments::StatsBase

data/lib/hooks/plugins/auth/shared_secret.rb

@@ -68,23 +68,21 @@ module Hooks
           secret_header = validator_config[:header]
 
           # Find the secret header with case-insensitive matching
-          raw_secret = find_header_value(headers, secret_header)
+          provided_secret = find_header_value(headers, secret_header)
 
-          if raw_secret.nil? || raw_secret.empty?
+          if provided_secret.nil? || provided_secret.empty?
             log.warn("Auth::SharedSecret validation failed: Missing or empty secret header '#{secret_header}'")
             return false
           end
 
           # Validate secret format using shared validation
-          unless valid_header_value?(raw_secret, "Secret")
+          unless valid_header_value?(provided_secret, "Secret")
             log.warn("Auth::SharedSecret validation failed: Invalid secret format")
             return false
           end
 
-          stripped_secret = raw_secret.strip
-
           # Use secure comparison to prevent timing attacks
-          result = Rack::Utils.secure_compare(secret, stripped_secret)
+          result = Rack::Utils.secure_compare(secret, provided_secret)
           if result
             log.debug("Auth::SharedSecret validation successful for header '#{secret_header}'")
           else

data/lib/hooks/version.rb

@@ -4,5 +4,5 @@
 module Hooks
   # Current version of the Hooks webhook framework
   # @return [String] The version string following semantic versioning
-  VERSION = "0.3.1".freeze
+  VERSION = "0.3.2".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hooks-ruby
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - github