httpimagestore 1.8.1 → 1.9.0

data/lib/httpimagestore/configuration/validate_hmac.rb

@@ -0,0 +1,170 @@
+require 'httpimagestore/configuration/handler/statement'
+require 'securerandom'
+
+module Configuration
+	class NoSecretKeySpecifiedError < ConfigurationError
+		def initialize
+			super 'no secret key given for validate_hmac (like secret="0f0f0...")'
+		end
+	end
+
+	class UnsupportedDigestError < ConfigurationError
+		def initialize(digest)
+			super "digest '#{digest}' is not supported"
+		end
+	end
+
+	class HMACAuthenticationFailedError < ArgumentError
+		def initialize(digest, msg)
+			super "HMAC URI authentication with digest '#{digest}' failed: #{msg}"
+		end
+	end
+
+	class HMACMismatchError < HMACAuthenticationFailedError
+		def initialize(expected_hmac, uri, digest)
+			super digest, "provided HMAC '#{expected_hmac}' for URI '#{uri}' is not valid"
+		end
+	end
+
+	class HMACMissingError < HMACAuthenticationFailedError
+		def initialize(hmac_qs_param_name, digest)
+			super digest, "HMAC query string parameter '#{hmac_qs_param_name}' not found"
+		end
+	end
+
+	class HMACMissingHeaderError < HMACAuthenticationFailedError
+		def initialize(digest, header_name)
+			super digest, "header '#{header_name}' not found in request body for HMAC verificaton"
+		end
+	end
+
+	class ValidateHMAC < HandlerStatement
+		include ConditionalInclusion
+
+		extend Stats
+		def_stats(
+			:total_hmac_validations,
+			:total_valid_hmac,
+			:total_invalid_hmac,
+			:total_lockpick_hmac
+		)
+
+		def self.new_with_common_options(configuration, node, hmac_qs_param_name, uri_source)
+			secret, digest, exclude, remove, lockpicks, remaining = *node.grab_attributes_with_remaining('secret', 'digest', 'exclude', 'remove', 'lockpicks')
+			conditions, remaining = *ConditionalInclusion.grab_conditions_with_remaining(remaining)
+			remaining.empty? or raise UnexpectedAttributesError.new(node, remaining)
+
+			obj = ValidateHMAC.new(hmac_qs_param_name, secret, lockpicks, digest, exclude, remove, uri_source)
+			obj.with_conditions(conditions)
+			obj
+		end
+
+		def initialize(hmac_qs_param_name, secret, lockpicks, digest, exclude, remove, uri_source)
+			@hmac_qs_param_name = hmac_qs_param_name
+			@secret = secret or raise NoSecretKeySpecifiedError
+			@digest = digest || 'sha1'
+
+			@exclude = (exclude || '').split(/ *, */)
+			@lockpicks = (lockpicks || '').split(/ *, */)
+			# always exclude hmac from hash computation
+			@exclude << @hmac_qs_param_name
+
+			# by default remove hmac for qs params but can be kept if remove=""
+			@remove = if remove
+				remove.split(/ *, */)
+			else
+				[@hmac_qs_param_name]
+			end
+
+			@uri_source = uri_source
+
+			# check if digest is valid
+			begin
+				OpenSSL::Digest.digest(@digest, 'blah')
+			rescue
+				raise UnsupportedDigestError.new(@digest)
+			end
+		end
+
+		attr_reader :digest
+
+		def realize(request_state)
+			expected_hmac = request_state.query_string[@hmac_qs_param_name] or raise HMACMissingError.new(@hmac_qs_param_name, @digest)
+
+			ValidateHMAC.stats.incr_total_hmac_validations
+
+			# we need to remove related query string params so we don't pass them as thumbnailer options
+			@remove.each do |rm|
+				log.debug "removing query string parameter '#{rm}' used for URI authentication"
+				request_state.query_string.delete(rm)
+			end
+
+			if lockpick = @lockpicks.detect{|lockpick| lockpick == expected_hmac}
+				# we try to get the URI if possible or else fail back to request_uri
+				# this is to help tracking where lockpicks are being used but still allow playing with APIs directly
+				# without need to set custom headers
+				lockpick_no = @lockpicks.find_index(lockpick) + 1
+				uri = @uri_source.call(self, request_state) rescue request_state.request_uri
+				uri = uri.gsub(/#{@exclude.last}=#{lockpick}/, "#{@exclude.last}=<lockpick #{lockpick_no} used>")
+
+				log.warn "valid lockpick provided! skipping URI HMAC validation for URI '#{uri}'"
+				ValidateHMAC.stats.incr_total_lockpick_hmac
+				return
+			end
+
+			uri = @uri_source.call(self, request_state) or fail "nil URI"
+			uri = @exclude.inject(uri) do |uri, ex|
+				uri.gsub(/(\?|&)#{ex}=.*?($|&)/, '\1')
+			end
+			uri.sub!(/(\?|&)$/, '')
+
+			digest = OpenSSL::Digest::Digest.new(@digest)
+
+			log.debug "validating URI '#{uri}' HMAC with digest '#{@digest}': expected HMAC '#{expected_hmac}'"
+			actual_hmac = OpenSSL::HMAC.hexdigest(digest, @secret, uri)
+
+			if actual_hmac != expected_hmac
+				sleep SecureRandom.random_number/10 # sleep some random time to make timing attack harder
+				log.warn "invalid HMAC with digest '#{@digest}' for URI '#{uri}'; expected HMAC '#{expected_hmac}'"
+				ValidateHMAC.stats.incr_total_invalid_hmac
+				raise HMACMismatchError.new(expected_hmac, uri, @digest)
+			else
+				ValidateHMAC.stats.incr_total_valid_hmac
+			end
+		end
+	end
+
+	class ValidateURIHMAC < ValidateHMAC
+		def self.match(node)
+			node.name == 'validate_uri_hmac'
+		end
+
+		def self.parse(configuration, node)
+			hmac_qs_param_name = node.grab_values('hmac').first
+			obj = self.new_with_common_options(configuration, node, hmac_qs_param_name, ->(obj, request_state){
+				request_state.request_uri
+			})
+			configuration.validators << obj
+		end
+	end
+
+	class ValidateHeaderHMAC < ValidateHMAC
+		def self.match(node)
+			node.name == 'validate_header_hmac'
+		end
+
+		def self.parse(configuration, node)
+			header_name, hmac_qs_param_name = *node.grab_values('header name', 'hmac')
+			header_name = header_name.upcase.gsub('_', '-')
+			obj = self.new_with_common_options(configuration, node, hmac_qs_param_name, ->(obj, request_state){
+				request_state.request_headers[header_name] or raise HMACMissingHeaderError.new(obj.digest, header_name)
+			})
+			configuration.validators << obj
+		end
+	end
+
+	Handler::register_node_parser ValidateURIHMAC
+	Handler::register_node_parser ValidateHeaderHMAC
+	StatsReporter << ValidateHMAC.stats
+end
+

data/lib/httpimagestore/error_reporter.rb

@@ -18,11 +18,16 @@ class ErrorReporter < Controller
 
 		on error(
 			Configuration::ZeroBodyLengthError,
-			Configuration::NoSpecSelectedError
+			Configuration::NoSpecSelectedError,
+			Configuration::InvalidSpecError
 		) do |error|
 			write_error 400, error
 		end
 
+		on error(Configuration::HMACAuthenticationFailedError) do |error|
+			write_error 403, error
+		end
+
 		on error Configuration::SourceFailoverAllFailedError do |error|
 			if [Configuration::S3NoSuchKeyError, Configuration::NoSuchFileError].member? error.errors.first.class
 				write_error 404, error

data/lib/httpimagestore/ruby_string_template.rb

@@ -23,33 +23,20 @@ class RubyStringTemplate < String
 	end
 
 	def render(locals = {})
-		template = self.to_s
-		values = {}
-
-		# use gsub with block instead!
-		template.scan(/#\{[^\}]+\}/um).uniq.each do |placeholder|
+		self.gsub(/#\{[^\}]+\}/um) do |placeholder|
 			name = placeholder.match(/#\{([^\}]*)\}/u).captures.first.to_sym
 
-			value = nil
-			@resolvers.find{|resolver| value = resolver.call(locals, name)} or fail NoValueForTemplatePlaceholderError.new(name, self)
-			values[placeholder] = value.to_s
-		end
-
-		values.each_pair do |placeholder, value|
-			template.gsub!(placeholder, value)
-		end
-
-		template
+			@resolvers.find do |resolver|
+				value = resolver.call(locals, name)
+				value and break value.to_s
+			end or fail NoValueForTemplatePlaceholderError.new(name, self)
+		end.to_s
 	end
 
 	def to_template
 		self
 	end
 
-	#def inspect
-		#super + "[#{@resolvers}]"
-	#end
-
 	def add_missing_resolver(&resolver)
 		@resolvers << resolver
 	end
@@ -59,6 +46,10 @@ class RubyStringTemplate < String
 		new_template.add_missing_resolver(&resolver)
 		new_template
 	end
+
+	def inspect
+		"T<#{to_s}>"
+	end
 end
 
 class String

metadata

@@ -1,52 +1,46 @@
 --- !ruby/object:Gem::Specification
 name: httpimagestore
 version: !ruby/object:Gem::Version
-  version: 1.8.1
-  prerelease: 
+  version: 1.9.0
 platform: ruby
 authors:
 - Jakub Pastuszek
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-08-28 00:00:00.000000000 Z
+date: 2015-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: unicorn-cuba-base
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.2.2
+        version: '1.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.2.2
+        version: '1.6'
 - !ruby/object:Gem::Dependency
   name: httpthumbnailer-client
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: aws-sdk
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -54,7 +48,6 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -62,23 +55,26 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: mime-types
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
+    - - <
+      - !ruby/object:Gem::Version
+        version: '2.99'
     - - ~>
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '2.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
+    - - <
+      - !ruby/object:Gem::Version
+        version: '2.99'
     - - ~>
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '2.6'
 - !ruby/object:Gem::Dependency
   name: sdl4r
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -86,7 +82,6 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -94,7 +89,6 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: msgpack
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -102,7 +96,6 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -110,7 +103,6 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -118,7 +110,6 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -126,23 +117,20 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -150,7 +138,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -158,39 +145,40 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: cucumber
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ~>
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ~>
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: jeweler
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.8.8
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.8.4
+        version: '1.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.8.8
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.8.4
+        version: '1.8'
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -198,7 +186,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -206,7 +193,6 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: daemon
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -214,7 +200,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -222,7 +207,6 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: prawn
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - '='
       - !ruby/object:Gem::Version
@@ -230,7 +214,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - '='
       - !ruby/object:Gem::Version
@@ -238,21 +221,19 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: httpthumbnailer
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.2.0
-description: Thumbnails images using httpthumbnailer and stored data on HTTP server
-  (S3)
+        version: '1.3'
+description: Configurable S3 or file system image storage and processing HTTP API
+  server. It is using HTTP Thumbnailer as image processing backend.
 email: jpastuszek@gmail.com
 executables:
 - httpimagestore
@@ -262,7 +243,6 @@ extra_rdoc_files:
 - README.md
 files:
 - .document
-- .rspec
 - Gemfile
 - Gemfile.lock
 - LICENSE.txt
@@ -270,86 +250,44 @@ files:
 - Rakefile
 - VERSION
 - bin/httpimagestore
-- features/cache-control.feature
-- features/compatibility.feature
-- features/data-uri.feature
-- features/encoding.feature
-- features/error-reporting.feature
-- features/flexi.feature
-- features/health-check.feature
-- features/request-matching.feature
-- features/rewrite.feature
-- features/s3-store-and-thumbnail.feature
-- features/source-failover.feature
-- features/step_definitions/httpimagestore_steps.rb
-- features/storage.feature
-- features/support/env.rb
-- features/support/test-large.jpg
-- features/support/test.empty
-- features/support/test.jpg
-- features/support/test.png
-- features/support/test.txt
-- features/support/tiny.png
-- features/xid-forwarding.feature
-- httpimagestore.gemspec
 - lib/httpimagestore/aws_sdk_regions_hack.rb
 - lib/httpimagestore/configuration.rb
 - lib/httpimagestore/configuration/file.rb
 - lib/httpimagestore/configuration/handler.rb
+- lib/httpimagestore/configuration/handler/source_store_base.rb
+- lib/httpimagestore/configuration/handler/statement.rb
 - lib/httpimagestore/configuration/identify.rb
 - lib/httpimagestore/configuration/output.rb
 - lib/httpimagestore/configuration/path.rb
+- lib/httpimagestore/configuration/request_state.rb
 - lib/httpimagestore/configuration/s3.rb
 - lib/httpimagestore/configuration/source_failover.rb
 - lib/httpimagestore/configuration/thumbnailer.rb
+- lib/httpimagestore/configuration/validate_hmac.rb
 - lib/httpimagestore/error_reporter.rb
 - lib/httpimagestore/ruby_string_template.rb
-- load_test/load_test.1k.23a022f6e.m1.small-comp.csv
-- load_test/load_test.1k.ec9bde794.m1.small.csv
-- load_test/load_test.jmx
-- load_test/thumbnail_specs.csv
-- load_test/thumbnail_specs_v2.csv
-- spec/configuration_file_spec.rb
-- spec/configuration_handler_spec.rb
-- spec/configuration_identify_spec.rb
-- spec/configuration_output_spec.rb
-- spec/configuration_path_spec.rb
-- spec/configuration_s3_spec.rb
-- spec/configuration_source_failover_spec.rb
-- spec/configuration_spec.rb
-- spec/configuration_thumbnailer_spec.rb
-- spec/ruby_string_template_spec.rb
-- spec/spec_helper.rb
-- spec/support/compute.jpg
-- spec/support/cuba_response_env.rb
-- spec/support/full.cfg
-- spec/support/utf_string.txt
 homepage: http://github.com/jpastuszek/httpimagestore
 licenses:
 - MIT
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
-      segments:
-      - 0
-      hash: 3314645469105412308
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.23
+rubygems_version: 2.4.7
 signing_key: 
-specification_version: 3
-summary: HTTP based image storage and thumbnailer
+specification_version: 4
+summary: HTTP API server for image thumbnailing and storage
 test_files: []