image_vise 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 13cb5031151e501b48add64f3082fa22a154dd62
-  data.tar.gz: fee7a59c9576786ecf2532db3e81a0cfea2f7a05
+  metadata.gz: 93c443e8b8b6c60e3b86d1d5bfccd4d49222c793
+  data.tar.gz: 41c91138bea11c4e76452634f6ff16a56cd6041c
 SHA512:
-  metadata.gz: c437c64f50ed44356f1d72b198d503c7ec562dc34e240cf6a4551fdbd8a713102b282b4e2962b7bdaeebeaa07653e6a0fdd7cd9c619d87425ee860d7b242ff0b
-  data.tar.gz: 0c2979889f495b9cce1ae6388b25b6e5e780efae0f6d7dbdd195da880ff5d6791b197aa2e6971fb952ca508a3d1a874c44c5b955cece414c009a019740edea07
+  metadata.gz: 044ddadc1b490096a3be67d766bd91e7c053603a05626e5c8023ee285f665d3032074fd64f04191baac62348788521ce3a665bd7870fc4433f2d849144b44852
+  data.tar.gz: dfc2a1727d89434bc2765e76b5db1dd5978d8150efada47f24f60f3aee6491e0cac0f45f8326f988318918cad56a3eb0dfb7239eabbfc8f84aee548661c2d00b

data/image_vise.gemspec

@@ -2,11 +2,11 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: image_vise 0.1.3 ruby lib
+# stub: image_vise 0.1.4 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "image_vise"
-  s.version = "0.1.3"
+  s.version = "0.1.4"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]

data/lib/image_vise/image_request.rb

@@ -10,6 +10,9 @@ class ImageVise::ImageRequest < Ks.strict(:src_url, :pipeline)
     base64_encoded_params = qs_params.fetch(:q) rescue qs_params.fetch('q')
     given_signature = qs_params.fetch(:sig) rescue qs_params.fetch('sig')
 
+    # Unmask slashes and equals signs (if they are present)
+    base64_encoded_params = base64_encoded_params.tr('-', '/').tr('_', '+')
+
     # Check the signature before decoding JSON (since we will be creating symbols)
     unless valid_signature?(base64_encoded_params, given_signature, secrets)
       raise SignatureError, "Invalid or missing signature"
@@ -30,7 +33,9 @@ class ImageVise::ImageRequest < Ks.strict(:src_url, :pipeline)
   end
 
   def to_path_params(signed_with_secret)
-    '/%{q}/%{sig}' % to_query_string_params(signed_with_secret)
+    qs = to_query_string_params(signed_with_secret)
+    q_masked = qs.fetch(:q).tr('/', '-').tr('+', '_')
+    '/%s/%s' % [q_masked, qs[:sig]]
   end
 
   def to_query_string_params(signed_with_secret)

data/lib/image_vise/render_engine.rb

@@ -105,10 +105,9 @@ class ImageVise::RenderEngine
     bail(400, 'Query strings are not supported') if rack_request.params.any?
     
     # Extract the tail (signature) and the front (the Base64-encoded request).
-    # The Base64-encoded string may contain slashes, that is why recovering one path component
-    # is not enough.
-    sig_from_path = rack_request.path_info[/\/([^\/]+)$/, 1]
-    q_from_path = rack_request.path_info[/\/?(.+)\/[^\/]+$/, 1]
+    # Slashes within :q are masked by ImageRequest already, so we don't have
+    # to worry about them.
+    *, q_from_path, sig_from_path = rack_request.path_info.split('/')
 
     # Raise if any of them are empty or blank
     nothing_recovered = [q_from_path, sig_from_path].all?{|v| v.nil? || v.empty? }

data/lib/image_vise.rb

@@ -8,7 +8,7 @@ require 'base64'
 require 'rack'
 
 class ImageVise
-  VERSION = '0.1.3'
+  VERSION = '0.1.4'
   S_MUTEX = Mutex.new
   private_constant :S_MUTEX
   

data/spec/image_vise/render_engine_spec.rb

@@ -154,21 +154,24 @@ describe ImageVise::RenderEngine do
       expect(parsed_image.columns).to eq(10)
     end
 
-    it 'properly decodes the image request if its Base64 representation contains slashes' do
+    it 'properly decodes the image request if its Base64 representation contains masked slashes and plus characters' do
       ImageVise.add_secret_key!("this is fab")
-      request_path = '/eyJwaXBlbGluZSI6W1sic2hhcnBlbiIseyJyYWRpdXMiO' +
+      sig = '64759d9ea610d75d9138bfa3ea01595d343ca8994261ae06fca8e6490222f140'
+      q = 'eyJwaXBlbGluZSI6W1sic2hhcnBlbiIseyJyYWRpdXMiO' +
        'jAuNSwic2lnbWEiOjAuNX1dXSwic3JjX3VybCI6InNoYWRl' +
-       'cmljb246L0NQR1BfRmlyZWJhbGw/Yz1kOWM4ZTMzO'+
+       'cmljb246L0NQR1BfRmlyZWJhbGw-Yz1kOWM4ZTMzO'+
        'TZmNjMwYzM1MjM0MTYwMmM2YzJhYmQyZjAzNTcxMTF'+
-       'jIn0/64759d9ea610d75d9138bfa3ea01595d343ca8994261ae06fca8e6490222f140'
-
+       'jIn0'
+      params = {q: q, sig: sig}
+      req = ImageVise::ImageRequest.from_params(qs_params: params, secrets: ['this is fab'])
+      
       # We do a check based on the raised exception - the request will fail
       # at the fetcher lookup stage. That stage however takes place _after_ the
       # signature has been validated, which means that the slash within the
       # Base64 payload has been taken into account
       expect(app).to receive(:raise_exceptions?).and_return(true)
       expect {
-        get request_path
+        get req.to_path_params('this is fab')
       }.to raise_error(/No fetcher registered for shadericon/)
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: image_vise
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - Julik Tarkhanov