ims-lti 2.3.1 → 2.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 517f20cf164297427cfa6cb070ab79f57514fa7b88e98f0ebd2adec5430e1897
-  data.tar.gz: 7740db235eee2784d84dd9d66a8aebd132eb337d4ecea837bfc36f49b6117f2a
+  metadata.gz: 6de9bbbf79d7c9a876eadd145ec7317b05268aa095ab1df5202db6c96d08599a
+  data.tar.gz: 3122f727f095833a7a3a380c46698da81f638a670f8bf49c72124327bf8fd1bb
 SHA512:
-  metadata.gz: a9e0205e846821c9415894bbab343e0ab1b53ff8627b2fdc6994ac968f3ce962c99753b5c98ee38e75bbfddafd840ffc9d053f332c573b6d43cde8cddb421d5b
-  data.tar.gz: 328b07aa4123c8bf8a296cc00231f35b3d03887e7b28562fff59bb19720c34b9e9ec653e263eed440522c1f460d3c64e81946c9c832fb5bfb5cf64bd7a59758a
+  metadata.gz: 8c6f21d78459aa18c5953e7e4d40f59882abc5e927eff0c3fedb9672208ac89d4ee4bced6222498cf86b4ef7f9f0803f64ca7f0a99af79dcb6283f6cced63c0d
+  data.tar.gz: 8032a4d4d4ffb044a7fb915467b5267fcc0bbbeb07683f5d7d920cdd1d9ee4942f8a394da50c92c9c7c5ae2bbe27cee599b997ab60019931cf6ada666425ed9d

data/lib/ims/lti/models/messages/message.rb

@@ -47,6 +47,19 @@ module IMS::LTI::Models::Messages
         @descendants || Set.new
       end
 
+      # For signature generation -- see usage in signed_post_params
+      def convert_param_values_to_crlf_endings(hash)
+        hash.transform_values do |val|
+          if val.is_a?(String)
+            # Convert to all newlines first, for consistency, just in case there
+            # is some weird mix of newlines & carriage returns in input
+            val.encode(universal_newline: true).encode(crlf_newline: true)
+          else
+            val
+          end
+        end
+      end
+
       private
 
       def add_params(instance_variable, param, *params)
@@ -148,7 +161,11 @@ module IMS::LTI::Models::Messages
     end
 
     def signed_post_params(secret)
-      message_params = oauth_params.merge(post_params)
+      # The params will be used in an HTML form, and browsers will always use
+      # newlines+carriage return line endings for submitted form data. The
+      # signature needs to match, and signature generation does not add carriage
+      # returns, so we ensure CRLF endings here.
+      message_params = self.class.convert_param_values_to_crlf_endings(oauth_params.merge(post_params))
       @message_authenticator = IMS::LTI::Services::MessageAuthenticator.new(launch_url, message_params, secret)
       @message_authenticator.signed_params
     end
@@ -219,4 +236,4 @@ module IMS::LTI::Models::Messages
     end
 
   end
-end
+end

data/lib/ims/lti/version.rb

@@ -1,5 +1,5 @@
 module IMS
   module LTI
-    VERSION = "2.3.1"
+    VERSION = "2.3.2"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ims-lti
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.3.2
 platform: ruby
 authors:
 - Instructure
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-08 00:00:00.000000000 Z
+date: 2022-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -100,6 +100,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.3.1
+- !ruby/object:Gem::Dependency
+  name: rexml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -212,7 +226,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.8'
-description:
+description: 
 email: opensource@instructure.com
 executables: []
 extensions: []
@@ -320,7 +334,7 @@ homepage: http://github.com/instructure/ims-lti
 licenses:
 - MIT
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -335,8 +349,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.2.15
+signing_key: 
 specification_version: 4
 summary: Ruby library for creating IMS LTI tool providers and consumers
 test_files: []