invisible_captcha 2.1.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f15e5223696c06e82c8ab6182a4396a9e4e4bf3acd6e425296e60cc6b49cb225
-  data.tar.gz: e35b51231012ae92b236f81eb1966a16ea3c7b02862d03977bf23478d968538d
+  metadata.gz: 8421f23e2c4ca4f1512efe6f0ac5b7d538c21fae25c94dae1eb12080bcc7bff2
+  data.tar.gz: d80bbba59b964e84f677620a2c24a5047744a95733805981583034e3629034a4
 SHA512:
-  metadata.gz: ccc4299595595e513fa8f8eb472233b83fa334608b3cd4fcba3d1316b8f1819d83e7cc3d2678dce0ac954c52a4b90ecf0643424d0358cd8dd3412c4aa04ac391
-  data.tar.gz: 1fcceba58cb21d931e6d8f7f49a3a1649230628442e18f3664a80d5ac983dbec0bc5caeeda17cacc748bfbfabce93bd189f695bc0d123d4bd2ef0d94a20cdb3e
+  metadata.gz: 94f28d33d89e5dcfa741d97c34c4a42645a5d3f668238653341cd402c1e1e3bfbf8d2c42f5bc6d9d8bda3815d3e7036c0dae13965691e7409ce5df1ff5763bee
+  data.tar.gz: 2a187357840766a3eae1c40f032015c38f07a2b12955c9bfc82f95251b81138a6eab8e69ccd0adbfb9e5f13c095a541e869f2b3d5672e29a75b893253702965e

data/.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       fail-fast: false
       matrix:
         ruby: ["2.7", "3.0", "3.1", "3.2"]
-        gemfile: [rails_6.0, rails_6.1, rails_7.0]
+        gemfile: [rails_6.0, rails_6.1, rails_7.0, rails_7.1]
         exclude:
           - ruby: "3.1"
             gemfile: rails_6.0

data/Appraisals

@@ -1,4 +1,5 @@
 %w(
+  7.1
   7.0
   6.1
   6.0

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.3.0]
+
+- Run honeypot + spinner checks and their callback also if timestamp triggers but passes through (#132)
+- Mark as spam requests with no spinner value (#134)
+
+## [2.2.0]
+
+- Official support for Rails 7.1
+- Fix flash message for `on_timestamp_spam` callback (#125)
+- Fix potential error when lookup the honeypot parameter using (#128)
+
 ## [2.1.0]
 
 - Drop official support for EOL Rubies: 2.5 and 2.6
@@ -130,6 +141,8 @@ All notable changes to this project will be documented in this file.
 
 - First version of controller filters
 
+[2.3.0]: https://github.com/markets/invisible_captcha/compare/v2.2.0...v2.3.0
+[2.2.0]: https://github.com/markets/invisible_captcha/compare/v2.1.0...v2.2.0
 [2.1.0]: https://github.com/markets/invisible_captcha/compare/v2.0.0...v2.1.0
 [2.0.0]: https://github.com/markets/invisible_captcha/compare/v1.1.0...v2.0.0
 [1.1.0]: https://github.com/markets/invisible_captcha/compare/v1.0.1...v1.1.0

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright 2012-2021 Marc Anguera Insa
+Copyright 2012-2024 Marc Anguera Insa
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -287,7 +287,7 @@ end
 Another option is to wait for the timestamp check to be valid:
 
 ```ruby
-# Maybe in a before block
+# Maybe inside a before block
 InvisibleCaptcha.init!
 InvisibleCaptcha.timestamp_threshold = 1
 
@@ -295,6 +295,26 @@ InvisibleCaptcha.timestamp_threshold = 1
 sleep InvisibleCaptcha.timestamp_threshold
 ```
 
+If you're using the "random honeypot" approach, you may want to set a known honeypot:
+
+```ruby
+config.honeypots = ['my_honeypot_field'] if Rails.env.test?
+```
+
+And for the "spinner validation" check, you may want to disable it:
+
+```ruby
+config.spinner_enabled = !Rails.env.test?
+```
+
+Or alternativelly, you should send a valid spinner value along your requests:
+
+```ruby
+# RSpec example
+session[:invisible_captcha_spinner] = '32ab649161f9f6faeeb323746de1a25d'
+post :create,  params: { topic: { title: 'foo' }, spinner: '32ab649161f9f6faeeb323746de1a25d' }
+```
+
 ## Contribute
 
 Any kind of idea, feedback or bug report are welcome! Open an [issue](https://github.com/markets/invisible_captcha/issues) or send a [pull request](https://github.com/markets/invisible_captcha/pulls).

data/gemfiles/rails_7.1.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 7.1.0"
+
+gemspec path: "../"

data/lib/invisible_captcha/controller_ext.rb

@@ -21,7 +21,10 @@ module InvisibleCaptcha
     def detect_spam(options = {})
       if timestamp_spam?(options)
         on_timestamp_spam(options)
-      elsif honeypot_spam?(options) || spinner_spam?
+        return if performed?
+      end
+
+      if honeypot_spam?(options) || spinner_spam?
         on_spam(options)
       end
     end
@@ -30,7 +33,8 @@ module InvisibleCaptcha
       if action = options[:on_timestamp_spam]
         send(action)
       else
-        redirect_back(fallback_location: root_path, flash: { error: InvisibleCaptcha.timestamp_error_message })
+        flash[:error] = InvisibleCaptcha.timestamp_error_message
+        redirect_back(fallback_location: root_path)
       end
     end
 
@@ -72,7 +76,7 @@ module InvisibleCaptcha
     end
 
     def spinner_spam?
-      if InvisibleCaptcha.spinner_enabled && params[:spinner] != session[:invisible_captcha_spinner]
+      if InvisibleCaptcha.spinner_enabled && (params[:spinner].blank? || params[:spinner] != session[:invisible_captcha_spinner])
         warn_spam("Spinner value mismatch")
         return true
       end
@@ -88,7 +92,7 @@ module InvisibleCaptcha
         # If honeypot is defined for this controller-action, search for:
         # - honeypot: params[:subtitle]
         # - honeypot with scope: params[:topic][:subtitle]
-        if params[honeypot].present? || params.dig(scope, honeypot).present?
+        if params[honeypot].present? || (params[scope] && params[scope][honeypot].present?)
           warn_spam("Honeypot param '#{honeypot}' was present.")
           return true
         else
@@ -98,7 +102,7 @@ module InvisibleCaptcha
         end
       else
         InvisibleCaptcha.honeypots.each do |default_honeypot|
-          if params[default_honeypot].present? || params.dig(scope, default_honeypot).present?
+          if params[default_honeypot].present? || (params[scope] && params[scope][default_honeypot].present?)
             warn_spam("Honeypot param '#{scope}.#{default_honeypot}' was present.")
             return true
           end

data/lib/invisible_captcha/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module InvisibleCaptcha
-  VERSION = "2.1.0"
+  VERSION = "2.3.0"
 end

data/spec/controllers_spec.rb

@@ -71,6 +71,12 @@ RSpec.describe InvisibleCaptcha::ControllerExt, type: :controller do
         .to be_present
     end
 
+    it 'runs on_spam callback if on_timestamp_spam callback is defined but passes' do
+      put :test_passthrough, params: { id: 1, topic: { title: 'bar', subtitle: 'foo' } }
+
+      expect(response.status).to eq(204)
+    end
+
     context 'successful submissions' do
       it 'passes if submission on or after timestamp_threshold' do
         sleep InvisibleCaptcha.timestamp_threshold
@@ -84,7 +90,7 @@ RSpec.describe InvisibleCaptcha::ControllerExt, type: :controller do
         }
 
         expect(flash[:error]).not_to be_present
-        expect(response.body).to be_present
+        expect(response.body).to redirect_to(new_topic_path)
 
         # Make sure session is cleared
         expect(session[:invisible_captcha_timestamp]).to be_nil
@@ -96,7 +102,13 @@ RSpec.describe InvisibleCaptcha::ControllerExt, type: :controller do
         post :publish, params: { id: 1 }
 
         expect(flash[:error]).not_to be_present
-        expect(response.body).to be_present
+        expect(response.body).to redirect_to(new_topic_path)
+      end
+
+      it 'passes if on_timestamp_spam doesn\'t perform' do
+        put :test_passthrough, params: { id: 1, topic: { title: 'bar' } }
+
+        expect(response.body).to redirect_to(new_topic_path)
       end
     end
   end
@@ -126,13 +138,13 @@ RSpec.describe InvisibleCaptcha::ControllerExt, type: :controller do
         it 'passes with no spam' do
           post :categorize, params: { topic: { title: 'foo' } }
 
-          expect(response.body).to be_present
+          expect(response.body).to redirect_to(new_topic_path)
         end
 
         it 'fails with spam' do
           post :categorize, params: { topic: { "#{InvisibleCaptcha.honeypots.sample}": 'foo' } }
 
-          expect(response.body).to be_blank
+          expect(response.body).not_to redirect_to(new_topic_path)
         end
       end
 
@@ -140,13 +152,13 @@ RSpec.describe InvisibleCaptcha::ControllerExt, type: :controller do
         it 'passes with no spam' do
           post :categorize
 
-          expect(response.body).to be_present
+          expect(response.body).to redirect_to(new_topic_path)
         end
 
         it 'fails with spam' do
           post :categorize, params: { "#{InvisibleCaptcha.honeypots.sample}": 'foo' }
 
-          expect(response.body).to be_blank
+          expect(response.body).not_to redirect_to(new_topic_path)
         end
       end
 

data/spec/dummy/app/controllers/topics_controller.rb

@@ -13,6 +13,10 @@ class TopicsController < ApplicationController
 
   invisible_captcha only: :categorize
 
+  invisible_captcha honeypot: :subtitle, only: :test_passthrough,
+    on_spam: :catching_on_spam_callback,
+    on_timestamp_spam: :on_timestamp_spam_callback_with_passthrough
+
   def index
     redirect_to new_topic_path
   end
@@ -56,6 +60,10 @@ class TopicsController < ApplicationController
     end
   end
 
+  def test_passthrough
+    redirect_to new_topic_path
+  end
+
   private
 
   def custom_callback
@@ -65,4 +73,12 @@ class TopicsController < ApplicationController
   def custom_timestamp_callback
     head(204)
   end
+
+  def on_timestamp_spam_callback_with_passthrough
+  end
+
+  def catching_on_spam_callback
+    head(204)
+  end
+
 end

data/spec/dummy/app/views/layouts/application.html.erb

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <title>Dummy</title>
+  <title>InvisibleCaptcha Demo</title>
   <%= stylesheet_link_tag "/styles.css" %>
   <%= csrf_meta_tags %>
   <%= invisible_captcha_styles %>
@@ -24,5 +24,11 @@
   <% end %>
 
   <%= yield %>
+
+  <footer>
+    Running on
+    <b>Ruby <%= RUBY_VERSION %></b> and
+    <b>Rails <%= Rails.version %></b>
+  </footer>
   </body>
 </html>

data/spec/dummy/config/routes.rb

@@ -4,6 +4,7 @@ Rails.application.routes.draw do
     post :rename, on: :collection
     post :categorize, on: :collection
     post :copy, on: :collection
+    post :test_passthrough, on: :collection
   end
 
   root to: 'topics#new'

data/spec/dummy/public/styles.css

@@ -31,6 +31,15 @@ button {
   font-size: 1em;
 }
 
+footer {
+  position: fixed;
+  bottom: 0;
+  width: 100%;
+  padding: 1em 0;
+  font-size: 0.8em;
+  background-color: #ccc;
+}
+
 .errors {
   color: darkred;
 }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: invisible_captcha
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Marc Anguera Insa
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-12 00:00:00.000000000 Z
+date: 2024-03-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -115,6 +115,7 @@ files:
 - gemfiles/rails_6.0.gemfile
 - gemfiles/rails_6.1.gemfile
 - gemfiles/rails_7.0.gemfile
+- gemfiles/rails_7.1.gemfile
 - invisible_captcha.gemspec
 - lib/invisible_captcha.rb
 - lib/invisible_captcha/controller_ext.rb
@@ -180,7 +181,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.6
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: Honeypot spam protection for Rails