json_web_token 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1f2f2e9c05d1aa0624ecb4c80542779a4947440d
-  data.tar.gz: a743b29a91a80f888ef14cff51a31692e007955d
+  metadata.gz: d2049604b3f41c8df52e18f3437bc061986b5f53
+  data.tar.gz: bfed75256ebea6502c691580fd18b6fcff707ace
 SHA512:
-  metadata.gz: 33a0ad974222c5dc8773f9640f90e07e70b5afaa6986476341c6a2cbafd114e392810f33be973d85cc91c29e366fe7e6c1d2815870563310b648ef7dc29e8fc6
-  data.tar.gz: df28c9e985c1fd29e09cc13ae48c4b486b00f350f5d37cb92d876f9c0a3df152bba6c71432f5bd924d9a4e52c15c9d6501aa115e7040dc0d3568c590069faa13
+  metadata.gz: d2b811ae25982cd749cc86d4c27b9a1e547766e407c4aff35a8f9e5ce97bc5d8bc47cdfc3880aef93a029cdac124af26bbe43ecd3b9ecbfa691fb5fef835b8f7
+  data.tar.gz: 5143565589c04bb1618c4c69baba3993b21a3fd62fa37ca584666c25ae6d7f49515fa7eeb04326896edd34b1b4f31ab2abadd179522e8e6a1a78371cf8e9d766

data/.rspec

@@ -1 +1,2 @@
 --color
+--require spec_helper

data/.travis.yml

@@ -1,7 +1,6 @@
 language: ruby
 rvm:
-  - 2.0.0-p648
   - 2.1.10
-  - 2.2.5
-  - 2.3.1
-before_install: gem install bundler -v 1.13.2
+  - 2.2.6
+  - 2.3.3
+  - 2.4.0

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## Changelog
 
+### v0.3.3 (2017-01-16)
+
+* Bug fixes
+  * Remove invalid RSA .validate_message_size
+
 ### v0.3.2 (2016-10-09)
 
 * Enhancements

data/LICENSE.md

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2016 Gary Fleshman
+Copyright (c) 2017 Gary Fleshman
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

data/README.md

@@ -131,7 +131,7 @@ ES512 | ECDSA using P-521 and SHA-512
 none | No digital signature or MAC performed (unsecured)
 
 ### Supported Ruby Versions
-Ruby 2.0.0 and up
+Ruby 2.1 and up
 
 ### Limitations
 Future implementation may include these features:

data/json_web_token.gemspec

@@ -23,12 +23,11 @@ Gem::Specification.new do |s|
   s.platform = Gem::Platform::RUBY
   s.required_ruby_version = '>= 2.0.0'
 
-  s.add_runtime_dependency 'json', '>= 1.8.3'
+  s.add_runtime_dependency 'json', '~> 2.0'
 
   s.add_development_dependency 'bundler', '~> 1.13'
   s.add_development_dependency 'rake', '~> 10.0'
   s.add_development_dependency 'rspec', '~> 3.0'
-  s.add_development_dependency 'pry', '~> 0.10'
   s.add_development_dependency 'pry-byebug', '~> 3.4'
   s.add_development_dependency 'simplecov', '~> 0.12'
   s.add_development_dependency 'yard', '~> 0.9'

data/lib/json_web_token/algorithm/rsa.rb

@@ -5,14 +5,10 @@ module JsonWebToken
     # Sign or verify a JSON Web Signature (JWS) structure using RSASSA-PKCS-v1_5
     # @see http://tools.ietf.org/html/rfc7518#section-3.3
     module Rsa
-
       extend JsonWebToken::Algorithm::Common
 
       KEY_BITS_MIN = 2048
 
-      # @see http://tools.ietf.org/html/rfc3447#section-7.2
-      MESSAGE_BYTES_MAX = 245 # 256 - 11 bytes
-
       module_function
 
       # @param sha_bits [String] desired security level in bits of the signature scheme
@@ -23,26 +19,23 @@ module JsonWebToken
       #   Rsa.sign('256', < private_key >, 'signing_input').bytes.length
       #   # => 256
       def sign(sha_bits, private_key, signing_input)
-        validate_params(sha_bits, private_key, signing_input)
+        validate_key(sha_bits, private_key)
         private_key.sign(digest_new(sha_bits), signing_input)
       end
 
       # @param mac [BinaryString] a digital signature, or mac
+      # @param sha_bits [String] desired security level in bits of the signature scheme
       # @param public_key [OpenSSL::PKey::RSA] key used to verify a digital signature, or mac
+      # @param signing_input [String] input payload for a mac computation
       # @return [Boolean] a predicate to verify the signing_input for a given +mac+
       # @example
       #   Rsa.verify?(< binary_string >, '256', < public_key >, 'signing_input')
       #   # => true
       def verify?(mac, sha_bits, public_key, signing_input)
-        validate_params(sha_bits, public_key, signing_input)
+        validate_key(sha_bits, public_key)
         public_key.verify(digest_new(sha_bits), mac, signing_input)
       end
 
-      def validate_params(sha_bits, key, signing_input)
-        validate_key(sha_bits, key)
-        validate_message_size(signing_input)
-      end
-
       def validate_key_size(_sha_bits, key)
         fail('Invalid key: RSA modulus too small') if weak_key?(key)
       end
@@ -52,15 +45,8 @@ module JsonWebToken
         !key || key.n.num_bits < KEY_BITS_MIN
       end
 
-      # http://tools.ietf.org/html/rfc3447#section-7.2
-      def validate_message_size(signing_input)
-        fail('Invalid message: too large for RSA') if signing_input.bytesize > MESSAGE_BYTES_MAX
-      end
-
-      private_class_method :validate_params,
-        :validate_key_size,
-        :weak_key?,
-        :validate_message_size
+      private_class_method :validate_key_size,
+        :weak_key?
     end
   end
 end

data/lib/json_web_token/version.rb

@@ -1,3 +1,3 @@
 module JsonWebToken
-  VERSION = '0.3.2'
+  VERSION = "0.3.3"
 end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: json_web_token
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: ruby
 authors:
 - Gary Fleshman
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-10-09 00:00:00.000000000 Z
+date: 2017-01-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.3
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.3
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -66,20 +66,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.10'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.10'
 - !ruby/object:Gem::Dependency
   name: pry-byebug
   requirement: !ruby/object:Gem::Requirement
@@ -187,7 +173,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.7
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: JSON Web Token (JWT) for Ruby