jwt 0.1.5 → 0.1.6

data/Rakefile

@@ -2,7 +2,7 @@ require 'rubygems'
 require 'rake'
 require 'echoe'
 
-Echoe.new('jwt', '0.1.5') do |p|
+Echoe.new('jwt', '0.1.6') do |p|
   p.description    = "JSON Web Token implementation in Ruby"
   p.url            = "http://github.com/progrium/ruby-jwt"
   p.author         = "Jeff Lindsay"

data/jwt.gemspec

@@ -2,11 +2,11 @@
 
 Gem::Specification.new do |s|
   s.name = "jwt"
-  s.version = "0.1.5"
+  s.version = "0.1.6"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
   s.authors = ["Jeff Lindsay"]
-  s.date = "2012-07-20"
+  s.date = "2013-03-05"
   s.description = "JSON Web Token implementation in Ruby"
   s.email = "progrium@gmail.com"
   s.extra_rdoc_files = ["lib/jwt.rb"]
@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.rdoc_options = ["--line-numbers", "--inline-source", "--title", "Jwt", "--main", "README.md"]
   s.require_paths = ["lib"]
   s.rubyforge_project = "jwt"
-  s.rubygems_version = "1.8.24"
+  s.rubygems_version = "1.8.23"
   s.summary = "JSON Web Token implementation in Ruby"
 
   if s.respond_to? :specification_version then

data/lib/jwt.rb

@@ -9,7 +9,7 @@ require "openssl"
 require "multi_json"
 
 module JWT
-  class DecodeError < Exception; end
+  class DecodeError < StandardError; end
 
   def self.sign(algorithm, msg, key)
     if ["HS256", "HS384", "HS512"].include?(algorithm)
@@ -79,7 +79,7 @@ module JWT
 
       begin
         if ["HS256", "HS384", "HS512"].include?(algo)
-          raise JWT::DecodeError.new("Signature verification failed") unless signature == sign_hmac(algo, signing_input, key)
+          raise JWT::DecodeError.new("Signature verification failed") unless secure_compare(signature, sign_hmac(algo, signing_input, key))
         elsif ["RS256", "RS384", "RS512"].include?(algo)
           raise JWT::DecodeError.new("Signature verification failed") unless verify_rsa(algo, key, signing_input, signature)
         else
@@ -92,4 +92,15 @@ module JWT
     payload
   end
 
+  # From devise
+  # constant-time comparison algorithm to prevent timing attacks
+  def self.secure_compare(a, b)
+    return false if a.nil? || b.nil? || a.empty? || b.empty? || a.bytesize != b.bytesize
+    l = a.unpack "C#{a.bytesize}"
+
+    res = 0
+    b.each_byte { |byte| res |= byte ^ l.shift }
+    res == 0
+  end
+
 end

data/spec/jwt_spec.rb

@@ -70,6 +70,36 @@ describe JWT do
     decoded_payload.should == @payload
   end
 
+  it "does not use == to compare digests" do
+    secret = "secret"
+    jwt = JWT.encode(@payload, secret)
+    crypto_segment = jwt.split(".").last
+
+    signature = JWT.base64url_decode(crypto_segment)
+    signature.should_not_receive('==')
+    JWT.should_receive(:base64url_decode).with(crypto_segment).once.and_return(signature)
+    JWT.should_receive(:base64url_decode).any_number_of_times.and_call_original
+
+    JWT.decode(jwt, secret)
+  end
+
+  describe "secure comparison" do
+    it "returns true if strings are equal" do
+      expect(JWT.secure_compare("Foo", "Foo")).to be_true
+    end
+
+    it "returns false if either input is nil or empty" do
+      [nil, ""].each do |bad|
+        expect(JWT.secure_compare(bad, "Foo")).to be_false
+        expect(JWT.secure_compare("Foo", bad)).to be_false
+      end
+    end
+
+    it "retuns falise of the strings are different" do
+        expect(JWT.secure_compare("Foo", "Bar")).to be_false
+    end
+  end
+
   it "raise exception on invalid signature" do
     pubkey = OpenSSL::PKey::RSA.new(<<-PUBKEY)
 -----BEGIN PUBLIC KEY-----

metadata

@@ -1,62 +1,55 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: jwt
-version: !ruby/object:Gem::Version 
-  hash: 17
+version: !ruby/object:Gem::Version
+  version: 0.1.6
   prerelease: 
-  segments: 
-  - 0
-  - 1
-  - 5
-  version: 0.1.5
 platform: ruby
-authors: 
+authors:
 - Jeff Lindsay
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2012-07-20 00:00:00 Z
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 2013-03-05 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: multi_json
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 15
-        segments: 
-        - 1
-        - 0
-        version: "1.0"
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '1.0'
   type: :runtime
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: echoe
   prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: echoe
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 33
-        segments: 
-        - 4
-        - 6
-        - 3
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 4.6.3
   type: :development
-  version_requirements: *id002
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 4.6.3
 description: JSON Web Token implementation in Ruby
 email: progrium@gmail.com
 executables: []
-
 extensions: []
-
-extra_rdoc_files: 
+extra_rdoc_files:
 - lib/jwt.rb
-files: 
+files:
 - Rakefile
 - lib/jwt.rb
 - spec/helper.rb
@@ -65,42 +58,32 @@ files:
 - jwt.gemspec
 homepage: http://github.com/progrium/ruby-jwt
 licenses: []
-
 post_install_message: 
-rdoc_options: 
+rdoc_options:
 - --line-numbers
 - --inline-source
 - --title
 - Jwt
 - --main
 - README.md
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
+required_ruby_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 11
-      segments: 
-      - 1
-      - 2
-      version: "1.2"
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '1.2'
 requirements: []
-
 rubyforge_project: jwt
-rubygems_version: 1.8.24
+rubygems_version: 1.8.23
 signing_key: 
 specification_version: 3
 summary: JSON Web Token implementation in Ruby
 test_files: []
-