linzer 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c09a63a7eae654921b40e0462b463b3e70867522fcedaf42f03373dd72ef55a5
-  data.tar.gz: b5fea79104954db4289fbf7e4df9f8e589827943cb62eb2836bd0b970611263a
+  metadata.gz: d2ec6a2a846f2bb066bdd658c2e50a869ceff52f65f3e5f8670cc5509af6069c
+  data.tar.gz: 5401df5ea61c39290b61a21cf19c4eaddc537abe908067a47688c1f209c982e3
 SHA512:
-  metadata.gz: 89572382dde42b597eeafecceca1572222cff5d20bba50345b0e3849f47d510cdbcfbc0988295e16b783aa9d28235a95e56b49302a53577e744dc8575253a419
-  data.tar.gz: bc8c2850994c211b4549dcd07d64ddb14fd54d948a05153d8011042eb4cd2b4adca4d8f80ab983a8c8c71deefc2473994fa479ec8b7ec00063dfa86ead7be7a4
+  metadata.gz: 53c504c5c0f886d3e73332d7d8bf7072137519a218ca6a005824f8ad073fb589dd91f2e7980aa02b232c17dd80a87923141e57b094087fb4f412dddbf5588a9f
+  data.tar.gz: 0a99fc9611e6b26ae820fecfe09e10a6c610be20bdf8f9c3fd7c6fab031f82f6f7fa109359470a2a65b7d7cd9817c21259e59fe6f99e50a1c6326d965b0df944

data/.standard.yml

@@ -7,3 +7,4 @@ ignore:
     - Layout/ExtraSpacing
     - Layout/HashAlignment
     - Layout/ArgumentAlignment
+    - Style/EmptyCaseCondition

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## [Unreleased]
 
+## [0.6.1] - 2024-12-02
+
+- Add more validation checks on HTTP field component identifiers and parameters.
+
+- Relax rack version requirements.
+
+- Update uri dependency to the latest version.
+
 ## [0.6.0] - 2024-04-06
 
 - Support parameters on HTTP field component identifiers.

data/lib/linzer/common.rb

@@ -18,10 +18,29 @@ module Linzer
       if components.include?("@signature-params")
         raise Error.new "Invalid component in signature input"
       end
+
       msg = "Cannot verify signature. Missing component in message: %s"
-      components.each { |c| raise Error.new msg % "\"#{c}\"" unless message.field?(c)  }
+      components.each do |c|
+        raise Error.new msg % "\"#{c}\"" unless message.field?(c)
+      end
+
+      validate_uniqueness components
+    end
+
+    def validate_uniqueness(components)
       msg = "Invalid signature. Duplicated component in signature input."
-      raise Error.new msg if components.size != components.uniq.size
+
+      uniq_components =
+        components
+          .partition { |c| c.start_with?("@") }
+          .flat_map
+          .with_index do |group, idx|
+            group
+              .map  { |comp| Starry.parse_item(idx.zero? ? comp[1..] : comp) }
+              .uniq { |comp| [comp.value, comp.parameters] }
+          end
+
+      raise Error.new msg if components.count != uniq_components.count
     end
   end
 end

data/lib/linzer/message.rb

@@ -47,7 +47,6 @@ module Linzer
       return nil if name.nil?
 
       if field_name.start_with?("@")
-        return nil if name.parameters["tr"]
         retrieve(name, :derived)
       else
         retrieve(name, :field)
@@ -79,13 +78,48 @@ module Linzer
       nil
     end
 
+    def validate_parameters(name, method)
+      has_unknown = name.parameters.any? { |p, _| !KNOWN_PARAMETERS.include?(p) }
+      return nil if has_unknown
+
+      has_name = name.parameters["name"]
+      has_req  = name.parameters["req"]
+      has_sf   = name.parameters["sf"] || name.parameters.key?("key")
+      has_bs   = name.parameters["bs"]
+      value    = name.value
+
+      # Section 2.2.8 of RFC 9421
+      return nil if has_name && value != :"query-param"
+
+      # No derived values come from trailers section
+      return nil if method == :derived && name.parameters["tr"]
+
+      # From: 2.1. HTTP Fields:
+      # The bs parameter, which requires the raw bytes of the field values
+      # from the message, is not compatible with the use of the sf or key
+      # parameters, which require the parsed data structures of the field
+      # values after combination
+      return nil if has_sf && has_bs
+
+      # req param only makes sense on responses with an associated request
+      return nil if has_req && (!response? || !attached_request?)
+
+      name
+    end
+
+    KNOWN_PARAMETERS = %w[sf key bs req tr name]
+    private_constant :KNOWN_PARAMETERS
+
     def retrieve(name, method)
+      if !name.parameters.empty?
+        valid_params = validate_parameters(name, method)
+        return nil if !valid_params
+      end
+
       has_req = name.parameters["req"]
       has_sf  = name.parameters["sf"] || name.parameters.key?("key")
       has_bs  = name.parameters["bs"]
 
-      return nil if has_req && (!response? || !attached_request?)
-
       if has_req
         name.parameters.delete("req")
         return req(name, method)
@@ -93,10 +127,13 @@ module Linzer
 
       value = send(method, name)
 
-      key = name.parameters["key"]
-      value = sf(value, key) if has_sf
-      value = bs(value)      if has_bs
-      value
+      case
+      when has_sf
+        key = name.parameters["key"]
+        sf(value, key)
+      when has_bs then bs(value)
+      else value
+      end
     end
 
     def derived(name)
@@ -128,7 +165,8 @@ module Linzer
     def derive(operation, method)
       return nil unless operation.respond_to?(method)
       value = operation.public_send(method)
-      return "?" + value if method == :query_string
+      return "?" + value    if method == :query_string
+      return value.downcase if %i[authority scheme].include?(method)
       value
     end
 
@@ -144,10 +182,12 @@ module Linzer
     def sf(value, key = nil)
       dict = Starry.parse_dictionary(value)
 
-      obj = dict[key] if key
-      return Starry.serialize(obj.is_a?(Starry::InnerList) ? [obj] : obj) if key
-
-      Starry.serialize(dict)
+      if key
+        obj = dict[key]
+        Starry.serialize(obj.is_a?(Starry::InnerList) ? [obj] : obj)
+      else
+        Starry.serialize(dict)
+      end
     end
 
     def bs(value)

data/lib/linzer/request.rb

@@ -11,7 +11,8 @@ module Linzer
       request_method = Rack.const_get(verb.upcase)
       args = {
         "REQUEST_METHOD" => request_method,
-        "PATH_INFO"      => uri.to_str
+        "PATH_INFO"      => uri.to_str,
+        "rack.input"     => StringIO.new
       }
 
       Rack::Request.new(build_rack_env(headers).merge(args))

data/lib/linzer/version.rb

@@ -1,9 +1,5 @@
 # frozen_string_literal: true
 
 module Linzer
-  VERSION = "0.6.0"
-
-  def self.ruby_dev?
-    RUBY_ENGINE == "ruby" && RUBY_PATCHLEVEL == -1 && /\Aruby 3.[0-9].0dev/ =~ RUBY_DESCRIPTION
-  end
+  VERSION = "0.6.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Miguel Landaeta
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-04-06 00:00:00.000000000 Z
+date: 2024-12-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: openssl
@@ -56,48 +56,54 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: uri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.12'
+        version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 1.0.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.12'
+        version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 1.0.2
 description:
 email:
 - miguel@miguel.cc
@@ -127,7 +133,6 @@ files:
 - lib/linzer/signer.rb
 - lib/linzer/verifier.rb
 - lib/linzer/version.rb
-- linzer.gemspec
 homepage: https://github.com/nomadium/linzer
 licenses:
 - MIT

data/linzer.gemspec

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "lib/linzer/version"
-
-Gem::Specification.new do |spec|
-  spec.name = "linzer"
-  spec.version = Linzer::VERSION
-  spec.authors = ["Miguel Landaeta"]
-  spec.email = %w[miguel@miguel.cc]
-
-  spec.summary = "An implementation of HTTP Messages Signatures (RFC9421)"
-  spec.homepage = "https://github.com/nomadium/linzer"
-  spec.license = "MIT"
-  spec.required_ruby_version = ">= 2.6.0"
-
-  spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = spec.homepage
-  spec.metadata["changelog_uri"] = spec.homepage + "/blob/master/CHANGELOG.md"
-
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files = Dir.chdir(__dir__) do
-    `git ls-files -z`.split("\x0").reject do |f|
-      (File.expand_path(f) == __FILE__) ||
-        f.start_with?(*%w[bin/ test/ spec/ features/ .git .circleci appveyor Gemfile])
-    end
-  end
-  spec.bindir = "exe"
-  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
-
-  spec.add_runtime_dependency "openssl", "~> 3.0", ">= 3.0.0"
-  spec.add_runtime_dependency "ed25519", "~> 1.3", ">= 1.3.0"
-  spec.add_runtime_dependency "starry", "~> 0.1" unless Linzer.ruby_dev?
-  spec.add_runtime_dependency "rack", "~> 3.0"
-  spec.add_runtime_dependency "uri", "~> 0.12", ">= 0.12.0"
-end