linzer 0.6.2 → 0.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db6a27eef77de787dbb8e481a845c44b2df6c284d98adc01d872fc10bb9f6061
-  data.tar.gz: c500a2ee97f3b9b9ec7717fc9162c9f26d979301dfdcd8aad50298126e9943a3
+  metadata.gz: bff7f24f79244ceffa58e5b005b45b2384b34f2d23eda4c0a613060c4f708fa4
+  data.tar.gz: bfee805d74cf0e1fc3d3588ec6eac8a1de5b96a16021198d016f0be9fb48e371
 SHA512:
-  metadata.gz: 828eabfdd8bb62382eb97b05b9ad7e75a8c8a71bdf082594d73abbf964735bf60fe8e31dcbfcd16e157bf14f369747e71631f54d7b896c7be3a8dfb336a1977f
-  data.tar.gz: 65d6be87fe00af2685a7bed82990d3ffa3fd92f4bd5375d00b34cb7d4756e9dca4beee0871c410b62918236cf4fdfd23f0304f5f51294cd855f9774fe104b1d0
+  metadata.gz: d62f773a0d20b09bb97987180f251a70b4db5c29eb4ecf2112e486c9169e418085823c813fa68e4063347d421328f171604c3f82bdf1b6ffae0385bfc41fd8ce
+  data.tar.gz: 0e53c41f9485a8028f11f67e368ca0ec60a82f8e795973d258fb96a57cfdcfe085308f4cd2eb0ac55fe8b5ee39c1a4f8d56d3d9d09fa57ee720eda17831e66ae

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 ## [Unreleased]
 
+## [0.6.4] - 2025-04-04
+
+- Allow validating the `created` parameter to mitigate the
+  risk of replay attacks.
+  Pull request [#8](https://github.com/nomadium/linzer/pull/8)
+  by [oneiros](https://github.com/oneiros).
+
+## [0.6.3] - 2025-03-29
+
+- Parse signature structured fields values as ASCII string.
+
 ## [0.6.2] - 2024-12-10
 
 - Remove dependency on ed25519 gem. Pull request

data/README.md

@@ -117,6 +117,15 @@ Linzer.verify(pubkey, message, signature)
 # => true
 ```
 
+To mitigate the risk of "replay attacks" (i.e. an attacker capturing a message with a valid signature and re-sending it at a later point) applications may want to validate the `created` parameter of the signature. Linzer can do this automatically when given the optional `no_older_than` keyword argument:
+
+```ruby
+Linzer.verify(pubkey, message, signature, no_older_than: 500)
+```
+
+`no_older_than` expects a number of seconds, but you can pass anything that to responds to `#to_i`, including an `ActiveSupport::Duration`.
+`::verify` will raise if the `created` parameter of the signature is older than the given number of seconds.
+
 ### What if an invalid signature if verified?
 
 ```ruby

data/lib/linzer/signature.rb

@@ -14,6 +14,18 @@ module Linzer
     alias_method :components, :metadata
     alias_method :bytes, :value
 
+    def created
+      Integer(parameters["created"])
+    rescue
+      return nil if parameters["created"].nil?
+      raise Error.new "Signature has a non-integer `created` parameter"
+    end
+
+    def older_than?(seconds)
+      raise Error.new "Signature is missing the `created` parameter" if created.nil?
+      (Time.now.to_i - created) > seconds
+    end
+
     def to_h
       {
         "signature" => Starry.serialize({label => value}),
@@ -31,11 +43,11 @@ module Linzer
         headers.transform_keys!(&:downcase)
         validate headers
 
-        input = parse_field(headers, "signature-input")
+        input = parse_structured_field(headers, "signature-input")
         reject_multiple_signatures if input.size > 1 && options[:label].nil?
         label = options[:label] || input.keys.first
 
-        signature = parse_field(headers, "signature")
+        signature = parse_structured_field(headers, "signature")
         fail_with_signature_not_found label unless signature.key?(label)
 
         raw_signature =
@@ -44,8 +56,7 @@ module Linzer
 
         fail_due_invalid_components unless input[label].value.respond_to?(:each)
 
-        ascii = Encoding::US_ASCII
-        components = input[label].value.map { |c| c.value.encode(ascii) }
+        components = input[label].value.map(&:value)
         parameters = input[label].parameters
 
         new(components, raw_signature, label, parameters)
@@ -75,8 +86,11 @@ module Linzer
         raise Error.new "Unexpected value for covered components."
       end
 
-      def parse_field(hsh, field_name)
-        Message.parse_structured_dictionary(hsh[field_name], field_name)
+      def parse_structured_field(hsh, field_name)
+        # Serialized Structured Field values for HTTP are ASCII strings.
+        # See: RFC 8941 (https://datatracker.ietf.org/doc/html/rfc8941)
+        value = hsh[field_name].encode(Encoding::US_ASCII)
+        Message.parse_structured_dictionary(value, field_name)
       end
     end
   end

data/lib/linzer/verifier.rb

@@ -5,8 +5,8 @@ module Linzer
     class << self
       include Common
 
-      def verify(key, message, signature)
-        validate message, key, signature
+      def verify(key, message, signature, no_older_than: nil)
+        validate message, key, signature, no_older_than: no_older_than
 
         parameters = signature.parameters
         components = signature.components
@@ -18,7 +18,7 @@ module Linzer
 
       private
 
-      def validate(message, key, signature)
+      def validate(message, key, signature, no_older_than: nil)
         raise Error.new "Message to verify cannot be null"       if message.nil?
         raise Error.new "Key to verify signature cannot be null" if key.nil?
         raise Error.new "Signature to verify cannot be null"     if signature.nil?
@@ -31,6 +31,9 @@ module Linzer
         raise Error.new "Components cannot be null"             if signature.components.nil?
 
         validate_components message, signature.components
+
+        return unless no_older_than
+        raise Error.new "Signature created more than #{no_older_than} seconds ago" if signature.older_than?(no_older_than.to_i)
       end
 
       def verify_or_fail(key, signature, data)

data/lib/linzer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Linzer
-  VERSION = "0.6.2"
+  VERSION = "0.6.4"
 end

data/lib/linzer.rb

@@ -32,8 +32,8 @@ module Linzer
       Linzer::Request.build(verb, uri, params, headers)
     end
 
-    def verify(pubkey, message, signature)
-      Linzer::Verifier.verify(pubkey, message, signature)
+    def verify(pubkey, message, signature, no_older_than: nil)
+      Linzer::Verifier.verify(pubkey, message, signature, no_older_than: no_older_than)
     end
 
     def sign(key, message, components, options = {})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.6.4
 platform: ruby
 authors:
 - Miguel Landaeta
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-12-10 00:00:00.000000000 Z
+date: 2025-04-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: openssl