machina-auth 1.0.0 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64cd50975d04d89620d0ad73d6be045f93256efc4d34c57a563782167e659dc2
-  data.tar.gz: 3a962c88b3b58a015fb267de869acc17575cf7377df37b1bfe4439c0bbc66eba
+  metadata.gz: 0ef95dc9a17c0abc2f72fd81cc6bc78ca5baea5a058fb8800087c0ab1753fa8f
+  data.tar.gz: 85e89ffab0def4950f3da9ad9513d0cca3475cd222af0cd7fa12f9c56a8e18f7
 SHA512:
-  metadata.gz: b8962c63372568bacb6c6afa2ea47a0530999c0299a39117cbeefee5cec676f81fa25eba413aa3f093e26201878446412a4c9a5fac7f5df7604a13f6078876cf
-  data.tar.gz: 5cc1964cc2c24e6f4d3ddd9e45334bd2dec68a59fdeb73c85ccfc604cd4d19c49094ab6decec799c2d71862f88bd37e8310c1e1801d4d0c5d85cbb383f4ef956
+  metadata.gz: b58c5c91d1ca06f6d5d050f79e200c3c012473d262a2a5231c8cc3b3a2dc0c799b1f163dffb4963e243bfe2c8d5d915e87ac74db516a4f1f493cdb34c55510a4
+  data.tar.gz: 2e8113a5ccfef4f7a6c07bba04127e746256da82ba8f0d79d7529625e5cb92acf2ac621beffacf80f552923e1b7858aae65f4de243d67f1d0775dbc01e43710a

data/app/controllers/machina/callbacks_controller.rb

@@ -39,11 +39,12 @@ module Machina
       }
     end
 
-    # Relative paths only — an absolute or protocol-relative return_to is an
-    # open redirect on a credential-bearing request.
+    # Relative paths only. Reject a leading // or /\ — browsers treat both as
+    # protocol-relative, so either is an open redirect on a credential-bearing
+    # request (a backslash also trips Rails' UnsafeRedirectError as a 500).
     def safe_return_to
       value = params[:return_to].to_s
-      return value if value.start_with?('/') && !value.start_with?('//')
+      return value if value.start_with?('/') && !value.match?(%r{\A/[/\\]})
 
       '/'
     end

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '1.0.0'
+  VERSION = '1.0.2'
 end

data/lib/machina/webhook_receiver.rb

@@ -18,6 +18,9 @@ module Machina
 
     def valid?
       return false if signature.blank?
+      # Fail closed on a blank service token: SHA256("") is a public constant, so
+      # a blank token would make every signature forgeable.
+      return false if Machina.config.service_token.blank?
 
       signing_key = Digest::SHA256.hexdigest(Machina.config.service_token.to_s)
       expected = OpenSSL::HMAC.hexdigest('SHA256', signing_key, raw_body)

data/spec/machina/webhook_receiver_spec.rb

@@ -28,6 +28,23 @@ RSpec.describe Machina::WebhookReceiver do
     expect(receiver.process!).to be(false)
   end
 
+  it 'fails closed when the service token is blank' do
+    Machina.config.service_token = ''
+    # A blank token makes the signing key SHA256(""), a public constant an
+    # attacker can compute — so even a correctly-signed request must be rejected.
+    raw_body = JSON.generate({ user_id: '1' })
+    forgeable_key = Digest::SHA256.hexdigest('')
+    signature = OpenSSL::HMAC.hexdigest('SHA256', forgeable_key, raw_body)
+    request = instance_double(
+      ActionDispatch::Request,
+      body: StringIO.new(raw_body),
+      headers: { 'X-Machina-Event' => 'permissions.changed', 'X-Machina-Signature' => signature },
+    )
+
+    receiver = described_class.new(request, cache:)
+    expect(receiver.process!).to be(false)
+  end
+
   describe 'permissions.changed' do
     it 'marks cached sessions as stale' do
       cache.write('machina:session:ps_123', { user_id: '1' })

data/spec/requests/machina/callbacks_spec.rb

@@ -68,6 +68,12 @@ RSpec.describe Machina::CallbacksController, type: :controller do
 
       expect(response).to redirect_to('/')
     end
+
+    it 'rejects a backslash protocol-relative return_to' do
+      get :show, params: { token:, state:, return_to: '/\\evil.example.com' }
+
+      expect(response).to redirect_to('/')
+    end
   end
 
   describe 'with an invalid state' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.2
 platform: ruby
 authors:
 - ZAR