mauth-client 4.0.2 → 4.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a21d16b8275a278bf76abd03b2a36c59789ef493
-  data.tar.gz: a2a371bfe255763a721f2cc3566865d86264e17d
+  metadata.gz: 1f18ac348ac61d91254ad0c5dea4874b5e76f486
+  data.tar.gz: 1516ee5f2fe7e7f26369e4d6878e9c5c6a220457
 SHA512:
-  metadata.gz: 3a9f889083c41d625ce4783f903b4edb94aefa7ea294aed7b6d1f3b9b6b2cf8d9d65121c3976c0bcb3903b9537bc5f615a09891177151a0734da5f333183a0f2
-  data.tar.gz: 4be1f2f77de4305c4b3bdb3dddf64655233b5a9a1779e03fa1b245666c464001acad2b1a4c800edbd5a6d9e3ecc30b03a0e2892729db4e6573b9d782e687bd08
+  metadata.gz: b46db4cd5a12bcf4a7df96e97a529b505a773eb303b62e722c8d447e16a1667c1613cd0c5a71e7d8faaf661ee9022d41a2f9b5f7e95832d9ec6808eebb19cab9
+  data.tar.gz: 18d84c20776c619f5821056b491d25b21a4ed9387bb89de4b2283740bffcaec4d793a807fe1eb9f8b17f452f6a3d44473d6bb62220f8331fb83fd8560a20ac1a

data/CHANGELOG.md

@@ -1,5 +1,8 @@
 # MAuth-Client History
 
+## v4.0.3
+- Updated signature to decode number sign (#) in requests
+
 ## v4.0.2
 - Store the config data to not load the config file multiple times
 

data/lib/mauth/client.rb

@@ -364,8 +364,7 @@ module MAuth
         expected_for_percent_reencoding = object.string_to_sign(time: object.x_mws_time, app_uuid: object.signature_app_uuid)
 
         # do a moderately complex Euresource-style reencoding of the path
-        object.attributes_for_signing[:request_url] = CGI.escape(original_request_uri.to_s)
-        object.attributes_for_signing[:request_url].gsub!('%2F', '/') # ...and then 'simply' decode the %2F's back into /'s, just like Euresource kind of does!
+        object.attributes_for_signing[:request_url] = euresource_escape(original_request_uri.to_s)
         expected_euresource_style_reencoding = object.string_to_sign(time: object.x_mws_time, app_uuid: object.signature_app_uuid)
 
         # reset the object original request_uri, just in case we need it again
@@ -383,6 +382,13 @@ module MAuth
         end
       end
 
+      # Note: RFC 3986 (https://www.ietf.org/rfc/rfc3986.txt) reserves the forward slash "/"
+      #   and number sign "#" as component delimiters. Since these are valid URI components,
+      #   they are decoded back into characters here to avoid signature invalidation
+      def euresource_escape(str)
+        CGI.escape(str).gsub(/%2F|%23/, "%2F" => "/", "%23" => "#")
+      end
+
       def retrieve_public_key(app_uuid)
         retrieve_security_token(app_uuid)['security_token']['public_key_str']
       end

data/lib/mauth/version.rb

@@ -1,3 +1,3 @@
 module MAuth
-  VERSION = '4.0.2'.freeze
+  VERSION = '4.0.3'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mauth-client
 version: !ruby/object:Gem::Version
-  version: 4.0.2
+  version: 4.0.3
 platform: ruby
 authors:
 - Matthew Szenher
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-01-11 00:00:00.000000000 Z
+date: 2017-05-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday