model_driven_api 3.12.2 → 3.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64d6dc96e02bf63e76a9948d41e1f7203433f9be2f3bb0a2abe16f19179351ad
-  data.tar.gz: 47bf8c07a5e6381bcabb15a150faae8bd08ae02000db9798c091b2a916e628df
+  metadata.gz: 9f71f26da0653883d6bcf4aa2382a9d6d9d51104e0f5f183f79abdf6da8cf242
+  data.tar.gz: 1cb5c008dfe9bbc44dbec5ec2bcf19670cd2c469239b0416b3a27d3ee4387387
 SHA512:
-  metadata.gz: 6d7039ac2e39aa75800db5a1ecdabd121a7465c8ffdc966ab88dac7961e53bd00eff37c0b8794b5d6ecca68f5a8d9eed3e4a3a8dd9d800a084301e12a7e321b0
-  data.tar.gz: 37566ee9050bfe09de0f3d784d0c6b4b6aebb39ec365ceb8c7f59e045b4865d3bf66518ebd1a393c38a8a04db575a2bd3ee2c106df84551f17e79c2b27c33780
+  metadata.gz: 4407253720ea30dbd1c209fe9997461564c28035ab24b7e97bb60ccdfb1614000f8405adc94f97666d06d1799a11a5aee5f5c2e498d105a8c2c88f56c32bc007
+  data.tar.gz: 734ca5f9bc6745ebcd0ef1ef382048d3d35205e1a692bdcc6fa41ed6c2480653e590bc25bf76ad29b32b9aae27392d065ecbb45294a9da8de87e8be402114ade

data/config/brakeman.ignore

@@ -0,0 +1,28 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "Remote Code Execution",
+      "warning_code": 24,
+      "fingerprint": "3a0e243d6afeb081594823f1d9102c5c6f9235211b4d2bcf3121eb57e91b65b9",
+      "check_name": "UnsafeReflection",
+      "message": "Unsafe reflection method `constantize` called on parameter value",
+      "file": "app/controllers/api/v2/application_controller.rb",
+      "line": 146,
+      "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
+      "code": "\"Endpoints::#{params[:ctrl].to_s.classify}\".constantize",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Api::V2::ApplicationController",
+        "method": "public_custom_action?"
+      },
+      "user_input": "params[:ctrl].to_s.classify",
+      "confidence": "High",
+      "cwe_id": [
+        470
+      ],
+      "note": "False positive (host Odoo #5884). The class name is always prefixed with Endpoints:: and ActiveSupport's constantize never falls back to a top-level constant (Endpoints::String raises NameError), so only an existing Endpoints::* class can be loaded; nothing is instantiated here. Guarded by the host's test/integration/api_reflection_test.rb."
+    }
+  ],
+  "brakeman_version": "8.1.0"
+}

data/lib/api/model_resolver.rb

@@ -4,17 +4,26 @@ module Api
 
     # Resolve model from params, controller_path, or controller_name.
     # Returns nil when no class can be resolved (info/utility controllers use this path).
-    # Raises NotFound when a class is resolved but is not an ActiveRecord model (and not TestApi).
+    # Raises NotFound when a class is resolved but is not a concrete ActiveRecord model (and not TestApi).
+    #
+    # The names come from the request path, so a resolved class is only ever inspected, never
+    # instantiated: checking a model with `.new` used to run the constructor of any class the
+    # path named (GET /api/v2/tempfiles created a file on the server).
     def self.resolve(params, controller_path, controller_name)
-      model = (params[:ctrl].classify.constantize rescue
-               params[:path].split("/").first.classify.constantize rescue
-               controller_path.classify.constantize rescue
-               controller_name.classify.constantize rescue
-               nil)
-      if model && model != TestApi
-        raise NotFound unless (model.new.is_a?(ActiveRecord::Base) rescue false)
-      end
+      model = [
+        params[:ctrl],
+        params[:path].to_s.split("/").first,
+        controller_path,
+        controller_name
+      ].lazy.filter_map { |name| name.to_s.classify.safe_constantize }.first
+      raise NotFound if model && model != TestApi && !model?(model)
+
       model
     end
+
+    def self.model?(klass)
+      klass.is_a?(Class) && klass < ActiveRecord::Base && !klass.abstract_class?
+    end
+    private_class_method :model?
   end
 end

data/lib/json_web_token.rb

@@ -1,21 +1,44 @@
 class JsonWebToken
   class << self
     def encode(payload, expiry = ENV.fetch('SESSION_TIMEOUT_IN_MINUTES', 31).to_i.minutes.from_now.to_i)
-      result = ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
+      result = ::JWT.encode(payload.merge(exp: expiry), signing_key)
       # Store the created token into the DB for later checks if is invalid
       # In a public environment management, without login, it has no interest, so I don't pollute the DB
       UsedToken.find_or_create_by(token: result, user_id: payload[:user_id]) if ENV["ALLOW_MULTISESSIONS"] == "false"
       result
     end
-    
+
     def decode(token)
-      # Check if the passed token is present and valid into the UsedToken 
+      # Check if the passed token is present and valid into the UsedToken
       raise "Token is invalidated by new login" if !UsedToken.exists?(token: token, is_valid: true) && ENV["ALLOW_MULTISESSIONS"] == "false"
-      body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
+      body = verified_payload(token)
       Rails.logger.debug "JsonWebToken: decode -> body -> #{body}"
       ::HashWithIndifferentAccess.new body
     # rescue
     #   nil
     end
+
+    private
+
+    def signing_key
+      ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"]
+    end
+
+    # After a SECRET_KEY_BASE rotation, a token signed with the previous key is still accepted until
+    # SECRET_KEY_BASE_PREVIOUS_EXPIRES_AT (ISO 8601), so app users never log in again: every authenticated
+    # response renews the token with the current key. The previous key may be public, so it is never
+    # trusted without an expiry, and only a bad signature falls back to it (an expired token stays expired).
+    def verified_payload(token)
+      ::JWT.decode(token, signing_key)[0]
+    rescue ::JWT::VerificationError
+      previous = previous_signing_key or raise
+      ::JWT.decode(token, previous)[0]
+    end
+
+    def previous_signing_key
+      key = ENV["SECRET_KEY_BASE_PREVIOUS"].presence or return
+      expires_at = Time.iso8601(ENV["SECRET_KEY_BASE_PREVIOUS_EXPIRES_AT"].to_s) rescue nil
+      key if expires_at && Time.current < expires_at
+    end
   end
-end
+end

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.12.2".freeze
+  VERSION = "3.13.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.12.2
+  version: 3.13.1
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -192,6 +192,7 @@ files:
 - app/models/endpoints/test_api.rb
 - app/models/test_api.rb
 - app/models/used_token.rb
+- config/brakeman.ignore
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/auto_include_json.rb
 - config/initializers/cors_api_thecore.rb