mongoid-rails 3.0.1 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 938a8a7267f6eafce011f4b5c8287cd01d635f0c
-  data.tar.gz: 111bff05388d968211405b09c78543140b77bf71
+  metadata.gz: 4aea5ee9cb7fac68f175dfecf0501e5d33e5e43e
+  data.tar.gz: 808273d3448c20c3d40958412e79ed4f30516c85
 SHA512:
-  metadata.gz: 8b793092250e4d6208ffacf660239f6ec43905c32fd12590a0d13ebb153f92c4dc58d05bb5509a4ec8025786786c8483ffcae539ad9b28477464ce6dba98d1f8
-  data.tar.gz: e1ccb692a26fe2e6b610ceac7998c7faf64b97dca97427fa60aa004e783ad4f0ef60e2ffbd935db31f85018a84e3fc0262c0ba32c6d63f959d8cd533444e34a9
+  metadata.gz: 5b536055b801ce792f26d15329e399ca1e3f46fa40f1b9b0ba902e874a78c5f598ffabc489d8e56af01b72708889858c6e7be98b5e1378e8f41b82c235e9c6ce
+  data.tar.gz: 48938aa44dc4aa138f0223ddef933f4f45919f2bea1763e133422aa2f9661205caaf7394b21bad86eba3b6b74b0a6d1592ac46abbeca03e6fab493b91d5f33bf

data/README.md

@@ -1,5 +1,4 @@
-mongoid-rails is the safest way to use MongoDB with Rails.
-
+mongoid-rails is the safest way to use MongoDB with Rails 3 or 4.
 
 Installation
 ------------
@@ -12,23 +11,23 @@ gem 'mongoid-rails'
 
 Then run `bundle install`.
 
+What does it do?
+----------------
 
-Usage
------
-
-You don't need to use `mongoid-rails` explicitly, instead it adds protection against a few known hash injection attacks automatically.
+Mongoid rails provides protection against [hash-injection
+attacks](http://cirw.in/blog/hash-injection) in mongoid.
 
 ### Forbidden attributes protection
 
-This causes things like `User.create(params[:user])` to raise an exception. If
+This causes things like `User.create(setings: params[:settings])` to raise an exception. If
 you want to create a user from parameters, you need to explicitly permit the
 fields that you want to allow.
 
 ```ruby
-User.create(params[:user].permit(:name, :email))
+User.create(settings: params[:settings].permit(:favorite_color))
 ```
 
-This prevents an attacker from sneakily setting `params[:user][:admin] = true` or similar.
+This prevents an attacker from sneakily setting `params[:settings][:admin] = true` or similar.
 
 ### Forbidden query protection
 
@@ -38,14 +37,11 @@ This protects you against query injection attacks. It makes the following code s
 User.where(api_token: params[:api_token])
 ```
 
-Without `mongoid-rails` an attacker can send `?api_token[$regex]=.*` to guess
-api tokens from your app. With `mongoid-rails` that will cause an exception to
-be raised.
+Without `mongoid-rails` an attacker can send `?api_token[$gt]=` to guess api
+tokens from your app. With `mongoid-rails` that will cause an exception to be
+raised.
 
 Meta
 ----
 
 `mongoid-rails` is released under the MIT license. See `LICENCE.MIT` for details.
-
-It currently only supports rails3 with the strong parameters gem installed. I'd
-love a patch to make it work with the mongoid4 beta releases.

data/lib/mongoid-rails.rb

@@ -1,9 +1,10 @@
 require 'mongoid'
-require 'strong_parameters'
+require 'mongoid-rails/should_permit'
+require 'mongoid-rails/forbidden_attributes_protection'
 require 'mongoid-rails/forbidden_query_protection'
 
 # From https://github.com/rails/strong_parameters/issues/32
-Mongoid::Document.send(:include, ActiveModel::ForbiddenAttributesProtection)
+Mongoid::Document.send(:include, MongoidRails::ForbiddenAttributesProtection)
 
 # From https://github.com/mongoid/mongoid/commit/f02144f3af7f798187ec2133dfb615c973334ffe
 Mongoid::Criteria.send(:include, MongoidRails::ForbiddenQueryProtection)

data/lib/mongoid-rails/forbidden_attributes_protection.rb

@@ -0,0 +1,13 @@
+module MongoidRails
+  module ForbiddenAttributesProtection
+
+    def sanitize_for_mass_assignment(attributes)
+      if MongoidRails.should_permit?(attributes)
+        attributes
+      else
+        raise ActiveModel::ForbiddenAttributesError
+      end
+    end
+    alias :sanitize_forbidden_attributes :sanitize_for_mass_assignment
+  end
+end

data/lib/mongoid-rails/forbidden_query_protection.rb

@@ -3,32 +3,9 @@ module MongoidRails
     # Redefine all query methods to be safe against hash injection attacks.
     Origin::Selectable.instance_methods(false).each do |method|
       define_method method do |*criteria|
-        raise ActiveModel::ForbiddenAttributes.new(klass, method, criteria) unless should_permit?(criteria)
+        raise ActiveModel::ForbiddenAttributesError unless MongoidRails.should_permit?(criteria)
         super(*criteria)
       end
     end
-
-    private
-
-    # Ensure that the criteria are permitted.
-    #
-    # @example Ignoring ActionController::Parameters
-    #   should_permit?({_id: ActionController::Parameters.new("$size" => 1)})
-    #
-    # @api private
-    #
-    # @param [ Object ] criteria
-    # @return [ Boolean ] if should permit
-    def should_permit?(criteria)
-      if criteria.respond_to?(:permitted?)
-        return criteria.permitted?
-      elsif Hash === criteria || Array === criteria
-        criteria.each do |criterion|
-          return false unless should_permit?(criterion)
-        end
-      end
-
-      true
-    end
   end
 end

data/lib/mongoid-rails/should_permit.rb

@@ -0,0 +1,23 @@
+
+module MongoidRails
+  # Ensure that the criteria are permitted.
+  #
+  # @example Ignoring ActionController::Parameters
+  #   should_permit?({_id: ActionController::Parameters.new("$size" => 1)})
+  #
+  # @api private
+  #
+  # @param [ Object ] criteria
+  # @return [ Boolean ] if should permit
+  def self.should_permit?(criteria)
+    if criteria.respond_to?(:permitted?)
+      return criteria.permitted?
+    elsif Hash === criteria || Array === criteria
+      criteria.each do |criterion|
+        return false unless should_permit?(criterion)
+      end
+    end
+
+    true
+  end
+end

data/mongoid-rails.gemspec

@@ -1,14 +1,13 @@
 Gem::Specification.new do |s|
   s.name        = "mongoid-rails"
-  s.version     = "3.0.1"
+  s.version     = "4.0.0"
   s.author      = "Conrad Irwin"
   s.email       = "conrad.irwin@gmail.com"
   s.homepage    = "https://github.com/ConradIrwin/mongoid-rails"
   s.summary     = "Strong parameter integration between rails and mongoid"
   s.license     = "MIT"
 
-  s.add_dependency("mongoid", ["~> 3.1"])
-  s.add_dependency("strong_parameters", ["~> 0.2"])
+  s.add_dependency("mongoid", ["~> 4.0"])
 
   s.files        = `git ls-files`.split("\n")
   s.require_path = 'lib'

metadata

@@ -1,54 +1,42 @@
 --- !ruby/object:Gem::Specification
 name: mongoid-rails
 version: !ruby/object:Gem::Version
-  version: 3.0.1
+  version: 4.0.0
 platform: ruby
 authors:
 - Conrad Irwin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-01-17 00:00:00.000000000 Z
+date: 2014-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mongoid
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
-- !ruby/object:Gem::Dependency
-  name: strong_parameters
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '0.2'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '0.2'
+        version: '4.0'
 description: 
 email: conrad.irwin@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
+- ".gitignore"
 - LICENCE.MIT
 - README.md
 - lib/mongoid-rails.rb
+- lib/mongoid-rails/forbidden_attributes_protection.rb
 - lib/mongoid-rails/forbidden_query_protection.rb
+- lib/mongoid-rails/should_permit.rb
 - mongoid-rails.gemspec
 homepage: https://github.com/ConradIrwin/mongoid-rails
 licenses:
@@ -60,17 +48,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.3
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: Strong parameter integration between rails and mongoid