oauth 0.5.5 → 0.5.10
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +415 -0
- data/CODE_OF_CONDUCT.md +84 -0
- data/CONTRIBUTING.md +23 -0
- data/LICENSE +18 -17
- data/README.md +372 -0
- data/SECURITY.md +16 -0
- data/bin/oauth +2 -2
- data/lib/oauth/cli/authorize_command.rb +8 -10
- data/lib/oauth/cli/base_command.rb +9 -7
- data/lib/oauth/cli/query_command.rb +3 -3
- data/lib/oauth/cli/sign_command.rb +12 -15
- data/lib/oauth/cli.rb +19 -19
- data/lib/oauth/client/action_controller_request.rb +20 -21
- data/lib/oauth/client/em_http.rb +99 -99
- data/lib/oauth/client/helper.rb +33 -36
- data/lib/oauth/client/net_http.rb +30 -30
- data/lib/oauth/consumer.rb +90 -89
- data/lib/oauth/errors/unauthorized.rb +3 -1
- data/lib/oauth/errors.rb +3 -3
- data/lib/oauth/helper.rb +17 -13
- data/lib/oauth/oauth.rb +4 -4
- data/lib/oauth/oauth_test_helper.rb +4 -4
- data/lib/oauth/request_proxy/action_controller_request.rb +56 -53
- data/lib/oauth/request_proxy/action_dispatch_request.rb +8 -4
- data/lib/oauth/request_proxy/base.rb +136 -132
- data/lib/oauth/request_proxy/curb_request.rb +49 -43
- data/lib/oauth/request_proxy/em_http_request.rb +59 -49
- data/lib/oauth/request_proxy/jabber_request.rb +12 -9
- data/lib/oauth/request_proxy/mock_request.rb +4 -2
- data/lib/oauth/request_proxy/net_http.rb +63 -54
- data/lib/oauth/request_proxy/rack_request.rb +35 -31
- data/lib/oauth/request_proxy/rest_client_request.rb +53 -50
- data/lib/oauth/request_proxy/typhoeus_request.rb +51 -45
- data/lib/oauth/request_proxy.rb +3 -3
- data/lib/oauth/server.rb +10 -12
- data/lib/oauth/signature/base.rb +10 -9
- data/lib/oauth/signature/hmac/sha1.rb +4 -4
- data/lib/oauth/signature/hmac/sha256.rb +17 -0
- data/lib/oauth/signature/plaintext.rb +2 -2
- data/lib/oauth/signature/rsa/sha1.rb +5 -5
- data/lib/oauth/signature.rb +5 -5
- data/lib/oauth/token.rb +5 -5
- data/lib/oauth/tokens/access_token.rb +3 -3
- data/lib/oauth/tokens/consumer_token.rb +2 -2
- data/lib/oauth/tokens/request_token.rb +7 -8
- data/lib/oauth/tokens/server_token.rb +0 -1
- data/lib/oauth/version.rb +1 -1
- data/lib/oauth.rb +8 -6
- metadata +47 -99
- data/README.rdoc +0 -88
data/lib/oauth/consumer.rb
CHANGED
@@ -1,23 +1,23 @@
|
|
1
|
-
require
|
2
|
-
require
|
3
|
-
require
|
4
|
-
require
|
5
|
-
require
|
6
|
-
require
|
1
|
+
require "net/http"
|
2
|
+
require "net/https"
|
3
|
+
require "oauth/oauth"
|
4
|
+
require "oauth/client/net_http"
|
5
|
+
require "oauth/errors"
|
6
|
+
require "cgi"
|
7
7
|
|
8
8
|
module OAuth
|
9
9
|
class Consumer
|
10
10
|
# determine the certificate authority path to verify SSL certs
|
11
|
-
if ENV[
|
12
|
-
if File.exist?(ENV[
|
13
|
-
CA_FILE = ENV[
|
11
|
+
if ENV["SSL_CERT_FILE"]
|
12
|
+
if File.exist?(ENV["SSL_CERT_FILE"])
|
13
|
+
CA_FILE = ENV["SSL_CERT_FILE"]
|
14
14
|
else
|
15
15
|
raise "The SSL CERT provided does not exist."
|
16
16
|
end
|
17
17
|
end
|
18
18
|
|
19
|
-
|
20
|
-
CA_FILES = %
|
19
|
+
unless defined?(CA_FILE)
|
20
|
+
CA_FILES = %w[/etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt /usr/share/curl/curl-ca-bundle.crt].freeze
|
21
21
|
CA_FILES.each do |ca_file|
|
22
22
|
if File.exist?(ca_file)
|
23
23
|
CA_FILE = ca_file
|
@@ -29,27 +29,27 @@ module OAuth
|
|
29
29
|
|
30
30
|
@@default_options = {
|
31
31
|
# Signature method used by server. Defaults to HMAC-SHA1
|
32
|
-
:
|
32
|
+
signature_method: "HMAC-SHA1",
|
33
33
|
|
34
34
|
# default paths on site. These are the same as the defaults set up by the generators
|
35
|
-
:
|
36
|
-
:
|
37
|
-
:
|
38
|
-
:
|
35
|
+
request_token_path: "/oauth/request_token",
|
36
|
+
authenticate_path: "/oauth/authenticate",
|
37
|
+
authorize_path: "/oauth/authorize",
|
38
|
+
access_token_path: "/oauth/access_token",
|
39
39
|
|
40
|
-
:
|
40
|
+
proxy: nil,
|
41
41
|
# How do we send the oauth values to the server see
|
42
|
-
#
|
42
|
+
# https://oauth.net/core/1.0/#consumer_req_param for more info
|
43
43
|
#
|
44
44
|
# Possible values:
|
45
45
|
#
|
46
46
|
# :header - via the Authorize header (Default) ( option 1. in spec)
|
47
47
|
# :body - url form encoded in body of POST request ( option 2. in spec)
|
48
48
|
# :query_string - via the query part of the url ( option 3. in spec)
|
49
|
-
:
|
49
|
+
scheme: :header,
|
50
50
|
|
51
51
|
# Default http method used for OAuth Token Requests (defaults to :post)
|
52
|
-
:
|
52
|
+
http_method: :post,
|
53
53
|
|
54
54
|
# Add a custom ca_file for consumer
|
55
55
|
# :ca_file => '/etc/certs.pem'
|
@@ -59,9 +59,9 @@ module OAuth
|
|
59
59
|
# nil, false - no debug output
|
60
60
|
# true - uses $stdout
|
61
61
|
# some_value - uses some_value
|
62
|
-
:
|
62
|
+
debug_output: nil,
|
63
63
|
|
64
|
-
:
|
64
|
+
oauth_version: "1.0"
|
65
65
|
}
|
66
66
|
|
67
67
|
attr_accessor :options, :key, :secret
|
@@ -94,9 +94,8 @@ module OAuth
|
|
94
94
|
@secret = consumer_secret
|
95
95
|
|
96
96
|
# ensure that keys are symbols
|
97
|
-
@options = @@default_options.merge(options.
|
97
|
+
@options = @@default_options.merge(options.each_with_object({}) do |(key, value), opts|
|
98
98
|
opts[key.to_sym] = value
|
99
|
-
opts
|
100
99
|
end)
|
101
100
|
end
|
102
101
|
|
@@ -127,7 +126,7 @@ module OAuth
|
|
127
126
|
if custom_uri
|
128
127
|
@uri = custom_uri
|
129
128
|
@http = create_http # yike, oh well. less intrusive this way
|
130
|
-
else
|
129
|
+
else # if no custom passed, we use existing, which, if unset, is set to site uri
|
131
130
|
@uri ||= URI.parse(site)
|
132
131
|
end
|
133
132
|
end
|
@@ -156,15 +155,18 @@ module OAuth
|
|
156
155
|
# will be exchanged out of band
|
157
156
|
request_options[:oauth_callback] ||= OAuth::OUT_OF_BAND unless request_options[:exclude_callback]
|
158
157
|
|
159
|
-
if block_given?
|
160
|
-
|
161
|
-
|
162
|
-
|
163
|
-
|
164
|
-
|
165
|
-
|
166
|
-
|
167
|
-
|
158
|
+
response = if block_given?
|
159
|
+
token_request(
|
160
|
+
http_method,
|
161
|
+
(request_token_url? ? request_token_url : request_token_path),
|
162
|
+
nil,
|
163
|
+
request_options,
|
164
|
+
*arguments,
|
165
|
+
&block
|
166
|
+
)
|
167
|
+
else
|
168
|
+
token_request(http_method, (request_token_url? ? request_token_url : request_token_path), nil, request_options, *arguments)
|
169
|
+
end
|
168
170
|
OAuth::RequestToken.from_hash(self, response)
|
169
171
|
end
|
170
172
|
|
@@ -187,18 +189,18 @@ module OAuth
|
|
187
189
|
|
188
190
|
# override the request with your own, this is useful for file uploads which Net::HTTP does not do
|
189
191
|
req = create_signed_request(http_method, path, token, request_options, *arguments)
|
190
|
-
return nil if block_given?
|
192
|
+
return nil if block_given? && (yield(req) == :done)
|
191
193
|
rsp = http.request(req)
|
192
194
|
# check for an error reported by the Problem Reporting extension
|
193
|
-
# (
|
195
|
+
# (https://wiki.oauth.net/ProblemReporting)
|
194
196
|
# note: a 200 may actually be an error; check for an oauth_problem key to be sure
|
195
197
|
if !(headers = rsp.to_hash["www-authenticate"]).nil? &&
|
196
|
-
|
197
|
-
|
198
|
+
(h = headers.select { |hdr| hdr =~ /^OAuth / }).any? &&
|
199
|
+
h.first =~ /oauth_problem/
|
198
200
|
|
199
201
|
# puts "Header: #{h.first}"
|
200
202
|
|
201
|
-
# TODO doesn't handle broken responses from api.login.yahoo.com
|
203
|
+
# TODO: doesn't handle broken responses from api.login.yahoo.com
|
202
204
|
# remove debug code when done
|
203
205
|
params = OAuth::Helper.parse_header(h.first)
|
204
206
|
|
@@ -232,24 +234,25 @@ module OAuth
|
|
232
234
|
# symbolize keys
|
233
235
|
# TODO this could be considered unexpected behavior; symbols or not?
|
234
236
|
# TODO this also drops subsequent values from multi-valued keys
|
235
|
-
CGI.parse(response.body).
|
237
|
+
CGI.parse(response.body).each_with_object({}) do |(k, v), h|
|
236
238
|
h[k.strip.to_sym] = v.first
|
237
239
|
h[k.strip] = v.first
|
238
|
-
h
|
239
240
|
end
|
240
241
|
end
|
241
242
|
when (300..399)
|
242
|
-
#
|
243
|
-
uri = URI.parse(response[
|
243
|
+
# Parse redirect to follow
|
244
|
+
uri = URI.parse(response["location"])
|
244
245
|
our_uri = URI.parse(site)
|
245
246
|
|
247
|
+
# Guard against infinite redirects
|
248
|
+
response.error! if uri.path == path && our_uri.host == uri.host
|
249
|
+
|
246
250
|
if uri.path == path && our_uri.host != uri.host
|
247
|
-
|
248
|
-
|
251
|
+
options[:site] = "#{uri.scheme}://#{uri.host}"
|
252
|
+
@http = create_http
|
249
253
|
end
|
250
254
|
|
251
|
-
|
252
|
-
self.token_request(http_method, uri.path, token, request_options, arguments)
|
255
|
+
token_request(http_method, uri.path, token, request_options, arguments)
|
253
256
|
when (400..499)
|
254
257
|
raise OAuth::Unauthorized, response
|
255
258
|
else
|
@@ -296,13 +299,13 @@ module OAuth
|
|
296
299
|
@options[:access_token_path]
|
297
300
|
end
|
298
301
|
|
299
|
-
# TODO this is ugly, rewrite
|
302
|
+
# TODO: this is ugly, rewrite
|
300
303
|
def request_token_url
|
301
304
|
@options[:request_token_url] || site + request_token_path
|
302
305
|
end
|
303
306
|
|
304
307
|
def request_token_url?
|
305
|
-
@options.
|
308
|
+
@options.key?(:request_token_url)
|
306
309
|
end
|
307
310
|
|
308
311
|
def authenticate_url
|
@@ -310,7 +313,7 @@ module OAuth
|
|
310
313
|
end
|
311
314
|
|
312
315
|
def authenticate_url?
|
313
|
-
@options.
|
316
|
+
@options.key?(:authenticate_url)
|
314
317
|
end
|
315
318
|
|
316
319
|
def authorize_url
|
@@ -318,7 +321,7 @@ module OAuth
|
|
318
321
|
end
|
319
322
|
|
320
323
|
def authorize_url?
|
321
|
-
@options.
|
324
|
+
@options.key?(:authorize_url)
|
322
325
|
end
|
323
326
|
|
324
327
|
def access_token_url
|
@@ -326,7 +329,7 @@ module OAuth
|
|
326
329
|
end
|
327
330
|
|
328
331
|
def access_token_url?
|
329
|
-
@options.
|
332
|
+
@options.key?(:access_token_url)
|
330
333
|
end
|
331
334
|
|
332
335
|
def proxy
|
@@ -337,19 +340,20 @@ module OAuth
|
|
337
340
|
|
338
341
|
# Instantiates the http object
|
339
342
|
def create_http(_url = nil)
|
340
|
-
|
341
|
-
|
342
|
-
if
|
343
|
-
|
344
|
-
|
345
|
-
|
346
|
-
|
347
|
-
|
348
|
-
|
349
|
-
|
350
|
-
|
351
|
-
|
352
|
-
|
343
|
+
_url = request_endpoint unless request_endpoint.nil?
|
344
|
+
|
345
|
+
our_uri = if _url.nil? || _url[0] =~ /^\//
|
346
|
+
URI.parse(site)
|
347
|
+
else
|
348
|
+
your_uri = URI.parse(_url)
|
349
|
+
if your_uri.host.nil?
|
350
|
+
# If the _url is a path, missing the leading slash, then it won't have a host,
|
351
|
+
# and our_uri *must* have a host, so we parse site instead.
|
352
|
+
URI.parse(site)
|
353
|
+
else
|
354
|
+
your_uri
|
355
|
+
end
|
356
|
+
end
|
353
357
|
|
354
358
|
if proxy.nil?
|
355
359
|
http_object = Net::HTTP.new(our_uri.host, our_uri.port)
|
@@ -358,22 +362,22 @@ module OAuth
|
|
358
362
|
http_object = Net::HTTP.new(our_uri.host, our_uri.port, proxy_uri.host, proxy_uri.port, proxy_uri.user, proxy_uri.password)
|
359
363
|
end
|
360
364
|
|
361
|
-
http_object.use_ssl = (our_uri.scheme ==
|
365
|
+
http_object.use_ssl = (our_uri.scheme == "https")
|
362
366
|
|
363
367
|
if @options[:no_verify]
|
364
368
|
http_object.verify_mode = OpenSSL::SSL::VERIFY_NONE
|
365
369
|
else
|
366
|
-
ca_file =
|
367
|
-
if ca_file
|
368
|
-
http_object.ca_file = ca_file
|
369
|
-
end
|
370
|
+
ca_file = @options[:ca_file] || CA_FILE
|
371
|
+
http_object.ca_file = ca_file if ca_file
|
370
372
|
http_object.verify_mode = OpenSSL::SSL::VERIFY_PEER
|
371
373
|
http_object.verify_depth = 5
|
372
374
|
end
|
373
375
|
|
374
|
-
http_object.read_timeout = http_object.open_timeout = @options[:timeout] ||
|
376
|
+
http_object.read_timeout = http_object.open_timeout = @options[:timeout] || 60
|
375
377
|
http_object.open_timeout = @options[:open_timeout] if @options[:open_timeout]
|
376
378
|
http_object.ssl_version = @options[:ssl_version] if @options[:ssl_version]
|
379
|
+
http_object.cert = @options[:ssl_client_cert] if @options[:ssl_client_cert]
|
380
|
+
http_object.key = @options[:ssl_client_key] if @options[:ssl_client_key]
|
377
381
|
http_object.set_debug_output(debug_output) if debug_output
|
378
382
|
|
379
383
|
http_object
|
@@ -383,41 +387,39 @@ module OAuth
|
|
383
387
|
def create_http_request(http_method, path, *arguments)
|
384
388
|
http_method = http_method.to_sym
|
385
389
|
|
386
|
-
if [
|
387
|
-
data = arguments.shift
|
388
|
-
end
|
390
|
+
data = arguments.shift if %i[post put patch].include?(http_method)
|
389
391
|
|
390
392
|
# if the base site contains a path, add it now
|
391
393
|
# only add if the site host matches the current http object's host
|
392
394
|
# (in case we've specified a full url for token requests)
|
393
395
|
uri = URI.parse(site)
|
394
|
-
path = uri.path + path if uri.path && uri.path !=
|
396
|
+
path = uri.path + path if uri.path && uri.path != "/" && uri.host == http.address
|
395
397
|
|
396
398
|
headers = arguments.first.is_a?(Hash) ? arguments.shift : {}
|
397
399
|
|
398
400
|
case http_method
|
399
401
|
when :post
|
400
|
-
request = Net::HTTP::Post.new(path,headers)
|
401
|
-
request["Content-Length"] =
|
402
|
+
request = Net::HTTP::Post.new(path, headers)
|
403
|
+
request["Content-Length"] = "0" # Default to 0
|
402
404
|
when :put
|
403
|
-
request = Net::HTTP::Put.new(path,headers)
|
404
|
-
request["Content-Length"] =
|
405
|
+
request = Net::HTTP::Put.new(path, headers)
|
406
|
+
request["Content-Length"] = "0" # Default to 0
|
405
407
|
when :patch
|
406
|
-
request = Net::HTTP::Patch.new(path,headers)
|
407
|
-
request["Content-Length"] =
|
408
|
+
request = Net::HTTP::Patch.new(path, headers)
|
409
|
+
request["Content-Length"] = "0" # Default to 0
|
408
410
|
when :get
|
409
|
-
request = Net::HTTP::Get.new(path,headers)
|
411
|
+
request = Net::HTTP::Get.new(path, headers)
|
410
412
|
when :delete
|
411
|
-
request =
|
413
|
+
request = Net::HTTP::Delete.new(path, headers)
|
412
414
|
when :head
|
413
|
-
request = Net::HTTP::Head.new(path,headers)
|
415
|
+
request = Net::HTTP::Head.new(path, headers)
|
414
416
|
else
|
415
|
-
raise ArgumentError, "Don't know how to handle http_method: :#{http_method
|
417
|
+
raise ArgumentError, "Don't know how to handle http_method: :#{http_method}"
|
416
418
|
end
|
417
419
|
|
418
420
|
if data.is_a?(Hash)
|
419
421
|
request.body = OAuth::Helper.normalize(data)
|
420
|
-
request.content_type =
|
422
|
+
request.content_type = "application/x-www-form-urlencoded"
|
421
423
|
elsif data
|
422
424
|
if data.respond_to?(:read)
|
423
425
|
request.body_stream = data
|
@@ -437,13 +439,12 @@ module OAuth
|
|
437
439
|
request
|
438
440
|
end
|
439
441
|
|
440
|
-
def marshal_dump(*
|
441
|
-
{:
|
442
|
+
def marshal_dump(*_args)
|
443
|
+
{ key: @key, secret: @secret, options: @options }
|
442
444
|
end
|
443
445
|
|
444
446
|
def marshal_load(data)
|
445
447
|
initialize(data[:key], data[:secret], data[:options])
|
446
448
|
end
|
447
|
-
|
448
449
|
end
|
449
450
|
end
|
data/lib/oauth/errors.rb
CHANGED
@@ -1,3 +1,3 @@
|
|
1
|
-
require
|
2
|
-
require
|
3
|
-
require
|
1
|
+
require "oauth/errors/error"
|
2
|
+
require "oauth/errors/unauthorized"
|
3
|
+
require "oauth/errors/problem"
|
data/lib/oauth/helper.rb
CHANGED
@@ -1,5 +1,5 @@
|
|
1
|
-
require
|
2
|
-
require
|
1
|
+
require "openssl"
|
2
|
+
require "base64"
|
3
3
|
|
4
4
|
module OAuth
|
5
5
|
module Helper
|
@@ -19,16 +19,16 @@ module OAuth
|
|
19
19
|
end
|
20
20
|
|
21
21
|
def unescape(value)
|
22
|
-
URI::DEFAULT_PARSER.unescape(value.gsub(
|
22
|
+
URI::DEFAULT_PARSER.unescape(value.gsub("+", "%2B"))
|
23
23
|
end
|
24
24
|
|
25
25
|
# Generate a random key of up to +size+ bytes. The value returned is Base64 encoded with non-word
|
26
26
|
# characters removed.
|
27
|
-
def generate_key(size=32)
|
28
|
-
Base64.encode64(OpenSSL::Random.random_bytes(size)).gsub(/\W/,
|
27
|
+
def generate_key(size = 32)
|
28
|
+
Base64.encode64(OpenSSL::Random.random_bytes(size)).gsub(/\W/, "")
|
29
29
|
end
|
30
30
|
|
31
|
-
|
31
|
+
alias generate_nonce generate_key
|
32
32
|
|
33
33
|
def generate_timestamp #:nodoc:
|
34
34
|
Time.now.to_i.to_s
|
@@ -47,18 +47,22 @@ module OAuth
|
|
47
47
|
# make sure the array has an element so we don't lose the key
|
48
48
|
values << nil if values.empty?
|
49
49
|
# multiple values were provided for a single key
|
50
|
-
values.
|
51
|
-
|
50
|
+
if values[0].is_a?(Hash)
|
51
|
+
normalize_nested_query(values, k)
|
52
|
+
else
|
53
|
+
values.sort.collect do |v|
|
54
|
+
[escape(k), escape(v)].join("=")
|
55
|
+
end
|
52
56
|
end
|
53
57
|
elsif values.is_a?(Hash)
|
54
58
|
normalize_nested_query(values, k)
|
55
59
|
else
|
56
|
-
[escape(k),escape(values)]
|
60
|
+
[escape(k), escape(values)].join("=")
|
57
61
|
end
|
58
62
|
end * "&"
|
59
63
|
end
|
60
64
|
|
61
|
-
#Returns a string representation of the Hash like in URL query string
|
65
|
+
# Returns a string representation of the Hash like in URL query string
|
62
66
|
# build_nested_query({:level_1 => {:level_2 => ['value_1','value_2']}}, 'prefix'))
|
63
67
|
# #=> ["prefix%5Blevel_1%5D%5Blevel_2%5D%5B%5D=value_1", "prefix%5Blevel_1%5D%5Blevel_2%5D%5B%5D=value_2"]
|
64
68
|
def normalize_nested_query(value, prefix = nil)
|
@@ -72,7 +76,7 @@ module OAuth
|
|
72
76
|
normalize_nested_query(v, prefix ? "#{prefix}[#{k}]" : k)
|
73
77
|
end.flatten.sort
|
74
78
|
else
|
75
|
-
[escape(prefix), escape(value)]
|
79
|
+
[escape(prefix), escape(value)].join("=")
|
76
80
|
end
|
77
81
|
end
|
78
82
|
|
@@ -86,10 +90,10 @@ module OAuth
|
|
86
90
|
#
|
87
91
|
def parse_header(header)
|
88
92
|
# decompose
|
89
|
-
params = header[6,header.length].split(/[,=&]/)
|
93
|
+
params = header[6, header.length].split(/[,=&]/)
|
90
94
|
|
91
95
|
# odd number of arguments - must be a malformed header.
|
92
|
-
raise OAuth::Problem
|
96
|
+
raise OAuth::Problem, "Invalid authorization header" if params.size.odd?
|
93
97
|
|
94
98
|
params.map! do |v|
|
95
99
|
# strip and unescape
|
data/lib/oauth/oauth.rb
CHANGED
@@ -1,12 +1,12 @@
|
|
1
1
|
module OAuth
|
2
2
|
# request tokens are passed between the consumer and the provider out of
|
3
3
|
# band (i.e. callbacks cannot be used), per section 6.1.1
|
4
|
-
OUT_OF_BAND = "oob"
|
4
|
+
OUT_OF_BAND = "oob".freeze
|
5
5
|
|
6
6
|
# required parameters, per sections 6.1.1, 6.3.1, and 7
|
7
|
-
PARAMETERS = %w
|
8
|
-
|
9
|
-
|
7
|
+
PARAMETERS = %w[oauth_callback oauth_consumer_key oauth_token
|
8
|
+
oauth_signature_method oauth_timestamp oauth_nonce oauth_verifier
|
9
|
+
oauth_version oauth_signature oauth_body_hash].freeze
|
10
10
|
|
11
11
|
# reserved character regexp, per section 5.1
|
12
12
|
RESERVED_CHARACTERS = /[^a-zA-Z0-9\-\.\_\~]/
|
@@ -1,5 +1,5 @@
|
|
1
|
-
require
|
2
|
-
require
|
1
|
+
require "action_controller"
|
2
|
+
require "action_controller/test_process"
|
3
3
|
|
4
4
|
module OAuth
|
5
5
|
module OAuthTestHelper
|
@@ -8,7 +8,7 @@ module OAuth
|
|
8
8
|
incoming.request_uri = request.path
|
9
9
|
incoming.host = request.uri.host
|
10
10
|
incoming.env["SERVER_PORT"] = request.uri.port
|
11
|
-
incoming.env[
|
11
|
+
incoming.env["REQUEST_METHOD"] = request.http_method
|
12
12
|
incoming
|
13
13
|
end
|
14
14
|
|
@@ -18,7 +18,7 @@ module OAuth
|
|
18
18
|
incoming.host = request.uri.host
|
19
19
|
incoming.env["HTTP_AUTHORIZATION"] = request.to_auth_string
|
20
20
|
incoming.env["SERVER_PORT"] = request.uri.port
|
21
|
-
incoming.env[
|
21
|
+
incoming.env["REQUEST_METHOD"] = request.http_method
|
22
22
|
incoming
|
23
23
|
end
|
24
24
|
end
|
@@ -1,22 +1,22 @@
|
|
1
|
-
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
require "active_support"
|
2
4
|
require "active_support/version"
|
3
|
-
require
|
4
|
-
require
|
5
|
+
require "action_controller"
|
6
|
+
require "uri"
|
5
7
|
|
6
|
-
if
|
7
|
-
|
8
|
-
|
9
|
-
require 'action_controller/request'
|
8
|
+
if Gem::Version.new(ActiveSupport::VERSION::STRING) < Gem::Version.new("3")
|
9
|
+
# rails 2.x
|
10
|
+
require "action_controller/request"
|
10
11
|
unless ActionController::Request::HTTP_METHODS.include?("patch")
|
11
12
|
ActionController::Request::HTTP_METHODS << "patch"
|
12
13
|
ActionController::Request::HTTP_METHOD_LOOKUP["PATCH"] = :patch
|
13
14
|
ActionController::Request::HTTP_METHOD_LOOKUP["patch"] = :patch
|
14
15
|
end
|
15
16
|
|
16
|
-
elsif
|
17
|
-
|
18
|
-
|
19
|
-
require 'action_dispatch/http/request'
|
17
|
+
elsif Gem::Version.new(ActiveSupport::VERSION::STRING) < Gem::Version.new("4")
|
18
|
+
# rails 3.x
|
19
|
+
require "action_dispatch/http/request"
|
20
20
|
unless ActionDispatch::Request::HTTP_METHODS.include?("patch")
|
21
21
|
ActionDispatch::Request::HTTP_METHODS << "patch"
|
22
22
|
ActionDispatch::Request::HTTP_METHOD_LOOKUP["PATCH"] = :patch
|
@@ -24,63 +24,66 @@ then # rails 3.x
|
|
24
24
|
end
|
25
25
|
|
26
26
|
else # rails 4.x and later - already has patch
|
27
|
-
require
|
27
|
+
require "action_dispatch/http/request"
|
28
28
|
end
|
29
29
|
|
30
|
-
module OAuth
|
31
|
-
|
32
|
-
|
30
|
+
module OAuth
|
31
|
+
module RequestProxy
|
32
|
+
class ActionControllerRequest < OAuth::RequestProxy::Base
|
33
|
+
proxies(defined?(::ActionDispatch::AbstractRequest) ? ::ActionDispatch::AbstractRequest : ::ActionDispatch::Request)
|
33
34
|
|
34
|
-
|
35
|
-
|
36
|
-
|
35
|
+
def method
|
36
|
+
request.method.to_s.upcase
|
37
|
+
end
|
37
38
|
|
38
|
-
|
39
|
-
|
40
|
-
|
39
|
+
def uri
|
40
|
+
request.url
|
41
|
+
end
|
41
42
|
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
43
|
+
def parameters
|
44
|
+
if options[:clobber_request]
|
45
|
+
options[:parameters] || {}
|
46
|
+
else
|
47
|
+
params = request_params.merge(query_params).merge(header_params)
|
48
|
+
params.stringify_keys! if params.respond_to?(:stringify_keys!)
|
49
|
+
params.merge(options[:parameters] || {})
|
50
|
+
end
|
49
51
|
end
|
50
|
-
end
|
51
52
|
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
53
|
+
# Override from OAuth::RequestProxy::Base to avoid roundtrip
|
54
|
+
# conversion to Hash or Array and thus preserve the original
|
55
|
+
# parameter names
|
56
|
+
def parameters_for_signature
|
57
|
+
params = []
|
58
|
+
params << options[:parameters].to_query if options[:parameters]
|
58
59
|
|
59
|
-
|
60
|
-
|
61
|
-
|
60
|
+
unless options[:clobber_request]
|
61
|
+
params << header_params.to_query
|
62
|
+
params << request.query_string unless query_string_blank?
|
62
63
|
|
63
|
-
|
64
|
-
params << request.raw_post
|
64
|
+
params << request.raw_post if raw_post_signature?
|
65
65
|
end
|
66
|
+
|
67
|
+
params.
|
68
|
+
join("&").split("&").
|
69
|
+
reject { |s| s.match(/\A\s*\z/) }.
|
70
|
+
map { |p| p.split("=").map { |esc| CGI.unescape(esc) } }.
|
71
|
+
reject { |kv| kv[0] == "oauth_signature" }
|
66
72
|
end
|
67
73
|
|
68
|
-
|
69
|
-
|
70
|
-
|
71
|
-
map { |p| p.split('=').map{|esc| CGI.unescape(esc)} }.
|
72
|
-
reject { |kv| kv[0] == 'oauth_signature'}
|
73
|
-
end
|
74
|
+
def raw_post_signature?
|
75
|
+
(request.post? || request.put?) && request.content_type.to_s.downcase.start_with?("application/x-www-form-urlencoded")
|
76
|
+
end
|
74
77
|
|
75
|
-
|
78
|
+
protected
|
76
79
|
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
+
def query_params
|
81
|
+
request.query_parameters
|
82
|
+
end
|
80
83
|
|
81
|
-
|
82
|
-
|
84
|
+
def request_params
|
85
|
+
request.request_parameters
|
86
|
+
end
|
83
87
|
end
|
84
|
-
|
85
88
|
end
|
86
89
|
end
|
@@ -1,7 +1,11 @@
|
|
1
|
-
|
1
|
+
# frozen_string_literal: true
|
2
2
|
|
3
|
-
|
4
|
-
|
5
|
-
|
3
|
+
require "oauth/request_proxy/rack_request"
|
4
|
+
|
5
|
+
module OAuth
|
6
|
+
module RequestProxy
|
7
|
+
class ActionDispatchRequest < OAuth::RequestProxy::RackRequest
|
8
|
+
proxies ::ActionDispatch::Request
|
9
|
+
end
|
6
10
|
end
|
7
11
|
end
|