oauth 1.1.0 → 1.1.6

data/lib/oauth/request_proxy/base.rb

@@ -8,8 +8,10 @@ module OAuth
     class Base
       include OAuth::Helper
 
-      def self.proxies(klass)
-        OAuth::RequestProxy.available_proxies[klass] = self
+      class << self
+        def proxies(klass)
+          OAuth::RequestProxy.available_proxies[klass] = self
+        end
       end
 
       attr_accessor :request, :options, :unsigned_parameters
@@ -23,15 +25,15 @@ module OAuth
       ## OAuth parameters
 
       def oauth_callback
-        parameters["oauth_callback"]
+        [parameters["oauth_callback"]].flatten.first
       end
 
       def oauth_consumer_key
-        parameters["oauth_consumer_key"]
+        [parameters["oauth_consumer_key"]].flatten.first
       end
 
       def oauth_nonce
-        parameters["oauth_nonce"]
+        [parameters["oauth_nonce"]].flatten.first
       end
 
       def oauth_signature
@@ -40,37 +42,35 @@ module OAuth
       end
 
       def oauth_signature_method
-        case parameters["oauth_signature_method"]
-        when Array
-          parameters["oauth_signature_method"].first
-        else
-          parameters["oauth_signature_method"]
-        end
+        [parameters["oauth_signature_method"]].flatten.first
       end
 
       def oauth_timestamp
-        parameters["oauth_timestamp"]
+        [parameters["oauth_timestamp"]].flatten.first
       end
 
       def oauth_token
-        parameters["oauth_token"]
+        [parameters["oauth_token"]].flatten.first
       end
 
+      # OAuth 1.0a only: value returned to the Consumer after user authorization
+      # and required when exchanging a Request Token for an Access Token.
+      # Not present in OAuth 1.0 flows.
       def oauth_verifier
-        parameters["oauth_verifier"]
+        [parameters["oauth_verifier"]].flatten.first
       end
 
       def oauth_version
-        parameters["oauth_version"]
+        [parameters["oauth_version"]].flatten.first
       end
 
       # TODO: deprecate these
-      alias consumer_key oauth_consumer_key
-      alias token oauth_token
-      alias nonce oauth_nonce
-      alias timestamp oauth_timestamp
-      alias signature oauth_signature
-      alias signature_method oauth_signature_method
+      alias_method :consumer_key, :oauth_consumer_key
+      alias_method :token, :oauth_token
+      alias_method :nonce, :oauth_nonce
+      alias_method :timestamp, :oauth_timestamp
+      alias_method :signature, :oauth_signature
+      alias_method :signature_method, :oauth_signature_method
 
       ## Parameter accessors
 
@@ -97,7 +97,7 @@ module OAuth
       # See 9.1.2 in specs
       def normalized_uri
         u = URI.parse(uri)
-        "#{u.scheme.downcase}://#{u.host.downcase}#{(u.scheme.casecmp("http").zero? && u.port != 80) || (u.scheme.casecmp("https").zero? && u.port != 443) ? ":#{u.port}" : ""}#{u.path && u.path != "" ? u.path : "/"}"
+        "#{u.scheme.downcase}://#{u.host.downcase}#{":#{u.port}" if (u.scheme.casecmp("http").zero? && u.port != 80) || (u.scheme.casecmp("https").zero? && u.port != 443)}#{(u.path && u.path != "") ? u.path : "/"}"
       end
 
       # See 9.1.1. in specs Normalize Request Parameters
@@ -130,14 +130,14 @@ module OAuth
       def signed_uri(with_oauth: true)
         if signed?
           params = if with_oauth
-                     parameters
-                   else
-                     non_oauth_parameters
-                   end
+            parameters
+          else
+            non_oauth_parameters
+          end
 
           [uri, normalize(params)].join("?")
         else
-          warn "This request has not yet been signed!"
+          warn("This request has not yet been signed!")
         end
       end
 
@@ -177,6 +177,17 @@ module OAuth
 
         {}
       end
+
+      # Utility to make parameter values array-style (or keep nil) so that
+      # subclasses can rely on array values for parameter merging/signing.
+      # Mirrors the implementation previously present in
+      # ActionDispatchRequest#wrap_values.
+      def wrap_values(hash)
+        return {} unless hash
+        hash.each_with_object({}) do |(k, v), acc|
+          acc[k] = (v.is_a?(Array) || v.nil?) ? v : [v]
+        end
+      end
     end
   end
 end

data/lib/oauth/request_proxy/em_http_request.rb

@@ -1,74 +1,75 @@
 # frozen_string_literal: true
 
 require "oauth/request_proxy/base"
-# em-http also uses adddressable so there is no need to require uri.
-require "em-http"
+require "oauth/optional"
 require "cgi"
 
-module OAuth
-  module RequestProxy
-    module EventMachine
-      class HttpRequest < OAuth::RequestProxy::Base
-        # A Proxy for use when you need to sign EventMachine::HttpClient instances.
-        # It needs to be called once the client is construct but before data is sent.
-        # Also see oauth/client/em-http
-        proxies ::EventMachine::HttpClient
+if OAuth::Optional.em_http_available?
+  module OAuth
+    module RequestProxy
+      module EventMachine
+        class HttpRequest < OAuth::RequestProxy::Base
+          # A Proxy for use when you need to sign EventMachine::HttpClient instances.
+          # It needs to be called once the client is construct but before data is sent.
+          # Also see oauth/client/em-http
+          proxies ::EventMachine::HttpClient
 
-        # Request in this con
+          # Request in this con
 
-        def method
-          request.req[:method]
-        end
+          def method
+            request.req[:method]
+          end
 
-        def uri
-          request.conn.normalize.to_s
-        end
+          def uri
+            request.conn.normalize.to_s
+          end
 
-        def parameters
-          if options[:clobber_request]
-            options[:parameters]
-          else
-            all_parameters
+          def parameters
+            if options[:clobber_request]
+              options[:parameters]
+            else
+              all_parameters
+            end
           end
-        end
 
-        protected
+          protected
 
-        def all_parameters
-          merged_parameters({}, post_parameters, query_parameters, options[:parameters])
-        end
+          def all_parameters
+            merged_parameters({}, post_parameters, query_parameters, options[:parameters])
+          end
 
-        def query_parameters
-          quer = request.req[:query]
-          hash_quer = if quer.respond_to?(:merge)
-                        quer
-                      else
-                        CGI.parse(quer.to_s)
-                      end
-          CGI.parse(request.conn.query.to_s).merge(hash_quer)
-        end
+          def query_parameters
+            quer = request.req[:query]
+            hash_quer = if quer.respond_to?(:merge)
+              quer
+            else
+              CGI.parse(quer.to_s)
+            end
+            CGI.parse(request.conn.query.to_s).merge(hash_quer)
+          end
 
-        def post_parameters
-          headers = request.req[:head] || {}
-          form_encoded = headers["Content-Type"].to_s.downcase.start_with?("application/x-www-form-urlencoded")
-          if %w[POST PUT].include?(method) && form_encoded
-            CGI.parse(request.normalize_body(request.req[:body]).to_s)
-          else
-            {}
+          def post_parameters
+            headers = request.req[:head] || {}
+            form_encoded = headers["Content-Type"].to_s.downcase.start_with?("application/x-www-form-urlencoded")
+            if %w[POST PUT].include?(method) && form_encoded
+              CGI.parse(request.normalize_body(request.req[:body]).to_s)
+            else
+              {}
+            end
           end
-        end
 
-        def merged_parameters(params, *extra_params)
-          extra_params.compact.each do |params_pairs|
-            params_pairs.each_pair do |key, value|
-              if params.key?(key)
-                params[key.to_s] += value
-              else
-                params[key.to_s] = [value].flatten
+          def merged_parameters(params, *extra_params)
+            extra_params.compact.each do |params_pairs|
+              params_pairs.each_pair do |key, value|
+                if params.key?(key)
+                  params[key.to_s] += value
+                else
+                  params[key.to_s] = [value].flatten
+                end
               end
             end
+            params
           end
-          params
         end
       end
     end

data/lib/oauth/request_proxy/jabber_request.rb

@@ -18,8 +18,15 @@ module OAuth
         oauth = @request.get_elements("//oauth").first
         return @params unless oauth
 
-        %w[ oauth_token oauth_consumer_key oauth_signature_method oauth_signature
-            oauth_timestamp oauth_nonce oauth_version ].each do |param|
+        %w[
+          oauth_token
+          oauth_consumer_key
+          oauth_signature_method
+          oauth_signature
+          oauth_timestamp
+          oauth_nonce
+          oauth_version
+        ].each do |param|
           next unless (element = oauth.first_element(param))
 
           @params[param] = element.text

data/lib/oauth/request_proxy/net_http.rb

@@ -69,7 +69,7 @@ module OAuth
           end
 
           def auth_header_params
-            return nil unless request["Authorization"] && request["Authorization"][0, 5] == "OAuth"
+            return unless request["Authorization"] && request["Authorization"][0, 5] == "OAuth"
 
             request["Authorization"]
           end

data/lib/oauth/request_proxy/rack_request.rb

@@ -26,10 +26,6 @@ module OAuth
         end
       end
 
-      def signature
-        parameters["oauth_signature"]
-      end
-
       protected
 
       def query_params

data/lib/oauth/request_proxy/rest_client_request.rb

@@ -34,7 +34,8 @@ module OAuth
           query ? CGI.parse(query) : {}
         end
 
-        def request_params; end
+        def request_params
+        end
 
         def post_parameters
           # Post params are only used if posting form data
@@ -52,9 +53,9 @@ module OAuth
           query.split("&").inject({}) do |result, q|
             k, v = q.split("=")
             if !v.nil?
-              result.merge({ k => v })
+              result.merge({k => v})
             elsif !result.key?(k)
-              result.merge({ k => true })
+              result.merge({k => true})
             else
               result
             end

data/lib/oauth/request_proxy.rb

@@ -2,24 +2,28 @@
 
 module OAuth
   module RequestProxy
-    def self.available_proxies # :nodoc:
-      @available_proxies ||= {}
-    end
+    AVAILABLE_PROXIES = {}
 
-    def self.proxy(request, options = {})
-      return request if request.is_a?(OAuth::RequestProxy::Base)
+    class << self
+      def available_proxies # :nodoc:
+        AVAILABLE_PROXIES
+      end
 
-      klass = available_proxies[request.class]
+      def proxy(request, options = {})
+        return request if request.is_a?(OAuth::RequestProxy::Base)
 
-      # Search for possible superclass matches.
-      if klass.nil?
-        request_parent = available_proxies.keys.find { |rc| request.is_a?(rc) }
-        klass = available_proxies[request_parent]
-      end
+        klass = available_proxies[request.class]
 
-      raise UnknownRequestType, request.class.to_s unless klass
+        # Search for possible superclass matches.
+        if klass.nil?
+          request_parent = available_proxies.keys.find { |rc| request.is_a?(rc) }
+          klass = available_proxies[request_parent]
+        end
 
-      klass.new(request, options)
+        raise UnknownRequestType, request.class.to_s unless klass
+
+        klass.new(request, options)
+      end
     end
 
     class UnknownRequestType < RuntimeError; end

data/lib/oauth/server.rb

@@ -7,12 +7,13 @@ module OAuth
   # This is mainly used to create consumer credentials and can pretty much be ignored if you want to create your own
   class Server
     include OAuth::Helper
+
     attr_accessor :base_url
 
     @@server_paths = {
       request_token_path: "/oauth/request_token",
       authorize_path: "/oauth/authorize",
-      access_token_path: "/oauth/access_token"
+      access_token_path: "/oauth/access_token",
     }
 
     # Create a new server instance
@@ -32,13 +33,16 @@ module OAuth
     # mainly for testing purposes
     def create_consumer
       creds = generate_credentials
-      Consumer.new(creds[0], creds[1],
-                   {
-                     site: base_url,
-                     request_token_path: request_token_path,
-                     authorize_path: authorize_path,
-                     access_token_path: access_token_path
-                   })
+      Consumer.new(
+        creds[0],
+        creds[1],
+        {
+          site: base_url,
+          request_token_path: request_token_path,
+          authorize_path: authorize_path,
+          access_token_path: access_token_path,
+        },
+      )
     end
 
     def request_token_path

data/lib/oauth/signature/base.rb

@@ -7,17 +7,27 @@ require "base64"
 
 module OAuth
   module Signature
+    # Base class for OAuth signature implementations.
+    #
+    # Includes {OAuth::AUTH_SANITIZER::FilteredAttributes} so inspect output redacts
+    # secret-bearing fields captured during signature construction.
     class Base
       include OAuth::Helper
+      include OAuth::AUTH_SANITIZER::FilteredAttributes
 
+      # Signature construction options.
+      #
+      # @return [Hash]
       attr_accessor :options
       attr_reader :token_secret, :consumer_secret, :request
+      filtered_attributes :options, :consumer_secret, :token_secret
 
-      def self.implements(signature_method = nil)
-        return @implements if signature_method.nil?
+      class << self
+        def implements(signature_method = nil)
+          return OAuth::Signature.available_methods.key(self) if signature_method.nil?
 
-        @implements = signature_method
-        OAuth::Signature.available_methods[@implements] = self
+          OAuth::Signature.available_methods[signature_method] = self
+        end
       end
 
       def initialize(request, options = {}, &block)
@@ -43,7 +53,7 @@ module OAuth
         # override secrets based on the values returned from the block (if any)
         if block
           # consumer secret and token secret need to be looked up based on pieces of the request
-          secrets = yield block.arity == 1 ? request : [token, consumer_key, nonce, request.timestamp]
+          secrets = yield (block.arity == 1) ? request : [token, consumer_key, nonce, request.timestamp]
           if secrets.is_a?(Array) && secrets.size == 2
             @token_secret = secrets[0]
             @consumer_secret = secrets[1]

data/lib/oauth/signature/rsa/sha1.rb

@@ -9,8 +9,8 @@ module OAuth
         implements "rsa-sha1"
 
         def ==(other)
-          public_key.verify(OpenSSL::Digest.new("SHA1"),
-                            Base64.decode64(other.is_a?(Array) ? other.first : other), signature_base_string)
+          decoded = Base64.decode64(other.is_a?(Array) ? other.first : other)
+          public_key.verify(OpenSSL::Digest.new("SHA1"), decoded, signature_base_string)
         end
 
         def public_key
@@ -25,7 +25,14 @@ module OAuth
         end
 
         def body_hash
-          Base64.encode64(OpenSSL::Digest.digest("SHA1", request.body || "")).chomp.delete("\n")
+          # Use SHA1 body hash with compatibility across OpenSSL versions
+          data = request.body || ""
+          begin
+            digest_bytes = OpenSSL::Digest.digest("SHA1", data)
+          rescue StandardError
+            digest_bytes = ::Digest::SHA1.digest(data)
+          end
+          Base64.encode64(digest_bytes).chomp.delete("\n")
         end
 
         private
@@ -47,7 +54,7 @@ module OAuth
               options[:private_key]
             else
               consumer_secret
-            end
+            end,
           )
 
           private_key.sign(OpenSSL::Digest.new("SHA1"), signature_base_string)

data/lib/oauth/signature.rb

@@ -2,45 +2,49 @@
 
 module OAuth
   module Signature
-    # Returns a list of available signature methods
-    def self.available_methods
-      @available_methods ||= {}
-    end
-
-    # Build a signature from a +request+.
-    #
-    # Raises UnknownSignatureMethod exception if the signature method is unknown.
-    def self.build(request, options = {}, &block)
-      request = OAuth::RequestProxy.proxy(request, options)
-      klass = available_methods[
-        (request.signature_method ||
-        ((c = request.options[:consumer]) && c.options[:signature_method]) ||
-        "").downcase]
-      raise UnknownSignatureMethod, request.signature_method unless klass
-
-      klass.new(request, options, &block)
-    end
-
-    # Sign a +request+
-    def self.sign(request, options = {}, &block)
-      build(request, options, &block).signature
-    end
-
-    # Verify the signature of +request+
-    def self.verify(request, options = {}, &block)
-      build(request, options, &block).verify
-    end
-
-    # Create the signature base string for +request+. This string is the normalized parameter information.
-    #
-    # See Also: {OAuth core spec version 1.0, section 9.1.1}[http://oauth.net/core/1.0#rfc.section.9.1.1]
-    def self.signature_base_string(request, options = {}, &block)
-      build(request, options, &block).signature_base_string
-    end
-
-    # Create the body hash for a request
-    def self.body_hash(request, options = {}, &block)
-      build(request, options, &block).body_hash
+    AVAILABLE_METHODS = {}
+
+    class << self
+      # Returns a list of available signature methods
+      def available_methods
+        AVAILABLE_METHODS
+      end
+
+      # Build a signature from a +request+.
+      #
+      # Raises UnknownSignatureMethod exception if the signature method is unknown.
+      def build(request, options = {}, &block)
+        request = OAuth::RequestProxy.proxy(request, options)
+        klass = available_methods[
+          (request.signature_method ||
+          ((c = request.options[:consumer]) && c.options[:signature_method]) ||
+          "").downcase]
+        raise UnknownSignatureMethod, request.signature_method unless klass
+
+        klass.new(request, options, &block)
+      end
+
+      # Sign a +request+
+      def sign(request, options = {}, &block)
+        build(request, options, &block).signature
+      end
+
+      # Verify the signature of +request+
+      def verify(request, options = {}, &block)
+        build(request, options, &block).verify
+      end
+
+      # Create the signature base string for +request+. This string is the normalized parameter information.
+      #
+      # See Also: {OAuth core spec version 1.0, section 9.1.1}[http://oauth.net/core/1.0#rfc.section.9.1.1]
+      def signature_base_string(request, options = {}, &block)
+        build(request, options, &block).signature_base_string
+      end
+
+      # Create the body hash for a request
+      def body_hash(request, options = {}, &block)
+        build(request, options, &block).body_hash
+      end
     end
 
     class UnknownSignatureMethod < RuntimeError; end

data/lib/oauth/tokens/access_token.rb

@@ -8,7 +8,7 @@ module OAuth
     def request(http_method, path, *arguments)
       request_uri = URI.parse(path)
       site_uri = consumer.uri
-      is_service_uri_different = (request_uri.absolute? && request_uri != site_uri)
+      is_service_uri_different = request_uri.absolute? && request_uri != site_uri
       begin
         consumer.uri(request_uri) if is_service_uri_different
         @response = super(http_method, path, *arguments)

data/lib/oauth/tokens/consumer_token.rb

@@ -4,18 +4,20 @@ module OAuth
   # Superclass for tokens used by OAuth Clients
   class ConsumerToken < Token
     attr_accessor :consumer, :params
-    attr_reader   :response
+    attr_reader :response
 
-    def self.from_hash(consumer, hash)
-      token = new(consumer, hash[:oauth_token], hash[:oauth_token_secret])
-      token.params = hash
-      token
+    class << self
+      def from_hash(consumer, hash)
+        token = new(consumer, hash[:oauth_token], hash[:oauth_token_secret])
+        token.params = hash
+        token
+      end
     end
 
     def initialize(consumer, token = "", secret = "")
       super(token, secret)
       @consumer = consumer
-      @params   = {}
+      @params = {}
     end
 
     # Make a signed request using given http_method to the path

data/lib/oauth/tokens/request_token.rb

@@ -6,14 +6,14 @@ module OAuth
   class RequestToken < ConsumerToken
     # Generate an authorization URL for user authorization
     def authorize_url(params = nil)
-      return nil if token.nil?
+      return if token.nil?
 
       params = (params || {}).merge(oauth_token: token)
       build_url(consumer.authorize_url, params)
     end
 
     def authenticate_url(params = nil)
-      return nil if token.nil?
+      return if token.nil?
 
       params = (params || {}).merge(oauth_token: token)
       build_url(consumer.authenticate_url, params)
@@ -25,8 +25,13 @@ module OAuth
 
     # exchange for AccessToken on server
     def get_access_token(options = {}, *arguments)
-      response = consumer.token_request(consumer.http_method,
-                                        (consumer.access_token_url? ? consumer.access_token_url : consumer.access_token_path), self, options, *arguments)
+      response = consumer.token_request(
+        consumer.http_method,
+        (consumer.access_token_url? ? consumer.access_token_url : consumer.access_token_path),
+        self,
+        options,
+        *arguments,
+      )
       OAuth::AccessToken.from_hash(consumer, response)
     end