oauth2 2.0.25 → 2.1.0

data/lib/oauth2/client.rb

@@ -66,6 +66,9 @@ module OAuth2
         raise_errors: true,
         logger: ::Logger.new($stdout),
         access_token_class: AccessToken,
+        # Default changed from true to false in 2.1.0 for security.
+        # Cross-origin redirects are now rejected before credentials are replayed.
+        allow_cross_origin_redirects: false,
       }.merge(opts)
       @options[:connection_opts][:ssl] = ssl if ssl
     end
@@ -491,13 +494,29 @@ module OAuth2
     def sanitize_redirect_options(req_opts, current_location, next_location)
       return req_opts unless cross_origin_redirect?(current_location, next_location)
 
-      headers = req_opts[:headers]
-      return req_opts unless headers && headers.any? { |key, _value| authorization_header?(key) }
+      unless options[:allow_cross_origin_redirects]
+        raise OAuth2::Error.new(
+          "error" => "cross_origin_redirect_blocked",
+          "error_description" => "Cross-origin redirect blocked: #{current_location.scheme}://#{current_location.host} -> #{next_location.scheme}://#{next_location.host}. " \
+            "Set allow_cross_origin_redirects: true to allow (deprecated)."
+        )
+      end
 
       safe_opts = req_opts.dup
-      safe_headers = headers.dup
-      safe_headers.delete_if { |key, _value| authorization_header?(key) }
-      safe_opts[:headers] = safe_headers
+
+      [:headers, "headers"].each do |key|
+        headers = safe_opts[key]
+        next unless headers && headers.any? { |header, _value| authorization_header?(header) }
+
+        safe_headers = headers.dup
+        safe_headers.delete_if { |header, _value| authorization_header?(header) }
+        safe_opts[key] = safe_headers
+      end
+
+      safe_opts.delete(:body)
+      safe_opts.delete("body")
+      safe_opts.delete(:params)
+      safe_opts.delete("params")
       safe_opts
     end
 
@@ -600,17 +619,28 @@ module OAuth2
     #
     # @api private
     def build_access_token_legacy(response, access_token_opts, extract_access_token)
-      extract_access_token.call(self, response.parsed.merge(access_token_opts))
-    rescue
-      # An error will be raised by the called if nil is returned and options[:raise_errors] is truthy, so this rescue is but temporary.
-      # Unfortunately, it does hide the real error, but this is deprecated legacy code,
-      #   and this was effectively the long-standing pre-existing behavior, so there is little point in changing it.
-      nil
+      parsed = response.parsed
+      begin
+        extract_access_token.call(self, parsed.merge(access_token_opts))
+      rescue
+        # An error will be raised by the called if nil is returned and options[:raise_errors] is truthy, so this rescue is but temporary.
+        # Unfortunately, it does hide the real error, but this is deprecated legacy code,
+        #   and this was effectively the long-standing pre-existing behavior, so there is little point in changing it.
+        nil
+      end
     end
 
     def oauth_debug_logging(builder)
       if OAuth2::OAUTH_DEBUG
         config = OAuth2.config
+        logger_options = {bodies: true}
+        # Faraday >= 1.0 supports pluggable formatters; use ours to redact
+        # structured (Hash/Array) bodies before Faraday renders them.
+        if defined?(OAuth2::SanitizedLogFormatter)
+          # Faraday instantiates the formatter with (logger:, options:); the
+          # formatter snapshots redaction config from OAuth2.config at that point.
+          logger_options[:formatter] = OAuth2::SanitizedLogFormatter
+        end
         builder.response(
           :logger,
           OAuth2::AUTH_SANITIZER::SanitizedLogger.new(
@@ -618,7 +648,7 @@ module OAuth2
             filtered_keys: config[:filtered_debug_keys],
             label: config[:filtered_label]
           ),
-          bodies: true
+          **logger_options
         )
       end
     end

data/lib/oauth2/sanitized_log_formatter.rb

@@ -0,0 +1,198 @@
+# frozen_string_literal: true
+
+require "faraday"
+
+begin
+  require "faraday/logging/formatter"
+rescue LoadError
+  # Faraday 0.x has no pluggable logging formatter; the text sanitizer remains
+  # active through OAuth2::AUTH_SANITIZER::SanitizedLogger.
+end
+
+module OAuth2
+  if defined?(Faraday::Logging::Formatter) # Faraday >= 1.0
+    # Faraday logging formatter that redacts sensitive values from Hash and Array
+    # request/response bodies BEFORE Faraday renders them (via `pretty_inspect`).
+    #
+    # Text-level sanitization ({OAuth2::AUTH_SANITIZER::SanitizedLogger}) remains as a
+    # second layer for headers, query strings, and already-serialized bodies.
+    #
+    # Redaction rules:
+    # - keys matching any filtered key (case-insensitive) are redacted, nested at any depth
+    # - the authorization `code` is redacted only in an authorization_code grant context,
+    #   detected from the request URL query or the body itself, so non-secret codes
+    #   (e.g. error codes) are preserved
+    # - cyclic structures are tolerated
+    #
+    # Requires Faraday >= 1.0 (Faraday::Logging::Formatter). On Faraday 0.17 this
+    # class is not defined and the caller falls back to text-level sanitization only.
+    #
+    # @api private
+    class SanitizedLogFormatter < Faraday::Logging::Formatter
+      # Keys redacted only in an authorization_code grant context.
+      CONTEXTUAL_KEYS = %w[code].freeze
+
+      # Faraday instantiates formatters itself with (logger:, options:), so the
+      # redaction configuration falls back to the current OAuth2.config values.
+      #
+      # @param filtered_keys [Array<String>, nil] key names to redact unconditionally
+      # @param label [String, nil] replacement label
+      # @param options [Hash] Faraday formatter options
+      def initialize(filtered_keys: nil, label: nil, **options)
+        super(**options)
+        config = OAuth2.config
+        @filtered_keys = (filtered_keys || config[:filtered_debug_keys]).map { |key| key.to_s.downcase }.freeze
+        @label = (label || config[:filtered_label]).to_s
+        @code_context = false
+      end
+
+      # Log the request, detecting authorization_code context from the URL and body.
+      #
+      # @param env [Faraday::Env] request environment
+      def request(env)
+        with_code_context(env) do
+          if @code_context && env.respond_to?(:url) && env.url && env.url.query.to_s.include?("code=")
+            # Log a sanitized COPY of the env; the real request must keep its URL.
+            sanitized_env = env.dup
+            sanitized_env.url = sanitize_url_code(env.url)
+            super(sanitized_env)
+          else
+            super
+          end
+        end
+      end
+
+      # Log the response, detecting authorization_code context from the URL and body.
+      #
+      # @param env [Faraday::Env] response environment
+      def response(env)
+        with_code_context(env) { super }
+      end
+
+      # Redact structured bodies before rendering; leave everything else to the parent.
+      #
+      # @param body [Object] request or response body
+      # @return [String] rendered body for logging
+      def dump_body(body)
+        case body
+        when Hash, Array
+          super(redact_structured(body, seen: {}, code_sensitive: @code_context))
+        when String
+          super(@code_context ? redact_code_in_string(body) : body)
+        else
+          super
+        end
+      end
+
+    private
+
+      # Redact the authorization `code` value in URL-encoded, JSON, and
+      # Hash#inspect-shaped string bodies. Only called in authorization_code
+      # grant context, so `code` always names the credential here.
+      def redact_code_in_string(body)
+        body.dup.scrub.
+          gsub(/\bcode=[^&\s"']+/, "code=#{@label}").
+          gsub(/("code"\s*:\s*")[^"]*(")/i) { "#{$1}#{@label}#{$2}" }.
+          gsub(/(("code"|code:)\s*=>?\s*")[^"]*(")/i) { "#{$1}#{@label}#{$3}" }
+      end
+
+      # Redact the `code` query parameter of a URL, returning a new URI.
+      def sanitize_url_code(url)
+        sanitized = url.dup
+        pairs = sanitized.query.to_s.tr("+", " ").split("&").map do |pair|
+          pair.start_with?("code=") ? "code=#{@label}" : pair
+        end
+        sanitized.query = pairs.join("&")
+        sanitized
+      end
+
+      def with_code_context(env)
+        previous = @code_context
+        @code_context = previous || authorization_code_request?(env)
+        yield
+      ensure
+        @code_context = previous
+      end
+
+      def authorization_code_request?(env)
+        url = env.respond_to?(:url) ? env.url : nil
+        if url
+          query_pairs = url.query.to_s.tr("+", " ").split("&")
+          return true if query_pairs.any? { |pair| pair == "grant_type=authorization_code" }
+        end
+
+        body = env.respond_to?(:body) ? env.body : nil
+        case body
+        when String
+          scrubbed = body.dup.scrub
+          scrubbed.match?(/grant_type=authorization_code/) ||
+            scrubbed.match?(/grant(?:\\u005f|_)type\\?"?\s*:\s*\\?"authorization_code/)
+        else
+          authorization_code_context?(body) || authorization_code_pairs_context?(body)
+        end
+      end
+
+      def redact_structured(node, seen:, code_sensitive:)
+        return node if node.nil?
+
+        case node
+        when Hash
+          object_id = node.object_id
+          return seen[object_id] if seen.key?(object_id)
+
+          copy = {}
+          seen[object_id] = copy
+          code_sensitive ||= authorization_code_context?(node)
+          node.each do |key, value|
+            copy[key] = if redact_key?(key, redact_code: code_sensitive)
+              @label
+            else
+              redact_structured(value, seen: seen, code_sensitive: code_sensitive)
+            end
+          end
+          copy
+        when Array
+          object_id = node.object_id
+          return seen[object_id] if seen.key?(object_id)
+
+          copy = []
+          seen[object_id] = copy
+          code_sensitive ||= authorization_code_pairs_context?(node)
+          if pair_array?(node)
+            node.each do |pair|
+              copy << if redact_key?(pair[0], redact_code: code_sensitive)
+                [pair[0], @label]
+              else
+                [pair[0], redact_structured(pair[1], seen: seen, code_sensitive: code_sensitive)]
+              end
+            end
+          else
+            node.each { |element| copy << redact_structured(element, seen: seen, code_sensitive: code_sensitive) }
+          end
+          copy
+        else
+          node
+        end
+      end
+
+      def redact_key?(key, redact_code:)
+        name = key.to_s.downcase
+        return true if @filtered_keys.include?(name)
+
+        redact_code && CONTEXTUAL_KEYS.include?(name)
+      end
+
+      def authorization_code_context?(node)
+        node.is_a?(Hash) && node.any? { |key, value| key.to_s == "grant_type" && value.to_s == "authorization_code" }
+      end
+
+      def pair_array?(node)
+        node.is_a?(Array) && !node.empty? && node.all? { |element| element.is_a?(Array) && element.length == 2 }
+      end
+
+      def authorization_code_pairs_context?(node)
+        pair_array?(node) && node.any? { |pair| pair[0].to_s == "grant_type" && pair[1].to_s == "authorization_code" }
+      end
+    end
+  end
+end

data/lib/oauth2/version.rb

@@ -1,8 +1,11 @@
 # frozen_string_literal: true
 
 module OAuth2
+  # Version namespace for this gem.
   module Version
-    VERSION = "2.0.25"
+    # Current gem version.
+    VERSION = "2.1.0"
   end
+  # Current gem version exposed at the traditional constant location.
   VERSION = Version::VERSION # Traditional Constant Location
 end

data/lib/oauth2.rb

@@ -9,9 +9,9 @@ require "snaky_hash"
 require "version_gem"
 
 # includes gem files
-require_relative "oauth2/version"
 require_relative "oauth2/auth_sanitizer"
 require_relative "oauth2/filtered_attributes"
+require_relative "oauth2/sanitized_log_formatter"
 require_relative "oauth2/error"
 require_relative "oauth2/authenticator"
 require_relative "oauth2/client"
@@ -23,6 +23,7 @@ require_relative "oauth2/strategy/client_credentials"
 require_relative "oauth2/strategy/assertion"
 require_relative "oauth2/access_token"
 require_relative "oauth2/response"
+require_relative "oauth2/version"
 
 # The namespace of this library
 #
@@ -67,6 +68,14 @@ module OAuth2
       assertion
       code_verifier
       token
+      password
+      client_assertion
+      device_code
+      subject_token
+      actor_token
+      accessToken
+      refreshToken
+      idToken
     ]
   )
 
@@ -98,6 +107,7 @@ end
 OAuth2::AUTH_SANITIZER.filtered_label_provider = -> { OAuth2.config[:filtered_label] }
 
 # Extend OAuth2::Version with VersionGem helpers to provide semantic version helpers.
+
 OAuth2::Version.class_eval do
   extend VersionGem::Basic
 end

data/sig/oauth2.rbs

@@ -6,4 +6,210 @@ module OAuth2
 
   def self.config: () -> untyped
   def self.configure: () { (untyped) -> void } -> void
+  module Version
+    VERSION: String
+  end
+  VERSION: String
+  class AccessToken
+    def self.from_hash: (OAuth2::Client, Hash[untyped, untyped]) -> OAuth2::AccessToken
+    def self.from_kvform: (OAuth2::Client, String) -> OAuth2::AccessToken
+
+    def initialize: (OAuth2::Client, String, ?Hash[Symbol, untyped]) -> void
+    def []: (String | Symbol) -> untyped
+    def expires?: () -> bool
+    def expired?: () -> bool
+    def refresh: (?Hash[untyped, untyped], ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::AccessToken
+    def revoke: (?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+    def to_hash: () -> Hash[Symbol, untyped]
+    def request: (Symbol, String, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+    def get: (String, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+    def post: (String, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+    def put: (String, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+    def patch: (String, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+    def delete: (String, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+    def headers: () -> Hash[String, String]
+    def configure_authentication!: (Hash[Symbol, untyped], Symbol) -> void
+    def convert_expires_at: (untyped) -> (Time | Integer | nil)
+
+    attr_accessor response: OAuth2::Response
+  end
+
+  class Authenticator
+    include OAuth2::FilteredAttributes
+
+    attr_reader mode: (Symbol | String)
+    attr_reader id: String?
+    attr_reader secret: String?
+
+    def initialize: (String? id, String? secret, (Symbol | String) mode) -> void
+
+    def apply: (Hash[untyped, untyped]) -> Hash[untyped, untyped]
+
+    def self.encode_basic_auth: (String, String) -> String
+
+    private
+
+    def apply_params_auth: (Hash[untyped, untyped]) -> Hash[untyped, untyped]
+    def apply_client_id: (Hash[untyped, untyped]) -> Hash[untyped, untyped]
+    def apply_basic_auth: (Hash[untyped, untyped]) -> Hash[untyped, untyped]
+    def basic_auth_header: () -> Hash[String, String]
+  end
+
+  class Client
+    RESERVED_REQ_KEYS: Array[String]
+    RESERVED_PARAM_KEYS: Array[String]
+
+    include OAuth2::FilteredAttributes
+
+    attr_reader id: String
+    attr_reader secret: String
+    attr_reader site: String?
+    attr_accessor options: Hash[Symbol, untyped]
+    attr_writer connection: untyped
+
+    def initialize: (String client_id, String client_secret, ?Hash[Symbol, untyped]) { (untyped) -> void } -> void
+
+    def site=: (String) -> String
+
+    def connection: () -> untyped
+
+    def authorize_url: (?Hash[untyped, untyped]) -> String
+    def token_url: (?Hash[untyped, untyped]) -> String
+    def revoke_url: (?Hash[untyped, untyped]) -> String
+
+    def request: (Symbol verb, String url, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+
+    def get_token: (Hash[untyped, untyped] params, ?Hash[Symbol, untyped] access_token_opts, ?Proc) { (Hash[Symbol, untyped]) -> void } -> (OAuth2::AccessToken | nil)
+
+    def revoke_token: (String token, ?String token_type_hint, ?Hash[Symbol, untyped]) { (untyped) -> void } -> OAuth2::Response
+
+    def http_method: () -> Symbol
+
+    def auth_code: () -> OAuth2::Strategy::AuthCode
+    def implicit: () -> OAuth2::Strategy::Implicit
+    def password: () -> OAuth2::Strategy::Password
+    def client_credentials: () -> OAuth2::Strategy::ClientCredentials
+    def assertion: () -> OAuth2::Strategy::Assertion
+
+    def redirection_params: () -> Hash[String, String]
+
+    private
+
+    def params_to_req_opts: (Hash[untyped, untyped]) -> Hash[Symbol, untyped]
+    def parse_snaky_params_headers: (Hash[untyped, untyped]) -> [Symbol, bool, untyped, (Symbol | nil), Hash[untyped, untyped], Hash[String, String]]
+    def execute_request: (Symbol verb, String url, ?Hash[Symbol, untyped]) { (Faraday::Request) -> void } -> OAuth2::Response
+    def authenticator: () -> OAuth2::Authenticator
+    def parse_response_legacy: (OAuth2::Response, Hash[Symbol, untyped], Proc) -> (OAuth2::AccessToken | nil)
+    def parse_response: (OAuth2::Response, Hash[Symbol, untyped]) -> (OAuth2::AccessToken | nil)
+    def build_access_token: (OAuth2::Response, Hash[Symbol, untyped], untyped) -> OAuth2::AccessToken
+    def build_access_token_legacy: (OAuth2::Response, Hash[Symbol, untyped], Proc) -> (OAuth2::AccessToken | nil)
+    def oauth_debug_logging: (untyped) -> void
+  end
+
+  class Error < StandardError
+    def initialize: (OAuth2::Response) -> void
+    def code: () -> (String | Integer | nil)
+    def description: () -> (String | nil)
+    def response: () -> OAuth2::Response
+  end
+
+  module FilteredAttributes
+    module InitializerMethods
+      def initialize: (*untyped args) { () -> untyped } -> untyped
+    end
+
+    def self.included: (untyped) -> untyped
+    def filtered_attributes: (*(String | Symbol)) -> void
+    def thing_filter: () -> OAuth2::ThingFilter
+  end
+
+  class Response
+    DEFAULT_OPTIONS: Hash[Symbol, untyped]
+
+    def self.register_parser: (Symbol key, (Array[String] | String) mime_types) { (String) -> untyped } -> void
+
+    def initialize: (untyped response, parse: Symbol?, snaky: bool?, snaky_hash_klass: untyped?, options: Hash[Symbol, untyped]?) -> void
+    def headers: () -> Hash[untyped, untyped]
+    def status: () -> Integer
+    def body: () -> String
+    def parsed: () -> untyped
+    def content_type: () -> (String | nil)
+    def parser: () -> (untyped | nil)
+
+    attr_reader response: untyped
+    attr_accessor options: Hash[Symbol, untyped]
+  end
+
+  class SanitizedLogger
+    def initialize: (untyped logger) -> void
+
+    def add: (untyped severity, ?untyped message, ?untyped progname) { () -> untyped } -> untyped
+    def <<: (String message) -> untyped
+    def debug: (?untyped progname) { () -> untyped } -> untyped
+    def info: (?untyped progname) { () -> untyped } -> untyped
+    def warn: (?untyped progname) { () -> untyped } -> untyped
+    def error: (?untyped progname) { () -> untyped } -> untyped
+    def fatal: (?untyped progname) { () -> untyped } -> untyped
+    def unknown: (?untyped progname) { () -> untyped } -> untyped
+    def close: () -> void
+    def formatter: () -> untyped
+    def formatter=: (untyped formatter) -> void
+    def level: () -> untyped
+    def level=: (untyped level) -> void
+    def progname: () -> untyped
+    def progname=: (untyped progname) -> void
+    def respond_to_missing?: (Symbol method_name, ?bool include_private) -> bool
+    def method_missing: (Symbol method_name, *untyped args) { () -> untyped } -> untyped
+
+    private
+
+    def log: (Symbol level, ?untyped progname) { () -> untyped } -> untyped
+    def sanitize: (untyped message) -> untyped
+    def thing_filter: () -> OAuth2::ThingFilter
+    def sanitize_authorization_header: (String message) -> String
+    def sanitize_json_pairs: (String message) -> String
+    def sanitize_form_and_query_pairs: (String message) -> String
+  end
+
+  module Strategy
+    class Base
+      def initialize: (OAuth2::Client) -> void
+    end
+
+    class AuthCode < Base
+      def authorize_params: (?Hash[untyped, untyped]) -> Hash[untyped, untyped]
+      def authorize_url: (?Hash[untyped, untyped]) -> String
+      def get_token: (String, ?Hash[untyped, untyped], ?Hash[Symbol, untyped]) -> OAuth2::AccessToken
+    end
+
+    class Implicit < Base
+      def authorize_params: (?Hash[untyped, untyped]) -> Hash[untyped, untyped]
+      def authorize_url: (?Hash[untyped, untyped]) -> String
+      def get_token: (*untyped) -> void
+    end
+
+    class Password < Base
+      def authorize_url: () -> void
+      def get_token: (String, String, ?Hash[untyped, untyped], ?Hash[Symbol, untyped]) -> OAuth2::AccessToken
+    end
+
+    class ClientCredentials < Base
+      def authorize_url: () -> void
+      def get_token: (?Hash[untyped, untyped], ?Hash[Symbol, untyped]) -> OAuth2::AccessToken
+    end
+
+    class Assertion < Base
+      def authorize_url: () -> void
+      def get_token: (Hash[untyped, untyped], Hash[Symbol, untyped], ?Hash[Symbol, untyped], ?Hash[Symbol, untyped]) -> OAuth2::AccessToken
+    end
+  end
+
+  class ThingFilter
+    attr_reader things: Array[String]
+    attr_reader label: String
+
+    def initialize: (Enumerable[untyped] things, label: String) -> void
+    def filtered?: (untyped thing_name) -> bool
+    def pattern_source: () -> String
+  end
 end