oauthenticator 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7006ebe89c4cd63acc4c40c404a81cd1d435c671
-  data.tar.gz: 54399c9d2d96645797f5bf0c179a46ac3aa0e47d
+  metadata.gz: 827942505f6a7a7454a54fec370230998566b31d
+  data.tar.gz: a2b80c738be4320eec657fea5b16d3b53ea06050
 SHA512:
-  metadata.gz: 85859997c9cba4592b097443e643528c6ccc479542eb0410e64a57611c6226a0988314d0b8adb3a17e3e0ae08b823d45a6bbeb75f0f15ca6c298c4b5581859ab
-  data.tar.gz: b1776d367f14799e6fcf5da5e09ed4c6c97cc932d86969c19c06bdcb99ac81827396c8d227fd445a64cbb8ae71f561a9ae4d7da9d65c6dfef67b3b788ce2c142
+  metadata.gz: ce622ff45391f968819261955cfabf0f1a8f73a7d0956b1e63011b7e342d83259f198a2f4b0d3f3895dcb119e8e89e0bc78e6fbc02c36fa54dc2eecd01b545a7
+  data.tar.gz: 42c979625cb2411ecb257e2010c7038f346c0b839cd2d57c079f09db4cefb7f04eddceff664e78b9fe5a8529e1ab93a0841b0f9cffcfac71dbb356d6611d77b0

data/CHANGELOG.md

@@ -0,0 +1,8 @@
+# 1.1.0
+
+- added OAuthenticator::NonceUsedError to address race condition between `#nonce_used?` and `#use_nonce!`
+- minor fixes for ruby 1.8.7 compatibility
+
+# 1.0.0
+
+- initial stable release

data/lib/oauthenticator/config_methods.rb

@@ -98,6 +98,10 @@ module OAuthenticator
     # it's worth noting that if this ever returns true, it may indicate a replay attack under way against your 
     # application. the replay attack will fail due to OAuth, but you may wish to log the event.
     #
+    # this method MAY simply return false IF the method #use_nonce! is implemented to raise 
+    # OAuthenticator::NonceUsedError when it encounters an already-used nonce. this may be preferable - see 
+    # the #use_nonce! documentation. 
+    #
     # @return [Boolean] whether the request's nonce has already been used.
     def nonce_used?
       config_method_not_implemented
@@ -106,7 +110,18 @@ module OAuthenticator
     # cause the nonce, available via the `#nonce` method, to be marked as used. you may wish to use this in 
     # conjunction with the timestamp (`#timestamp`).
     #
+    # although this will only be called when #nonce_used? has returned false, since a nonzero amount of time 
+    # does elapse between that being called and this, a race condition may occur. therefore, if the 
+    # implementation is able to perform an atomic test-and-set (e.g. with SETNX in redis, or with a 
+    # uniqueness-ensuring index in SQL) when it is using the nonce, then it SHOULD do so in this method, 
+    # and if the test-and-set indicates the nonce has been used, SHOULD raise OAuthenticator::NonceUsedError.
+    #
+    # if it is more performant for the implementation to only check whether the nonce is used once, when 
+    # setting, then the method #nonce_used? MAY simply return false, and raising 
+    # OAuthenticator::NonceUsedError from this method may be the only method of indicating a used nonce.
+    #
     # @return [Void] (return value is ignored / unused)
+    # @raise [OAuthenticator::NonceUsedError] if the nonce (with the timestamp, optionally) has already been used
     def use_nonce!
       config_method_not_implemented
     end

data/lib/oauthenticator/parse_authorization.rb

@@ -4,7 +4,7 @@ module OAuthenticator
   class Error < StandardError
     # @param message [String]
     # @param errors [Hash<String, Array<String>>]
-    def initialize(message, errors=nil)
+    def initialize(message=nil, errors=nil)
       super(message)
       @errors = errors
     end
@@ -47,7 +47,7 @@ module OAuthenticator
       unless scanner.eos?
         auth_parse_error.call("Could not parse Authorization header: #{header}\naround or after character #{scanner.pos}: #{scanner.rest}")
       end
-      duplicates = attributes.select { |k,v| v.size > 1 }
+      duplicates = attributes.reject { |k,v| v.size <= 1 }
       if duplicates.any?
         errors = duplicates.map do |k,vs|
           {k => "Received multiple instances of Authorization parameter #{k}. Received values were: #{vs.inspect}"}

data/lib/oauthenticator/signed_request.rb

@@ -2,6 +2,10 @@ require 'oauthenticator/signable_request'
 require 'oauthenticator/parse_authorization'
 
 module OAuthenticator
+  # an error which is to be raised when an attempt is made to use a nonce which has already been used.
+  class NonceUsedError < Error
+  end
+
   # this class represents an OAuth signed request. its primary user-facing method is {#errors}, which returns 
   # nil if the request is valid and authentic, or a helpful object of error messages describing what was 
   # invalid if not. 
@@ -215,7 +219,12 @@ module OAuthenticator
           throw(:errors, {'Authorization oauth_signature' => ['is invalid']})
         end
 
-        use_nonce!
+        begin
+          use_nonce!
+        rescue NonceUsedError
+          throw(:errors, {'Authorization oauth_nonce' => ['has already been used']})
+        end
+
         nil
       end
     end

data/lib/oauthenticator/version.rb

@@ -1,5 +1,5 @@
 # OAuthenticator 
 module OAuthenticator
   # OAuthenticator::VERSION
-  VERSION = "1.0.0"
+  VERSION = "1.1.0"
 end

data/test/config_methods_test.rb

@@ -36,7 +36,7 @@ describe OAuthenticator::SignedRequest do
     assert_equal 2, called
   end
   it 'uses the default value for allowed signature methods' do
-    assert_equal %w(RSA-SHA1 HMAC-SHA1 PLAINTEXT), OAuthenticator::SignedRequest.new({}).allowed_signature_methods
+    assert_equal %w(RSA-SHA1 HMAC-SHA1 PLAINTEXT).sort, OAuthenticator::SignedRequest.new({}).allowed_signature_methods.sort
   end
   it 'uses default value for body_hash_required?' do
     assert_equal false, OAuthenticator::SignedRequest.new({}).body_hash_required?

data/test/rack_authenticator_test.rb

@@ -51,7 +51,7 @@ describe OAuthenticator::RackAuthenticator do
     request = Rack::Request.new(Rack::MockRequest.env_for('/',
       :method => 'GET',
       :input => 'a=b&a=c',
-      'CONTENT_TYPE' => 'application/x-www-form-urlencoded; charset=UTF8',
+      'CONTENT_TYPE' => 'application/x-www-form-urlencoded; charset=UTF8'
     ))
     request.env['HTTP_AUTHORIZATION'] = OAuthenticator::SignableRequest.new({
       :request_method => request.request_method,
@@ -318,6 +318,26 @@ describe OAuthenticator::RackAuthenticator do
     assert_response(200, '☺', *oapp.call(request.env))
     assert_response(401, /Authorization oauth_nonce.*has already been used/m, *oapp.call(request.env))
   end
+  it 'has an already-used nonce, via use_nonce!' do
+    Timecop.travel Time.at 1391021695
+    consumer # cause this to be created
+    request = Rack::Request.new(Rack::MockRequest.env_for('/', :method => 'GET'))
+    request.env['HTTP_AUTHORIZATION'] = %q(OAuth oauth_consumer_key="test_client_app_key", ) +
+      %q(oauth_nonce="c1c2bd8676d44e48691c8dceffa66a96", ) +
+      %q(oauth_signature="Xy1s5IUn8x0U2KPyHBw4B2cHZMo%3D", ) +
+      %q(oauth_signature_method="HMAC-SHA1", ) +
+      %q(oauth_timestamp="1391021695", ) +
+      %q(oauth_version="1.0")
+    test_config_methods_nonce_used_false = Module.new do
+      include OAuthenticatorTestConfigMethods
+      def nonce_used?
+        false
+      end
+    end
+    app = OAuthenticator::RackAuthenticator.new(simpleapp, :config_methods => test_config_methods_nonce_used_false)
+    assert_response(200, '☺', *app.call(request.env))
+    assert_response(401, /Authorization oauth_nonce.*has already been used/m, *app.call(request.env))
+  end
   it 'omits signature' do
     Timecop.travel Time.at 1391021695
     consumer # cause this to be created

data/test/test_config_methods.rb

@@ -1,3 +1,5 @@
+# encoding: utf-8
+
 # config methods for testing OAuthenticator. simple 
 module OAuthenticatorTestConfigMethods
   class << self
@@ -16,7 +18,12 @@ module OAuthenticatorTestConfigMethods
   end
 
   def use_nonce!
-    OAuthenticatorTestConfigMethods.nonces << nonce
+    if OAuthenticatorTestConfigMethods.nonces.include?(nonce)
+      # checking the same thing as #nonce_used? lets #nonce_used? be overridden to return false and things still work 
+      raise OAuthenticator::NonceUsedError
+    else
+      OAuthenticatorTestConfigMethods.nonces << nonce
+    end
   end
 
   def timestamp_valid_period

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oauthenticator
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Ethan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-22 00:00:00.000000000 Z
+date: 2014-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -201,6 +201,7 @@ extra_rdoc_files: []
 files:
 - ".simplecov"
 - ".yardopts"
+- CHANGELOG.md
 - LICENSE.txt
 - README.md
 - Rakefile.rb