omniauth-facebook 2.0.1 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 260633e199c78445cef2c7490799eccf267750cc
-  data.tar.gz: ae89d1f7b067443f94929e2a897686ef95f5adc6
+  metadata.gz: 224e91c8d4a4c7c48c231c2f78984cd0cfe1c307
+  data.tar.gz: 49914f654b85df17a35c191dc7e9ee34cebf596f
 SHA512:
-  metadata.gz: b89ed9dbbdf85294d20dbd318cd00f1120a0c6cabbc641c60e96cac5f864d31a2797c6108e5b2459d69c023f34be1e2ec58fcb958c9e51a55458d27775076909
-  data.tar.gz: 763264ae25e2c483f541cd8143d9a177c3ff5392fdc217c5b495c06e64242e9f7805266696670af94ff263cb321cc81f3659fb55240d5ae013528721f9aeefaf
+  metadata.gz: d3ad4f0e61e6b00294a12e80a8d389b58c7230797fe3617585fdf4d39c9dd0da2481d1fb1da476543a3e14c5bb42891d70cadd98f540a0c1ec859237581fcc9b
+  data.tar.gz: e980bb1e8a8fd53bd844ad8b8d41c20be01eb3ada85322748c29e1cf68e24f99e137d1719b69f047dcea53646f85ce96f9bfb16fa0237ddc5d494c5dd4ecb4b8

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 3.0.0 (2015-10-26)
+
+Changes:
+
+ - Remove query string from redirect_uri on callback by default (#221, @gioblu)
+ - Signed request parsing extracted to `OmniAuth::Facebook::SignedRequest` class. (#183, @simi, @Vrael)
+ - Change default value of `info_fields` to `name,email` for the [graph-api-v2.4](https://developers.facebook.com/blog/post/2015/07/08/graph-api-v2.4/). ([#209](https://github.com/mkdynamic/omniauth-facebook/pull/209))
+
 ## 2.0.1 (2015-02-21)
 
 Bugfixes:

data/README.md

@@ -3,7 +3,8 @@ More details [here](https://github.com/mkdynamic/omniauth-facebook/wiki/CSRF-vul
 
 ---
 
-# OmniAuth Facebook  [![Build Status](https://secure.travis-ci.org/mkdynamic/omniauth-facebook.png?branch=master)](https://travis-ci.org/mkdynamic/omniauth-facebook)
+# OmniAuth Facebook  [![Build Status](https://secure.travis-ci.org/mkdynamic/omniauth-facebook.svg?branch=master)](https://travis-ci.org/mkdynamic/omniauth-facebook) [![Gem Version](https://img.shields.io/gem/v/omniauth-facebook.svg)](https://rubygems.org/gems/omniauth-facebook)
+
 
 **These notes are based on master, please see tags for README pertaining to specific releases.**
 
@@ -44,9 +45,9 @@ Option name | Default | Explanation
 `scope` | `email` | A comma-separated list of permissions you want to request from the user. See the Facebook docs for a full list of available permissions: https://developers.facebook.com/docs/reference/login/
 `display` | `page` | The display context to show the authentication page. Options are: `page`, `popup` and `touch`. Read the Facebook docs for more details: https://developers.facebook.com/docs/reference/dialogs/oauth/
 `image_size` | `square` | Set the size for the returned image url in the auth hash. Valid options include `square` (50x50), `small` (50 pixels wide, variable height), `normal` (100 pixels wide, variable height), or `large` (about 200 pixels wide, variable height). Additionally, you can request a picture of a specific size by setting this option to a hash with `:width` and `:height` as keys. This will return an available profile picture closest to the requested size and requested aspect ratio. If only `:width` or `:height` is specified, we will return a picture whose width or height is closest to the requested size, respectively.
-`info_fields` |  | Specify exactly which fields should be returned when getting the user's info. Value should be a comma-separated string as per https://developers.facebook.com/docs/graph-api/reference/user/ (only `/me` endpoint).
+`info_fields` | 'name,email' | Specify exactly which fields should be returned when getting the user's info. Value should be a comma-separated string as per https://developers.facebook.com/docs/graph-api/reference/user/ (only `/me` endpoint).
 `locale` |  | Specify locale which should be used when getting the user's info. Value should be locale string as per https://developers.facebook.com/docs/reference/api/locale/.
-`auth_type` | | Optionally specifies the requested authentication features as a comma-separated list, as per https://developers.facebook.com/docs/facebook-login/reauthentication/. Valid values are `https` (checks for the presence of the secure cookie and asks for re-authentication if it is not present), and `reauthenticate` (asks the user to re-authenticate unconditionally). Default is `nil`.
+`auth_type` | | Optionally specifies the requested authentication features as a comma-separated list, as per https://developers.facebook.com/docs/facebook-login/reauthentication/. Valid values are `https` (checks for the presence of the secure cookie and asks for re-authentication if it is not present), and `reauthenticate` (asks the user to re-authenticate unconditionally). Use 'rerequest' when you want to request premissions. Default is `nil`.
 `secure_image_url` | `false` | Set to `true` to use https for the avatar image url returned in the auth hash.
 `callback_url` / `callback_path` | | Specify a custom callback URL used during the server-side flow. Note this must be allowed by your app configuration on Facebook (see 'Valid OAuth redirect URIs' under the 'Advanced' settings section in the configuration for your Facebook app for more details).
 
@@ -178,4 +179,3 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 
 [![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/mkdynamic/omniauth-facebook/trend.png)](https://bitdeli.com/free "Bitdeli Badge")
-

data/Rakefile

@@ -3,6 +3,7 @@ require 'rake/testtask'
 
 Rake::TestTask.new do |task|
   task.libs << 'test'
+  task.test_files = FileList['test/*_test.rb']
 end
 
 task :default => :test

data/lib/omniauth/facebook/signed_request.rb

@@ -0,0 +1,52 @@
+require 'openssl'
+
+module OmniAuth
+  module Facebook
+    class SignedRequest
+      class UnknownSignatureAlgorithmError < NotImplementedError; end
+      SUPPORTED_ALGORITHM = 'HMAC-SHA256'
+
+      attr_reader :value, :secret
+
+      def self.parse(value, secret)
+        new(value, secret).payload
+      end
+
+      def initialize(value, secret)
+        @value = value
+        @secret = secret
+      end
+
+      def payload
+        @payload ||= parse_signed_request
+      end
+
+      private
+
+      def parse_signed_request
+        signature, encoded_payload = value.split('.')
+        return if signature.nil?
+
+        decoded_hex_signature = base64_decode_url(signature)
+        decoded_payload = MultiJson.decode(base64_decode_url(encoded_payload))
+
+        unless decoded_payload['algorithm'] == SUPPORTED_ALGORITHM
+          raise UnknownSignatureAlgorithmError, "unknown algorithm: #{decoded_payload['algorithm']}"
+        end
+
+        if valid_signature?(decoded_hex_signature, encoded_payload)
+          decoded_payload
+        end
+      end
+
+      def valid_signature?(signature, payload, algorithm = OpenSSL::Digest::SHA256.new)
+        OpenSSL::HMAC.digest(algorithm, secret, payload) == signature
+      end
+
+      def base64_decode_url(value)
+        value += '=' * (4 - value.size.modulo(4))
+        Base64.decode64(value.tr('-_', '+/'))
+      end
+    end
+  end
+end

data/lib/omniauth/facebook/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Facebook
-    VERSION = "2.0.1"
+    VERSION = "3.0.0"
   end
 end

data/lib/omniauth/strategies/facebook.rb

@@ -1,5 +1,5 @@
 require 'omniauth/strategies/oauth2'
-require 'base64'
+require 'omniauth/facebook/signed_request'
 require 'openssl'
 require 'rack/utils'
 require 'uri'
@@ -8,10 +8,8 @@ module OmniAuth
   module Strategies
     class Facebook < OmniAuth::Strategies::OAuth2
       class NoAuthorizationCodeError < StandardError; end
-      class UnknownSignatureAlgorithmError < NotImplementedError; end
 
       DEFAULT_SCOPE = 'email'
-      SUPPORTED_ALGORITHM = 'HMAC-SHA256'
 
       option :client_options, {
         :site => 'https://graph.facebook.com',
@@ -62,7 +60,7 @@ module OmniAuth
 
       def info_options
         params = {:appsecret_proof => appsecret_proof}
-        params.merge!({:fields => options[:info_fields]}) if options[:info_fields]
+        params.merge!({:fields => (options[:info_fields] || 'name,email')})
         params.merge!({:locale => options[:locale]}) if options[:locale]
 
         { :params => params }
@@ -74,7 +72,7 @@ module OmniAuth
         end
       rescue NoAuthorizationCodeError => e
         fail!(:no_authorization_code, e)
-      rescue UnknownSignatureAlgorithmError => e
+      rescue OmniAuth::Facebook::SignedRequest::UnknownSignatureAlgorithmError => e
         fail!(:unknown_signature_algorithm, e)
       end
 
@@ -85,7 +83,8 @@ module OmniAuth
         if @authorization_code_from_signed_request_in_cookie
           ''
         else
-          options[:callback_url] || super
+          # Fixes regression in omniauth-oauth2 v1.4.0 by https://github.com/intridea/omniauth-oauth2/commit/85fdbe117c2a4400d001a6368cc359d88f40abc7
+          options[:callback_url] || (full_host + script_name + callback_path)
         end
       end
 
@@ -120,7 +119,7 @@ module OmniAuth
       private
 
       def signed_request_from_cookie
-        @signed_request_from_cookie ||= raw_signed_request_from_cookie && parse_signed_request(raw_signed_request_from_cookie)
+        @signed_request_from_cookie ||= raw_signed_request_from_cookie && OmniAuth::Facebook::SignedRequest.parse(raw_signed_request_from_cookie, client.secret)
       end
 
       def raw_signed_request_from_cookie
@@ -160,31 +159,6 @@ module OmniAuth
         end
       end
 
-      def parse_signed_request(value)
-        signature, encoded_payload = value.split('.')
-        return if signature.nil?
-
-        decoded_hex_signature = base64_decode_url(signature)
-        decoded_payload = MultiJson.decode(base64_decode_url(encoded_payload))
-
-        unless decoded_payload['algorithm'] == SUPPORTED_ALGORITHM
-          raise UnknownSignatureAlgorithmError, "unknown algorithm: #{decoded_payload['algorithm']}"
-        end
-
-        if valid_signature?(client.secret, decoded_hex_signature, encoded_payload)
-          decoded_payload
-        end
-      end
-
-      def valid_signature?(secret, signature, payload, algorithm = OpenSSL::Digest::SHA256.new)
-        OpenSSL::HMAC.digest(algorithm, secret, payload) == signature
-      end
-
-      def base64_decode_url(value)
-        value += '=' * (4 - value.size.modulo(4))
-        Base64.decode64(value.tr('-_', '+/'))
-      end
-
       def image_url(uid, options)
         uri_class = options[:secure_image_url] ? URI::HTTPS : URI::HTTP
         site_uri = URI.parse(client.site)

data/test/fixtures/payload.json

@@ -0,0 +1,16 @@
+{
+  "algorithm": "HMAC-SHA256",
+  "expires": 1308988800,
+  "issued_at": 1308985018,
+  "oauth_token": "111111111111111|2.AQBAttRlLVnwqNPZ.3600.1111111111.1-111111111111111|T49w3BqoZUegypru51Gra70hED8",
+  "user":
+  {
+    "country": "de",
+    "locale": "en_US",
+    "age":
+    {
+      "min": 21
+    }
+  },
+  "user_id": "111111111111111"
+}

data/test/fixtures/signed_request.txt

@@ -0,0 +1 @@
+53umfudisP7mKhsi9nZboBg15yMZKhfQAARL9UoZtSE.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImV4cGlyZXMiOjEzMDg5ODg4MDAsImlzc3VlZF9hdCI6MTMwODk4NTAxOCwib2F1dGhfdG9rZW4iOiIxMTExMTExMTExMTExMTF8Mi5BUUJBdHRSbExWbndxTlBaLjM2MDAuMTExMTExMTExMS4xLTExMTExMTExMTExMTExMXxUNDl3M0Jxb1pVZWd5cHJ1NTFHcmE3MGhFRDgiLCJ1c2VyIjp7ImNvdW50cnkiOiJkZSIsImxvY2FsZSI6ImVuX1VTIiwiYWdlIjp7Im1pbiI6MjF9fSwidXNlcl9pZCI6IjExMTExMTExMTExMTExMSJ9

data/test/signed_request_test.rb

@@ -0,0 +1,26 @@
+require 'helper'
+require 'omniauth/facebook/signed_request'
+
+class SignedRequestTest < Minitest::Test
+  def setup
+    @value = fixture('signed_request.txt').strip
+    @secret = "897z956a2z7zzzzz5783z458zz3z7556"
+    @expected_payload = MultiJson.decode(fixture('payload.json'))
+  end
+
+  def test_signed_request_payload
+    signed_request = OmniAuth::Facebook::SignedRequest.new(@value, @secret)
+    assert_equal @expected_payload, signed_request.payload
+  end
+
+  def test_signed_request_parse
+    payload = OmniAuth::Facebook::SignedRequest.parse(@value, @secret)
+    assert_equal @expected_payload, payload
+  end
+
+  private
+
+  def fixture(name)
+    File.read(File.expand_path("fixtures/#{name}", File.dirname(__FILE__)))
+  end
+end

data/test/{test.rb → strategy_test.rb}

@@ -24,18 +24,20 @@ class ClientTest < StrategyTestCase
 end
 
 class CallbackUrlTest < StrategyTestCase
-  test "returns the default callback url" do
+  test "returns the default callback url (omitting querystring)" do
     url_base = 'http://auth.request.com'
     @request.stubs(:url).returns("#{url_base}/some/page")
     strategy.stubs(:script_name).returns('') # as not to depend on Rack env
+    strategy.stubs(:query_string).returns('?foo=bar')
     assert_equal "#{url_base}/auth/facebook/callback", strategy.callback_url
   end
 
-  test "returns path from callback_path option" do
+  test "returns path from callback_path option (omitting querystring)" do
     @options = { :callback_path => "/auth/FB/done"}
     url_base = 'http://auth.request.com'
     @request.stubs(:url).returns("#{url_base}/page/path")
     strategy.stubs(:script_name).returns('') # as not to depend on Rack env
+    strategy.stubs(:query_string).returns('?foo=bar')
     assert_equal "#{url_base}/auth/FB/done", strategy.callback_url
   end
 
@@ -259,7 +261,7 @@ class RawInfoTest < StrategyTestCase
     super
     @access_token = stub('OAuth2::AccessToken')
     @appsecret_proof = 'appsecret_proof'
-    @options = {:appsecret_proof => @appsecret_proof}
+    @options = {:appsecret_proof => @appsecret_proof, :fields => 'name,email'}
   end
 
   test 'performs a GET to https://graph.facebook.com/me' do
@@ -288,6 +290,14 @@ class RawInfoTest < StrategyTestCase
     strategy.raw_info
   end
 
+  test 'performs a GET to https://graph.facebook.com/me with default info_fields' do
+    strategy.stubs(:access_token).returns(@access_token)
+    strategy.stubs(:appsecret_proof).returns(@appsecret_proof)
+    params = {:params => {:appsecret_proof => @appsecret_proof, :fields => 'name,email'}}
+    @access_token.expects(:get).with('me', params).returns(stub_everything('OAuth2::Response'))
+    strategy.raw_info
+  end
+
   test 'returns a Hash' do
     strategy.stubs(:access_token).returns(@access_token)
     strategy.stubs(:appsecret_proof).returns(@appsecret_proof)
@@ -437,7 +447,7 @@ module SignedRequestTests
 
     test 'throws an error if the algorithm is unknown' do
       setup('UNKNOWN-ALGO')
-      assert_equal "unknown algorithm: UNKNOWN-ALGO", assert_raises(OmniAuth::Strategies::Facebook::UnknownSignatureAlgorithmError) { strategy.send(:signed_request_from_cookie) }.message
+      assert_equal "unknown algorithm: UNKNOWN-ALGO", assert_raises(OmniAuth::Facebook::SignedRequest::UnknownSignatureAlgorithmError) { strategy.send(:signed_request_from_cookie) }.message
     end
   end
 
@@ -497,7 +507,7 @@ module SignedRequestTests
     end
 
     test 'calls fail! when an algorithm is unknown' do
-      strategy.expects(:fail!).times(1).with(:unknown_signature_algorithm, kind_of(OmniAuth::Strategies::Facebook::UnknownSignatureAlgorithmError))
+      strategy.expects(:fail!).times(1).with(:unknown_signature_algorithm, kind_of(OmniAuth::Facebook::SignedRequest::UnknownSignatureAlgorithmError))
       strategy.callback_phase
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-facebook
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 3.0.0
 platform: ruby
 authors:
 - Mark Dodwell
@@ -9,62 +9,62 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-21 00:00:00.000000000 Z
+date: 2015-10-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.2'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: mocha
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 description: 
@@ -75,8 +75,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".travis.yml"
+- .gitignore
+- .travis.yml
 - CHANGELOG.md
 - Gemfile
 - README.md
@@ -87,12 +87,16 @@ files:
 - example/config.ru
 - lib/omniauth-facebook.rb
 - lib/omniauth/facebook.rb
+- lib/omniauth/facebook/signed_request.rb
 - lib/omniauth/facebook/version.rb
 - lib/omniauth/strategies/facebook.rb
 - omniauth-facebook.gemspec
+- test/fixtures/payload.json
+- test/fixtures/signed_request.txt
 - test/helper.rb
+- test/signed_request_test.rb
+- test/strategy_test.rb
 - test/support/shared_examples.rb
-- test/test.rb
 homepage: https://github.com/mkdynamic/omniauth-facebook
 licenses:
 - MIT
@@ -103,21 +107,24 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.0.14
 signing_key: 
 specification_version: 4
 summary: Facebook OAuth2 Strategy for OmniAuth
 test_files:
+- test/fixtures/payload.json
+- test/fixtures/signed_request.txt
 - test/helper.rb
+- test/signed_request_test.rb
+- test/strategy_test.rb
 - test/support/shared_examples.rb
-- test/test.rb