omniauth-jets_csrf_protection 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8b9588c379677f5371b3d98fa53f792c54d1eb40c17ae94680392f19a93d40f1
+  data.tar.gz: 738c44783c5614d4e666642b113398352b9ddc7baa47825320ab0e7dcd1c3b16
+SHA512:
+  metadata.gz: e81b47383050bfe65153723eae2624549a6ba1e9340368b477cf94bf1a260aed8e827abddb6eb39b6397d22ea78de0834dc78220484758c3e0472833f13e2159
+  data.tar.gz: 6fa14a6d02a404e8738d5a2f8050c7c50558520dc2e1d89cc683e133ec8c7a1e222262c202cea1e9420757477f17724d667d7ee9f5c41127f65cca5a161a4b5d

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Tung Nguyen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,16 @@
+# Omniauth - Jets CSRF Protection
+
+[![Gem Version](https://badge.fury.io/rb/omniauth-jets_csrf_protection.png)](http://badge.fury.io/rb/omniauth-jets_csrf_protection)
+
+[![BoltOps Badge](https://img.boltops.com/boltops/badges/boltops-badge.png)](https://www.boltops.com)
+
+[![BoltOps Learn Badge](https://img.boltops.com/boltops-learn/boltops-learn.png)](https://learn.boltops.com)
+
+
+This gem provides protection against [CVE-2015-9284] (Cross-Site Request
+Forgery on the request phase when using OmniAuth gem with a Ruby on Jets
+application) for Jets applications using OmniAuth gem. It achieves this by integrating a CSRF token verifier that leverages the `ActionController::RequestForgeryProtection`.
+
+[CVE-2015-9284]: https://nvd.nist.gov/vuln/detail/CVE-2015-9284
+
+This is a fork of [cookpad/omniauth-rails_csrf_protection](https://github.com/cookpad/omniauth-rails_csrf_protection). Credit goes to the original authors of that gem.

data/Rakefile

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+task default: %i[]

data/lib/omniauth/jets_csrf_protection/token_verifier.rb

@@ -0,0 +1,44 @@
+require "active_support/configurable"
+require "action_controller"
+
+module OmniAuth
+  module JetsCsrfProtection
+    # Provides a callable method that verifies Cross-Site Request Forgery
+    # protection token. This class includes
+    # `ActionController::RequestForgeryProtection` directly and utilizes
+    # `verified_request?` method to match the way Jets performs token
+    # verification in Jets controllers.
+    #
+    # If you like to learn more about how Jets generate and verify
+    # authenticity token, you can find the source code at
+    # https://github.com/rails/rails/blob/v5.2.2/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L217-L240.
+    class TokenVerifier
+      include ActiveSupport::Configurable
+      include ActionController::RequestForgeryProtection
+
+      # `ActionController::RequestForgeryProtection` contains a few
+      # configurable options. As we want to make sure that our configuration is
+      # the same as what being set in `ActionController::Base`, we should make
+      # all out configuration methods to delegate to `ActionController::Base`.
+      config.each_key do |configuration_name|
+        undef_method configuration_name
+        define_method configuration_name do
+          ActionController::Base.config[configuration_name]
+        end
+      end
+
+      def call(env)
+        @request = env['jets.controller'].request
+
+        unless verified_request?
+          raise ActionController::InvalidAuthenticityToken
+        end
+      end
+
+      private
+
+        attr_reader :request
+        delegate :params, :session, to: :request
+    end
+  end
+end

data/lib/omniauth/jets_csrf_protection/turbine.rb

@@ -0,0 +1,12 @@
+require "omniauth"
+require "omniauth/jets_csrf_protection/token_verifier"
+
+module OmniAuth
+  module JetsCsrfProtection
+    class Turbine < Jets::Turbine
+      initializer "omniauth-jets_csrf_protection.initialize" do
+        OmniAuth.config.request_validation_phase = TokenVerifier.new
+      end
+    end
+  end
+end

data/lib/omniauth/jets_csrf_protection/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Omniauth
+  module JetsCsrfProtection
+    VERSION = "0.1.0"
+  end
+end

data/lib/omniauth/jets_csrf_protection.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require_relative "jets_csrf_protection/version"
+require_relative "jets_csrf_protection/turbine"
+
+module Omniauth
+  module JetsCsrfProtection
+    class Error < StandardError; end
+    # Your code goes here...
+  end
+end

metadata

@@ -0,0 +1,121 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-jets_csrf_protection
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Tung Nguyen
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2023-12-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.2'
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: jets
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: 
+email:
+- tongueroo@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE.txt
+- README.md
+- Rakefile
+- lib/omniauth/jets_csrf_protection.rb
+- lib/omniauth/jets_csrf_protection/token_verifier.rb
+- lib/omniauth/jets_csrf_protection/turbine.rb
+- lib/omniauth/jets_csrf_protection/version.rb
+homepage: https://github.com/rubyonjets/omniauth-jets_csrf_protection
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/rubyonjets/omniauth-jets_csrf_protection
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.6.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.20
+signing_key: 
+specification_version: 4
+summary: Provides CSRF protection on OmniAuth request endpoint on Jets application.
+test_files: []