omniauth-rails_csrf_protection 0.1.2 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ddd12c3aa3f5c4f89fbfeceeef6809aeee75e299cd2671447240368334553d4
-  data.tar.gz: 27675eb799f7693ae06ed1327efcb50b93f4c9944bc5c2882dff4aa48364fc57
+  metadata.gz: f892f67e16cc87463da3671c7109d84cf2c672ab9f48e3f15c0ea26e2d0de891
+  data.tar.gz: 972512c31e47d1ca67255adf9e962a1082c3025ae28dbc9f27abdbdc726784c8
 SHA512:
-  metadata.gz: 73c42c5bc5763dc015c27685436b1dc01d04f2161b9f9717d223019e2bbb0c2785aeabbf9044369dfeca7d19a1c5251c6f47b11f7b37fb0c15aedb833536d871
-  data.tar.gz: a92516800f4e6817eb762cf74b64e525813948024ef3362e8b02d4a608fc280f1a3b0cde2c498ec9760ee98b94af8d6c40fa556db6d8e6f1078056f41083a026
+  metadata.gz: bd891acf5bbde8455180fe33d076bee9d62413d06c32a610336586346c40ff71a1f30adf5b3cfaf2ad4f768f9f69fbbf27040a0c805bc09462b27e3f7e10115a
+  data.tar.gz: e17f26e0b3224a0f5c8660ec7f7d7524690b18df2f1004f9bdc097cdef04026c6d7c4c15433d0d349087333b4a381b79624b65c9361975c1a123ca34313643b2

data/.circleci/config.yml

@@ -27,6 +27,14 @@ ruby-2-6: &ruby-2-6
   docker:
     - image: circleci/ruby:2.6
 
+ruby-2-7: &ruby-2-7
+  docker:
+    - image: circleci/ruby:2.7
+
+ruby-3-0: &ruby-3-0
+  docker:
+    - image: circleci/ruby:3.0
+
 rails-4-2: &rails-4-2
   environment:
       RAILS_VERSION: "~> 4.2.0"
@@ -45,7 +53,11 @@ rails-5-2: &rails-5-2
 
 rails-6-0: &rails-6-0
   environment:
-      RAILS_VERSION: "6.0.0.rc1"
+      RAILS_VERSION: "~> 6.0.0"
+
+rails-6-1: &rails-6-1
+  environment:
+      RAILS_VERSION: "~> 6.1.0"
 
 rails-edge: &rails-edge
   environment:
@@ -85,6 +97,10 @@ jobs:
     <<: *ruby-2-5
     <<: *rails-6-0
     <<: *build_steps
+  "ruby-2-5-rails-6-1":
+    <<: *ruby-2-5
+    <<: *rails-6-1
+    <<: *build_steps
   "ruby-2-5-rails-edge":
     <<: *ruby-2-5
     <<: *rails-edge
@@ -106,11 +122,53 @@ jobs:
     <<: *ruby-2-6
     <<: *rails-6-0
     <<: *build_steps
+  "ruby-2-6-rails-6-1":
+    <<: *ruby-2-6
+    <<: *rails-6-1
+    <<: *build_steps
   "ruby-2-6-rails-edge":
     <<: *ruby-2-6
     <<: *rails-edge
     <<: *build_steps
 
+  "ruby-2-7-rails-5-0":
+    <<: *ruby-2-7
+    <<: *rails-5-0
+    <<: *build_steps
+  "ruby-2-7-rails-5-1":
+    <<: *ruby-2-7
+    <<: *rails-5-1
+    <<: *build_steps
+  "ruby-2-7-rails-5-2":
+    <<: *ruby-2-7
+    <<: *rails-5-2
+    <<: *build_steps
+  "ruby-2-7-rails-6-0":
+    <<: *ruby-2-7
+    <<: *rails-6-0
+    <<: *build_steps
+  "ruby-2-7-rails-6-1":
+    <<: *ruby-2-7
+    <<: *rails-6-1
+    <<: *build_steps
+  "ruby-2-7-rails-edge":
+    <<: *ruby-2-7
+    <<: *rails-edge
+    <<: *build_steps
+
+  "ruby-3-0-rails-6-0":
+    <<: *ruby-3-0
+    <<: *rails-6-0
+    <<: *build_steps
+  "ruby-3-0-rails-6-1":
+    <<: *ruby-3-0
+    <<: *rails-6-1
+    <<: *build_steps
+  "ruby-3-0-rails-edge":
+    <<: *ruby-3-0
+    <<: *rails-edge
+    <<: *build_steps
+
 workflows:
   version: 2
   build:
@@ -123,10 +181,23 @@ workflows:
       - "ruby-2-5-rails-5-1"
       - "ruby-2-5-rails-5-2"
       - "ruby-2-5-rails-6-0"
+      - "ruby-2-5-rails-6-1"
       - "ruby-2-5-rails-edge"
 
       - "ruby-2-6-rails-5-0"
       - "ruby-2-6-rails-5-1"
       - "ruby-2-6-rails-5-2"
       - "ruby-2-6-rails-6-0"
+      - "ruby-2-6-rails-6-1"
       - "ruby-2-6-rails-edge"
+
+      - "ruby-2-7-rails-5-0"
+      - "ruby-2-7-rails-5-1"
+      - "ruby-2-7-rails-5-2"
+      - "ruby-2-7-rails-6-0"
+      - "ruby-2-7-rails-6-1"
+      - "ruby-2-7-rails-edge"
+
+      - "ruby-3-0-rails-6-0"
+      - "ruby-3-0-rails-6-1"
+      - "ruby-3-0-rails-edge"

data/README.md

@@ -1,12 +1,14 @@
 # OmniAuth - Rails CSRF Protection
 
-This gem provides a mitigation against CVE-2015-9284 (Cross-Site Request
-Forgery on the request phrase when using OmniAuth gem with a Ruby on Rails
-application) by implementing a CSRF token verifier that directly utilize
+This gem provides a mitigation against [CVE-2015-9284] (Cross-Site Request
+Forgery on the request phase when using OmniAuth gem with a Ruby on Rails
+application) by implementing a CSRF token verifier that directly uses
 `ActionController::RequestForgeryProtection` code from Rails.
 
 [![CircleCI](https://circleci.com/gh/cookpad/omniauth-rails_csrf_protection/tree/master.svg?style=svg)](https://circleci.com/gh/cookpad/omniauth-rails_csrf_protection/tree/master)
 
+[CVE-2015-9284]: https://nvd.nist.gov/vuln/detail/CVE-2015-9284
+
 ## Usage
 
 Add this line to your application's Gemfile:
@@ -18,7 +20,7 @@ gem "omniauth-rails_csrf_protection"
 Then run `bundle install` to install this gem.
 
 You will then need to verify that all links in your application that would
-initiate OAuth request phrase are being converted to a HTTP POST form that
+initiate OAuth request phase are being converted to a HTTP POST form that
 contains `authenticity_token` value. This might simply be done by changing all
 `link_to` to `button_to`, or use `link_to ..., method: :post`.
 
@@ -26,10 +28,10 @@ contains `authenticity_token` value. This might simply be done by changing all
 
 This gem does a few things to your application:
 
-* Disable access to the OAuth request phrase using HTTP GET method.
-* Insert a Rails CSRF token verifier at before request phrase.
+* Disable access to the OAuth request phase using HTTP GET method.
+* Insert a Rails CSRF token verifier at the before request phase.
 
-These actions mitigate you from the attack vector described in CVE-2015-9284.
+These actions mitigate you from the attack vector described in [CVE-2015-9284].
 
 ## Contributing
 

data/lib/omniauth/rails_csrf_protection/railtie.rb

@@ -4,8 +4,7 @@ module OmniAuth
   module RailsCsrfProtection
     class Railtie < Rails::Railtie
       initializer "omniauth-rails_csrf_protection.initialize" do
-        OmniAuth.config.allowed_request_methods = [:post]
-        OmniAuth.config.before_request_phase = TokenVerifier.new
+        OmniAuth.config.request_validation_phase = TokenVerifier.new
       end
     end
   end

data/lib/omniauth/rails_csrf_protection/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module RailsCsrfProtection
-    VERSION = "0.1.2".freeze
+    VERSION = "1.0.0".freeze
   end
 end

data/omniauth-rails_csrf_protection.gemspec

@@ -28,7 +28,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "actionpack", ">= 4.2"
-  spec.add_dependency "omniauth", ">= 1.3.1"
+  spec.add_dependency "omniauth", "~> 2.0"
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "minitest"

data/test/application_test.rb

@@ -11,14 +11,16 @@ class ApplicationTest < Minitest::Test
 
   def test_request_phrase_without_token_via_post
     post "/auth/developer"
+    follow_redirect!
 
-    assert last_response.unprocessable?
+    assert last_response.not_found?
   end
 
   def test_request_phrase_with_bad_token_via_post
     post "/auth/developer", authenticity_token: "BAD_TOKEN"
+    follow_redirect!
 
-    assert last_response.unprocessable?
+    assert last_response.not_found?
   end
 
   def test_request_phrase_with_correct_token_via_post

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-rails_csrf_protection
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 1.0.0
 platform: ruby
 authors:
 - Cookpad Inc.
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-06-04 00:00:00.000000000 Z
+date: 2021-01-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -28,16 +28,16 @@ dependencies:
   name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.1
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.1
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -124,7 +124,7 @@ homepage: https://github.com/cookpad/omniauth-rails_csrf_protection
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -139,8 +139,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: Provides CSRF protection on OmniAuth request endpoint on Rails application.
 test_files: