omniauth-rails_csrf_protection 1.0.2 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca8b6b6b0f1b3f05b0317c4e0f629529a44158edc57497fee9eec34a1422125d
-  data.tar.gz: 640c1535d81dea4a56fac9e851dc595f351d05dfc53e11ef3a720aeba1d2b770
+  metadata.gz: 3846d12e29003349aab3262355ab3caa8202537194bf6f46be894f616d17a723
+  data.tar.gz: c6458df501c2ca900d58cd1d5d87c10189e2c27a887f91c4de3c47d1ee7eae6c
 SHA512:
-  metadata.gz: 9db585b6633c9a06372ed96fd2c4a59502d75f7eb39c69f25c92bd0706ad5d2f0ae03d8471fd8ff19342cf98b01159ed742251eb568b200960eb031956b3976a
-  data.tar.gz: d6ff32d88319e0072a760853da4a7dca07bfab9ad6a5243552df8eeb7a603ee133f69a38686ce3d591c29b4bb131217348c0a6bc8010c1e45aea3478235e0cb5
+  metadata.gz: 62351dc511a547b5f9983a3860e32be7e4ab66fd564f1d21533a5f97a60b6f31752823194342e5c37f4149ac93ef7ab99103330f3adef76e11c0dfc09e3cc49e
+  data.tar.gz: c2e6963ce81d58797117f512734eada4a98ec6b9fdeb8d124d239f8159b8341d9dba174e3e9d58b74fd96efd9aeb99ba5143b2c1b63364aaba14263058c68175

data/README.md

@@ -7,6 +7,21 @@ application) by implementing a CSRF token verifier that directly uses
 
 [CVE-2015-9284]: https://nvd.nist.gov/vuln/detail/CVE-2015-9284
 
+> [!NOTE]
+> [OmniAuth] has provided a built-in solution to mitigate against
+> [CVE-2015-9284] since [version 2.0.0].
+> You should be able to mitigate against this vulnerability
+> by adding this configuration to your application:
+>
+> ```ruby
+> OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token)
+> ```
+>
+> This gem will continued to be maintained as an alternative to the solution above.
+
+[OmniAuth]: https://github.com/omniauth/omniauth
+[Version 2.0.0]: https://github.com/omniauth/omniauth/releases/tag/v2.0.0
+
 ## Usage
 
 Add this line to your application's Gemfile:

data/lib/omniauth/rails_csrf_protection/token_verifier.rb

@@ -1,6 +1,10 @@
-require "active_support/configurable"
+require "action_pack/version"
 require "action_controller"
 
+unless ActionPack.version >= Gem::Version.new("8.1.a")
+  require "active_support/configurable"
+end
+
 module OmniAuth
   module RailsCsrfProtection
     # Provides a callable method that verifies Cross-Site Request Forgery
@@ -13,20 +17,36 @@ module OmniAuth
     # authenticity token, you can find the source code at
     # https://github.com/rails/rails/blob/v5.2.2/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L217-L240.
     class TokenVerifier
-      include ActiveSupport::Configurable
-      include ActionController::RequestForgeryProtection
+      if ActionPack.version >= Gem::Version.new("8.1.a")
+        # `ActiveSupport::Configurable` is deprecated in Rails 8.1 and will be
+        # removed in Rails 8.2. As `ActionController::RequestForgeryProtection`
+        # directly accesing configurations via `config`, we only need to define
+        # these methods and delegate them to `ActionController::Base.config`.
+        def self.config
+          ActionController::Base.config
+        end
 
-      # `ActionController::RequestForgeryProtection` contains a few
-      # configurable options. As we want to make sure that our configuration is
-      # the same as what being set in `ActionController::Base`, we should make
-      # all out configuration methods to delegate to `ActionController::Base`.
-      config.each_key do |configuration_name|
-        undef_method configuration_name
-        define_method configuration_name do
-          ActionController::Base.config[configuration_name]
+        def config
+          self.class.config
+        end
+      else
+        include ActiveSupport::Configurable
+
+        # `ActionController::RequestForgeryProtection` contains a few
+        # configurable options. As we want to make sure that our configuration is
+        # the same as what being set in `ActionController::Base`, we should make
+        # all out configuration methods to delegate to `ActionController::Base`.
+        config.each_key do |configuration_name|
+          undef_method configuration_name if defined?(configuration_name)
+          define_method configuration_name do
+            ActionController::Base.config[configuration_name]
+          end
         end
       end
 
+      # Include this module only after we've prepared the configuration
+      include ActionController::RequestForgeryProtection
+
       def call(env)
         dup._call(env)
       end

data/lib/omniauth/rails_csrf_protection/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module RailsCsrfProtection
-    VERSION = "1.0.2".freeze
+    VERSION = "2.0.0".freeze
   end
 end

data/test/test_helper.rb

@@ -13,6 +13,7 @@ end
 
 silence_warnings do
   require "bundler/inline"
+  require "logger"
 
   # Define dependencies required by this test app
   gemfile do
@@ -24,12 +25,17 @@ silence_warnings do
       gem "rails"
     end
 
+    if RUBY_VERSION >= "3.4"
+      gem "bigdecimal"
+      gem "mutex_m"
+    end
+
     gem "omniauth"
     gem "omniauth-rails_csrf_protection", path: File.expand_path("..", __dir__)
   end
 end
 
-puts "Running test against Rails #{Rails.version}"
+puts "Running test on Ruby #{RUBY_VERSION} against Rails #{Rails.version}"
 
 require "rack/test"
 require "action_controller/railtie"
@@ -57,6 +63,13 @@ class TestApp < Rails::Application
     provider :developer
   end
 
+  # Silence the deprecation warning in Rails 8.0.x
+  if Rails.version.is_a?(Gem::Version) &&
+      Rails.version >= Gem::Version.new("8.0.x") &&
+      Rails.version < Gem::Version.new("8.1")
+    config.active_support.to_time_preserves_timezone = :zone
+  end
+
   # We need to call initialize! to run all railties
   initialize!
 

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-rails_csrf_protection
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 2.0.0
 platform: ruby
 authors:
 - Cookpad Inc.
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-10 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -117,7 +116,6 @@ homepage: https://github.com/cookpad/omniauth-rails_csrf_protection
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -132,8 +130,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Provides CSRF protection on OmniAuth request endpoint on Rails application.
 test_files: