omniauth-saml 1.9.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a3895e66de86a36af32ed2a4307562e1d549d69a
-  data.tar.gz: 413848e6bdb2dc31758a1b60f5aeae811afb9b2c
+  metadata.gz: 6bf6bca05fbb7097d01d4f3abe1ff2b033932051
+  data.tar.gz: 5cde5570d1457ba576f7d7d05850bcca7b4384c5
 SHA512:
-  metadata.gz: f27b3b76a2859c680bdc446b0f678616b43cd2d2e1896bba9297d673e00689c25e55170b1f2a4ea021653704bff92f7885df322518100431c3ac50ef97271782
-  data.tar.gz: 0f0e9056f26ff234e92e000c9a360e12038b8c25e7ae56599eda22b7eb06a8434befbe85ec564d388d9fb0396f3b329db7e66c9bb69ff70afc3ff5bcfa008350
+  metadata.gz: d3413b70bad6963317a2fa55389a370fea07cb3a2015b600d10461d36245feb1e3efa02ec2fc25529d391f7f8929f9918859ab51055fc6bba979b7f3b920e2ca
+  data.tar.gz: 4623b91adf535ff1e018d15007fab6a050410f806884d6cc842eec80f60a46a2838f13f35786cb7ee1e725ee70043b8c669bad62dfde10c761df97c22c72d7ff

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+<a name="v1.10.0"></a>
+### v1.10.0 (2018-02-19)
+
+
+#### Bug Fixes
+
+* ambiguous path match in other phase	 ([1b465b9](/../../commit/1b465b9))
+* Update ruby-saml gem to 1.7 or later to fix CVE-2017-11430 ([6bc28ad](/../../commit/6bc28ad))
+
+
 <a name="v1.9.0"></a>
 ### v1.9.0 (2018-01-29)
 

data/README.md

@@ -23,7 +23,7 @@ https://github.com/omniauth/omniauth-saml
 
 ## Versioning
 
-We tag and release gems according to the [Semantic Versioning](http://semver.org/) principle.
+We tag and release gems according to the [Semantic Versioning](http://semver.org/) principle. In addition to the guidelines of Semantic Versioning, we follow a further guideline that otherwise backwards-compatible dependency upgrades for security reasons should generally be cause for a MINOR version upgrade as opposed to a PATCH version upgrade. Backwards-incompatible dependency upgrades for security reasons should still result in a MAJOR version upgrade for this library.
 
 ## Usage
 

data/lib/omniauth-saml/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module SAML
-    VERSION = '1.9.0'
+    VERSION = '1.10.0'
   end
 end

data/lib/omniauth/strategies/saml.rb

@@ -69,7 +69,7 @@ module OmniAuth
       end
 
       def other_phase
-        if current_path.start_with?(request_path)
+        if request_path_pattern.match(current_path)
           @env['omniauth.strategy'] ||= self
           setup_phase
 
@@ -120,6 +120,10 @@ module OmniAuth
 
       private
 
+      def request_path_pattern
+        @request_path_pattern ||= %r{\A#{Regexp.quote(request_path)}(/|\z)}
+      end
+
       def on_subpath?(subpath)
         on_path?("#{request_path}/#{subpath}")
       end

data/spec/omniauth/strategies/saml_spec.rb

@@ -435,6 +435,15 @@ describe OmniAuth::Strategies::SAML, :type => :strategy do
     specify { expect(last_response.status).to eql 404 }
   end
 
+  context 'when hitting a route that contains a substring match for the strategy name' do
+    before { get '/auth/saml2/metadata' }
+
+    it 'should not set the strategy' do
+      expect(last_request.env['omniauth.strategy']).to be_nil
+      expect(last_response.status).to eql 404
+    end
+  end
+
   describe 'subclass behavior' do
     it 'registers subclasses in OmniAuth.strategies' do
       subclass = Class.new(described_class)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-saml
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.10.0
 platform: ruby
 authors:
 - Raecoo Cao
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-31 00:00:00.000000000 Z
+date: 2018-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth
@@ -42,20 +42,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.4'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.4.3
+        version: '1.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.4'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.4.3
+        version: '1.7'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement