omniauth 1.2.2 → 1.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 0ccca6a859c1cf14b111691d6447c4fda9e6a392
-  data.tar.gz: 9b5e43d88cdc536a6e2e31111ea81f547d18abe9
+SHA256:
+  metadata.gz: 35d19268ad77477704f29c8bb7aa989bc4fd087dfc75cad3757f0dba77615ab0
+  data.tar.gz: 7d6405feca4e14d010330e2c577aa815b7593de7ebc2591e9b45c266af3e05b5
 SHA512:
-  metadata.gz: cae2202a6cfd9bbd4f0f5bc5b68d613e4890458ac14cdd6e919e1e53db3cb5835b17c3b0d426a4cce305b4508943534e7ebde9b2638fa1864cf3e929b3393603
-  data.tar.gz: 4ea31502c6e79c25aa73e39340becc0302d4001fad09b0921ad08f211e6467a9b2a9982be5cadf63975b6f0e8af85291500492de52913af240d38da9a6de7e99
+  metadata.gz: f2f0a59be54f42f5c6747e9601599eee747d0220c8cfbfd3037e713840453c29598b325beae1e0ca8c41db8581d02cd1adada18d1dcfb5afe8cab2fb8c5c7e61
+  data.tar.gz: 945998eec68b09718830c23c75ca2cd1ad23da58f9541d38c39ec0c4c08b587cb35827390a003c3c1fb551793d2b5a1ade0cf354236035c6489b229fa66a699f

data/.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,20 @@
+Please complete all sections.
+
+### Configuration
+
+- Provider Gem: `omniauth-*`
+- Ruby Version: ``
+- Framework: ``
+- Platform: ``
+
+### Expected Behavior
+
+Tell us what should happen.
+
+### Actual Behavior
+
+Tell us what happens instead.
+
+### Steps to Reproduce
+
+Please list all steps to reproduce the issue.

data/.gitignore

@@ -4,6 +4,7 @@
 .rvmrc
 .yardoc
 Gemfile.lock
+Gemfile.*.lock
 coverage/*
 doc/*
 log/*

data/.rubocop.yml

@@ -1,81 +1,69 @@
 AllCops:
-  Include:
-    - 'Gemfile'
-    - 'Rakefile'
-    - 'omniauth.gemspec'
+  TargetRubyVersion: 2.2
 
-# Avoid long parameter lists
-ParameterLists:
-  Max: 4
-  CountKeywordArgs: true
+Layout/AccessModifierIndentation:
+  EnforcedStyle: outdent
 
-MethodLength:
-  CountComments: false
-  Max: 15
+Layout/AlignHash:
+  Enabled: false
 
-# Avoid more than `Max` levels of nesting.
-BlockNesting:
-  Max: 2
+Layout/DotPosition:
+  EnforcedStyle: trailing
 
-# Align with the style guide.
-CollectionMethods:
-  PreferredMethods:
-    map:      'collect'
-    reduce:   'inject'
-    find:     'detect'
-    find_all: 'select'
+Layout/SpaceInsideHashLiteralBraces:
+  EnforcedStyle: no_space
 
-# Limit line length
-LineLength:
+Lint/HandleExceptions:
   Enabled: false
 
-# Disable documentation checking until a class needs to be documented once
-Documentation:
+Metrics/BlockLength:
   Enabled: false
 
-# Enforce Ruby 1.8-compatible hash syntax
-HashSyntax:
-  EnforcedStyle: hash_rockets
-
-# No spaces inside hash literals
-SpaceInsideHashLiteralBraces:
-  EnforcedStyle: no_space
+Metrics/BlockNesting:
+  Max: 2
 
-# Allow dots at the end of lines
-DotPosition:
+Metrics/LineLength:
+  AllowURI: true
   Enabled: false
 
-# Don't require magic comment at the top of every file
-Encoding:
-  Enabled: false
+Metrics/MethodLength:
+  CountComments: false
+  Max: 15
 
-# Enforce outdenting of access modifiers (i.e. public, private, protected)
-AccessModifierIndentation:
-  EnforcedStyle: outdent
+Metrics/ParameterLists:
+  Max: 4
+  CountKeywordArgs: true
 
-EmptyLinesAroundAccessModifier:
-  Enabled: true
+Metrics/AbcSize:
+  Enabled: false
 
-# Align ends correctly
-EndAlignment:
-  AlignWith: variable
+Style/CollectionMethods:
+  PreferredMethods:
+    map:      'collect'
+    reduce:   'inject'
+    find:     'detect'
+    find_all: 'select'
 
-# Indentation of when/else
-CaseIndentation:
-  IndentWhenRelativeTo: end
-  IndentOneStep: false
+Style/Documentation:
+  Enabled: false
 
-Lambda:
+Style/DoubleNegation:
   Enabled: false
 
-HandleExceptions:
+Style/EachWithObject:
   Enabled: false
 
-RaiseArgs:
-  EnforcedStyle: compact
+Style/Encoding:
+  Enabled: false
 
-TrailingComma:
+Style/ExpandPathArguments:
   Enabled: false
 
-EachWithObject:
+Style/HashSyntax:
+  EnforcedStyle: hash_rockets
+
+Style/Lambda:
   Enabled: false
+
+Style/RaiseArgs:
+  EnforcedStyle: compact

data/.travis.yml

@@ -1,37 +1,25 @@
 bundler_args: --without development
-gemfile:
-  - Gemfile
-  - Gemfile.rack-1.3.x
+before_install:
+  - gem uninstall -v '>= 2' -i $(rvm gemdir)@global -ax bundler || true
+  - gem install bundler -v '1.17.3'
+install:
+ - bundle _1.17.3_ install --jobs=3 --retry=3
+cache: bundler
+env:
+  global:
+    - JRUBY_OPTS="$JRUBY_OPTS --debug"
 language: ruby
 rvm:
-  - 1.8.7
-  - 1.9.2
-  - 1.9.3
-  - 2.0.0
-  - 2.1.0
-  - rbx-2
+  - jruby-9000
+  - 2.2.9
+  - 2.3.5
+  - 2.4.4
+  - 2.5.3
+  - jruby-head
   - ruby-head
 matrix:
-  include:
-    - rvm: jruby-18mode
-      env: JRUBY_OPTS="$JRUBY_OPTS --debug"
-      gemfile: Gemfile
-    - rvm: jruby-18mode
-      env: JRUBY_OPTS="$JRUBY_OPTS --debug"
-      gemfile: Gemfile.rack-1.3.x
-    - rvm: jruby-19mode
-      env: JRUBY_OPTS="$JRUBY_OPTS --debug"
-      gemfile: Gemfile
-    - rvm: jruby-19mode
-      env: JRUBY_OPTS="$JRUBY_OPTS --debug"
-      gemfile: Gemfile.rack-1.3.x
-    - rvm: jruby-head
-      env: JRUBY_OPTS="$JRUBY_OPTS --debug"
-      gemfile: Gemfile
-    - rvm: jruby-head
-      env: JRUBY_OPTS="$JRUBY_OPTS --debug"
-      gemfile: Gemfile.rack-1.3.x
   allow_failures:
     - rvm: jruby-head
     - rvm: ruby-head
   fast_finish: true
+sudo: false

data/Gemfile

@@ -1,33 +1,27 @@
 source 'https://rubygems.org'
 
-gem 'jruby-openssl', :platforms => :jruby
-gem 'rake'
-gem 'yard'
+gem 'jruby-openssl', '~> 0.9.19', :platforms => :jruby
+gem 'rake', '>= 12.0'
+gem 'yard', '>= 0.9.11'
 
 group :development do
-  gem 'growl'
-  platforms :ruby_19, :ruby_20 do
-    gem 'guard'
-    gem 'guard-bundler'
-    gem 'guard-rspec'
-  end
+  gem 'benchmark-ips'
   gem 'kramdown'
-  gem 'plymouth', :platforms => [:ruby_19, :ruby_20, :ruby_21]
+  gem 'memory_profiler'
   gem 'pry'
-  gem 'pry-debugger', :platforms => [:mri_19, :mri_20]
-  gem 'pry-byebug', :platforms => [:mri_21]
-  gem 'rb-fsevent'
 end
 
 group :test do
   gem 'coveralls', :require => false
-  gem 'json', '>= 1.8.1', :platforms => [:jruby, :ruby_18, :ruby_19]
-  gem 'mime-types', '~> 1.25', :platforms => [:jruby, :ruby_18]
+  gem 'hashie', '>= 3.4.6', '~> 4.0.0', :platforms => [:jruby_18]
+  gem 'json', '~> 2.0.3', :platforms => %i[jruby_18 jruby_19 ruby_19]
+  gem 'mime-types', '~> 3.1', :platforms => [:jruby_18]
+  gem 'rack', '>= 2.0.6', :platforms => %i[jruby_18 jruby_19 ruby_19 ruby_20 ruby_21]
   gem 'rack-test'
-  gem 'rest-client', '~> 1.6.0', :platforms => [:jruby, :ruby_18]
-  gem 'rspec', '~> 3.0'
-  gem 'rubocop', '>= 0.23', :platforms => [:ruby_19, :ruby_20, :ruby_21]
-  gem 'simplecov', :require => false
+  gem 'rest-client', '~> 2.0.0', :platforms => [:jruby_18]
+  gem 'rspec', '~> 3.5.0'
+  gem 'rubocop', '>= 0.58.2', '< 0.69.0', :platforms => %i[ruby_20 ruby_21 ruby_22 ruby_23 ruby_24]
+  gem 'tins', '~> 1.13.0', :platforms => %i[jruby_18 jruby_19 ruby_19]
 end
 
 gemspec

data/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (c) 2010-2013 Michael Bleigh and Intridea, Inc.
+Copyright (c) 2010-2017 Michael Bleigh and Intridea, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -1,22 +1,15 @@
 # OmniAuth: Standardized Multi-Provider Authentication
 
 [![Gem Version](http://img.shields.io/gem/v/omniauth.svg)][gem]
-[![Build Status](http://img.shields.io/travis/intridea/omniauth.svg)][travis]
-[![Dependency Status](http://img.shields.io/gemnasium/intridea/omniauth.svg)][gemnasium]
-[![Code Climate](http://img.shields.io/codeclimate/github/intridea/omniauth.svg)][codeclimate]
-[![Coverage Status](http://img.shields.io/coveralls/intridea/omniauth.svg)][coveralls]
-[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/intridea/omniauth/trend.png)](https://bitdeli.com/free "Bitdeli Badge")
+[![Build Status](http://img.shields.io/travis/omniauth/omniauth.svg)][travis]
+[![Code Climate](http://img.shields.io/codeclimate/github/omniauth/omniauth.svg)][codeclimate]
+[![Coverage Status](http://img.shields.io/coveralls/omniauth/omniauth.svg)][coveralls]
+[![Security](https://hakiri.io/github/omniauth/omniauth/master.svg)](https://hakiri.io/github/omniauth/omniauth/master)
 
 [gem]: https://rubygems.org/gems/omniauth
-[travis]: http://travis-ci.org/intridea/omniauth
-[gemnasium]: https://gemnasium.com/intridea/omniauth
-[codeclimate]: https://codeclimate.com/github/intridea/omniauth
-[coveralls]: https://coveralls.io/r/intridea/omniauth
-
-**OmniAuth 1.0 has several breaking changes from version 0.x. You can set
-the dependency to `~> 0.3.2` if you do not wish to make the more difficult
-upgrade. See [the wiki](https://github.com/intridea/omniauth/wiki/Upgrading-to-1.0)
-for more information.**
+[travis]: http://travis-ci.org/omniauth/omniauth
+[codeclimate]: https://codeclimate.com/github/omniauth/omniauth
+[coveralls]: https://coveralls.io/r/omniauth/omniauth
 
 ## An Introduction
 OmniAuth is a library that standardizes multi-provider authentication for
@@ -27,7 +20,7 @@ have been created for everything from Facebook to LDAP.
 
 In order to use OmniAuth in your applications, you will need to leverage
 one or more strategies. These strategies are generally released
-individually as RubyGems, and you can see a [community maintained list](https://github.com/intridea/omniauth/wiki/List-of-Strategies)
+individually as RubyGems, and you can see a [community maintained list](https://github.com/omniauth/omniauth/wiki/List-of-Strategies)
 on the wiki for this project.
 
 One strategy, called `Developer`, is included with OmniAuth and provides
@@ -120,13 +113,71 @@ Authentication Hash which will contain information about the just
 authenticated user including a unique id, the strategy they just used
 for authentication, and personal details such as name and email address
 as available. For an in-depth description of what the authentication
-hash might contain, see the [Auth Hash Schema wiki page](https://github.com/intridea/omniauth/wiki/Auth-Hash-Schema).
+hash might contain, see the [Auth Hash Schema wiki page](https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema).
 
 Note that OmniAuth does not perform any actions beyond setting some
 environment information on the callback request. It is entirely up to
 you how you want to implement the particulars of your application's
 authentication flow.
 
+**Please note:** there is currently a CSRF vulnerability which affects OmniAuth (designated [CVE-2015-9284](https://nvd.nist.gov/vuln/detail/CVE-2015-9284)) that requires mitigation at the application level. More details on how to do this can be found on the [Wiki](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284).
+
+## Configuring The `origin` Param
+The `origin` url parameter is typically used to inform where a user came from and where, should you choose to use it, they'd want to return to.
+
+There are three possible options:
+
+Default Flow:
+```ruby
+# /auth/twitter/?origin=[URL]
+# No change
+# If blank, `omniauth.origin` is set to HTTP_REFERER
+```
+
+Renaming Origin Param:
+```ruby
+# /auth/twitter/?return_to=[URL]
+# If blank, `omniauth.origin` is set to HTTP_REFERER
+provider :twitter, ENV['KEY'], ENV['SECRET'], origin_param: 'return_to'
+```
+
+Disabling Origin Param:
+```ruby
+# /auth/twitter
+# Origin handled externally, if need be. `omniauth.origin` is not set
+provider :twitter, ENV['KEY'], ENV['SECRET'], origin_param: false
+```
+
+## Integrating OmniAuth Into Your Rails API
+The following middleware are (by default) included for session management in
+Rails applications. When using OmniAuth with a Rails API, you'll need to add
+one of these required middleware back in:
+
+- `ActionDispatch::Session::CacheStore`
+- `ActionDispatch::Session::CookieStore`
+- `ActionDispatch::Session::MemCacheStore`
+
+The trick to adding these back in is that, by default, they are passed
+`session_options` when added (including the session key), so you can't just add
+a `session_store.rb` initializer, add `use ActionDispatch::Session::CookieStore`
+and have sessions functioning as normal.
+
+To be clear: sessions may work, but your session options will be ignored
+(i.e the session key will default to `_session_id`).  Instead of the
+initializer, you'll have to set the relevant options somewhere
+before your middleware is built (like `application.rb`) and pass them to your
+preferred middleware, like this:
+
+**application.rb:**
+
+```ruby
+config.session_store :cookie_store, key: '_interslice_session'
+config.middleware.use ActionDispatch::Cookies # Required for all session management
+config.middleware.use ActionDispatch::Session::CookieStore, config.session_options
+```
+
+(Thanks @mltsy)
+
 ## Logging
 OmniAuth supports a configurable logger. By default, OmniAuth will log
 to `STDOUT` but you can configure this using `OmniAuth.config.logger`:
@@ -137,13 +188,13 @@ OmniAuth.config.logger = Rails.logger
 ```
 
 ## Resources
-The [OmniAuth Wiki](https://github.com/intridea/omniauth/wiki) has
+The [OmniAuth Wiki](https://github.com/omniauth/omniauth/wiki) has
 actively maintained in-depth documentation for OmniAuth. It should be
 your first stop if you are wondering about a more in-depth look at
 OmniAuth, how it works, and how to use it.
 
 ## Supported Ruby Versions
-OmniAuth is tested under 1.8.7, 1.9.2, 1.9.3, 2.0.0, 2.1.0, JRuby, and Rubinius.
+OmniAuth is tested under 2.1.10, 2.2.6, 2.3.3, 2.4.0, 2.5.0, and JRuby.
 
 ## Versioning
 This library aims to adhere to [Semantic Versioning 2.0.0][semver]. Violations
@@ -158,10 +209,10 @@ Constraint][pvc] with two digits of precision. For example:
     spec.add_dependency 'omniauth', '~> 1.0'
 
 [semver]: http://semver.org/
-[pvc]: http://docs.rubygems.org/read/chapter/16#page74
+[pvc]: http://guides.rubygems.org/patterns/#pessimistic-version-constraint
 
 ## License
-Copyright (c) 2010-2013 Michael Bleigh and Intridea, Inc. See [LICENSE][] for
+Copyright (c) 2010-2017 Michael Bleigh and Intridea, Inc. See [LICENSE][] for
 details.
 
 [license]: LICENSE.md

data/Rakefile

@@ -10,8 +10,44 @@ begin
   RuboCop::RakeTask.new
 rescue LoadError
   task :rubocop do
-    $stderr.puts 'RuboCop is disabled'
+    warn 'RuboCop is disabled'
   end
 end
 
-task :default => [:spec, :rubocop]
+task :default => %i[spec rubocop]
+
+namespace :perf do
+  task :setup do
+    require 'omniauth'
+    require 'rack/test'
+    app = Rack::Builder.new do |b|
+      b.use Rack::Session::Cookie, :secret => 'abc123'
+      b.use OmniAuth::Strategies::Developer
+      b.run lambda { |_env| [200, {}, ['Not Found']] }
+    end.to_app
+    @app = Rack::MockRequest.new(app)
+
+    def call_app(path = ENV['GET_PATH'] || '/')
+      result = @app.get(path)
+      raise "Did not succeed #{result.body}" unless result.status == 200
+
+      result
+    end
+  end
+
+  task :ips => :setup do
+    require 'benchmark/ips'
+    Benchmark.ips do |x|
+      x.report('ips') { call_app }
+    end
+  end
+
+  task :mem => :setup do
+    require 'memory_profiler'
+    num = Integer(ENV['CNT'] || 1)
+    report = MemoryProfiler.report do
+      num.times { call_app }
+    end
+    report.pretty_print
+  end
+end

data/lib/omniauth/auth_hash.rb

@@ -1,11 +1,11 @@
-require 'hashie/mash'
+require 'omniauth/key_store'
 
 module OmniAuth
   # The AuthHash is a normalized schema returned by all OmniAuth
   # strategies. It maps as much user information as the provider
   # is able to provide into the InfoHash (stored as the `'info'`
   # key).
-  class AuthHash < Hashie::Mash
+  class AuthHash < OmniAuth::KeyStore
     def self.subkey_class
       Hashie::Mash
     end
@@ -20,13 +20,11 @@ module OmniAuth
     end
 
     def regular_writer(key, value)
-      if key.to_s == 'info' && !value.is_a?(InfoHash)
-        value = InfoHash.new(value)
-      end
+      value = InfoHash.new(value) if key.to_s == 'info' && value.is_a?(::Hash) && !value.is_a?(InfoHash)
       super
     end
 
-    class InfoHash < Hashie::Mash
+    class InfoHash < OmniAuth::KeyStore
       def self.subkey_class
         Hashie::Mash
       end
@@ -36,13 +34,14 @@ module OmniAuth
         return "#{first_name} #{last_name}".strip if first_name? || last_name?
         return nickname if nickname?
         return email if email?
+
         nil
       end
 
       def name?
-        !!name # rubocop:disable DoubleNegation
+        !!name
       end
-      alias_method :valid?, :name?
+      alias valid? name?
 
       def to_hash
         hash = super

data/lib/omniauth/builder.rb

@@ -1,20 +1,5 @@
 module OmniAuth
   class Builder < ::Rack::Builder
-    def initialize(app, &block)
-      @options = nil
-      if rack14?
-        super
-      else
-        @app = app
-        super(&block)
-        @ins << @app
-      end
-    end
-
-    def rack14?
-      Rack.release.split('.')[1].to_i >= 4
-    end
-
     def on_failure(&block)
       OmniAuth.config.on_failure = block
     end
@@ -36,7 +21,8 @@ module OmniAuth
     end
 
     def options(options = false)
-      return @options || {} if options == false
+      return @options ||= {} if options == false
+
       @options = options
     end
 
@@ -45,7 +31,7 @@ module OmniAuth
         middleware = klass
       else
         begin
-          middleware = OmniAuth::Strategies.const_get("#{OmniAuth::Utils.camelize(klass.to_s)}")
+          middleware = OmniAuth::Strategies.const_get(OmniAuth::Utils.camelize(klass.to_s).to_s)
         rescue NameError
           raise(LoadError.new("Could not find matching strategy for #{klass.inspect}. You may need to install an additional gem (such as omniauth-#{klass})."))
         end

data/lib/omniauth/failure_endpoint.rb

@@ -22,22 +22,24 @@ module OmniAuth
     end
 
     def raise_out!
-      fail(env['omniauth.error'] || OmniAuth::Error.new(env['omniauth.error.type']))
+      raise(env['omniauth.error'] || OmniAuth::Error.new(env['omniauth.error.type']))
     end
 
     def redirect_to_failure
       message_key = env['omniauth.error.type']
-      new_path = "#{env['SCRIPT_NAME']}#{OmniAuth.config.path_prefix}/failure?message=#{message_key}#{origin_query_param}#{strategy_name_query_param}"
+      new_path = "#{env['SCRIPT_NAME']}#{OmniAuth.config.path_prefix}/failure?message=#{Rack::Utils.escape(message_key)}#{origin_query_param}#{strategy_name_query_param}"
       Rack::Response.new(['302 Moved'], 302, 'Location' => new_path).finish
     end
 
     def strategy_name_query_param
       return '' unless env['omniauth.error.strategy']
+
       "&strategy=#{env['omniauth.error.strategy'].name}"
     end
 
     def origin_query_param
       return '' unless env['omniauth.origin']
+
       "&origin=#{Rack::Utils.escape(env['omniauth.origin'])}"
     end
   end

data/lib/omniauth/form.css

@@ -56,7 +56,7 @@ input {
 }
 
 input#identifier, input#openid_url {
-  background: url(http://openid.net/login-bg.gif) no-repeat;
+  background: url(https://openid.net/images/login-bg.gif) no-repeat;
   background-position: 0 50%;
   padding-left: 18px;
 }

data/lib/omniauth/form.rb

@@ -1,5 +1,5 @@
 module OmniAuth
-  class Form # rubocop:disable ClassLength
+  class Form
     DEFAULT_CSS = File.read(File.expand_path('../form.css', __FILE__))
 
     attr_accessor :options
@@ -82,6 +82,7 @@ module OmniAuth
 
     def footer
       return self if @footer
+
       @html << "\n<button type='submit'>Connect</button>" unless @with_custom_button
       @html << <<-HTML
       </form>

data/lib/omniauth/key_store.rb

@@ -0,0 +1,22 @@
+require 'hashie/mash'
+
+module OmniAuth
+  # Generic helper hash that allows method access on deeply nested keys.
+  class KeyStore < ::Hashie::Mash
+    # Disables warnings on Hashie 3.5.0+ for overwritten keys
+    def self.override_logging
+      require 'hashie/version'
+      return unless Gem::Version.new(Hashie::VERSION) >= Gem::Version.new('3.5.0')
+
+      if respond_to?(:disable_warnings)
+        disable_warnings
+      else
+        define_method(:log_built_in_message) { |*| }
+        private :log_built_in_message
+      end
+    end
+
+    # Disable on loading of the class
+    override_logging
+  end
+end

data/lib/omniauth/strategies/developer.rb

@@ -31,13 +31,13 @@ module OmniAuth
     class Developer
       include OmniAuth::Strategy
 
-      option :fields, [:name, :email]
+      option :fields, %i[name email]
       option :uid_field, :email
 
       def request_phase
         form = OmniAuth::Form.new(:title => 'User Info', :url => callback_path)
         options.fields.each do |field|
-          form.text_field field.to_s.capitalize.gsub('_', ' '), field.to_s
+          form.text_field field.to_s.capitalize.tr('_', ' '), field.to_s
         end
         form.button 'Sign In'
         form.to_response