omniauth 2.1.3 → 2.2.0

data/lib/omniauth/strategy/fetchers.rb

@@ -0,0 +1,57 @@
+module OmniAuth
+  module Strategy
+    # Builds the auth hash from the uid, info, credentials, and extra
+    # blocks a strategy declares with the class-level fetcher DSL.
+    module Fetchers
+      def uid
+        self.class.uid_stack(self).last
+      end
+
+      def info
+        merge_stack(self.class.info_stack(self))
+      end
+
+      def credentials
+        merge_stack(self.class.credentials_stack(self))
+      end
+
+      def extra
+        merge_stack(self.class.extra_stack(self))
+      end
+
+      def auth_hash
+        credentials_data = credentials
+        extra_data = extra
+        AuthHash.new(:provider => name, :uid => uid).tap do |auth|
+          auth.info = info unless skip_info?
+          auth.credentials = credentials_data if credentials_data
+          auth.extra = extra_data if extra_data
+        end
+      end
+
+      # Determines whether or not user info should be retrieved. This
+      # allows some strategies to save a call to an external API service
+      # for existing users. You can use it either by setting the `:skip_info`
+      # to true or by setting `:skip_info` to a Proc that takes a uid and
+      # evaluates to true when you would like to skip info.
+      #
+      # @example
+      #
+      #   use MyStrategy, :skip_info => lambda{|uid| User.find_by_uid(uid)}
+      def skip_info?
+        return false unless options.skip_info?
+        return true unless options.skip_info.respond_to?(:call)
+
+        options.skip_info.call(uid)
+      end
+
+    protected
+
+      def merge_stack(stack)
+        merged = {} #: Hash[untyped, untyped]
+        stack.each { |hash| merged.merge!(hash) }
+        merged
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/hosts.rb

@@ -0,0 +1,48 @@
+module OmniAuth
+  module Strategy
+    # Guards against forged hosts. Unless a full_host is set, callback URLs
+    # use the request's host, which comes from the Host or X-Forwarded-Host
+    # header, so a forged one would send the provider a redirect_uri on
+    # another host.
+    module Hosts
+    protected
+
+      # Whether callback URLs may use this request's host. They always may
+      # when a full_host is set, since then the request's host isn't used.
+      # Otherwise, if OmniAuth.config.allowed_hosts is set, the host must
+      # match one of its entries: a string matches the whole host, ignoring
+      # case, and a regexp must match the whole host.
+      def allowed_host?
+        return true if full_host_set?
+
+        allowed_hosts = OmniAuth.config.allowed_hosts
+        return true unless allowed_hosts
+
+        host = request.host
+        allowed_hosts.any? do |allowed|
+          allowed.instance_of?(Regexp) ? /\A(?:#{allowed})\z/ === host : allowed.casecmp?(host)
+        end
+      end
+
+      def full_host_set?
+        !(options[:full_host] || OmniAuth.config.full_host).nil?
+      end
+
+      def warn_if_using_request_host
+        return if full_host_set? || OmniAuth.config.allowed_hosts
+
+        log :warn, <<-WARN
+  OmniAuth is building callback URLs from the request's host, which comes
+  from the Host or X-Forwarded-Host header and can be forged unless your
+  app or a proxy in front of it checks it. To fix this, set either:
+  OmniAuth.config.full_host = 'https://example.com'
+  OmniAuth.config.allowed_hosts = ['example.com']
+        WARN
+      end
+
+      def invalid_host!
+        fail!(:invalid_host, Error.new('The request host is not in OmniAuth.config.allowed_hosts'))
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/paths.rb

@@ -0,0 +1,140 @@
+module OmniAuth
+  module Strategy
+    # Works out the request, callback, and setup paths for a strategy and
+    # whether the current request is on one of them, plus the full URLs
+    # built from them.
+    module Paths
+      # Returns true if the environment recognizes either the
+      # request or callback path.
+      def on_auth_path?
+        on_request_path? || on_callback_path?
+      end
+
+      def on_request_path?
+        if options[:request_path].respond_to?(:call)
+          options.fetch(:request_path).call(env)
+        else
+          on_path?(request_path)
+        end
+      end
+
+      def on_callback_path?
+        on_path?(callback_path) || current_path.sub(FORMAT_EXTENSION_REGEX, EMPTY_STRING).casecmp(callback_path).zero?
+      end
+
+      def on_path?(path)
+        current_path.casecmp(path).zero?
+      end
+
+      def path_prefix
+        options[:path_prefix] || OmniAuth.config.path_prefix
+      end
+
+      def custom_path(kind)
+        if options[kind].respond_to?(:call)
+          result = options.fetch(kind).call(env)
+          return nil unless result.is_a?(String)
+
+          result
+        else
+          options[kind]
+        end
+      end
+
+      def request_path
+        @request_path ||=
+          if options[:request_path].is_a?(String)
+            options.fetch(:request_path)
+          else
+            "#{script_name}#{path_prefix}/#{name}"
+          end
+      end
+
+      def callback_path
+        @callback_path ||= callback_path_option || custom_path(:request_path) || "#{script_name}#{path_prefix}/#{name}/callback"
+      end
+
+      def setup_path
+        options[:setup_path] || "#{path_prefix}/#{name}/setup"
+      end
+
+      CURRENT_PATH_REGEX = %r{/$}.freeze
+      FORMAT_EXTENSION_REGEX = /\.\w+\z/.freeze
+      EMPTY_STRING = ''.freeze
+      # Repeated slashes are collapsed, as Rails routing does, so a proxy
+      # that sends //auth/:provider still reaches the strategy.
+      def current_path
+        @current_path ||= request.path.downcase.squeeze('/').sub(CURRENT_PATH_REGEX, EMPTY_STRING)
+      end
+
+      def query_string
+        request.query_string.empty? ? '' : "?#{request.query_string}"
+      end
+
+      # The scheme and host for URLs such as callback_url: the strategy's
+      # :full_host option, else OmniAuth.config.full_host, else the
+      # request's. Either setting can be a string or a proc taking the env.
+      def full_host
+        host = options[:full_host] || OmniAuth.config.full_host
+        case host
+        when String then host
+        when Proc then host.call(env)
+        else full_host_from_request
+        end
+      end
+
+      def callback_url
+        full_host + callback_path + query_string
+      end
+
+      def script_name
+        current_env = @env
+        return '' if current_env.nil?
+
+        current_env['SCRIPT_NAME'] || ''
+      end
+
+    protected
+
+      # The :callback_path option: a string, or a lambda that returns true
+      # when the current path is the callback path.
+      def callback_path_option
+        option = options[:callback_path]
+        return option if option.is_a?(String)
+
+        current_path if option.respond_to?(:call) && option.call(env)
+      end
+
+      # The scheme, host, and port of the current request, or an empty
+      # string if the request URL isn't absolute.
+      def full_host_from_request
+        # in Rack 1.3.x, request.url explodes if scheme is nil
+        return '' unless request.scheme && URI.parse(request.url).absolute?
+
+        uri = URI.parse(request.url.sub(/\?.*/, ''))
+        uri.path = ''
+        # sometimes the url is actually showing http inside rails because the
+        # other layers (like nginx) have handled the ssl termination.
+        uri.scheme = 'https' if ssl?
+        String(uri)
+      end
+
+      # Rack env values that mean the request came in over HTTPS.
+      SSL_ENV_VALUES = {
+        'HTTPS' => 'on',
+        'HTTP_X_FORWARDED_SSL' => 'on',
+        'HTTP_X_FORWARDED_SCHEME' => 'https',
+        'rack.url_scheme' => 'https'
+      }.freeze
+
+      # Reads request.env rather than env, so full_host and callback_url also
+      # work outside a Rack call, as when a strategy's tests stub #request.
+      def ssl?
+        request_env = request.env
+        # A proxy chain can list several protocols; the first is the client's.
+        forwarded_proto = request_env['HTTP_X_FORWARDED_PROTO'].to_s.split(',').first
+        forwarded_proto.eql?('https') || SSL_ENV_VALUES.any? { |key, value| request_env[key].eql?(value) }
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/test_mode.rb

@@ -0,0 +1,53 @@
+module OmniAuth
+  module Strategy
+    # Runs the request and callback phases against OmniAuth.config.mock_auth
+    # instead of the provider when OmniAuth.config.test_mode is enabled.
+    module TestMode
+      # This is called in lieu of the normal request process
+      # in the event that OmniAuth has been configured to be
+      # in test mode.
+      def mock_call!(*)
+        if request_call?
+          mock_request_call
+        elsif on_callback_path?
+          mock_callback_call
+        else
+          call_app!
+        end
+      rescue StandardError => e
+        handle_phase_error(e)
+      end
+
+      def mock_request_call
+        setup_phase
+
+        run_hook(:request_validation_phase)
+
+        session['omniauth.params'] = omniauth_params
+
+        run_hook(:before_request_phase)
+
+        store_origin if options.origin_param
+
+        result = redirect(callback_url)
+
+        run_hook(:after_request_phase)
+        result
+      end
+
+      def mock_callback_call
+        setup_phase
+
+        origin = session.delete('omniauth.origin')
+        env['omniauth.origin'] ||= origin
+        env['omniauth.origin'] = nil if env.fetch('omniauth.origin').eql?('')
+        env['omniauth.params'] = session.delete('omniauth.params') || {}
+
+        mocked_auth = OmniAuth.mock_auth_for(name)
+        env['omniauth.auth'] = mocked_auth unless mocked_auth.instance_of?(Symbol)
+        run_hook(:before_callback_phase)
+        mocked_auth.instance_of?(Symbol) ? fail!(mocked_auth) : call_app!
+      end
+    end
+  end
+end