omniauth 2.3.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50ca36a1e5d776acd239b6bf0795352777cbbb9d4cfb6cdad37b35fa42071e30
-  data.tar.gz: 5042edc2920336a00c334faeed9ef80957f83b470ce97c9dd79056d93ba11959
+  metadata.gz: bddaf279c8ba5ce1bca9cb80c8c5cd73b541b7dcda1c2adfde1767077b9233f4
+  data.tar.gz: bb344106bc102d803528d8070d046f2230f18a4d1deb000aff8f83459ffe3cd0
 SHA512:
-  metadata.gz: b3a700e831fec507055fec1860e78be412699562972e2fddd79018d7a07dd0751d650d415bb8921c0207c593fe27871768d084742c6707bbb44bbf52f6222e86
-  data.tar.gz: 0f7776d3a2446974cf8fc9a93f0eaae46c92b3c20becbf4321daa64dd50dd89dbf25d618fef2ac8acd22ee5e9ec586e2db075f62670e5f2344a5907931f10bf7
+  metadata.gz: 1630c220c39715558036324880226c351541be17bfaa86b772a3ad9e5c2d3e2049d971b158a25738dc228c6da614506dee69eecdd30391fddd61e9b431502f5f
+  data.tar.gz: 701902a0b78c8b62dea137fe0fafa811800a16f2cf8e29499e3ff7dc53a72165c4d779ff4098c312ca3382646742b8ff49c3098fb1b04c6bd9624083d1b69f50

data/README.md

@@ -6,6 +6,7 @@
 [![JRuby](https://github.com/omniauth/omniauth/actions/workflows/jruby.yml/badge.svg)][githubactionsjruby]
 [![Maintainability](https://qlty.sh/gh/omniauth/projects/omniauth/maintainability.svg)][qlty]
 [![Coverage Status](http://img.shields.io/coveralls/omniauth/omniauth.svg)][coveralls]
+[![Duel](https://raw.githubusercontent.com/omniauth/omniauth/duel/badge/badge.svg)](https://github.com/sferik/duel-ruby)
 
 [gem]: https://rubygems.org/gems/omniauth
 [githubactions]: https://github.com/omniauth/omniauth/actions/workflows/main.yml
@@ -15,7 +16,7 @@
 [coveralls]: https://coveralls.io/r/omniauth/omniauth
 
 This is the documentation for the in-development branch of OmniAuth.
-You can find the documentation for the latest stable release [here](https://github.com/omniauth/omniauth/tree/v2.3.0)
+You can find the documentation for the latest stable release [here](https://github.com/omniauth/omniauth/tree/v2.4.0)
 
 ## An Introduction
 OmniAuth is a library that standardizes multi-provider authentication for
@@ -378,12 +379,41 @@ def callback_sign_in_key
 end
 ```
 
-OmniAuth then stores the origin and params of the latest 5 sign-ins under
+OmniAuth then stores the origin and params of the latest 3 sign-ins under
 their keys in `session['omniauth.sign_ins']`, and gives each callback its
 own. It still sets `omniauth.origin` and `omniauth.params` in the session
 for the latest sign-in, and falls back to them when a callback's key isn't
 remembered.
 
+The session is often a 4 KB cookie, so each sign-in stores only what it
+needs: no origin when there isn't one, no params when they're empty, and
+no params with more than 512 bytes in their keys and values. A callback
+whose params were too large to keep gets empty `omniauth.params`, and
+OmniAuth logs a warning.
+
+A strategy that needs its own values in the callback, such as an OAuth 2.0
+PKCE verifier, can store them in the same sign-in instead of under another
+session key, so the key isn't stored twice. It passes them to
+`remember_sign_in`, and the callback reads them from `remembered_sign_in`,
+which is the sign-in stored for the callback's key, or `nil`:
+
+```ruby
+def request_phase
+  state = SecureRandom.hex(24)
+  remember_sign_in(state, 'verifier' => verifier)
+  redirect authorize_url(state)
+end
+
+def callback_phase
+  return fail!(:csrf_detected) unless remembered_sign_in
+
+  exchange_code(remembered_sign_in['verifier'])
+end
+```
+
+The keys `origin` and `params` are OmniAuth's, so a strategy shouldn't
+use them.
+
 ## Resources
 The [OmniAuth Wiki](https://github.com/omniauth/omniauth/wiki) has
 actively maintained in-depth documentation for OmniAuth. It should be

data/lib/omniauth/strategy/sign_ins.rb

@@ -8,20 +8,35 @@ module OmniAuth
     # A strategy opts in when its provider sends a value from the request
     # phase back to the callback, such as OAuth 2.0's state. Its request
     # phase calls remember_sign_in with that value, and it overrides
-    # callback_sign_in_key to return the value from the callback.
+    # callback_sign_in_key to return the value from the callback. It can
+    # store its own values for the callback in the same sign-in, such as
+    # OAuth 2.0's PKCE verifier, and read them back with
+    # remembered_sign_in.
+    #
+    # The sign-ins live in the session, which is often a 4 KB cookie, so
+    # each one stores only what isn't empty.
     module SignIns
       # How many sign-ins are remembered. Remembering another forgets the
       # oldest.
-      MAX_REMEMBERED_SIGN_INS = 5
+      MAX_REMEMBERED_SIGN_INS = 3
+
+      # The largest params, counting the bytes of their keys and values, that
+      # a sign-in remembers. The params come from the request, so they can be any
+      # size, and a few large ones would overflow a cookie session.
+      MAX_REMEMBERED_PARAMS_BYTESIZE = 512
 
-      # Remembers the origin and params stored for the current request phase
-      # under key, which the provider sends back to the callback.
-      def remember_sign_in(key)
+      # Remembers the current request phase's sign-in under key, which the
+      # provider sends back to the callback: the strategy's own data, plus
+      # the origin and params OmniAuth stored, under "origin" and "params",
+      # so data shouldn't use those keys.
+      def remember_sign_in(key, data = nil)
         return if key.empty?
 
+        sign_in = data ? data.dup : {} #: Hash[String, untyped]
+        add_origin_and_params(sign_in)
         sign_ins = remembered_sign_ins
         sign_ins.delete(key)
-        sign_ins[key] = {'origin' => session['omniauth.origin'], 'params' => session.fetch('omniauth.params')}
+        sign_ins[key] = sign_in
         session['omniauth.sign_ins'] = sign_ins.to_a.last(MAX_REMEMBERED_SIGN_INS).to_h
       end
 
@@ -31,19 +46,28 @@ module OmniAuth
 
     protected
 
-      # The origin and params for this callback, removed from the session:
-      # the ones remembered under its key, or else omniauth.origin and
-      # omniauth.params, which hold the latest sign-in's.
-      def recall_sign_in
-        fallback = {'origin' => session.delete('omniauth.origin'), 'params' => session.delete('omniauth.params')}
+      # The sign-in remembered under the callback's key, removed from the
+      # session, or nil if none is. It's the same for the whole callback,
+      # so the strategy can read its own data after OmniAuth takes the
+      # origin and params.
+      def remembered_sign_in
+        return @remembered_sign_in if instance_variable_defined?(:@remembered_sign_in)
+
         key = callback_sign_in_key
         sign_ins = remembered_sign_ins
         remembered = sign_ins.keys.detect { |stored| Rack::Utils.secure_compare(stored, key) } if key.instance_of?(String)
         sign_in = sign_ins.delete(remembered)
-        return fallback unless sign_in
+        session['omniauth.sign_ins'] = sign_ins if sign_in
+        @remembered_sign_in = sign_in
+      end
 
-        session['omniauth.sign_ins'] = sign_ins
-        sign_in
+      # The origin and params for this callback, removed from the session:
+      # the ones remembered under its key, or else omniauth.origin and
+      # omniauth.params, which hold the latest sign-in's. Either may be
+      # missing.
+      def recall_sign_in
+        fallback = {'origin' => session.delete('omniauth.origin'), 'params' => session.delete('omniauth.params')}
+        remembered_sign_in || fallback
       end
 
       # A copy of the remembered sign-ins, which are changed by assigning the
@@ -52,6 +76,43 @@ module OmniAuth
         sign_ins = session['omniauth.sign_ins']
         sign_ins.is_a?(Hash) ? sign_ins.dup : {}
       end
+
+    private
+
+      # Adds the origin and params stored for the current request phase to
+      # sign_in, leaving out an empty origin, empty params, and params too
+      # large to keep.
+      def add_origin_and_params(sign_in)
+        origin = session['omniauth.origin']
+        params = session['omniauth.params']
+        sign_in['origin'] = origin unless origin.nil? || origin.empty?
+        sign_in['params'] = params if params && !params.empty? && params_small_enough?(params)
+      end
+
+      def params_small_enough?(params)
+        bytesize = params_bytesize(params)
+        small_enough = bytesize <= MAX_REMEMBERED_PARAMS_BYTESIZE
+        log :warn, "Not remembering #{bytesize} bytes of params for this sign-in, more than #{MAX_REMEMBERED_PARAMS_BYTESIZE}. The callback gets empty omniauth.params." unless small_enough
+        small_enough
+      end
+
+      # The bytes in the keys and values of params, nested hashes and arrays
+      # included. It's counted without building a string, since every
+      # request phase with params counts them.
+      def params_bytesize(value)
+        case value
+        when Hash
+          total = 0
+          value.each_pair { |key, nested| total += key.to_s.bytesize + params_bytesize(nested) }
+          total
+        when Array
+          total = 0
+          value.each { |nested| total += params_bytesize(nested) }
+          total
+        else
+          value.to_s.bytesize
+        end
+      end
     end
   end
 end

data/lib/omniauth/strategy.rb

@@ -1,3 +1,4 @@
+require 'cgi/escape'
 require 'omniauth/key_store'
 require 'omniauth/strategy/class_methods'
 require 'omniauth/strategy/fetchers'
@@ -208,10 +209,13 @@ module OmniAuth
     # referer) so the callback phase can send them back there.
     def store_origin
       origin = request.params[options.origin_param]
-      referer = env['HTTP_REFERER']
       if origin
-        session['omniauth.origin'] = origin
-      elsif referer && !referer.match?(/#{request_path}$/)
+        # A present origin param is what the app asked for, so never silently
+        # fall back to the referer when it's rejected; just store nothing. It
+        # must be a String: an array (origin[]=...) would pass the scheme check
+        # through its to_s and still land in the session.
+        session['omniauth.origin'] = origin if origin.is_a?(String) && safe_origin?(origin)
+      elsif (referer = referer_origin)
         session['omniauth.origin'] = referer
       end
     end
@@ -223,9 +227,9 @@ module OmniAuth
       return invalid_host! unless allowed_host?
 
       sign_in = recall_sign_in
-      origin = sign_in.fetch('origin')
+      origin = sign_in['origin']
       env['omniauth.origin'] = (origin unless origin.eql?(''))
-      env['omniauth.params'] = sign_in.fetch('params') || {}
+      env['omniauth.params'] = sign_in['params'] || {}
       run_hook(:before_callback_phase)
       callback_phase
     end
@@ -282,12 +286,16 @@ module OmniAuth
     end
 
     def redirect(uri)
+      uri = ascii_compatible_uri(uri)
       r = Rack::Response.new
+      r['content-type'] = 'text/html'
 
-      if options[:iframe]
-        r.write("<script type='text/javascript' charset='utf-8'>top.location.href = '#{uri}';</script>")
+      # A disallowed scheme (javascript:, data:, ...) never reaches the inline
+      # script; it falls through to the 302, where a Location header is inert.
+      if options[:iframe] && allowed_redirect_uri?(uri)
+        r.write("<script type='text/javascript' charset='utf-8'>top.location.href = '#{escape_javascript(uri)}';</script>")
       else
-        r.write("Redirecting to #{uri}...")
+        r.write("Redirecting to #{CGI.escapeHTML(uri.to_s)}...")
         r.redirect(uri)
       end
 
@@ -316,6 +324,91 @@ module OmniAuth
 
   protected
 
+    # Characters that could end the single-quoted string literal or the
+    # <script> element the :iframe redirect writes the URI into.
+    JAVASCRIPT_UNSAFE = /[\x00-\x1f"&'<>\\\u2028\u2029]/.freeze
+    private_constant :JAVASCRIPT_UNSAFE
+
+    # Rewrites each unsafe character as a \uXXXX escape, which the browser
+    # decodes back to that character inside the string literal. Binary strings
+    # (which Rack hands back for query strings and the like) are read as UTF-8
+    # so multibyte characters survive, any other encoding is transcoded so a
+    # non-UTF-8 charset isn't misread, and only invalid bytes are replaced.
+    # A valid UTF-8 string goes straight through without being copied.
+    def escape_javascript(value)
+      string = value.to_s
+      string = string.dup.force_encoding(Encoding::UTF_8) if string.encoding.equal?(Encoding::BINARY)
+      string = string.encode(Encoding::UTF_8, :invalid => :replace, :undef => :replace) unless string.encoding.equal?(Encoding::UTF_8)
+      string = string.scrub unless string.valid_encoding?
+      string.gsub(JAVASCRIPT_UNSAFE) { |char| format('\\u%04x', char.ord) }
+    end
+
+    # Tab/newline/CR anywhere, or a leading control byte or space, which a
+    # browser strips before it reads the scheme.
+    NEEDS_NORMALIZING = /[\t\r\n]|\A[\x00-\x20]/.freeze
+    private_constant :NEEDS_NORMALIZING
+
+    # Schemes a browser runs as script when it follows the URL. Escaping can't
+    # neutralize one (none of its characters are unsafe), so such a URI must
+    # never reach the inline :iframe script or be persisted as an origin.
+    DANGEROUS_SCHEME = /\A(?:javascript|vbscript|data):/i.freeze
+    private_constant :DANGEROUS_SCHEME
+
+    ANY_SCHEME = /\A[a-z][a-z0-9+.-]*:/i.freeze
+    private_constant :ANY_SCHEME
+
+    WEB_SCHEME = /\Ahttps?:/i.freeze
+    private_constant :WEB_SCHEME
+
+    # The URI as a browser reads its scheme: tab/newline/CR dropped anywhere
+    # and leading control bytes and spaces trimmed, so a split or padded scheme
+    # can't slip past the checks. A URI with none of those is returned as-is,
+    # so the common case allocates nothing. Invalid bytes are scrubbed first,
+    # since matching a regexp against them raises ArgumentError.
+    def normalize_redirect_uri(uri)
+      uri = uri.to_s
+      uri = uri.scrub unless uri.valid_encoding?
+      return uri unless uri.match?(NEEDS_NORMALIZING)
+
+      uri.gsub(/[\t\r\n]/, '').sub(/\A[\x00-\x20]+/, '')
+    end
+
+    # Safe to write into the inline :iframe script: a relative/protocol-relative
+    # path or an http(s) URL. A javascript:/data:/vbscript: URI is excluded here
+    # because escaping leaves it able to run in the application's origin.
+    def allowed_redirect_uri?(uri)
+      uri = normalize_redirect_uri(uri)
+      !uri.match?(ANY_SCHEME) || uri.match?(WEB_SCHEME)
+    end
+
+    # Safe to persist as an origin: anything but a scheme that runs as script.
+    # Unlike the iframe check this keeps non-web deep links such as myapp://,
+    # which mobile sign-in relies on, while still refusing a URI that a later
+    # redirect to omniauth.origin could execute.
+    def safe_origin?(uri)
+      !normalize_redirect_uri(uri).match?(DANGEROUS_SCHEME)
+    end
+
+    # The referer to fall back on as the origin, unless it is the request path
+    # itself or has a scheme that runs as script. It's scrubbed before any
+    # matching, which would otherwise raise on invalid bytes.
+    def referer_origin
+      referer = env['HTTP_REFERER']
+      return unless referer
+
+      referer = referer.scrub unless referer.valid_encoding?
+      referer if !referer.end_with?(request_path) && safe_origin?(referer)
+    end
+
+    # A URI in an encoding that isn't ASCII-compatible, such as UTF-16, can't
+    # be matched against the scheme checks or written into the UTF-8 response,
+    # so it's transcoded to UTF-8 first. Anything else is returned as-is.
+    def ascii_compatible_uri(uri)
+      return uri unless uri.is_a?(String) && !uri.encoding.ascii_compatible?
+
+      uri.encode(Encoding::UTF_8, :invalid => :replace, :undef => :replace)
+    end
+
     # Re-raises errors from the downstream app; reports anything else
     # raised during a phase as an authentication failure.
     def handle_phase_error(error)

data/lib/omniauth/version.rb

@@ -1,3 +1,3 @@
 module OmniAuth
-  VERSION = '2.3.0'.freeze
+  VERSION = '2.4.0'.freeze
 end

data/sig/omniauth.rbs

@@ -459,11 +459,16 @@ module OmniAuth
     # A strategy opts in by calling remember_sign_in in its request phase
     # and overriding callback_sign_in_key.
     module SignIns : _Core
+      @remembered_sign_in: Hash[String, untyped]?
+
       MAX_REMEMBERED_SIGN_INS: Integer
 
-      # Remembers the current request phase's origin and params under key,
-      # which the provider sends back to the callback.
-      def remember_sign_in: (String key) -> void
+      MAX_REMEMBERED_PARAMS_BYTESIZE: Integer
+
+      # Remembers the current request phase's sign-in under key, which the
+      # provider sends back to the callback: the strategy's own data, plus
+      # the origin and params under "origin" and "params".
+      def remember_sign_in: (String key, ?Hash[String, untyped]? data) -> void
 
       # The key the callback sends back, or nil for a strategy that doesn't
       # remember sign-ins.
@@ -471,11 +476,21 @@ module OmniAuth
 
       private
 
+      # The sign-in remembered under the callback's key, removed from the
+      # session, or nil if none is.
+      def remembered_sign_in: () -> Hash[String, untyped]?
+
       # The "origin" and "params" for this callback, removed from the
       # session.
       def recall_sign_in: () -> Hash[String, untyped]
 
       def remembered_sign_ins: () -> Hash[String, Hash[String, untyped]]
+
+      def add_origin_and_params: (Hash[String, untyped] sign_in) -> void
+
+      def params_small_enough?: (Hash[String, untyped] params) -> bool
+
+      def params_bytesize: (untyped value) -> Integer
     end
 
     # Runs the request and callback phases against OmniAuth.config.mock_auth
@@ -568,6 +583,28 @@ module OmniAuth
 
     private
 
+    JAVASCRIPT_UNSAFE: Regexp
+
+    NEEDS_NORMALIZING: Regexp
+
+    DANGEROUS_SCHEME: Regexp
+
+    ANY_SCHEME: Regexp
+
+    WEB_SCHEME: Regexp
+
+    def escape_javascript: (_ToS value) -> String
+
+    def normalize_redirect_uri: (_ToS uri) -> String
+
+    def allowed_redirect_uri?: (_ToS uri) -> bool
+
+    def safe_origin?: (_ToS uri) -> bool
+
+    def referer_origin: () -> String?
+
+    def ascii_compatible_uri: [T < Object] (T uri) -> (T | String)
+
     def handle_phase_error: (StandardError error) -> rack_response
 
     def run_hook: (Symbol name) -> void

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.4.0
 platform: ruby
 authors:
 - Erik Berlin
@@ -124,7 +124,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 3.6.9
 specification_version: 4
 summary: A generalized Rack framework for multiple-provider authentication.
 test_files: []