pelle-ruby-openid 2.1.8

data/lib/openid/trustroot.rb

@@ -0,0 +1,349 @@
+require 'uri'
+require 'openid/urinorm'
+
+module OpenID
+
+  class RealmVerificationRedirected < Exception
+    # Attempting to verify this realm resulted in a redirect.
+    def initialize(relying_party_url, rp_url_after_redirects)
+      @relying_party_url = relying_party_url
+      @rp_url_after_redirects = rp_url_after_redirects
+    end
+
+    def to_s
+      return "Attempting to verify #{@relying_party_url} resulted in " +
+        "redirect to #{@rp_url_after_redirects}"
+    end
+  end
+
+  module TrustRoot
+    TOP_LEVEL_DOMAINS = %w'
+      ac ad ae aero af ag ai al am an ao aq ar arpa as asia at
+      au aw ax az ba bb bd be bf bg bh bi biz bj bm bn bo br bs bt
+      bv bw by bz ca cat cc cd cf cg ch ci ck cl cm cn co com coop
+      cr cu cv cx cy cz de dj dk dm do dz ec edu ee eg er es et eu
+      fi fj fk fm fo fr ga gb gd ge gf gg gh gi gl gm gn gov gp gq
+      gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in info int
+      io iq ir is it je jm jo jobs jp ke kg kh ki km kn kp kr kw
+      ky kz la lb lc li lk lr ls lt lu lv ly ma mc md me mg mh mil
+      mk ml mm mn mo mobi mp mq mr ms mt mu museum mv mw mx my mz
+      na name nc ne net nf ng ni nl no np nr nu nz om org pa pe pf
+      pg ph pk pl pm pn pr pro ps pt pw py qa re ro rs ru rw sa sb
+      sc sd se sg sh si sj sk sl sm sn so sr st su sv sy sz tc td
+      tel tf tg th tj tk tl tm tn to tp tr travel tt tv tw tz ua
+      ug uk us uy uz va vc ve vg vi vn vu wf ws xn--0zwm56d
+      xn--11b5bs3a9aj6g xn--80akhbyknj4f xn--9t4b11yi5a
+      xn--deba0ad xn--g6w251d xn--hgbk6aj7f53bba
+      xn--hlcj6aya9esc7a xn--jxalpdlp xn--kgbechtv xn--zckzah ye
+      yt yu za zm zw'
+
+    ALLOWED_PROTOCOLS = ['http', 'https']
+
+    # The URI for relying party discovery, used in realm verification.
+    #
+    # XXX: This should probably live somewhere else (like in
+    # OpenID or OpenID::Yadis somewhere)
+    RP_RETURN_TO_URL_TYPE = 'http://specs.openid.net/auth/2.0/return_to'
+
+    # If the endpoint is a relying party OpenID return_to endpoint,
+    # return the endpoint URL. Otherwise, return None.
+    #
+    # This function is intended to be used as a filter for the Yadis
+    # filtering interface.
+    #
+    # endpoint: An XRDS BasicServiceEndpoint, as returned by
+    # performing Yadis dicovery.
+    #
+    # returns the endpoint URL or None if the endpoint is not a
+    # relying party endpoint.
+    def TrustRoot._extract_return_url(endpoint)
+      if endpoint.matchTypes([RP_RETURN_TO_URL_TYPE])
+        return endpoint.uri
+      else
+        return nil
+      end
+    end
+
+    # Is the return_to URL under one of the supplied allowed
+    # return_to URLs?
+    def TrustRoot.return_to_matches(allowed_return_to_urls, return_to)
+      allowed_return_to_urls.each { |allowed_return_to|
+        # A return_to pattern works the same as a realm, except that
+        # it's not allowed to use a wildcard. We'll model this by
+        # parsing it as a realm, and not trying to match it if it has
+        # a wildcard.
+
+        return_realm = TrustRoot.parse(allowed_return_to)
+        if (# Parses as a trust root
+            !return_realm.nil? and
+
+            # Does not have a wildcard
+            !return_realm.wildcard and
+
+            # Matches the return_to that we passed in with it
+            return_realm.validate_url(return_to)
+            )
+          return true
+        end
+      }
+
+      # No URL in the list matched
+      return false
+    end
+
+    # Given a relying party discovery URL return a list of return_to
+    # URLs.
+    def TrustRoot.get_allowed_return_urls(relying_party_url)
+      rp_url_after_redirects, return_to_urls = services.get_service_endpoints(
+        relying_party_url, _extract_return_url)
+
+      if rp_url_after_redirects != relying_party_url
+        # Verification caused a redirect
+        raise RealmVerificationRedirected.new(
+                relying_party_url, rp_url_after_redirects)
+      end
+
+      return return_to_urls
+    end
+
+    # Verify that a return_to URL is valid for the given realm.
+    #
+    # This function builds a discovery URL, performs Yadis discovery
+    # on it, makes sure that the URL does not redirect, parses out
+    # the return_to URLs, and finally checks to see if the current
+    # return_to URL matches the return_to.
+    #
+    # raises DiscoveryFailure when Yadis discovery fails returns
+    # true if the return_to URL is valid for the realm
+    def TrustRoot.verify_return_to(realm_str, return_to, _vrfy=nil)
+      # _vrfy parameter is there to make testing easier
+      if _vrfy.nil?
+        _vrfy = self.method('get_allowed_return_urls')
+      end
+
+      if !(_vrfy.is_a?(Proc) or _vrfy.is_a?(Method))
+        raise ArgumentError, "_vrfy must be a Proc or Method"
+      end
+
+      realm = TrustRoot.parse(realm_str)
+      if realm.nil?
+        # The realm does not parse as a URL pattern
+        return false
+      end
+
+      begin
+        allowable_urls = _vrfy.call(realm.build_discovery_url())
+      rescue RealmVerificationRedirected => err
+        Util.log(err.to_s)
+        return false
+      end
+
+      if return_to_matches(allowable_urls, return_to)
+        return true
+      else
+        Util.log("Failed to validate return_to #{return_to} for " +
+            "realm #{realm_str}, was not in #{allowable_urls}")
+        return false
+      end
+    end
+
+    class TrustRoot
+
+      attr_reader :unparsed, :proto, :wildcard, :host, :port, :path
+
+      @@empty_re = Regexp.new('^http[s]*:\/\/\*\/$')
+
+      def TrustRoot._build_path(path, query=nil, frag=nil)
+        s = path.dup
+
+        frag = nil if frag == ''
+        query = nil if query == ''
+
+        if query
+          s << "?" << query
+        end
+
+        if frag
+          s << "#" << frag
+        end
+
+        return s
+      end
+
+      def TrustRoot._parse_url(url)
+        begin
+          url = URINorm.urinorm(url)
+        rescue URI::InvalidURIError => err
+          nil
+        end
+
+        begin
+          parsed = URI::parse(url)
+        rescue URI::InvalidURIError
+          return nil
+        end
+
+        path = TrustRoot._build_path(parsed.path,
+                                     parsed.query,
+                                     parsed.fragment)
+
+        return [parsed.scheme || '', parsed.host || '',
+                parsed.port || '', path || '']
+      end
+
+      def TrustRoot.parse(trust_root)
+        trust_root = trust_root.dup
+        unparsed = trust_root.dup
+
+        # look for wildcard
+        wildcard = (not trust_root.index('://*.').nil?)
+        trust_root.sub!('*.', '') if wildcard
+
+        # handle http://*/ case
+        if not wildcard and @@empty_re.match(trust_root)
+          proto = trust_root.split(':')[0]
+          port = proto == 'http' ? 80 : 443
+          return new(unparsed, proto, true, '', port, '/')
+        end
+
+        parts = TrustRoot._parse_url(trust_root)
+        return nil if parts.nil?
+
+        proto, host, port, path = parts
+
+        # check for URI fragment
+        if path and !path.index('#').nil?
+          return nil
+        end
+
+        return nil unless ['http', 'https'].member?(proto)
+        return new(unparsed, proto, wildcard, host, port, path)
+      end
+
+      def TrustRoot.check_sanity(trust_root_string)
+        trust_root = TrustRoot.parse(trust_root_string)
+        if trust_root.nil?
+          return false
+        else
+          return trust_root.sane?
+        end
+      end
+
+      # quick func for validating a url against a trust root.  See the
+      # TrustRoot class if you need more control.
+      def self.check_url(trust_root, url)
+        tr = self.parse(trust_root)
+        return (!tr.nil? and tr.validate_url(url))
+      end
+
+      # Return a discovery URL for this realm.
+      #
+      # This function does not check to make sure that the realm is
+      # valid. Its behaviour on invalid inputs is undefined.
+      #
+      # return_to:: The relying party return URL of the OpenID
+      # authentication request
+      #
+      # Returns the URL upon which relying party discovery should be
+      # run in order to verify the return_to URL
+      def build_discovery_url
+        if self.wildcard
+          # Use "www." in place of the star
+          www_domain = 'www.' + @host
+          port = (!@port.nil? and ![80, 443].member?(@port)) ? (":" + @port.to_s) : ''
+          return "#{@proto}://#{www_domain}#{port}#{@path}"
+        else
+          return @unparsed
+        end
+      end
+
+      def initialize(unparsed, proto, wildcard, host, port, path)
+        @unparsed = unparsed
+        @proto = proto
+        @wildcard = wildcard
+        @host = host
+        @port = port
+        @path = path
+      end
+
+      def sane?
+        return true if @host == 'localhost'
+
+        host_parts = @host.split('.')
+
+        # a note: ruby string split does not put an empty string at
+        # the end of the list if the split element is last.  for
+        # example, 'foo.com.'.split('.') => ['foo','com'].  Mentioned
+        # because the python code differs here.
+
+        return false if host_parts.length == 0
+
+        # no adjacent dots
+        return false if host_parts.member?('')
+
+        # last part must be a tld
+        tld = host_parts[-1]
+        return false unless TOP_LEVEL_DOMAINS.member?(tld)
+
+        return false if host_parts.length == 1
+
+        if @wildcard
+          if tld.length == 2 and host_parts[-2].length <= 3
+            # It's a 2-letter tld with a short second to last segment
+            # so there needs to be more than two segments specified
+            # (e.g. *.co.uk is insane)
+            return host_parts.length > 2
+          end
+        end
+
+        return true
+      end
+
+      def validate_url(url)
+        parts = TrustRoot._parse_url(url)
+        return false if parts.nil?
+
+        proto, host, port, path = parts
+
+        return false unless proto == @proto
+        return false unless port == @port
+        return false unless host.index('*').nil?
+
+        if !@wildcard
+          if host != @host
+            return false
+          end
+        elsif ((@host != '') and
+               (!host.ends_with?('.' + @host)) and
+               (host != @host))
+          return false
+        end
+
+        if path != @path
+          path_len = @path.length
+          trust_prefix = @path[0...path_len]
+          url_prefix = path[0...path_len]
+
+          # must be equal up to the length of the path, at least
+          if trust_prefix != url_prefix
+            return false
+          end
+
+          # These characters must be on the boundary between the end
+          # of the trust root's path and the start of the URL's path.
+          if !@path.index('?').nil?
+            allowed = '&'
+          else
+            allowed = '?/'
+          end
+
+          return (!allowed.index(@path[-1]).nil? or
+                  !allowed.index(path[path_len]).nil?)
+        end
+
+        return true
+      end
+    end
+  end
+end
+

data/lib/openid/urinorm.rb

@@ -0,0 +1,75 @@
+require 'uri'
+
+require "openid/extras"
+
+module OpenID
+
+  module URINorm
+    public
+    def URINorm.urinorm(uri)
+      uri = URI.parse(uri)
+
+      raise URI::InvalidURIError.new('no scheme') unless uri.scheme
+      uri.scheme = uri.scheme.downcase
+      unless ['http','https'].member?(uri.scheme)
+        raise URI::InvalidURIError.new('Not an HTTP or HTTPS URI')
+      end
+
+      raise URI::InvalidURIError.new('no host') unless uri.host
+      uri.host = uri.host.downcase
+
+      uri.path = remove_dot_segments(uri.path)
+      uri.path = '/' if uri.path.length == 0
+
+      uri = uri.normalize.to_s
+      uri = uri.gsub(PERCENT_ESCAPE_RE) {
+        sub = $&[1..2].to_i(16).chr
+        reserved(sub) ? $&.upcase : sub
+      }
+
+      return uri
+    end
+
+    private
+    RESERVED_RE = /[A-Za-z0-9._~-]/
+    PERCENT_ESCAPE_RE = /%[0-9a-zA-Z]{2}/
+
+    def URINorm.reserved(chr)
+      not RESERVED_RE =~ chr
+    end
+
+    def URINorm.remove_dot_segments(path)
+      result_segments = []
+
+      while path.length > 0
+        if path.starts_with?('../')
+          path = path[3..-1]
+        elsif path.starts_with?('./')
+          path = path[2..-1]
+        elsif path.starts_with?('/./')
+          path = path[2..-1]
+        elsif path == '/.'
+          path = '/'
+        elsif path.starts_with?('/../')
+          path = path[3..-1]
+          result_segments.pop if result_segments.length > 0
+        elsif path == '/..'
+          path = '/'
+          result_segments.pop if result_segments.length > 0
+        elsif path == '..' or path == '.'
+          path = ''
+        else
+          i = 0
+          i = 1 if path[0].chr == '/'
+          i = path.index('/', i)
+          i = path.length if i.nil?
+          result_segments << path[0...i]
+          path = path[i..-1]
+        end
+      end
+
+      return result_segments.join('')
+    end
+  end
+
+end

data/lib/openid/util.rb

@@ -0,0 +1,110 @@
+require "cgi"
+require "uri"
+require "logger"
+
+require "openid/extras"
+
+# See OpenID::Consumer or OpenID::Server modules, as well as the store classes
+module OpenID
+  class AssertionError < Exception
+  end
+
+  # Exceptions that are raised by the library are subclasses of this
+  # exception type, so if you want to catch all exceptions raised by
+  # the library, you can catch OpenIDError
+  class OpenIDError < StandardError
+  end
+
+  module Util
+
+    BASE64_CHARS = ('ABCDEFGHIJKLMNOPQRSTUVWXYZ' \
+                    'abcdefghijklmnopqrstuvwxyz0123456789+/')
+    BASE64_RE = Regexp.compile("
+    \\A
+    ([#{BASE64_CHARS}]{4})*
+    ([#{BASE64_CHARS}]{2}==|
+     [#{BASE64_CHARS}]{3}=)?
+    \\Z", Regexp::EXTENDED)
+
+    def Util.assert(value, message=nil)
+      if not value
+        raise AssertionError, message or value
+      end
+    end
+
+    def Util.to_base64(s)
+      [s].pack('m').gsub("\n", "")
+    end
+
+    def Util.from_base64(s)
+      without_newlines = s.gsub(/[\r\n]+/, '')
+      if !BASE64_RE.match(without_newlines)
+        raise ArgumentError, "Malformed input: #{s.inspect}"
+      end
+      without_newlines.unpack('m').first
+    end
+
+    def Util.urlencode(args)
+      a = []
+      args.each do |key, val|
+        val = '' unless val
+        a << (CGI::escape(key) + "=" + CGI::escape(val))
+      end
+      a.join("&")
+    end
+
+    def Util.parse_query(qs)
+      query = {}
+      CGI::parse(qs).each {|k,v| query[k] = v[0]}
+      return query
+    end
+
+    def Util.append_args(url, args)
+      url = url.dup
+      return url if args.length == 0
+
+      if args.respond_to?('each_pair')
+        args = args.sort
+      end
+
+      url << (url.include?("?") ? "&" : "?")
+      url << Util.urlencode(args)
+    end
+
+    @@logger = Logger.new(STDERR)
+    @@logger.progname = "OpenID"
+
+    def Util.logger=(logger)
+      @@logger = logger
+    end
+
+    def Util.logger
+      @@logger
+    end
+
+    # change the message below to do whatever you like for logging
+    def Util.log(message)
+      logger.info(message)
+    end
+
+    def Util.auto_submit_html(form, title='OpenID transaction in progress')
+      return "
+<html>
+<head>
+  <title>#{title}</title>
+</head>
+<body onload='document.forms[0].submit();'>
+#{form}
+<script>
+var elements = document.forms[0].elements;
+for (var i = 0; i < elements.length; i++) {
+  elements[i].style.display = \"none\";
+}
+</script>
+</body>
+</html>
+"
+    end
+  end
+
+end

data/lib/openid/yadis/accept.rb

@@ -0,0 +1,148 @@
+module OpenID
+
+  module Yadis
+
+    # Generate an accept header value
+    #
+    # [str or (str, float)] -> str
+    def self.generate_accept_header(*elements)
+      parts = []
+      elements.each { |element|
+        if element.is_a?(String)
+          qs = "1.0"
+          mtype = element
+        else
+          mtype, q = element
+          q = q.to_f
+          if q > 1 or q <= 0
+            raise ArgumentError.new("Invalid preference factor: #{q}")
+          end
+          qs = sprintf("%0.1f", q)
+        end
+
+        parts << [qs, mtype]
+      }
+
+      parts.sort!
+      chunks = []
+      parts.each { |q, mtype|
+        if q == '1.0'
+          chunks << mtype
+        else
+          chunks << sprintf("%s; q=%s", mtype, q)
+        end
+      }
+
+      return chunks.join(', ')
+    end
+
+    def self.parse_accept_header(value)
+      # Parse an accept header, ignoring any accept-extensions
+      #
+      # returns a list of tuples containing main MIME type, MIME
+      # subtype, and quality markdown.
+      #
+      # str -> [(str, str, float)]
+      chunks = value.split(',', -1).collect { |v| v.strip }
+      accept = []
+      chunks.each { |chunk|
+        parts = chunk.split(";", -1).collect { |s| s.strip }
+
+        mtype = parts.shift
+        if mtype.index('/').nil?
+          # This is not a MIME type, so ignore the bad data
+          next
+        end
+
+        main, sub = mtype.split('/', 2)
+
+        q = nil
+        parts.each { |ext|
+          if !ext.index('=').nil?
+            k, v = ext.split('=', 2)
+            if k == 'q'
+              q = v.to_f
+            end
+          end
+        }
+
+        q = 1.0 if q.nil?
+
+        accept << [q, main, sub]
+      }
+
+      accept.sort!
+      accept.reverse!
+
+      return accept.collect { |q, main, sub| [main, sub, q] }
+    end
+
+    def self.match_types(accept_types, have_types)
+      # Given the result of parsing an Accept: header, and the
+      # available MIME types, return the acceptable types with their
+      # quality markdowns.
+      #
+      # For example:
+      #
+      # >>> acceptable = parse_accept_header('text/html, text/plain; q=0.5')
+      # >>> matchTypes(acceptable, ['text/plain', 'text/html', 'image/jpeg'])
+      # [('text/html', 1.0), ('text/plain', 0.5)]
+      #
+      # Type signature: ([(str, str, float)], [str]) -> [(str, float)]
+      if accept_types.nil? or accept_types == []
+        # Accept all of them
+        default = 1
+      else
+        default = 0
+      end
+
+      match_main = {}
+      match_sub = {}
+      accept_types.each { |main, sub, q|
+        if main == '*'
+          default = [default, q].max
+          next
+        elsif sub == '*'
+          match_main[main] = [match_main.fetch(main, 0), q].max
+        else
+          match_sub[[main, sub]] = [match_sub.fetch([main, sub], 0), q].max
+        end
+      }
+
+      accepted_list = []
+      order_maintainer = 0
+      have_types.each { |mtype|
+        main, sub = mtype.split('/', 2)
+        if match_sub.member?([main, sub])
+          q = match_sub[[main, sub]]
+        else
+          q = match_main.fetch(main, default)
+        end
+
+        if q != 0
+          accepted_list << [1 - q, order_maintainer, q, mtype]
+          order_maintainer += 1
+        end
+      }
+
+      accepted_list.sort!
+      return accepted_list.collect { |_, _, q, mtype| [mtype, q] }
+    end
+
+    def self.get_acceptable(accept_header, have_types)
+      # Parse the accept header and return a list of available types
+      # in preferred order. If a type is unacceptable, it will not be
+      # in the resulting list.
+      #
+      # This is a convenience wrapper around matchTypes and
+      # parse_accept_header
+      #
+      # (str, [str]) -> [str]
+      accepted = self.parse_accept_header(accept_header)
+      preferred = self.match_types(accepted, have_types)
+      return preferred.collect { |mtype, _| mtype }
+    end
+
+  end
+
+end

data/lib/openid/yadis/constants.rb

@@ -0,0 +1,21 @@
+
+require 'openid/yadis/accept'
+
+module OpenID
+
+  module Yadis
+
+    YADIS_HEADER_NAME = 'X-XRDS-Location'
+    YADIS_CONTENT_TYPE = 'application/xrds+xml'
+
+    # A value suitable for using as an accept header when performing
+    # YADIS discovery, unless the application has special requirements
+    YADIS_ACCEPT_HEADER = generate_accept_header(
+                                                 ['text/html', 0.3],
+                                                 ['application/xhtml+xml', 0.5],
+                                                 [YADIS_CONTENT_TYPE, 1.0]
+                                                 )
+
+  end
+
+end