pwned 1.2.1 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/FUNDING.yml +1 -0
- data/.github/workflows/tests.yml +39 -0
- data/CHANGELOG.md +75 -18
- data/README.md +153 -10
- data/bin/pwned +52 -0
- data/lib/pwned.rb +22 -6
- data/lib/pwned/hashed_password.rb +36 -0
- data/lib/pwned/not_pwned_validator.rb +3 -3
- data/lib/pwned/password.rb +12 -96
- data/lib/pwned/password_base.rb +141 -0
- data/lib/pwned/version.rb +1 -1
- data/pwned.gemspec +11 -2
- metadata +29 -34
- data/.travis.yml +0 -23
- data/docs/NotPwnedValidator.html +0 -488
- data/docs/Pwned.html +0 -513
- data/docs/Pwned/Error.html +0 -149
- data/docs/Pwned/Password.html +0 -925
- data/docs/Pwned/TimeoutError.html +0 -152
- data/docs/PwnedValidator.html +0 -192
- data/docs/_index.html +0 -162
- data/docs/class_list.html +0 -51
- data/docs/css/common.css +0 -1
- data/docs/css/full_list.css +0 -58
- data/docs/css/style.css +0 -499
- data/docs/file.README.html +0 -294
- data/docs/file_list.html +0 -56
- data/docs/frames.html +0 -17
- data/docs/index.html +0 -294
- data/docs/js/app.js +0 -248
- data/docs/js/full_list.js +0 -216
- data/docs/js/jquery.js +0 -4
- data/docs/method_list.html +0 -115
- data/docs/top-level-namespace.html +0 -112
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 1790330e2068217b48ba0929c4b2409dfecd939e76f7d231acc872ef9802320a
|
|
4
|
+
data.tar.gz: afa13cc83a53df1be859a74876e00992b15eed757e571bec652168d85b3ab73e
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 23482aeeab95bb130ba04f1fdc57f769282d78c7c4c56c594f15652c472ffce9573967d8a31d539548a325c85f54aa038d65bb023aded41352147ad9a906534e
|
|
7
|
+
data.tar.gz: d31fb7ad5171adc4cc8ee28ed97d125fbd19c93bc68e65e7921076d1fb586748a1a4f12007e70cbfe6378e3c868effa756efaa08e627bfa82b2c73166e0b7dd1
|
data/.github/FUNDING.yml
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
github: philnash
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
name: tests
|
|
2
|
+
|
|
3
|
+
on: [push, pull_request]
|
|
4
|
+
|
|
5
|
+
jobs:
|
|
6
|
+
test:
|
|
7
|
+
runs-on: ubuntu-latest
|
|
8
|
+
strategy:
|
|
9
|
+
fail-fast: false
|
|
10
|
+
matrix:
|
|
11
|
+
ruby: [2.5, 2.6, 2.7, 3.0, head]
|
|
12
|
+
rails: [4.2.11.3, 5.0.7.2, 5.1.7, 5.2.4.4, 6.0.3.4, 6.1.0]
|
|
13
|
+
exclude:
|
|
14
|
+
# Ruby 3.0 and Rails 5 do not get along together.
|
|
15
|
+
- ruby: 3.0
|
|
16
|
+
rails: 5.0.7.2
|
|
17
|
+
- ruby: 3.0
|
|
18
|
+
rails: 5.1.7
|
|
19
|
+
- ruby: 3.0
|
|
20
|
+
rails: 5.2.4.4
|
|
21
|
+
- ruby: head
|
|
22
|
+
rails: 5.0.7.2
|
|
23
|
+
- ruby: head
|
|
24
|
+
rails: 5.1.7
|
|
25
|
+
- ruby: head
|
|
26
|
+
rails: 5.2.4.4
|
|
27
|
+
continue-on-error: ${{ endsWith(matrix.ruby, 'head') }}
|
|
28
|
+
env:
|
|
29
|
+
RAILS_VERSION: ${{ matrix.rails }}
|
|
30
|
+
steps:
|
|
31
|
+
- uses: actions/checkout@v2
|
|
32
|
+
- name: Set up Ruby ${{ matrix.ruby }}
|
|
33
|
+
uses: ruby/setup-ruby@v1
|
|
34
|
+
with:
|
|
35
|
+
ruby-version: ${{ matrix.ruby }}
|
|
36
|
+
- name: "Install dependencies (rails: ${{matrix.rails}})"
|
|
37
|
+
run: bundle install
|
|
38
|
+
- name: Run tests
|
|
39
|
+
run: bundle exec rspec
|
data/CHANGELOG.md
CHANGED
|
@@ -1,31 +1,88 @@
|
|
|
1
1
|
# Changelog for `Pwned`
|
|
2
2
|
|
|
3
|
-
## Ongoing [☰](https://github.com/philnash/pwned/compare/
|
|
3
|
+
## Ongoing [☰](https://github.com/philnash/pwned/compare/v2.0.2...master)
|
|
4
4
|
|
|
5
|
-
...
|
|
5
|
+
## 2.2.0 (March 27, 2021) [☰](https://github.com/philnash/pwned/compare/v2.1.0...v2.2.0)
|
|
6
6
|
|
|
7
|
-
|
|
7
|
+
- Minor updates
|
|
8
8
|
|
|
9
|
-
|
|
10
|
-
|
|
9
|
+
- Adds `:proxy` option to `request_options` to directly set a proxy on the
|
|
10
|
+
request. Fixes #21, thanks [dparpyani](https://github.com/dparpyani).
|
|
11
11
|
|
|
12
|
-
## 1.
|
|
12
|
+
## 2.1.0 (July 8, 2020) [☰](https://github.com/philnash/pwned/compare/v2.0.2...v2.1.0)
|
|
13
13
|
|
|
14
|
-
|
|
15
|
-
* Changes `PwnedValidator` to `NotPwnedValidator`, so that the validation looks like `validates :password, not_pwned: true`. `PwnedValidator` now subclasses `NotPwnedValidator` for backwards compatibility with version 1.1.0 but is deprecated.
|
|
14
|
+
- Minor updates
|
|
16
15
|
|
|
17
|
-
|
|
16
|
+
- Adds `Pwned::HashedPassword` class which is initializd with a SHA1 hash to
|
|
17
|
+
query the API with so that the lookup can be done in the background without
|
|
18
|
+
storing passwords. Fixes #19, thanks [@paprikati](https://github.com/paprikati).
|
|
18
19
|
|
|
19
|
-
|
|
20
|
-
* Refactors exception handling with built in Ruby method ([PR #1](https://github.com/philnash/pwned/pull/1) thanks [@kpumuk](https://github.com/kpumuk))
|
|
21
|
-
* Passwords must be strings, the initializer will raise a `TypeError` unless `password.is_a? String`. ([dbf7697](https://github.com/philnash/pwned/commit/dbf7697e878d87ac74aed1e715cee19b73473369))
|
|
22
|
-
* Added Ruby on Rails validator ([PR #3](https://github.com/philnash/pwned/pull/3) & [PR #6](https://github.com/philnash/pwned/pull/6))
|
|
23
|
-
* Added simplified accessors `Pwned.pwned?` and `Pwned.pwned_count` ([PR #4](https://github.com/philnash/pwned/pull/4))
|
|
20
|
+
## 2.0.2 (May 20, 2020) [☰](https://github.com/philnash/pwned/compare/v2.0.1...v2.0.2)
|
|
24
21
|
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
22
|
+
- Minor fix
|
|
23
|
+
|
|
24
|
+
- It was found to be possible for reading the lines body of a response to
|
|
25
|
+
result in a `nil` which caused trouble with string concatenation. This
|
|
26
|
+
avoids that scenario. Fixes #18, thanks [@flori](https://github.com/flori).
|
|
27
|
+
|
|
28
|
+
## 2.0.1 (January 14, 2020) [☰](https://github.com/philnash/pwned/compare/v2.0.0...v2.0.1)
|
|
29
|
+
|
|
30
|
+
- Minor updates
|
|
31
|
+
|
|
32
|
+
- Adds double-splat to ActiveModel::Errors#add calls with options to make Ruby 2.7 happy.
|
|
33
|
+
- Detects presence of Net::HTTPClientException in tests to remove deprecation warning.
|
|
34
|
+
|
|
35
|
+
## 2.0.0 (October 1, 2019) [☰](https://github.com/philnash/pwned/compare/v1.2.1...v2.0.0)
|
|
36
|
+
|
|
37
|
+
- Major updates
|
|
38
|
+
|
|
39
|
+
- Switches from `open-uri` to `Net::HTTP`. This is a potentially breaking change.
|
|
40
|
+
- `request_options` are now used to configure `Net::HTTP.start`.
|
|
41
|
+
- Rather than using all string keys from `request_options`, HTTP headers are now
|
|
42
|
+
specified in their own `headers` hash. To upgrade, any options intended as
|
|
43
|
+
headers need to be extracted into a `headers` hash, e.g.
|
|
44
|
+
|
|
45
|
+
```diff
|
|
46
|
+
validates :password, not_pwned: {
|
|
47
|
+
- request_options: { read_timeout: 5, open_timeout: 1, "User-Agent" => "Super fun user agent" }
|
|
48
|
+
+ request_options: { read_timeout: 5, open_timeout: 1, headers: { "User-Agent" => "Super fun user agent" } }
|
|
49
|
+
}
|
|
50
|
+
|
|
51
|
+
- password = Pwned::Password.new("password", 'User-Agent' => 'Super fun new user agent')
|
|
52
|
+
+ password = Pwned::Password.new("password", headers: { 'User-Agent' => 'Super fun new user agent' }, read_timeout: 10)
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
- Adds a CLI to let you check passwords on the command line
|
|
56
|
+
|
|
57
|
+
```bash
|
|
58
|
+
$ pwned password
|
|
59
|
+
Pwned!
|
|
60
|
+
The password has been found in public breaches 3730471 times.
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
## 1.2.1 (March 17, 2018) [☰](https://github.com/philnash/pwned/compare/v1.2.0...v1.2.1)
|
|
64
|
+
|
|
65
|
+
- Minor updates
|
|
66
|
+
- Validator no longer raises `TypeError` when password is `nil`
|
|
67
|
+
|
|
68
|
+
## 1.2.0 (March 15, 2018) [☰](https://github.com/philnash/pwned/compare/v1.1.0...v1.2.0)
|
|
69
|
+
|
|
70
|
+
- Major updates
|
|
71
|
+
- Changes `PwnedValidator` to `NotPwnedValidator`, so that the validation looks like `validates :password, not_pwned: true`. `PwnedValidator` now subclasses `NotPwnedValidator` for backwards compatibility with version 1.1.0 but is deprecated.
|
|
72
|
+
|
|
73
|
+
## 1.1.0 (March 12, 2018) [☰](https://github.com/philnash/pwned/compare/v1.0.0...v1.1.0)
|
|
74
|
+
|
|
75
|
+
- Major updates
|
|
76
|
+
|
|
77
|
+
- Refactors exception handling with built in Ruby method ([PR #1](https://github.com/philnash/pwned/pull/1) thanks [@kpumuk](https://github.com/kpumuk))
|
|
78
|
+
- Passwords must be strings, the initializer will raise a `TypeError` unless `password.is_a? String`. ([dbf7697](https://github.com/philnash/pwned/commit/dbf7697e878d87ac74aed1e715cee19b73473369))
|
|
79
|
+
- Added Ruby on Rails validator ([PR #3](https://github.com/philnash/pwned/pull/3) & [PR #6](https://github.com/philnash/pwned/pull/6))
|
|
80
|
+
- Added simplified accessors `Pwned.pwned?` and `Pwned.pwned_count` ([PR #4](https://github.com/philnash/pwned/pull/4))
|
|
81
|
+
|
|
82
|
+
- Minor updates
|
|
83
|
+
- SHA1 is only calculated once
|
|
84
|
+
- Frozen string literal to make sure Ruby does not copy strings over and over again
|
|
85
|
+
- Removal of `@match_data`, since we only use it to retrieve the counter. Caching the counter instead (all [PR #2](https://github.com/philnash/pwned/pull/2) thanks [@kpumuk](https://github.com/kpumuk))
|
|
29
86
|
|
|
30
87
|
## 1.0.0 (March 6, 2018) [☰](https://github.com/philnash/pwned/commits/v1.0.0)
|
|
31
88
|
|
data/README.md
CHANGED
|
@@ -2,9 +2,34 @@
|
|
|
2
2
|
|
|
3
3
|
An easy, Ruby way to use the Pwned Passwords API.
|
|
4
4
|
|
|
5
|
-
[](https://rubygems.org/gems/pwned)
|
|
6
|
-
|
|
7
|
-
[API docs](https://
|
|
5
|
+
[](https://rubygems.org/gems/pwned)  [](https://codeclimate.com/github/philnash/pwned/maintainability) [](https://inch-ci.org/github/philnash/pwned)
|
|
6
|
+
|
|
7
|
+
[API docs](https://www.rubydoc.info/gems/pwned) | [GitHub repo](https://github.com/philnash/pwned)
|
|
8
|
+
|
|
9
|
+
## Table of Contents
|
|
10
|
+
|
|
11
|
+
- [Pwned](#pwned)
|
|
12
|
+
- [Table of Contents](#table-of-contents)
|
|
13
|
+
- [About](#about)
|
|
14
|
+
- [Installation](#installation)
|
|
15
|
+
- [Usage](#usage)
|
|
16
|
+
- [Plain Ruby](#plain-ruby)
|
|
17
|
+
- [Advanced](#advanced)
|
|
18
|
+
- [ActiveRecord Validator](#activerecord-validator)
|
|
19
|
+
- [I18n](#i18n)
|
|
20
|
+
- [Threshold](#threshold)
|
|
21
|
+
- [Network Error Handling](#network-error-handling)
|
|
22
|
+
- [Custom Request Options](#custom-request-options)
|
|
23
|
+
- [Using Asynchronously](#using-asynchronously)
|
|
24
|
+
- [Devise](#devise)
|
|
25
|
+
- [Rodauth](#rodauth)
|
|
26
|
+
- [Command line](#command-line)
|
|
27
|
+
- [Unpwn](#unpwn)
|
|
28
|
+
- [How Pwned is Pi?](#how-pwned-is-pi)
|
|
29
|
+
- [Development](#development)
|
|
30
|
+
- [Contributing](#contributing)
|
|
31
|
+
- [License](#license)
|
|
32
|
+
- [Code of Conduct](#code-of-conduct)
|
|
8
33
|
|
|
9
34
|
## About
|
|
10
35
|
|
|
@@ -14,6 +39,8 @@ Troy Hunt's [Pwned Passwords API V2](https://haveibeenpwned.com/API/v2#PwnedPass
|
|
|
14
39
|
|
|
15
40
|
The data from this API is provided by [Have I been pwned?](https://haveibeenpwned.com/). Before using the API, please check [the acceptable uses and license of the API](https://haveibeenpwned.com/API/v2#AcceptableUse).
|
|
16
41
|
|
|
42
|
+
Here is a blog post I wrote on [how to use this gem in your Ruby applications to make your users' passwords better](https://www.twilio.com/blog/2018/03/better-passwords-in-ruby-applications-pwned-passwords-api.html).
|
|
43
|
+
|
|
17
44
|
## Installation
|
|
18
45
|
|
|
19
46
|
Add this line to your application's Gemfile:
|
|
@@ -32,6 +59,14 @@ Or install it yourself as:
|
|
|
32
59
|
|
|
33
60
|
## Usage
|
|
34
61
|
|
|
62
|
+
There are a few ways you can use this gem:
|
|
63
|
+
|
|
64
|
+
1. [Plain Ruby](#plain-ruby)
|
|
65
|
+
2. [Rails](#activerecord-validator)
|
|
66
|
+
3. [Rails and Devise](#devise)
|
|
67
|
+
|
|
68
|
+
### Plain Ruby
|
|
69
|
+
|
|
35
70
|
To test a password against the API, instantiate a `Pwned::Password` object and then ask if it is `pwned?`.
|
|
36
71
|
|
|
37
72
|
```ruby
|
|
@@ -72,10 +107,11 @@ Pwned.pwned_count("password")
|
|
|
72
107
|
|
|
73
108
|
#### Advanced
|
|
74
109
|
|
|
75
|
-
You can set
|
|
110
|
+
You can set http request options to be used with `Net::HTTP.start` when making the request to the API. These options are
|
|
111
|
+
documented in the [`Net::HTTP.start` documentation](http://ruby-doc.org/stdlib-2.6.3/libdoc/net/http/rdoc/Net/HTTP.html#method-c-start). The `:headers` option defines defines HTTP headers. These headers must be string keys.
|
|
76
112
|
|
|
77
113
|
```ruby
|
|
78
|
-
password = Pwned::Password.new("password", { 'User-Agent' => 'Super fun new user agent' })
|
|
114
|
+
password = Pwned::Password.new("password", headers: { 'User-Agent' => 'Super fun new user agent' }, read_timeout: 10)
|
|
79
115
|
```
|
|
80
116
|
|
|
81
117
|
### ActiveRecord Validator
|
|
@@ -113,7 +149,7 @@ class User < ApplicationRecord
|
|
|
113
149
|
end
|
|
114
150
|
```
|
|
115
151
|
|
|
116
|
-
#### Network
|
|
152
|
+
#### Network Error Handling
|
|
117
153
|
|
|
118
154
|
By default the record will be treated as valid when we cannot reach the [haveibeenpwned.com](https://haveibeenpwned.com/) servers. This can be changed with the `:on_error` validator parameter:
|
|
119
155
|
|
|
@@ -145,17 +181,124 @@ end
|
|
|
145
181
|
|
|
146
182
|
#### Custom Request Options
|
|
147
183
|
|
|
148
|
-
You can configure network requests made from the validator using `:request_options` (see [
|
|
184
|
+
You can configure network requests made from the validator using `:request_options` (see [Net::HTTP.start](http://ruby-doc.org/stdlib-2.6.3/libdoc/net/http/rdoc/Net/HTTP.html#method-c-start) for the list of available options).
|
|
185
|
+
In addition to these options, HTTP headers can be specified with the `:headers` key (e.g. `"User-Agent"`) and proxy can be specified with the `:proxy` key:
|
|
149
186
|
|
|
150
187
|
```ruby
|
|
151
188
|
validates :password, not_pwned: {
|
|
152
|
-
request_options: {
|
|
189
|
+
request_options: {
|
|
190
|
+
read_timeout: 5,
|
|
191
|
+
open_timeout: 1,
|
|
192
|
+
headers: { "User-Agent" => "Super fun user agent" },
|
|
193
|
+
proxy: "https://username:password@example.com:12345"
|
|
194
|
+
}
|
|
153
195
|
}
|
|
154
196
|
```
|
|
155
197
|
|
|
156
|
-
|
|
198
|
+
### Using Asynchronously
|
|
199
|
+
|
|
200
|
+
You may have a use case for hashing the password in advance, and then making the call to the Pwned Passwords API later (for example if you want to enqueue a job without storing the plaintext password). To do this, you can hash the password with the `Pwned.hash_password` method and then initialize the `Pwned::HashPassword` class with the hash, like this:
|
|
201
|
+
|
|
202
|
+
```ruby
|
|
203
|
+
hashed_password = Pwned.hash_password(password)
|
|
204
|
+
# some time later
|
|
205
|
+
Pwned::HashPassword.new(hashed_password, request_options).pwned?
|
|
206
|
+
```
|
|
207
|
+
|
|
208
|
+
### Devise
|
|
209
|
+
|
|
210
|
+
If you are using [Devise](https://github.com/heartcombo/devise) I recommend you use the [devise-pwned_password extension](https://github.com/michaelbanfield/devise-pwned_password) which is now powered by this gem.
|
|
211
|
+
|
|
212
|
+
### Rodauth
|
|
213
|
+
|
|
214
|
+
If you are using [Rodauth](https://github.com/jeremyevans/rodauth) then you can use the [rodauth-pwned](https://github.com/janko/rodauth-pwned) feature which is powered by this gem.
|
|
215
|
+
|
|
216
|
+
### Command line
|
|
217
|
+
|
|
218
|
+
The gem provides a command line utility for checking passwords. You can call it from your terminal application like this:
|
|
219
|
+
|
|
220
|
+
```bash
|
|
221
|
+
$ pwned password
|
|
222
|
+
Pwned!
|
|
223
|
+
The password has been found in public breaches 3645804 times.
|
|
224
|
+
```
|
|
225
|
+
|
|
226
|
+
If you don't want the password you are checking to be visible, call:
|
|
157
227
|
|
|
158
|
-
|
|
228
|
+
```bash
|
|
229
|
+
$ pwned --secret
|
|
230
|
+
```
|
|
231
|
+
|
|
232
|
+
You will be prompted for the password, but it won't be displayed.
|
|
233
|
+
|
|
234
|
+
### Unpwn
|
|
235
|
+
|
|
236
|
+
To cut down on unnecessary network requests, [the unpwn project](https://github.com/indirect/unpwn) uses a list of the top one million passwords to check passwords against. Only if a password is not included in the top million is it then checked against the Pwned Passwords API.
|
|
237
|
+
|
|
238
|
+
## How Pwned is Pi?
|
|
239
|
+
|
|
240
|
+
[@daz](https://github.com/daz) [shared](https://twitter.com/dazonic/status/1074647842046660609) a fantastic example of using this gem to show how many times the digits of Pi have been used as passwords and leaked.
|
|
241
|
+
|
|
242
|
+
```ruby
|
|
243
|
+
require 'pwned'
|
|
244
|
+
|
|
245
|
+
PI = '3.14159265358979323846264338327950288419716939937510582097494459230781640628620899862803482534211706798214808651328230664709384460955058223172535940812848111'
|
|
246
|
+
|
|
247
|
+
for n in 1..40
|
|
248
|
+
password = Pwned::Password.new PI[0..(n + 1)]
|
|
249
|
+
str = [ n.to_s.rjust(2) ]
|
|
250
|
+
str << (password.pwned? ? '😡' : '😃')
|
|
251
|
+
str << password.pwned_count.to_s.rjust(4)
|
|
252
|
+
str << password.password
|
|
253
|
+
|
|
254
|
+
puts str.join ' '
|
|
255
|
+
end
|
|
256
|
+
```
|
|
257
|
+
|
|
258
|
+
The results may, or may not, surprise you.
|
|
259
|
+
|
|
260
|
+
```
|
|
261
|
+
1 😡 16 3.1
|
|
262
|
+
2 😡 238 3.14
|
|
263
|
+
3 😡 34 3.141
|
|
264
|
+
4 😡 1345 3.1415
|
|
265
|
+
5 😡 2552 3.14159
|
|
266
|
+
6 😡 791 3.141592
|
|
267
|
+
7 😡 9582 3.1415926
|
|
268
|
+
8 😡 1591 3.14159265
|
|
269
|
+
9 😡 637 3.141592653
|
|
270
|
+
10 😡 873 3.1415926535
|
|
271
|
+
11 😡 137 3.14159265358
|
|
272
|
+
12 😡 103 3.141592653589
|
|
273
|
+
13 😡 65 3.1415926535897
|
|
274
|
+
14 😡 201 3.14159265358979
|
|
275
|
+
15 😡 41 3.141592653589793
|
|
276
|
+
16 😡 57 3.1415926535897932
|
|
277
|
+
17 😡 28 3.14159265358979323
|
|
278
|
+
18 😡 29 3.141592653589793238
|
|
279
|
+
19 😡 1 3.1415926535897932384
|
|
280
|
+
20 😡 7 3.14159265358979323846
|
|
281
|
+
21 😡 5 3.141592653589793238462
|
|
282
|
+
22 😡 2 3.1415926535897932384626
|
|
283
|
+
23 😡 2 3.14159265358979323846264
|
|
284
|
+
24 😃 0 3.141592653589793238462643
|
|
285
|
+
25 😡 3 3.1415926535897932384626433
|
|
286
|
+
26 😃 0 3.14159265358979323846264338
|
|
287
|
+
27 😃 0 3.141592653589793238462643383
|
|
288
|
+
28 😃 0 3.1415926535897932384626433832
|
|
289
|
+
29 😃 0 3.14159265358979323846264338327
|
|
290
|
+
30 😃 0 3.141592653589793238462643383279
|
|
291
|
+
31 😃 0 3.1415926535897932384626433832795
|
|
292
|
+
32 😃 0 3.14159265358979323846264338327950
|
|
293
|
+
33 😃 0 3.141592653589793238462643383279502
|
|
294
|
+
34 😃 0 3.1415926535897932384626433832795028
|
|
295
|
+
35 😃 0 3.14159265358979323846264338327950288
|
|
296
|
+
36 😃 0 3.141592653589793238462643383279502884
|
|
297
|
+
37 😃 0 3.1415926535897932384626433832795028841
|
|
298
|
+
38 😃 0 3.14159265358979323846264338327950288419
|
|
299
|
+
39 😃 0 3.141592653589793238462643383279502884197
|
|
300
|
+
40 😃 0 3.1415926535897932384626433832795028841971
|
|
301
|
+
```
|
|
159
302
|
|
|
160
303
|
## Development
|
|
161
304
|
|
data/bin/pwned
ADDED
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
|
|
3
|
+
require "pwned"
|
|
4
|
+
require "optparse"
|
|
5
|
+
require "io/console"
|
|
6
|
+
|
|
7
|
+
options = {}
|
|
8
|
+
parser = OptionParser.new do |opts|
|
|
9
|
+
opts.banner = <<-USAGE
|
|
10
|
+
Usage: pwned <password>
|
|
11
|
+
|
|
12
|
+
Tests a password against the Pwned Passwords API using the k-anonymity model,
|
|
13
|
+
which avoids sending the entire password to the service.opts
|
|
14
|
+
|
|
15
|
+
If the password has been found in a publicly available breach then this tool
|
|
16
|
+
will report how many times it has been seen. Otherwise the tool will report that
|
|
17
|
+
the password has not been found in a public breach yet.
|
|
18
|
+
|
|
19
|
+
USAGE
|
|
20
|
+
|
|
21
|
+
opts.version = Pwned::VERSION
|
|
22
|
+
|
|
23
|
+
opts.on("-s", "--secret", "Enter password without displaying characters.\n#{" "* 37}Overrides provided arguments.")
|
|
24
|
+
opts.on_tail("-h", "--help", "Show help.")
|
|
25
|
+
opts.on_tail("-v", "--version", "Show version number.\n\n")
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
parser.parse!(ARGV, into: options)
|
|
29
|
+
|
|
30
|
+
if options[:help]
|
|
31
|
+
puts parser.help
|
|
32
|
+
exit
|
|
33
|
+
end
|
|
34
|
+
if options[:version]
|
|
35
|
+
puts parser.ver
|
|
36
|
+
exit
|
|
37
|
+
end
|
|
38
|
+
password_to_test = ARGV.first
|
|
39
|
+
if options[:secret]
|
|
40
|
+
password_to_test = STDIN.getpass("Password: ")
|
|
41
|
+
end
|
|
42
|
+
if !password_to_test || password_to_test.strip == ""
|
|
43
|
+
puts parser.help
|
|
44
|
+
exit
|
|
45
|
+
end
|
|
46
|
+
password = Pwned::Password.new(password_to_test || ARGV.first)
|
|
47
|
+
if password.pwned?
|
|
48
|
+
puts "Pwned!\nThe password has been found in public breaches #{password.pwned_count} times."
|
|
49
|
+
else
|
|
50
|
+
puts "The password has not been found in a public breach."
|
|
51
|
+
end
|
|
52
|
+
|
data/lib/pwned.rb
CHANGED
|
@@ -1,8 +1,10 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
+
require "digest"
|
|
3
4
|
require "pwned/version"
|
|
4
5
|
require "pwned/error"
|
|
5
6
|
require "pwned/password"
|
|
7
|
+
require "pwned/hashed_password"
|
|
6
8
|
|
|
7
9
|
begin
|
|
8
10
|
# Load Rails and our custom validator
|
|
@@ -29,10 +31,10 @@ module Pwned
|
|
|
29
31
|
# Pwned.pwned?("pwned::password") #=> false
|
|
30
32
|
#
|
|
31
33
|
# @param password [String] The password you want to check against the API.
|
|
32
|
-
# @param [Hash] request_options Options that can be passed to +
|
|
34
|
+
# @param [Hash] request_options Options that can be passed to +Net::HTTP.start+ when
|
|
33
35
|
# calling the API
|
|
34
|
-
# @option request_options [
|
|
35
|
-
#
|
|
36
|
+
# @option request_options [Symbol] :headers ({ "User-Agent" => "Ruby Pwned::Password #{Pwned::VERSION}" })
|
|
37
|
+
# HTTP headers to include in the request
|
|
36
38
|
# @return [Boolean] Whether the password appears in the data breaches or not.
|
|
37
39
|
# @since 1.1.0
|
|
38
40
|
def self.pwned?(password, request_options={})
|
|
@@ -47,14 +49,28 @@ module Pwned
|
|
|
47
49
|
# Pwned.pwned_count("pwned::password") #=> 0
|
|
48
50
|
#
|
|
49
51
|
# @param password [String] The password you want to check against the API.
|
|
50
|
-
# @param [Hash] request_options Options that can be passed to +
|
|
52
|
+
# @param [Hash] request_options Options that can be passed to +Net::HTTP.start+ when
|
|
51
53
|
# calling the API
|
|
52
|
-
# @option request_options [
|
|
53
|
-
#
|
|
54
|
+
# @option request_options [Symbol] :headers ({ "User-Agent" => "Ruby Pwned::Password #{Pwned::VERSION}" })
|
|
55
|
+
# HTTP headers to include in the request
|
|
54
56
|
# @return [Integer] The number of times the password has appeared in the data
|
|
55
57
|
# breaches.
|
|
56
58
|
# @since 1.1.0
|
|
57
59
|
def self.pwned_count(password, request_options={})
|
|
58
60
|
Pwned::Password.new(password, request_options).pwned_count
|
|
59
61
|
end
|
|
62
|
+
|
|
63
|
+
##
|
|
64
|
+
# Returns the full SHA1 hash of the given password in uppercase. This can be safely passed around your code
|
|
65
|
+
# before making the pwned request (e.g. dropped into a queue table).
|
|
66
|
+
#
|
|
67
|
+
# @example
|
|
68
|
+
# Pwned.hash_password("password") #=> 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
|
|
69
|
+
#
|
|
70
|
+
# @param password [String] The password you want to check against the API
|
|
71
|
+
# @return [String] An uppercase SHA1 hash of the password
|
|
72
|
+
# @since 2.1.0
|
|
73
|
+
def self.hash_password(password)
|
|
74
|
+
Digest::SHA1.hexdigest(password).upcase
|
|
75
|
+
end
|
|
60
76
|
end
|