qiniu 6.5.0 → 6.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 445c1054edf50c45ea525aae13c712ecb4fbd00d
-  data.tar.gz: ffb5c071f5c74d7f49f00927767377ee8e868d93
+  metadata.gz: 4183bac23fa834f48579fbc1b8d05a8218ada08b
+  data.tar.gz: 62ff9f7fb37c1acb45d03b37c72c13d6c5073d67
 SHA512:
-  metadata.gz: ab95ba7f0557d14af30f7fee674c36b88323cbf715ae756bf92d5c6774a2176d4c790434a6e59c55d36ac359d32950a8f9f62cc60e9996c3077de060b2b7f42b
-  data.tar.gz: c2893489903aaaf9ac55bcf4efd15866bcfa9703a838bb8b382f8feac7bf66b2a566285aad56a9158c9ee00acec2c51679cac286e0f10a08cccbe042674841f5
+  metadata.gz: c417b92d7a4a06508a9db2be71a9049843fdcb4730854e3e47b0bddccc0c246c4301504bc5acc7745402f07e5452f5639d9d4d8604a45e8e54e2e8d156fa29a6
+  data.tar.gz: b30fde59f5ff8711b0f8c76c5ee1b8db8539798ac5da75907fc77302a0cdc49a8accbb779ed46fa050711fde471d81a95709a512c7c53a6d22072ed237517661

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## CHANGE LOG
 
+### V6.5.1
+
+- 为 Qiniu::Auth 添加验证七牛回调请求签名合法性的函数。[https://github.com/qiniu/ruby-sdk/pull/133](https://github.com/qiniu/ruby-sdk/pull/133)
+
 ### v6.5.0
 
 - 为 Qiniu::Auth 添加一个异常处理逻辑，在 Access Key 和 Secret Key 未正常设置（nil 值）的情况下给出正确提示。[https://github.com/qiniu/ruby-sdk/pull/126](https://github.com/qiniu/ruby-sdk/pull/126)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    qiniu (6.5.0)
+    qiniu (6.5.1)
       json (~> 1.8)
       mime-types (~> 1.19)
       rest-client (~> 1.7.3)

data/lib/qiniu/auth.rb

@@ -206,11 +206,7 @@ module Qiniu
           return authorize_download_url(download_url, args)
         end # authorize_download_url_2
 
-        def generate_acctoken(url, body = '')
-          ### 提取AK/SK信息
-          access_key = Config.settings[:access_key]
-          secret_key = Config.settings[:secret_key]
-
+        def generate_acctoken_sign_with_mac(access_key, secret_key, url, body)
           ### 解析URL，生成待签名字符串
           uri = URI.parse(url)
           signing_str = uri.path
@@ -232,13 +228,12 @@ module Qiniu
 
           ### 生成数字签名
           sign = calculate_hmac_sha1_digest(secret_key, signing_str)
-          encoded_sign = Utils.urlsafe_base64_encode(sign)
-
-          ### 生成管理授权凭证
-          acctoken = "#{access_key}:#{encoded_sign}"
+          return Utils.urlsafe_base64_encode(sign)
+        end # generate_acctoken_sign_with_mac
 
-          ### 返回管理授权凭证
-          return acctoken
+        def generate_acctoken(url, body = '')
+          encoded_sign = generate_acctoken_sign_with_mac(Config.settings[:access_key], Config.settings[:secret_key], url, body)
+          return "#{Config.settings[:access_key]}:#{encoded_sign}"
         end # generate_acctoken
 
         def generate_uptoken(put_policy)
@@ -259,6 +254,31 @@ module Qiniu
           ### 返回上传授权凭证
           return uptoken
         end # generate_uptoken
+
+        def authenticate_callback_request(auth_str, url, body = '')
+          ### 提取AK/SK信息
+          access_key = Config.settings[:access_key]
+          secret_key = Config.settings[:secret_key]
+
+          ### 检查签名格式
+          ak_pos = auth_str.index(access_key)
+          if ak_pos.nil? then
+            return false
+          end
+
+          colon_pos = auth_str.index(':', ak_pos + 1)
+          if colon_pos.nil? || ((ak_pos + access_key.length) != colon_pos) then
+            return false
+          end
+
+          encoded_sign = generate_acctoken_sign_with_mac(access_key, secret_key, url, body)
+          sign_pos = auth_str.index(encoded_sign, colon_pos + 1)
+          if sign_pos.nil? || ((sign_pos + encoded_sign.length) != auth_str.length) then
+            return false
+          end
+
+          return true
+        end # authenticate_callback_request
       end # class << self
 
     end # module Auth

data/lib/qiniu/http.rb

@@ -65,7 +65,7 @@ module Qiniu
         end
 
         content_type = resp_headers["content-type"][0]
-        if !content_type.nil? && content_type == API_RESULT_MIMETYPE then
+        if !content_type.nil? && !content_type.downcase.index(API_RESULT_MIMETYPE).nil? then
           # 如果是JSON格式，则反序列化
           resp_body = Utils.safe_json_parse(resp_body)
         end
@@ -117,7 +117,7 @@ module Qiniu
         end
 
         content_type = resp_headers["content-type"][0]
-        if !content_type.nil? && content_type == API_RESULT_MIMETYPE then
+        if !content_type.nil? && !content_type.downcase.index(API_RESULT_MIMETYPE).nil? then
           # 如果是JSON格式，则反序列化
           resp_body = Utils.safe_json_parse(resp_body)
         end

data/lib/qiniu/version.rb

@@ -4,7 +4,7 @@ module Qiniu
     module Version
       MAJOR = 6
       MINOR = 5
-      PATCH = 0
+      PATCH = 1
       # Returns a version string by joining <tt>MAJOR</tt>, <tt>MINOR</tt>, and <tt>PATCH</tt> with <tt>'.'</tt>
       #
       # Example

data/spec/qiniu/auth_spec.rb

@@ -3,6 +3,7 @@
 
 require 'spec_helper'
 require 'qiniu/auth'
+require 'qiniu/config'
 require 'qiniu/storage'
 require 'digest/sha1'
 
@@ -69,6 +70,25 @@ module Qiniu
         end
       end
     end
+
+    ### 测试回调签名
+    context ".authenticate_callback_request" do
+      it "should works" do
+        url = '/test.php'
+        body = 'name=xxx&size=1234'
+        false.should == Qiniu::Auth.authenticate_callback_request('ABCD', url, body)
+        false.should == Qiniu::Auth.authenticate_callback_request(Config.settings[:access_key], url, body)
+        false.should == Qiniu::Auth.authenticate_callback_request('QBox ' + Config.settings[:access_key] + ':', url, body)
+        false.should == Qiniu::Auth.authenticate_callback_request('QBox ' + Config.settings[:access_key] + ':????', url, body)
+
+        acctoken = Qiniu::Auth.generate_acctoken(url, body)
+        auth_str = 'QBox ' + acctoken
+
+        false.should == Qiniu::Auth.authenticate_callback_request(auth_str + '  ', url, body)
+        true.should == Qiniu::Auth.authenticate_callback_request(auth_str, url, body)
+        true.should == Qiniu::Auth.authenticate_callback_request(acctoken, url, body)
+      end
+    end
   end # module Auth
 
   module Exception_Auth

data/spec/qiniu/image_spec.rb

@@ -59,14 +59,18 @@ module Qiniu
         end
       end
 
-=begin
       context ".exif" do
         it "should works" do
-          code, data = Qiniu::Fop::Image.exif(@source_image_url)
+          result = Qiniu.get(@bucket, 'gogopher.jpg')
+          result["url"].should_not be_empty
+          puts result.inspect
+
+          code, data, headers = Qiniu::Fop::Image.exif(result["url"])
+          code.should == 200
           puts data.inspect
+          puts headers.inspect
         end
       end
-=end
 
       context ".mogrify_preview_url" do
         it "should works" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: qiniu
 version: !ruby/object:Gem::Version
-  version: 6.5.0
+  version: 6.5.1
 platform: ruby
 authors:
 - why404
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-26 00:00:00.000000000 Z
+date: 2015-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake