quo_vadis 2.1.6 → 2.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ae53bae73aaf968a8edec5148304394b411eace9c0df39069c6b240e90a6ea9
-  data.tar.gz: 4980707b8a6670298f0d99f7f1a554767c12323055d5103057c3028837da49af
+  metadata.gz: f2f5586e06a0e01dd89d66bf9cae01317b0d302ba51e5a82cfcb4bc00dc0ea85
+  data.tar.gz: f37f34fbae6ab23081643aff844525b4ca8795c9e5057cbce737e7348d6a254f
 SHA512:
-  metadata.gz: 00f025682cb8623ff02713e15bf25fdcc8c2a2964273bbc9f450f562375d18dd508ae1e729657cfa2275f2cb92672ef75b278edf8dbebd75cb2d6064d6c974b9
-  data.tar.gz: c017aa443847c3d62dd17e8e384f50db13e11f63189008787be7d896ebc80a362318328139537859d8613a240607362ef2bd81c5022a99a358086f77d079bedf
+  metadata.gz: de242f63f325f1520fb9fb209535a4dfcff1c6f3f2e80d6620bce3e940c1000d5452145e83b6917e9106deb844aa4f467be922880c92bbb357da2dcb6bbf563b
+  data.tar.gz: d706a441437cab9af6ee75f3581cc18df8edfd17414317555eecd58a1c984f7cc62a085297158fb5a42f9d244bcfdbde98bd6792220434a6118e32f801c0241e

data/CHANGELOG.md

@@ -4,6 +4,12 @@
 ## HEAD
 
 
+## 2.1.7 (30 May 2022)
+
+* Use SHA256 digest for encryption.
+* Use <time> element in logs view.
+
+
 ## 2.1.6 (30 May 2022)
 
 * Fix typo in session scope.

data/app/views/quo_vadis/logs/index.html.erb

@@ -12,7 +12,7 @@
   <tbody>
     <% @logs.each do |log| %>
       <tr>
-        <td><%= log.created_at %></td>
+        <td><time datetime="<%= log.created_at.to_formatted_s(:iso8601) %>"><%= log.created_at.to_formatted_s('%-d %B %Y') %></time></td>
         <td><%= QuoVadis.translate "log.action.#{log.action}" %></td>
         <td><%= log.ip %></td>
         <td><%= log.metadata.empty? ? '' : log.metadata.map {|k,v| "#{k}: #{v}"}.join(', ') %></td>

data/lib/quo_vadis/crypt.rb

@@ -8,7 +8,7 @@ module QuoVadis
       return '' if value == ''
 
       salt = SecureRandom.hex KEY_LENGTH
-      crypt = encryptor key(salt)
+      crypt = encryptor salt
       ciphertext = crypt.encrypt_and_sign value
       [salt, ciphertext].join SEPARATOR
     end
@@ -18,7 +18,7 @@ module QuoVadis
       return '' if value == ''
 
       salt, data = value.split SEPARATOR
-      crypt = encryptor key(salt)
+      crypt = encryptor salt
       crypt.decrypt_and_verify(data)
     end
 
@@ -27,12 +27,18 @@ module QuoVadis
     KEY_LENGTH = ActiveSupport::MessageEncryptor.key_len
     SEPARATOR = '$$'
 
-    def self.encryptor(key)
-      ActiveSupport::MessageEncryptor.new(key)
+    def self.encryptor(salt)
+      key_sha256 = key salt, OpenSSL::Digest::SHA256
+      key_sha1   = key salt, OpenSSL::Digest::SHA1
+      ActiveSupport::MessageEncryptor.new(key_sha256).tap { |crypt|
+        crypt.rotate key_sha1
+      }
     end
 
-    def self.key(salt)
-      ActiveSupport::KeyGenerator.new(secret).generate_key(salt, KEY_LENGTH)
+    def self.key(salt, hash_digest_class)
+      ActiveSupport::KeyGenerator
+        .new(secret, hash_digest_class: hash_digest_class)
+        .generate_key(salt, KEY_LENGTH)
     end
 
     def self.secret

data/lib/quo_vadis/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module QuoVadis
-  VERSION = '2.1.6'
+  VERSION = '2.1.7'
 end

data/test/integration/sessions_test.rb

@@ -54,7 +54,7 @@ class SessionsTest < IntegrationTest
     phone.get quo_vadis.sessions_path
     phone.assert_response :success
     phone.assert_select 'td', 'This session'
-    phone.assert_select 'td input[type=submit][value="Log out"]', 1
+    phone.assert_select 'td button[type=submit]', text: 'Log out', count: 1
 
     # on phone, log out the desktop session
     phone.delete quo_vadis.session_path(QuoVadis::Session.first.id)

data/test/models/crypt_test.rb

@@ -4,6 +4,13 @@ class CryptTest < ActiveSupport::TestCase
 
   setup do
     @crypt = QuoVadis::Crypt
+
+    @crypt_sha1 = Class.new(QuoVadis::Crypt) do
+      def self.encryptor(salt)
+        key_sha1 = key salt, OpenSSL::Digest::SHA1
+        ActiveSupport::MessageEncryptor.new key_sha1
+      end
+    end
   end
 
   test 'round trip' do
@@ -19,4 +26,16 @@ class CryptTest < ActiveSupport::TestCase
     refute_equal ciphertext, @crypt.encrypt(plaintext)
   end
 
+  test 'rotation' do
+    # This test only works if our test Rails contains this commit:
+    # https://github.com/rails/rails/commit/447e28347eb46e2ad5dc625de616152bd1b69a32
+    return unless ActiveSupport::KeyGenerator.respond_to? :hash_digest_class
+
+    plaintext = 'the quick brown fox'
+    # Encrypt with SHA1 digest
+    ciphertext_sha1 = @crypt_sha1.encrypt plaintext
+    # Ensure code can decrypt it.
+    assert_equal plaintext, @crypt.decrypt(ciphertext_sha1)
+  end
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: quo_vadis
 version: !ruby/object:Gem::Version
-  version: 2.1.6
+  version: 2.1.7
 platform: ruby
 authors:
 - Andy Stewart