rack-session-smart_cookie 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1810a34a2f96c7812e4d15fa413b375614d51997
-  data.tar.gz: 899d9e588489e1250d1c5617861b2b0c18d74953
+  metadata.gz: e83bdebac8d1746d4918c878dfa16fdfcd8f4b03
+  data.tar.gz: 77739204186ab0b9d50c0b15abca508d326cb990
 SHA512:
-  metadata.gz: 6b78233babd67dee7a0d90dad14d5110f89224afeb2c755e72fdcccd600cdedec7d7455c0cb0925ca0c4614c703eb0f8fcf228913fcb7e74f3d69a34bdbc9dab
-  data.tar.gz: 676876cf5c8c5cb309aec3a44e9c81f23404a319eaa68185088aeb311dc9abc31944d434f77c5313a2a76d860d443086fabfa4fe22dd622d9c9a6d72ebc752c8
+  metadata.gz: 4b026b789349a4e07d5da56fb01ae3012f62ff91b0cea6b87e7fdb89589638f5721cc1bbb9b0b88a4443ed351541785fe1f92cb74c95f3d64a143b22e5baa60e
+  data.tar.gz: 1642c2bf3230c4b6f0e0ad0e52dccc7a2073f11982d1019b9b1ee3dddf9d6dc42e1146f7591820fbdca7876d12a5e072a7382a3e2140a96e771ab033053ed00e

data/README.md

@@ -6,21 +6,21 @@
 The version of Rack::Session::Cookie that ships with Rack 2 has the following
 limitations:
 
-* Insecure SHA1 (HMAC-SHA1) by default
+* HMAC-SHA1 by default
 * Slow and/or bloated JSON, ZipJSON, or Marshal encoding out of the box
 * JSON encodings do not preserve Symbols
 * Digest is double-encoded and bloated (hexdigest of a base64)
 * Base64-encoded strings contain unecessary padding and characters that need to
   be escaped (e.g. `/` becomes `%2F`), wasting precious cookie bytes
-* It has some bugs in the size check that may lead to truncated cookies, token
-  leakage, and/or cross-site request forgery
+* It has some bugs in the size check that may lead to dropped or truncated
+  cookies, token leakage, and/or cross-site request forgery
 
 Of course, none of these are true show-stoppers, and the worst can be worked
 around by passing e.g. `:hmac` and `:coder` to the initializer. But we are nice
 people and we deserve nice things. This gem provides a minor derivative of
 Rack::Session::Cookie with the following improvements:
 
-* Secure SHA2 (HMAC-SHA-256) by default
+* HMAC-SHA256 by default
 * Compact binary serialization format (currently [MessagePack][3] but will
   likely change to [CBOR][4] in the future) out of the box
 * Symbols are preserved with the default `:coder`
@@ -49,7 +49,7 @@ stringification scheme other than non-padded, URL-safe Base64! It doesn't need
 to be configurable. The serializer remains configurable as the `:coder`.
 
 The remaining differences are mostly just better defaults: MessagePack and
-SHA2.
+HMAC-SHA256.
 
 ## Installation
 
@@ -103,8 +103,8 @@ and add ZipJSON. Although it comes in second-most compact at 289 bytes (cf.
 protocol buffers and MessagePack at 204 and 373 bytes, respectively), it was
 97% slower to encode and 91% slower to decode cf. MessagePack.
 
-I put this mock session payload through the following configurations with SHA2
-and 128 sidbits and here are the results:
+I put this mock session payload through the following configurations with
+HMAC-SHA256 and 128 sidbits and here are the results:
 
 ```ruby
 {

data/lib/rack/session/smart_cookie.rb

@@ -3,13 +3,13 @@ require 'rack/session/smart_cookie/version'
 
 require 'base64'
 require 'msgpack'
-require 'openssl'
+require 'openssl/digest'
 require 'rack/session/cookie'
 
 module Rack
   module Session
     class SmartCookie < Cookie
-      BAD_DIGESTS = %w[MD2 MD4 MD5 SHA SHA1].freeze
+      BAD_DIGESTS = %w[MD2 MD4 MD5 SHA].freeze
       DEFAULT_DIGEST = 'SHA256'
       SECRET_MIN_BYTESIZE = 16
 
@@ -33,16 +33,7 @@ module Rack
           def self.decode(str)
             return unless str
 
-            num_pad_chars =
-              case str.bytesize % 4
-              when 0 then 0
-              when 2 then 2
-              when 3 then 1
-              else
-                fail 'Invalid Base64-encoded string!'
-              end
-
-            ::Base64.urlsafe_decode64(str + '=' * num_pad_chars)
+            ::Base64.urlsafe_decode64(str + '=' * (-str.bytesize % 4))
           rescue
           end
         end
@@ -79,7 +70,7 @@ module Rack
 
       def initialize(app, options={})
         options[:coder] ||= MessagePack.new
-        options[:hmac] = OpenSSL::Digest.const_get(DEFAULT_DIGEST) unless options.key?(:hmac)
+        options[:hmac] = OpenSSL::Digest(DEFAULT_DIGEST) unless options.key?(:hmac)
 
         super
 
@@ -91,10 +82,10 @@ module Rack
         digest algorithm (#{hmac.class}).
 
         Such algorithms are generally considered to be effectively broken. It
-        is strongly recommended that you elect to use a message digest algorithm
-        from the SHA2 family: SHA224, SHA256, SHA384, or SHA512, or one of the
-        derivatives such as SHA512/256. This will help prevent exploits that
-        may be possible from crafted cookies.
+        is strongly recommended that you elect to use a message digest
+        algorithm from the SHA2 family: SHA224, SHA256, SHA384, or SHA512, or
+        one of the derivatives such as SHA512/256. This will help prevent
+        exploits that may be possible from crafted cookies.
 
         Called from: #{caller[0]}.
           MSG

data/lib/rack/session/smart_cookie/version.rb

@@ -10,7 +10,7 @@ module Rack
     Cookie = Class.new unless defined?(Cookie)
 
     class SmartCookie < Cookie
-      VERSION = '0.1.3'.freeze
+      VERSION = '0.1.4'.freeze
     end
   end
 end

data/rack-session-smart_cookie.gemspec

@@ -9,7 +9,7 @@ Gem::Specification.new do |spec|
   spec.authors       = ['Mike Pastore']
   spec.email         = ['mike@oobak.org']
 
-  spec.summary       = %q{Slightly smarter session cookies for Rack apps}
+  spec.summary       = %q{Slightly smarter session cookies for Rack 2 apps}
   spec.homepage      = 'https://github.com/mwpastore/rack-session-smart_cookie#readme'
   spec.license       = 'MIT'
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-session-smart_cookie
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - Mike Pastore
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-11-01 00:00:00.000000000 Z
+date: 2017-11-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: msgpack
@@ -150,5 +150,5 @@ rubyforge_project:
 rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
-summary: Slightly smarter session cookies for Rack apps
+summary: Slightly smarter session cookies for Rack 2 apps
 test_files: []