rack-tamperproof 0.0.1

data/.document

@@ -0,0 +1,5 @@
+README.rdoc
+lib/**/*.rb
+bin/*
+features/**/*.feature
+LICENSE

data/.gitignore

@@ -0,0 +1,5 @@
+*.sw?
+.DS_Store
+coverage
+rdoc
+pkg

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2009 Joshua Hull
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,11 @@
+= Rack::Tamperproof
+
+== Usage
+
+  use Rack::Tamperproof(:default_key => "123u9ew90uqn") do
+    delete_for :just_delete_this
+    exception_for :don_t_tamper
+  end
+
+  # delete_for cookies will delete if they are tampered with and your request passes through normally
+  # exception_for produces an exception if the cookie is tampered with

data/Rakefile

@@ -0,0 +1,49 @@
+require 'rubygems'
+require 'rake'
+
+begin
+  require 'jeweler'
+  Jeweler::Tasks.new do |gem|
+    gem.name = "rack-tamperproof"
+    gem.summary = "Rack middleware that provides tamper-proof cookies"
+    gem.email = "joshbuddy@gmail.com"
+    gem.homepage = "http://github.com/joshbuddy/rack-tamperproof"
+    gem.authors = ["Joshua Hull"]
+    # gem is a Gem::Specification... see http://www.rubygems.org/read/chapter/20 for additional settings
+  end
+  Jeweler::GemcutterTasks.new
+
+rescue LoadError
+  puts "Jeweler (or a dependency) not available. Install it with: sudo gem install jeweler"
+end
+
+require 'spec/rake/spectask'
+Spec::Rake::SpecTask.new(:spec) do |spec|
+  spec.libs << 'lib' << 'spec'
+  spec.spec_files = FileList['spec/**/*_spec.rb']
+end
+
+Spec::Rake::SpecTask.new(:rcov) do |spec|
+  spec.libs << 'lib' << 'spec'
+  spec.pattern = 'spec/**/*_spec.rb'
+  spec.rcov = true
+end
+
+
+task :default => :spec
+
+require 'rake/rdoctask'
+Rake::RDocTask.new do |rdoc|
+  if File.exist?('VERSION.yml')
+    config = YAML.load(File.read('VERSION.yml'))
+    version = "#{config[:major]}.#{config[:minor]}.#{config[:patch]}"
+  else
+    version = ""
+  end
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "rack-tamperproof #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end
+

data/VERSION

@@ -0,0 +1 @@
+0.0.1

data/lib/rack-tamperproof.rb

@@ -0,0 +1,107 @@
+require 'rack'
+require 'digest/sha1'
+
+module Rack
+  class Request
+    def delete_cookie(key)
+      c = cookies
+      c.delete(key)
+      env['HTTP_COOKIE'] = c.map{|k,v| "#{Rack::Utils.escape(k)}=#{Rack::Utils.escape(v)}"}.join(';')
+      env.delete('rack.request.cookie_string')
+      env.delete('rack.request.cookie_hash')
+    end
+  end
+end
+
+module Rack
+  class Tamperproof
+    
+    Tampered = Class.new(RuntimeError)
+    
+    class Protector
+      
+      def initialize(name, secret, postfix = '_key')
+        @name = name.to_s
+        @secret = secret
+        @postfix = postfix
+      end
+      
+      def secret_cookie_key
+        "#{@name}#{@postfix}"
+      end
+      
+      def self.sign(name, value, secret)
+        digest = Digest::SHA1.new
+        digest.update(name)
+        digest.update(value)
+        digest.update(secret)
+        digest.hexdigest
+      end
+      
+      def secret(cookies)
+        self.class.sign(@name, cookies[@name], @secret)
+      end
+      
+      def valid?(request)
+        secret(request.cookies) == request.cookies[secret_cookie_key]
+      end
+      
+      def add_secret_to_response(response, cookies)
+        response.set_cookie(secret_cookie_key, secret(cookies))
+      end
+      
+      class ExceptionProtector < Protector
+        def validate(request)
+          valid?(request) or raise(Tampered.new)
+        end
+      end
+
+      class DeleteProtector < Protector
+        def validate(request)
+          unless valid?(request)
+            request.delete_cookie(@name)
+            request.delete_cookie(secret_cookie_key)
+          end
+        end
+      end
+    end
+    
+    def exception_for(name, key = @default_key || raise)
+      @protected_cookies[name.to_s] = Protector::ExceptionProtector.new(name, key)
+    end
+    
+    def delete_for(name, key = @default_key || raise)
+      @protected_cookies[name.to_s] = Protector::DeleteProtector.new(name, key)
+    end
+    
+      
+    def initialize(app, opts = nil, &block)
+      @app = app
+      @default_key = opts && opts[:default_key]
+      @protected_cookies = {}
+      instance_eval(&block)
+    end
+    
+    def call(env)
+      
+      # detect cookies that are supposed to be tamper proof
+      
+      request = Rack::Request.new(env)
+      request.cookies.each do |name, value|
+        if @protected_cookies[name]
+          @protected_cookies[name].validate(request)
+        end
+      end
+      
+      result = @app.call(env)
+      response = Rack::Response.new(result[2], result[0], result[1])
+      
+      cookies = Rack::Utils.parse_query(response['Set-Cookie'], "\n")
+      @protected_cookies.each do |name, protector|
+        protector.add_secret_to_response(response, cookies)
+      end
+      response.to_a
+    end
+    
+  end
+end

data/spec/rack-tamperproof_spec.rb

@@ -0,0 +1,93 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe "Rack-Tamperproof" do
+
+  describe "key signing" do
+    it "should use all three values to create a key" do
+      vals = ['value0','value1','value2']
+      3.times do |i|
+        Rack::Tamperproof::Protector.sign(*vals).should_not == Rack::Tamperproof::Protector.sign(*vals.map{|v| v[-1] == i.to_s[0] ? v.upcase : v})
+      end
+    end
+  end
+
+  describe "with a delete cookie" do
+
+    it "should generate a secret" do
+      response = build_builder(Proc.new{
+        delete_for :test
+      }).call(Rack::MockRequest.env_for('/'))
+      headers = Rack::Utils::HeaderHash.new(response[1])
+      cookies = Rack::Utils.parse_query(headers['Set-Cookie'], "\n")
+      cookies['test'].should == 'protected'
+      cookies['test_key'].should == Rack::Tamperproof::Protector.sign('test', 'protected', 'testing this key')
+    end
+
+    it "should delete a tampered cookie" do
+      response = build_builder(Proc.new{
+        delete_for :test
+      }) { |request, response|
+        request.cookies['test'].should == nil
+      }.call(Rack::MockRequest.env_for('/', {
+        'HTTP_COOKIE' => build_cookie_header({'test' => 'protected2', 'test_key' => Rack::Tamperproof::Protector.sign('test', 'protected', 'testing this key')})
+      }))
+      
+    end
+
+    it "should allow override of the secret" do
+      response = build_builder(Proc.new{
+        delete_for :test, 'my new secret'
+      }).call(Rack::MockRequest.env_for('/'))
+      headers = Rack::Utils::HeaderHash.new(response[1])
+      cookies = Rack::Utils.parse_query(headers['Set-Cookie'], "\n")
+      cookies['test'].should == 'protected'
+      cookies['test_key'].should == Rack::Tamperproof::Protector.sign('test', 'protected', 'my new secret')
+    end
+
+    it "should raise if no default is given" do
+      Proc.new {
+        build_builder(Proc.new{
+          delete_for :test
+        }, nil) { |request, response|
+          request.cookies['test'].should == nil
+        }.call(Rack::MockRequest.env_for('/', {
+          'HTTP_COOKIE' => build_cookie_header({'test' => 'protected2', 'test_key' => Rack::Tamperproof::Protector.sign('test', 'protected', 'testing this key')})
+        }))
+      }.should raise_error
+    end
+  end
+
+  describe "with an exception cookie" do
+    it "should generate a secret" do
+      response = build_builder(Proc.new{
+        exception_for :test
+      }).call(Rack::MockRequest.env_for('/'))
+      headers = Rack::Utils::HeaderHash.new(response[1])
+      cookies = Rack::Utils.parse_query(headers['Set-Cookie'], "\n")
+      cookies['test'].should == 'protected'
+      cookies['test_key'].should == Rack::Tamperproof::Protector.sign('test', 'protected', 'testing this key')
+    end
+
+    it "should raise an exception on a tampered cookie" do
+      Proc.new {build_builder(Proc.new{
+        exception_for :test
+      }).call(Rack::MockRequest.env_for('/', {
+        'HTTP_COOKIE' => build_cookie_header({'test' => 'protected2', 'test_key' => Rack::Tamperproof::Protector.sign('test', 'protected', 'testing this key')})
+      }))}.should raise_error Rack::Tamperproof::Tampered
+
+    end
+
+    it "should allow override of the secret" do
+      response = build_builder(Proc.new{
+        exception_for :test, 'my new secret'
+      }).call(Rack::MockRequest.env_for('/'))
+      headers = Rack::Utils::HeaderHash.new(response[1])
+      cookies = Rack::Utils.parse_query(headers['Set-Cookie'], "\n")
+      cookies['test'].should == 'protected'
+      cookies['test_key'].should == Rack::Tamperproof::Protector.sign('test', 'protected', 'my new secret')
+    end
+
+
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,37 @@
+require 'spec'
+require 'rubygems'
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+require 'rack-tamperproof'
+
+def build_builder(config, key = "testing this key", &block)
+  app = Rack::Builder.new do
+    if key
+      use Rack::Tamperproof, :default_key => "testing this key", &config
+    else
+      use Rack::Tamperproof, &config
+    end
+    run build_app(& (block || Proc.new{ |a,b|
+    }))
+  end
+  
+end
+
+def build_app(&block)
+  Proc.new { |env|
+    request = Rack::Request.new(env)
+    Rack::Response.new do |response|
+      response.body = ['hello']
+      response.header['Content-type'] = 'text/plain'
+      unless request.cookies['test']
+        response.set_cookie('test', 'protected') 
+      end
+      block.call(request, response)
+    end.to_a
+  }
+end
+
+def build_cookie_header(cookies)
+  cookies.map{|k,v| "#{Rack::Utils.escape(k)}=#{Rack::Utils.escape(v)}"}.join(';')
+end
+

metadata

@@ -0,0 +1,65 @@
+--- !ruby/object:Gem::Specification 
+name: rack-tamperproof
+version: !ruby/object:Gem::Version 
+  version: 0.0.1
+platform: ruby
+authors: 
+- Joshua Hull
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2009-12-03 00:00:00 -05:00
+default_executable: 
+dependencies: []
+
+description: 
+email: joshbuddy@gmail.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE
+- README.rdoc
+files: 
+- .document
+- .gitignore
+- LICENSE
+- README.rdoc
+- Rakefile
+- VERSION
+- lib/rack-tamperproof.rb
+- spec/rack-tamperproof_spec.rb
+- spec/spec_helper.rb
+has_rdoc: true
+homepage: http://github.com/joshbuddy/rack-tamperproof
+licenses: []
+
+post_install_message: 
+rdoc_options: 
+- --charset=UTF-8
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.5
+signing_key: 
+specification_version: 3
+summary: Rack middleware that provides tamper-proof cookies
+test_files: 
+- spec/rack-tamperproof_spec.rb
+- spec/spec_helper.rb