rack-wwwhisper 1.1.2 → 1.1.3

data/lib/rack/wwwhisper.rb

@@ -7,37 +7,10 @@
 require 'addressable/uri'
 require 'net/http/persistent'
 require 'rack/utils'
+require 'rack/wwwhisper_version'
 
 module Rack
 
-# An internal middleware used by Rack::WWWhisper to change directives
-# that enable public caching into directives that enable private
-# caching.
-#
-# To be on a safe side, all wwwhisper protected content is treated as
-# sensitive and not publicly cacheable.
-class NoPublicCache
-  def initialize(app)
-    @app = app
-  end
-
-  # If a response enables caching, makes sure it is private.
-  def call(env)
-    status, headers, body = @app.call(env)
-    if cache_control = headers['Cache-Control']
-      cache_control = cache_control.gsub(/public/, 'private')
-      if (not cache_control.include? 'private' and
-          cache_control.index(/max-age\s*=\s*0*[1-9]/))
-        # max-age > 0 without 'public' or 'private' directive is
-        # treated as 'public', so 'private' needs to be prepended.
-        cache_control.insert(0, 'private, ')
-      end
-      headers['Cache-Control'] = cache_control
-    end
-    [status, headers, body]
-  end
-end
-
 # Communicates with the wwwhisper service to authorize each incomming
 # request. Acts as a proxy for requests to locations handled by
 # wwwhisper (/wwwhisper/auth and /wwwhisper/admin)
@@ -56,9 +29,17 @@ class WWWhisper
   @@WWWHISPER_PREFIX = '/wwwhisper/'
   # Name prefix of cookies that are passed to wwwhisper.
   @@AUTH_COOKIES_PREFIX = 'wwwhisper'
+
   # Headers that are passed to wwwhisper ('Cookie' is handled
   # in a special way: only wwwhisper related cookies are passed).
-  # In addition, the current site url is passed in the Site-Url header.
+  #
+  # In addition, the current site URL is passed in the Site-Url header.
+  # This is needed to perform URL verification of Persona assertions and to
+  # construct Location headers in redirects.
+  #
+  # wwwhisper library version is passed in the User-Agent header. This
+  # is to warn the site owner if a vulnerability in the library is
+  # discovered and the library needs to be updated.
   @@FORWARDED_HEADERS = ['Accept', 'Accept-Language', 'Cookie', 'Origin',
                          'X-CSRFToken', 'X-Requested-With']
   @@DEFAULT_IFRAME = %Q[<script type="text/javascript" src="%s"> </script>
@@ -174,6 +155,7 @@ class WWWhisper
     copy_headers(rack_req.env, sub_req)
     scheme = rack_req.env['HTTP_X_FORWARDED_PROTO'] ||=  rack_req.scheme
     sub_req['Site-Url'] = "#{scheme}://#{rack_req.env['HTTP_HOST']}"
+    sub_req['User-Agent'] = "Ruby-#{Rack::WWWHISPER_VERSION}"
     if @wwwhisper_uri.user and @wwwhisper_uri.password
       sub_req.basic_auth(@wwwhisper_uri.user, @wwwhisper_uri.password)
     end
@@ -280,6 +262,35 @@ class WWWhisper
     end
   end
 
+
+  # An internal middleware used by Rack::WWWhisper to change directives
+  # that enable public caching into directives that enable private
+  # caching.
+  #
+  # To be on a safe side, all wwwhisper protected content is treated as
+  # sensitive and not publicly cacheable.
+  class NoPublicCache
+    def initialize(app)
+      @app = app
+    end
+
+    # If a response enables caching, makes sure it is private.
+    def call(env)
+      status, headers, body = @app.call(env)
+      if cache_control = headers['Cache-Control']
+        cache_control = cache_control.gsub(/public/, 'private')
+        if (not cache_control.include? 'private' and
+            cache_control.index(/max-age\s*=\s*0*[1-9]/))
+          # max-age > 0 without 'public' or 'private' directive is
+          # treated as 'public', so 'private' needs to be prepended.
+          cache_control.insert(0, 'private, ')
+        end
+        headers['Cache-Control'] = cache_control
+      end
+      [status, headers, body]
+    end
+  end # class NoPublicCache
+
 end # class WWWhisper
 
 end # module

data/test/test_wwwhisper.rb

@@ -8,6 +8,7 @@ require 'rack/test'
 require 'test/unit'
 require 'webmock/test_unit'
 require 'rack/wwwhisper'
+require 'rack/wwwhisper_version'
 
 ENV['RACK_ENV'] = 'test'
 
@@ -196,6 +197,16 @@ class TestWWWhisper < Test::Unit::TestCase
     assert_requested :get, full_url(@wwwhisper.auth_query(path))
   end
 
+  def test_library_version_passed_to_wwwhisper
+    path = '/foo/bar'
+    stub_request(:get, full_url(@wwwhisper.auth_query(path))).
+      with(:headers => {'User-Agent' => "Ruby-#{Rack::WWWHISPER_VERSION}"}).
+      to_return(granted())
+
+    get path
+    assert last_response.ok?
+  end
+
   def assert_path_normalized(normalized, requested, script_name=nil)
     stub_request(:get, full_url(@wwwhisper.auth_query(normalized))).
       to_return(granted())
@@ -266,11 +277,11 @@ class TestWWWhisper < Test::Unit::TestCase
     # X-Forwarded headers must be sent to wwwhisper backend.
     stub_request(:get, full_url(@wwwhisper.auth_query(path))).
       with(:headers => {
-             'Site-url' =>  "#{SITE_PROTO}://#{SITE_HOST}"
+             'Site-Url' =>  "#{SITE_PROTO}://#{SITE_HOST}"
            }).
       to_return(granted())
     stub_request(:get, full_url(path)).
-      with(:headers => {'Site-url' =>  "#{SITE_PROTO}://#{SITE_HOST}"}).
+      with(:headers => {'Site-Url' =>  "#{SITE_PROTO}://#{SITE_HOST}"}).
       to_return(:status => 200, :body => 'Admin page', :headers => {})
 
     get path

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-wwwhisper
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.1.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-20 00:00:00.000000000 Z
+date: 2013-03-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -131,7 +131,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 4077151302499284124
+      hash: -2256402036579086807
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -140,7 +140,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 4077151302499284124
+      hash: -2256402036579086807
 requirements: []
 rubyforge_project: 
 rubygems_version: 1.8.24