ruby-openid 2.1.4 → 2.1.5

data/CHANGELOG

@@ -1,11 +1,18 @@
-Fri Dec 19 11:50:10 PST 2008  cygnus@janrain.com
-  tagged 2.1.4
+Fri Apr 17 11:05:55 PDT 2009  cygnus@janrain.com
+  tagged 2.1.5
+  Ignore-this: 5f2efd8e91589c54cb0833b6379b9cfa
+
+Fri Apr 17 11:05:49 PDT 2009  cygnus@janrain.com
+  * Up version to 2.1.5
+  Ignore-this: 9f500a47200c6e2edb54057ebe9b19a0
 
-Fri Dec 19 11:48:25 PST 2008  cygnus@janrain.com
-  * Version: 2.1.4
+Fri Apr 17 11:03:31 PDT 2009  cygnus@janrain.com
+  * SECURITY FIX: Claimed identifier verification was inadvertently comparing values that would always return true (thanks to jbradley@mac.com)
+  Ignore-this: f69797d1383b08b6e58da70f183edb39
 
-Fri Dec 19 11:42:47 PST 2008  cygnus@janrain.com
-  * Normalize XRIs when doing discovery in accordance with the OpenID 2 spec
+Fri Apr 17 11:01:45 PDT 2009  cygnus@janrain.com
+  * Remove redundant test code
+  Ignore-this: 78592d7f2d00ff25e4ab07a90df84477
 
-Tue Dec 16 13:14:07 PST 2008  cygnus@janrain.com
-  tagged 2.1.3
+Fri Dec 19 11:50:10 PST 2008  cygnus@janrain.com
+  tagged 2.1.4

data/lib/openid.rb

@@ -13,7 +13,7 @@
 # permissions and limitations under the License.
 
 module OpenID
-  VERSION = "2.1.4"
+  VERSION = "2.1.5"
 end
 
 require "openid/consumer"

data/lib/openid/consumer/idres.rb

@@ -469,14 +469,14 @@ module OpenID
         # Fragments do not influence discovery, so we can't compare a
         # claimed identifier with a fragment to discovered information.
         defragged_claimed_id =
-          case Yadis::XRI.identifier_scheme(endpoint.claimed_id)
+          case Yadis::XRI.identifier_scheme(to_match.claimed_id)
           when :xri
-            endpoint.claimed_id
+            to_match.claimed_id
           when :uri
             begin
-              parsed = URI.parse(endpoint.claimed_id)
+              parsed = URI.parse(to_match.claimed_id)
             rescue URI::InvalidURIError
-              endpoint.claimed_id
+              to_match.claimed_id
             else
               parsed.fragment = nil
               parsed.to_s

data/test/test_idres.rb

@@ -685,7 +685,6 @@ module OpenID
                                  'identity' => 'sour grapes',
                                  'claimed_id' => 'monkeysoft',
                                  'op_endpoint' => 'Green Cheese'}) do |idres|
-                        idres.extend(InstanceDefExtension)
               idres.instance_def(:discover_and_verify) do |claimed_id, endpoints|
                 @endpoint = endpoint
               end
@@ -694,6 +693,22 @@ module OpenID
           assert(endpoint.equal?(result))
         end
 
+        def test_verify_discovery_single_claimed_id_mismatch
+          idres = IdResHandler.new(nil, nil)
+          @endpoint.local_id = 'my identity'
+          @endpoint.claimed_id = 'http://i-am-sam/'
+          @endpoint.server_url = 'Phone Home'
+          @endpoint.type_uris = [OPENID_2_0_TYPE]
+
+          to_match = @endpoint.dup
+          to_match.claimed_id = 'http://something.else/'
+
+          e = assert_raises(ProtocolError) {
+            idres.send(:verify_discovery_single, @endpoint, to_match)
+          }
+          assert(e.to_s =~ /different subjects/)
+        end
+
         def test_openid2_use_pre_discovered
           @endpoint.local_id = 'my identity'
           @endpoint.claimed_id = 'http://i-am-sam/'

metadata

@@ -3,8 +3,8 @@ rubygems_version: 0.9.0
 specification_version: 1
 name: ruby-openid
 version: !ruby/object:Gem::Version 
-  version: 2.1.4
-date: 2008-12-19 00:00:00 -08:00
+  version: 2.1.5
+date: 2009-04-17 00:00:00 -07:00
 summary: A library for consuming and serving OpenID identities.
 require_paths: 
 - lib