safe_redirect 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 42781306d360f12ef01f4a73870f29f7d7bb3ccf
+  data.tar.gz: 17ee1e4e9949489f5cb4f4b80798aadbb8ed32bd
+SHA512:
+  metadata.gz: 9d5601897b86a1bd091e90ec5fa091f43a2d4d595715339933aa99a519edda52cd677d30d33a8f10c87879adcb6a5caf066de95e7095dc48fe3649a4fefa254a
+  data.tar.gz: f2ddf78d33afb33fb33ed17927dc24af704b2b1ccc904e21a38ac2d9bbc85fb8909cac98c1bd4594f8152c0fb90a42df6d11de91d701d970f18ff37c8967ec87

data/.gitignore

@@ -0,0 +1,2 @@
+*.swp
+*.gem

data/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2015 Edwin Tunggawan (sdsdkkk)
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,51 @@
+# SafeRedirect
+
+A little gem to keep our Rails app safe from open redirection vulnerabilities.
+
+## Installation
+
+Add this line to Gemfile.
+
+```
+gem 'safe_redirect'
+```
+
+##  Usage
+
+Create a `config/initializer/safe_redirect.rb` file.
+
+```rb
+SafeRedirect.configure do |config|
+  config.domain_whitelists = ['www.google.com']
+  config.default_path = 'https://www.yahoo.com'
+end
+```
+
+Add this line to the controllers you wish to secure from open redirection.
+
+```rb
+include SafeRedirect
+```
+
+The `redirect_to` method provided by Rails will be overrode by `safe_redirect`'s `redirect_to` method.
+
+```rb
+redirect_to 'https://www.google.com' # => redirects to https://www.google.com
+redirect_to 'https://www.golgege.com' # => redirects to ''
+redirect_to 'https://www.golgege.com/hahaha' # => redirects to '/hahaha'
+redirect_to 1234 # => redirects to https://www.yahoo.com as default path
+```
+
+## Contributing
+
+- Fork the repository
+- Create a branch for a new feature, build it
+- Create a pull request
+
+## License
+
+MIT License
+
+## Author
+
+- [Edwin Tunggawan](https://github.com/sdsdkkk)

data/lib/safe_redirect.rb

@@ -0,0 +1,3 @@
+require 'safe_redirect/version'
+require 'safe_redirect/safe_redirect'
+require 'safe_redirect/configuration'

data/lib/safe_redirect/configuration.rb

@@ -0,0 +1,17 @@
+module SafeRedirect
+  class << self
+    attr_writer :configuration
+
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield(configuration)
+    end
+  end
+
+  class Configuration
+    attr_accessor :default_path, :domain_whitelists
+  end
+end

data/lib/safe_redirect/safe_redirect.rb

@@ -0,0 +1,27 @@
+module SafeRedirect
+  def safe_domain?(path)
+    whitelists = SafeRedirect.configuration.domain_whitelists || []
+    path =~ /^\// && !(path =~ /^\/\/+/)  ||
+    whitelists.any? do |w|
+      path =~ /^https?:\/\/#{w}($|\/.*)/
+    end
+  end
+
+  def safe_path(path)
+    if path.kind_of?(String)
+      stripped_path = path.strip
+      if safe_domain?(stripped_path)
+        stripped_path
+      else
+        stripped_path.gsub(/https?:\/\/[a-z0-9\-\.:]*/i, '')
+                     .gsub(/^(data:|javascript:|\.|\/\/|@)+/i, '')
+      end
+    else
+      SafeRedirect.configuration.default_path
+    end
+  end
+
+  def redirect_to(path)
+    super safe_path(path)
+  end
+end

data/lib/safe_redirect/version.rb

@@ -0,0 +1,3 @@
+module SafeRedirect
+  VERSION = '0.1.0'
+end

data/safe_redirect.gemspec

@@ -0,0 +1,18 @@
+
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'safe_redirect/version'
+
+Gem::Specification.new do |gem|
+  gem.name          = "safe_redirect"
+  gem.version       = SafeRedirect::VERSION
+  gem.authors       = ["Edwin Tunggawan"]
+  gem.email         = ["vcc.edwint@gmail.com"]
+  gem.description   = %q{Preventing open redirects in Ruby web apps}
+  gem.summary       = %q{Preventing open redirects in Ruby web apps}
+  gem.homepage      = "https://github.com/sdsdkkk/safe_redirect"
+
+  gem.files         = `git ls-files`.split($/)
+  gem.require_paths = ["lib", "lib/safe_redirect"]
+end

metadata

@@ -0,0 +1,52 @@
+--- !ruby/object:Gem::Specification
+name: safe_redirect
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Edwin Tunggawan
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-04-30 00:00:00.000000000 Z
+dependencies: []
+description: Preventing open redirects in Ruby web apps
+email:
+- vcc.edwint@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- LICENSE
+- README.md
+- lib/safe_redirect.rb
+- lib/safe_redirect/configuration.rb
+- lib/safe_redirect/safe_redirect.rb
+- lib/safe_redirect/version.rb
+- safe_redirect.gemspec
+homepage: https://github.com/sdsdkkk/safe_redirect
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+- lib/safe_redirect
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.1
+signing_key: 
+specification_version: 4
+summary: Preventing open redirects in Ruby web apps
+test_files: []