shrine 3.10.1 → 3.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '078c4711b7bd211c577666899edb233967df970a48b96d3b6239189f9c516586'
-  data.tar.gz: a46ed9608642d54c84fd80cc106e56655b4bff7439ff3cf2627bd1c199b40a15
+  metadata.gz: 2027c3833ffb021cf9fe9be3761c3238ca807eb1591ed910b585b226cad80497
+  data.tar.gz: fd9ce3716ac5c110a306f4823acf90de7cf673132ef90b181e8d7040cc8d74d0
 SHA512:
-  metadata.gz: 9526af08df019ad15b330e804d2136d0a2f876657b55018b3498ec5fd9c75b881ee1d7559fb4bd862512975d0a7439c4991d11dedf61b9c2bcc6d8c1c3ef38b6
-  data.tar.gz: af84847b2664f400250142bda5995b31d9303de422d5e73d75593ec2d9911f1cdc9e6dc27f10a3f97ab97aaefcb9ebf3f5754a35a6220501af2230dc7f7dcd6b
+  metadata.gz: 9181db3a505b16fba406a6d98cc2f4a37222fcbacdf47427d5ec80d087ef3746b0db2152d21685b89f8cfc77db766b0ed13f1b976241354dc48b9e82aaa1fd35
+  data.tar.gz: 4f891d6fcfd5cdd29a39e04479d42d20bc7a6511557a2f82f85dc6889536bf38be9b5f281389fe6751ce7e26271bd1c85897c6e899b6ba3e08d3070ffc1e717e

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 3.10.2 (2026-10-11)
+
+* `derivation_endpoint` – Prevent bypassing CDN caching by modifying the encoding or structure of the signed URL query string (@Antsiscool, @janko)
+
 ## 3.10.1 (2026-10-10)
 
 * `model` – Make `Attacher#write` a no-op when the attacher isn't backed by a model, fixing `remove_invalid` raising `NoMethodError` on attachers without a record (@janko)

data/doc/release_notes/3.10.2.md

@@ -0,0 +1,31 @@
+---
+title: Shrine 3.10.2
+---
+
+## Security
+
+* The `derivation_endpoint` plugin now verifies the URL signature against the
+  URL exactly as it was received. Previously, query parameters were decoded and
+  re-encoded before verification, so the same signed URL could be requested
+  through an unlimited number of variants that all passed verification. Since
+  each variant is a separate cache key on a CDN, this could be used to bypass
+  CDN caching and repeatedly trigger derivations on the server:
+
+  ```
+  /derivations/thumbnail/...?type=image%2Fwebp&signature=abc123      # original
+  /derivations/thumbnail/...?%74ype=image%2Fwebp&signature=abc123    # encoded parameter name
+  /derivations/thumbnail/...?&&type=image%2Fwebp&signature=abc123    # empty parameters
+  /derivations/thumbnail/...?type=image%2Fwebp&signature=abc123?foo  # appended query
+  ```
+
+  These variants now return a `403 Forbidden` response. The `signature` query
+  parameter is also required to be the last parameter, which is where Shrine
+  always puts it.
+
+## Backwards compatibility
+
+* URLs generated by the `derivation_endpoint` plugin are unchanged, so
+  existing URLs remain valid. However, if a proxy between the client and your
+  application rewrites the query string (e.g. re-encodes characters, reorders
+  parameters, or appends tracking parameters), signature verification will now
+  fail for those requests.

data/lib/shrine/plugins/derivation_endpoint.rb

@@ -717,29 +717,27 @@ class Shrine
 
     # Returns a URL with the `signature` query parameter
     def sign_url(url)
-      path, query = url.split("?")
+      path, query = url.split("?", 2)
 
-      params = Rack::Utils.parse_query(query.to_s)
-      params.merge!("signature" => generate_signature(url))
-
-      query = Rack::Utils.build_query(params)
+      signature = generate_signature("#{path}?#{query}")
+      query     = [query, "signature=#{signature}"].reject { |part| part.to_s.empty? }.join("&")
 
       "#{path}?#{query}"
     end
 
-    # Calculcates the signature from the URL and checks whether it matches the
-    # value in the `signature` query parameter. Raises `InvalidSignature` if
-    # the `signature` parameter is missing or its value doesn't match the
-    # calculated signature.
+    # Calculates the signature from the URL and checks whether it matches the
+    # value in the trailing `signature` query parameter. Raises
+    # `InvalidSignature` if the `signature` parameter is missing or its value
+    # doesn't match the calculated signature. The URL is verified as is,
+    # without any normalization, so that each signed URL has only one valid
+    # form (otherwise variants of it could be used to bypass CDN caching).
     def verify_url(url)
-      path, query = url.split("?")
-
-      params    = Rack::Utils.parse_query(query.to_s)
-      signature = params.delete("signature")
+      path, query = url.split("?", 2)
 
-      query = Rack::Utils.build_query(params)
+      params    = query.to_s.split("&", -1)
+      signature = params.pop.delete_prefix("signature=") if params.last&.start_with?("signature=")
 
-      verify_signature("#{path}?#{query}", signature)
+      verify_signature("#{path}?#{params.join("&")}", signature)
     end
 
     def verify_signature(string, signature)

data/lib/shrine/version.rb

@@ -8,7 +8,7 @@ class Shrine
   module VERSION
     MAJOR = 3
     MINOR = 10
-    TINY  = 1
+    TINY  = 2
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shrine
 version: !ruby/object:Gem::Version
-  version: 3.10.1
+  version: 3.10.2
 platform: ruby
 authors:
 - Janko Marohnić
@@ -491,6 +491,7 @@ files:
 - doc/release_notes/3.1.0.md
 - doc/release_notes/3.10.0.md
 - doc/release_notes/3.10.1.md
+- doc/release_notes/3.10.2.md
 - doc/release_notes/3.2.0.md
 - doc/release_notes/3.2.1.md
 - doc/release_notes/3.2.2.md