signed_json 2.0.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7f87c5b0f1a4ece38890c06ce7ea92402ac1051f
-  data.tar.gz: 0f74718e9382c444ded4db1a5fccbced5fcc8430
+  metadata.gz: b0d232f1c98656d1df95445512bd1b456fb23f94
+  data.tar.gz: 88b330d8e3a7cda309dfa306a07038b15f62f2c4
 SHA512:
-  metadata.gz: 0b1a8f253f94571aec508af9fd4202627bf0f15a9e8aedf4f1c5b38bca11440f02d13444a3a9161d8da3947cdc4ffaec1fa7ef0a134900cc96092fbf5c6a9814
-  data.tar.gz: 7320c16827347b01d0bcc9416d8ab2e801ce1c2cdd680e892934f3a83d1b32b2f6359b5e3e47d94443913ef45eb4c7a8888d1988946fb9725980937b6ceb0b4a
+  metadata.gz: 4a2fc3e5a36e9cb1b8c5c84250ef85e1353cfc6cbaa6c08176e179e07495b691eb1e09ad8fde070b5a2e5478141e8730eea93a7cc912d80f35880168eeb4109a
+  data.tar.gz: 6c3f9f5936eea3cf7c41d147010f30847ea34bf2664d30bf33abce94c7d06e51130f928621979522b0b7a86a891a8830575b4cb859324be7aac3d726999839be

data/lib/signed_json.rb

@@ -11,7 +11,7 @@ module SignedJson
 
     def encode(input)
       data_to_encode = [digest_for(input), input]
-      json_generate(data_to_encode)
+      JSON.generate(data_to_encode)
     end
 
     def decode(input)
@@ -26,7 +26,7 @@ module SignedJson
     def digest_for(input)
       require 'openssl' unless defined?(OpenSSL) # from ActiveSupport::MessageVerifier
       digest = OpenSSL::Digest.const_get(@digest).new
-      OpenSSL::HMAC.hexdigest(digest, @secret, json_generate(input))
+      OpenSSL::HMAC.hexdigest(digest, @secret, signature_input(input))
     end
 
     private
@@ -45,9 +45,23 @@ module SignedJson
       raise InputError
     end
 
-    def json_generate(data)
-      # Use JSON.dump; JSON.generate only handles top-level object/array.
-      JSON.dump(data)
+    def signature_input(data)
+      if [Array, Hash].any? { |c| c === data }
+        JSON.generate(data)
+      else
+        signature_input_for_unsupported_root_type(data)
+      end
+    end
+
+    # signed_json depended on Ruby JSON encoding top-level objects other than
+    # array and object, which are the only two JSON actually supports.
+    #
+    # json_pure v2.x refuses to JSON encode these types.
+    #
+    # signed_json must continue to support them to avoid breaking signatures
+    # across versions / implementations.
+    def signature_input_for_unsupported_root_type(data)
+      JSON.generate([data])[1..-2]
     end
 
   end

data/lib/signed_json/version.rb

@@ -1,3 +1,3 @@
 module SignedJson
-  VERSION = "2.0.0"
+  VERSION = "3.0.0"
 end

data/signed_json.gemspec

@@ -18,8 +18,6 @@ Gem::Specification.new do |s|
   s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
 
-  s.add_dependency('json')
-
   s.add_development_dependency('rspec', ['~> 3.1'])
   s.add_development_dependency('rake')
 end

data/spec/signed_json_spec.rb

@@ -38,6 +38,44 @@ describe SignedJson do
       expect(JSON.parse(encoded)).to be_instance_of(Array)
     end
 
+    describe "known-good signature from v2.0.0" do
+      {
+        {"hello" => "world"} => "c9bd3c44a91cfe176f71afcc1e08240555f0ce8b",
+        ["hello", "world"] => "67a288435a9268645d399e5969de777096028b2d",
+        nil => "546b281dfcf7e69a4dbcb6a5001929585d65c7d7",
+        "hello world" => "1ed96f0a1cadcee5bd139eb850d39ac1bcda6747",
+        1234 => "307c560360fbf15ecab5a78299052fe68a302d7a",
+      }.each do |data, expected|
+        it "is #{expected} for #{data.inspect}" do
+          encoded = SignedJson::Signer.new("secret").encode(data)
+          signature, payload = JSON.parse(encoded)
+          expect(signature).to eq(expected)
+          expect(payload).to eq(data)
+        end
+      end
+    end
+
+    it "returns known-good signature and payload for object" do
+      encoded = SignedJson::Signer.new("secret").encode(hello: "world")
+      signature, payload = JSON.parse(encoded)
+      expect(signature).to eq("c9bd3c44a91cfe176f71afcc1e08240555f0ce8b")
+      expect(payload).to eq({"hello" => "world"})
+    end
+
+    it "returns known-good signature and payload for array" do
+      encoded = SignedJson::Signer.new("secret").encode(%w(hello world))
+      signature, payload = JSON.parse(encoded)
+      expect(signature).to eq("67a288435a9268645d399e5969de777096028b2d")
+      expect(payload).to eq(["hello", "world"])
+    end
+
+    it "returns known-good signature and payload for nil" do
+      encoded = SignedJson::Signer.new("secret").encode(nil)
+      signature, payload = JSON.parse(encoded)
+      expect(signature).to eq("546b281dfcf7e69a4dbcb6a5001929585d65c7d7")
+      expect(payload).to eq(nil)
+    end
+
   end
 
   describe "Signer#decode error handling" do

metadata

@@ -1,55 +1,41 @@
 --- !ruby/object:Gem::Specification
 name: signed_json
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 3.0.0
 platform: ruby
 authors:
 - Paul Annesley
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-11-10 00:00:00.000000000 Z
+date: 2016-07-08 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.1'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 description: 
@@ -59,7 +45,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
+- .gitignore
 - Gemfile
 - README.md
 - Rakefile
@@ -78,17 +64,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: signed_json
-rubygems_version: 2.2.2
+rubygems_version: 2.0.14.1
 signing_key: 
 specification_version: 4
 summary: Encodes and decodes data to a JSON string signed with OpenSSL HMAC. Great