simple_google_auth 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8dd8d1cf6e697eb5d635b3118923e4f916ca5de03847c78143fb7ce8ece9c8c5
-  data.tar.gz: 61cf025ca623785b3c150f79c5035eabd5b4606e5e95f47a48affd0bc090d790
+  metadata.gz: b0cddb7c5d88d861d18686ee5601d635e94f133d51863fbfe50f9aadf46c8664
+  data.tar.gz: 19728334ae4996d63a0547f3ec9637ee20234fc8083a95355b734b5358809c64
 SHA512:
-  metadata.gz: 1c4a1060d4eda6cc1bdf1acc2609e40766019254c8165d756495bb145b253f3bec4ab769a69656ac6f0af46ec93330491527da2a2611ad86bead167fa381243b
-  data.tar.gz: 870f90edbed191d998ffb364cf474a40776c436ea4ec8c25b33c5f27881edfa3c60f6f86d2e07981c362112658b9d1548155898daa1ab3eda495dcb82e0513d5
+  metadata.gz: 990eb2a0608217e84f01a2e5cfd5273773e758c64581930563cee30b38deae2f4becae0bf070f7edf2d3550d4b8e4ca10f793d7be144ef418f41ea8c915c21d6
+  data.tar.gz: 721625b234e2c0b937dca66e38bec0ce8ac5c087237d57a46831404112110f22f46e06934768c7bbb22837d829546a0868a06396d400fc37bda14049cf94e517

data/lib/simple_google_auth/receiver.rb

@@ -11,10 +11,11 @@ module SimpleGoogleAuth
       data = AuthDataPresenter.new(auth_data)
       raise Error, "Authentication failed" unless config.authenticate.call(data)
 
+      renew_session(request)
       request.session[config.data_session_key_name] = auth_data
 
       path = config.authentication_uri_state_path_extractor.call(request.session[config.state_session_key_name])
-      path = "/" if path.blank?
+      path = "/" unless safe_redirect_path?(path)
       [302, {"Location" => path}, [" "]]
 
     rescue Error => e
@@ -26,7 +27,9 @@ module SimpleGoogleAuth
 
     protected
     def ensure_params_are_correct(request, config)
-      if request.params["state"] != request.session[config.state_session_key_name]
+      expected_state = request.session[config.state_session_key_name]
+
+      if expected_state.blank? || !states_match?(request.params["state"], expected_state)
         raise Error, "Invalid state returned from Google"
       elsif request.params["error"]
         raise Error, "Authentication failed: #{request.params["error"]}"
@@ -34,5 +37,30 @@ module SimpleGoogleAuth
         raise Error, "No authentication code returned"
       end
     end
+
+    private
+
+    # Constant-time comparison so the CSRF state token isn't leaked via timing.
+    # A blank expected state is rejected by the caller before we get here.
+    def states_match?(actual, expected)
+      return false if actual.nil?
+      ActiveSupport::SecurityUtils.secure_compare(actual.to_s, expected.to_s)
+    end
+
+    # Only redirect back to a path on our own host. A safe path starts with a
+    # single "/" that isn't followed by another "/" or "\" -- both of which a
+    # browser can resolve to a different origin ("//evil.com", "/\evil.com").
+    # Written as an allowlist so we don't have to chase every dangerous form.
+    def safe_redirect_path?(path)
+      path = path.to_s
+      path.start_with?("/") && !path.start_with?("//", "/\\")
+    end
+
+    # Rotate the session on successful login to defend against session fixation.
+    # No-op on session stores that don't expose options (e.g. in unit tests).
+    def renew_session(request)
+      session = request.session
+      session.options[:renew] = true if session.respond_to?(:options) && session.options
+    end
   end
 end

data/lib/simple_google_auth/version.rb

@@ -1,3 +1,3 @@
 module SimpleGoogleAuth
-  VERSION = "0.3.0"
+  VERSION = "0.3.2"
 end

data/spec/simple_google_auth/http_client_spec.rb

@@ -14,7 +14,7 @@ describe SimpleGoogleAuth::HttpClient do
       expect(http).to receive(:request).with(request).and_return(response)
 
       expect(Net::HTTP::Post).to receive(:new).with("/somepath").and_return(request)
-      expect(request).to receive(:set_form_data).with('some' => 'data')
+      expect(request).to receive(:set_form_data).with({'some' => 'data'})
     end
 
     subject { SimpleGoogleAuth::HttpClient.new("https://some.host/somepath", open_timeout: 12, read_timeout: 13) }

data/spec/simple_google_auth/receiver_spec.rb

@@ -44,6 +44,18 @@ describe SimpleGoogleAuth::Receiver do
 
         expect(subject).to eq [302, {"Location" => "/place"}, [" "]]
       end
+
+      it "does not follow a protocol-relative redirect path (open redirect)" do
+        expect(authentication_uri_state_path_extractor).to receive(:call).with(state).and_return('//evil.com')
+
+        expect(subject).to eq [302, {"Location" => "/"}, [" "]]
+      end
+
+      it "does not follow a backslash-prefixed redirect path (open redirect)" do
+        expect(authentication_uri_state_path_extractor).to receive(:call).with(state).and_return('/\\evil.com')
+
+        expect(subject).to eq [302, {"Location" => "/"}, [" "]]
+      end
     end
 
     context "and the authenticator rejects the login" do
@@ -63,6 +75,15 @@ describe SimpleGoogleAuth::Receiver do
     end
   end
 
+  context "when the session holds no state and the callback omits it (forged callback)" do
+    let(:state) { nil }
+    let(:params) { {"code" => code} }
+
+    it "rejects the login rather than treating two blank states as a match" do
+      expect(subject).to eq [302, {"Location" => "/error?message=Invalid+state+returned+from+Google"}, [" "]]
+    end
+  end
+
   context "when the google authentication fails" do
     let(:params) { {"state" => state, "error" => "bad stuff"} }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simple_google_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Roger Nesbitt
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-02-04 00:00:00.000000000 Z
+date: 2026-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.9'
+        version: '6.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.9'
+        version: '6.1'
 description: An extremely easy way to protect your site by requiring Google logins
   without having to set up a traditional authentication system
 email:
@@ -73,7 +73,7 @@ homepage: https://github.com/mogest/simple_google_auth
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -88,18 +88,17 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Super simple Google authentication for your Rails site
 test_files:
-- spec/spec_helper.rb
-- spec/simple_google_auth/http_client_spec.rb
-- spec/simple_google_auth/config_spec.rb
 - spec/simple_google_auth/auth_data_presenter_spec.rb
-- spec/simple_google_auth/oauth_spec.rb
-- spec/simple_google_auth/receiver_spec.rb
 - spec/simple_google_auth/authorization_uri_builder_spec.rb
+- spec/simple_google_auth/config_spec.rb
 - spec/simple_google_auth/controller_spec.rb
+- spec/simple_google_auth/http_client_spec.rb
+- spec/simple_google_auth/oauth_spec.rb
+- spec/simple_google_auth/receiver_spec.rb
 - spec/simple_google_auth_spec.rb
+- spec/spec_helper.rb