simple_google_auth 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8220475142931f00b726a976c242b8a1d5ff19f7f58d423697df36708be7eff4
-  data.tar.gz: d3a3d9717a687e19cd013c281b4215325f9843317df071601af8dcb087668cf6
+  metadata.gz: b0cddb7c5d88d861d18686ee5601d635e94f133d51863fbfe50f9aadf46c8664
+  data.tar.gz: 19728334ae4996d63a0547f3ec9637ee20234fc8083a95355b734b5358809c64
 SHA512:
-  metadata.gz: 01eb71b28da44db2653c853e06c927822458f085624e1b9aa82f039289bdc390297f1fbe379b1f0dd13c100c9fd076a37de133ecfae9177a67690cf0ad2b594b
-  data.tar.gz: 30bff27ae11a2b9e4e7f5781814b878233ea8db8f0965fd51bb08d2de1b6413f39f97292d018a97ae7b1aa70c351ad3512287aaa338bd2f9d39c3e8c74560b92
+  metadata.gz: 990eb2a0608217e84f01a2e5cfd5273773e758c64581930563cee30b38deae2f4becae0bf070f7edf2d3550d4b8e4ca10f793d7be144ef418f41ea8c915c21d6
+  data.tar.gz: 721625b234e2c0b937dca66e38bec0ce8ac5c087237d57a46831404112110f22f46e06934768c7bbb22837d829546a0868a06396d400fc37bda14049cf94e517

data/lib/simple_google_auth/receiver.rb

@@ -11,10 +11,11 @@ module SimpleGoogleAuth
       data = AuthDataPresenter.new(auth_data)
       raise Error, "Authentication failed" unless config.authenticate.call(data)
 
+      renew_session(request)
       request.session[config.data_session_key_name] = auth_data
 
       path = config.authentication_uri_state_path_extractor.call(request.session[config.state_session_key_name])
-      path = "/" if path.blank?
+      path = "/" unless safe_redirect_path?(path)
       [302, {"Location" => path}, [" "]]
 
     rescue Error => e
@@ -26,7 +27,9 @@ module SimpleGoogleAuth
 
     protected
     def ensure_params_are_correct(request, config)
-      if request.params["state"] != request.session[config.state_session_key_name]
+      expected_state = request.session[config.state_session_key_name]
+
+      if expected_state.blank? || !states_match?(request.params["state"], expected_state)
         raise Error, "Invalid state returned from Google"
       elsif request.params["error"]
         raise Error, "Authentication failed: #{request.params["error"]}"
@@ -34,5 +37,30 @@ module SimpleGoogleAuth
         raise Error, "No authentication code returned"
       end
     end
+
+    private
+
+    # Constant-time comparison so the CSRF state token isn't leaked via timing.
+    # A blank expected state is rejected by the caller before we get here.
+    def states_match?(actual, expected)
+      return false if actual.nil?
+      ActiveSupport::SecurityUtils.secure_compare(actual.to_s, expected.to_s)
+    end
+
+    # Only redirect back to a path on our own host. A safe path starts with a
+    # single "/" that isn't followed by another "/" or "\" -- both of which a
+    # browser can resolve to a different origin ("//evil.com", "/\evil.com").
+    # Written as an allowlist so we don't have to chase every dangerous form.
+    def safe_redirect_path?(path)
+      path = path.to_s
+      path.start_with?("/") && !path.start_with?("//", "/\\")
+    end
+
+    # Rotate the session on successful login to defend against session fixation.
+    # No-op on session stores that don't expose options (e.g. in unit tests).
+    def renew_session(request)
+      session = request.session
+      session.options[:renew] = true if session.respond_to?(:options) && session.options
+    end
   end
 end

data/lib/simple_google_auth/version.rb

@@ -1,3 +1,3 @@
 module SimpleGoogleAuth
-  VERSION = "0.3.1"
+  VERSION = "0.3.2"
 end

data/spec/simple_google_auth/receiver_spec.rb

@@ -44,6 +44,18 @@ describe SimpleGoogleAuth::Receiver do
 
         expect(subject).to eq [302, {"Location" => "/place"}, [" "]]
       end
+
+      it "does not follow a protocol-relative redirect path (open redirect)" do
+        expect(authentication_uri_state_path_extractor).to receive(:call).with(state).and_return('//evil.com')
+
+        expect(subject).to eq [302, {"Location" => "/"}, [" "]]
+      end
+
+      it "does not follow a backslash-prefixed redirect path (open redirect)" do
+        expect(authentication_uri_state_path_extractor).to receive(:call).with(state).and_return('/\\evil.com')
+
+        expect(subject).to eq [302, {"Location" => "/"}, [" "]]
+      end
     end
 
     context "and the authenticator rejects the login" do
@@ -63,6 +75,15 @@ describe SimpleGoogleAuth::Receiver do
     end
   end
 
+  context "when the session holds no state and the callback omits it (forged callback)" do
+    let(:state) { nil }
+    let(:params) { {"code" => code} }
+
+    it "rejects the login rather than treating two blank states as a match" do
+      expect(subject).to eq [302, {"Location" => "/error?message=Invalid+state+returned+from+Google"}, [" "]]
+    end
+  end
+
   context "when the google authentication fails" do
     let(:params) { {"state" => state, "error" => "bad stuff"} }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: simple_google_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - Roger Nesbitt