simple_oauth 1.0.2 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c80dd2b6480173dc8278a8b927f6b25929bddb430a72e152abbd29c8cae4c4da
-  data.tar.gz: ac11a3c3e75fb0d1eb7964d25e5f53b002b334e27273e9e6428b5a6b9226481f
+  metadata.gz: '085f7b377ecba7e5a389e1fa122341ca4c5b517b65cf77ac41d4e69c6f3ac2d0'
+  data.tar.gz: d38ee1bd5f40c23c29182df41d687f6eee8bb04004b9aee9152ed04b61e532bd
 SHA512:
-  metadata.gz: 7749f45d33c7f55a4186b9a744ea4119fe9d0ce1211ee26c89789887cad66f0a478dfddf4146e585044078adbaae82f548620794b71961a9da832cd8888ee5d3
-  data.tar.gz: bc81ed8ad865e68843a764e75fc04b06afa4cd441fb4b24a22406c8512ec844dfd01a975dde11ea88bf96f1d4679a96b23fbe63463db5735803193781d72c39c
+  metadata.gz: 111934cffa979ed69516a53f3dbe875e8f4ebc3dfb60890dd202019df92f267ae46cbcf8dd313c3241889548e05e026583e72ee455283635f0e06822a639d063
+  data.tar.gz: 267bbab778351538d6173534b4315ca9a953911cbc74c610f3c1395f9cbea6fc854ae9b274cfcaeb4ba62a58158d43232ad67f75fc745aeecc6246b79b4ab98d

data/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/2.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.4] - 2026-11-14
+
+### Changed
+
+- Look up a signature method by the name it was registered under without allocating, so signing a request allocates at least 4 fewer objects and verifying one at least 6 fewer. Verifying without a `signature_method` now allocates fewer objects than in 1.0.1
+
+## [0.5.4] - 2026-11-14
+
+### Changed
+
+- Look up a signature method by the name it was registered under without allocating, so signing a request allocates at least 4 fewer objects and verifying one at least 6 fewer. Verifying without a `signature_method` now allocates fewer objects than in 0.5.1
+
+## [1.0.3] - 2026-11-14
+
+### Fixed
+
+- Verify as fast as 1.0.1 when `Header#valid?` is not given a `signature_method`. 1.0.2 parsed the `consumer_secret` as an RSA key on every verification, which takes far longer to fail for a shared secret than verifying does, and parsed an RSA key twice. That made such a verification about 60 to 70 percent slower. Only a secret in PEM, or one that could be in DER, is now parsed, and an RSA key only once
+
+## [0.5.3] - 2026-11-14
+
+### Fixed
+
+- Verify as fast as 0.5.1 when `Header#valid?` is not given a `signature_method`. 0.5.2 parsed the `consumer_secret` as an RSA key on every verification, which takes far longer to fail for a shared secret than verifying does, and parsed an RSA key twice. That made such a verification about 60 to 70 percent slower. Only a secret in PEM, or one that could be in DER, is now parsed, and an RSA key only once
+
 ## [1.0.2] - 2026-11-14
 
 ### Security
@@ -18,6 +42,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Calling `Header#valid?` without a `signature_method`, which a later major version will require
 
+## [0.5.2] - 2026-11-14
+
+### Security
+
+- `Header#valid?` no longer verifies with whatever signature method the received header claims. A server verifying RSA signatures with a client's public key, as the README showed, accepted forged requests signed with that public key as an HMAC-SHA1 or PLAINTEXT secret. Reported by Rathnadeepan (HotWater, [@HotWater-015](https://github.com/HotWater-015))
+  - Given a `signature_method`, the header must claim that method
+  - Without one, the header must claim an RSA method for an RSA key and an HMAC method for any other secret
+  - PLAINTEXT signatures verify only when the caller names `PLAINTEXT`
+
+### Deprecated
+
+- Calling `Header#valid?` without a `signature_method`, which a later major version will require
+
 ## [1.0.1] - 2026-09-30
 
 ### Fixed
@@ -118,7 +155,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Avoid symbolizing untrusted input in parse methods for security
 - Refactored `Header.parse` for improved robustness using StringScanner
 
+[1.0.4]: https://github.com/laserlemon/simple_oauth/compare/v1.0.3...v1.0.4
+[0.5.4]: https://github.com/laserlemon/simple_oauth/compare/v0.5.3...v0.5.4
+[1.0.3]: https://github.com/laserlemon/simple_oauth/compare/v1.0.2...v1.0.3
+[0.5.3]: https://github.com/laserlemon/simple_oauth/compare/v0.5.2...v0.5.3
 [1.0.2]: https://github.com/laserlemon/simple_oauth/compare/v1.0.1...v1.0.2
+[0.5.2]: https://github.com/laserlemon/simple_oauth/compare/v0.5.1...v0.5.2
 [1.0.1]: https://github.com/laserlemon/simple_oauth/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/laserlemon/simple_oauth/compare/v0.5.1...v1.0.0
 [0.5.1]: https://github.com/laserlemon/simple_oauth/compare/v0.5.0...v0.5.1

data/lib/simple_oauth/header/verification.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module SimpleOAuth
+  class Header
+    # Checks of the signature method a received header claims, before it is verified with it
+    #
+    # @api private
+    module Verification
+      # The first byte of a key in DER, which encodes every key as an ASN.1 SEQUENCE
+      ASN1_SEQUENCE = 0x30
+
+      # The start of the line that opens every key in PEM
+      PEM_BOUNDARY = "-----BEGIN"
+
+      private
+
+      # Checks that the header claims a signature method the verifier accepts
+      #
+      # @api private
+      # @param verifying [Hash] the header's options merged with the verifier's secrets
+      # @param expected [String, nil] the signature method the verifier expects, if it names one
+      # @return [Boolean] true if the claimed method is the expected one, or fits the key
+      # @raise [ArgumentError] if the expected signature method is not registered
+      def signature_method_acceptable?(verifying, expected)
+        claimed = options[:signature_method].to_s
+        return expected_signature_method?(claimed, expected) if expected
+
+        warn("SimpleOAuth::Header#valid? without a signature_method is deprecated. " \
+             "Name the method to verify with, such as signature_method: \"HMAC-SHA1\"", category: :deprecated)
+        key = verifying[:consumer_secret].to_s
+        Signature.registered?(claimed) && !PLAINTEXT_SIGNATURE_METHOD.casecmp(claimed).eql?(0) &&
+          (Signature.rsa?(claimed) ? key_encoded?(key) : !rsa_key?(key))
+      end
+
+      # Checks that the header claims the signature method the verifier names
+      #
+      # Signature method names are compared without regard to ASCII case, as the registry looks
+      # them up, and without allocating. A header that claims the expected method needs no other
+      # check here, since Signature.verify raises for a method that is not registered.
+      #
+      # @api private
+      # @param claimed [String] the signature method the header claims
+      # @param expected [String] the signature method the verifier expects
+      # @return [Boolean] true if the header claims the expected method
+      # @raise [ArgumentError] if the expected signature method is not registered
+      def expected_signature_method?(claimed, expected)
+        return true if claimed.casecmp(expected).eql?(0)
+        raise ArgumentError, "Unknown signature method: #{expected}" unless Signature.registered?(expected)
+
+        false
+      end
+
+      # Checks whether a verifying key is encoded as a key could be
+      #
+      # Only a key in PEM, which always holds a "-----BEGIN" line, or in DER, which always starts with
+      # the byte of an ASN.1 SEQUENCE, can be an RSA key, as those are the encodings OpenSSL decodes.
+      # Any other secret need not be parsed, which matters since a parse that fails is far slower
+      # than verifying a signature.
+      #
+      # @api private
+      # @param key [String] the consumer_secret the verifier gave
+      # @return [Boolean] true if the key is in PEM or could be in DER
+      def key_encoded?(key)
+        key.getbyte(0).eql?(ASN1_SEQUENCE) || key.include?(PEM_BOUNDARY)
+      end
+
+      # Checks whether a verifying key is an RSA key
+      #
+      # @api private
+      # @param key [String] the consumer_secret the verifier gave
+      # @return [Boolean] true if the key parses as an RSA key
+      def rsa_key?(key)
+        return false unless key_encoded?(key)
+
+        OpenSSL::PKey::RSA.new(key)
+        true
+      rescue OpenSSL::PKey::PKeyError
+        false
+      end
+    end
+  end
+end

data/lib/simple_oauth/header.rb

@@ -7,6 +7,7 @@ require_relative "parser"
 require_relative "signature"
 require_relative "header/class_methods"
 require_relative "header/params"
+require_relative "header/verification"
 
 module SimpleOAuth
   # Generates OAuth 1.0 Authorization headers for HTTP requests
@@ -68,6 +69,7 @@ module SimpleOAuth
     attr_reader :options
 
     include Params
+    include Verification
 
     extend ClassMethods
     extend Encoding
@@ -147,9 +149,8 @@ module SimpleOAuth
     #   # => true
     def valid?(secrets = {})
       verifying = options.merge(secrets)
-      signature_method_acceptable?(verifying, secrets[:signature_method]) && body_hash_valid? &&
-        Signature.verify(options.fetch(:signature_method), signing_key(verifying), signature_base,
-          options.fetch(:signature))
+      expected = secrets[:signature_method]
+      signature_method_acceptable?(verifying, expected) && body_hash_valid? && signature_valid?(verifying, expected)
     end
 
     # Returns the OAuth attributes including the signature
@@ -231,47 +232,25 @@ module SimpleOAuth
       Signature.rsa?(options.fetch(:signature_method)) ? options[:consumer_secret] : secret(options)
     end
 
-    # Checks that the header claims a signature method the verifier accepts
+    # Verifies the signature with the method the header claims
+    #
+    # A header that claims an RSA method, with no signature_method named, is verified without first
+    # parsing the key to check that it is an RSA key, so the key is parsed once rather than twice. The verifier
+    # raises PKeyError only for a key that is not an RSA key, which makes the header not valid, as
+    # the key does not fit the method. A verifier that names a method keeps the error, since naming
+    # an RSA method with another key is a mistake to report.
     #
     # @api private
     # @param verifying [Hash] the header's options merged with the verifier's secrets
     # @param expected [String, nil] the signature method the verifier expects, if it names one
-    # @return [Boolean] true if the claimed method is the expected one, or fits the key
-    # @raise [ArgumentError] if the expected signature method is not registered
-    def signature_method_acceptable?(verifying, expected)
-      claimed = options[:signature_method].to_s
-      return expected_signature_method?(claimed, expected) if expected
-
-      warn("SimpleOAuth::Header#valid? without a signature_method is deprecated. " \
-           "Name the method to verify with, such as signature_method: \"HMAC-SHA1\"", category: :deprecated)
-      Signature.registered?(claimed) && !PLAINTEXT_SIGNATURE_METHOD.casecmp?(claimed) &&
-        Signature.rsa?(claimed).eql?(rsa_key?(verifying[:consumer_secret]))
-    end
-
-    # Checks that the header claims the signature method the verifier names
-    #
-    # Signature method names are compared without regard to case, as the registry looks them up.
-    #
-    # @api private
-    # @param claimed [String] the signature method the header claims
-    # @param expected [String] the signature method the verifier expects
-    # @return [Boolean] true if the header claims the expected method
-    # @raise [ArgumentError] if the expected signature method is not registered
-    def expected_signature_method?(claimed, expected)
-      raise ArgumentError, "Unknown signature method: #{expected}" unless Signature.registered?(expected)
-
-      claimed.casecmp?(expected)
-    end
-
-    # Checks whether a verifying key is an RSA key
-    #
-    # @api private
-    # @param key [String, nil] the consumer_secret the verifier gave
-    # @return [Boolean] true if the key parses as an RSA key
-    def rsa_key?(key)
-      OpenSSL::PKey::RSA.new(key.to_s)
-      true
+    # @return [Boolean] true if the signature is valid
+    # @raise [OpenSSL::PKey::PKeyError] if the verifier names an RSA method with a key that is not an RSA key
+    def signature_valid?(verifying, expected)
+      Signature.verify(options.fetch(:signature_method), signing_key(verifying), signature_base,
+        options.fetch(:signature))
     rescue OpenSSL::PKey::PKeyError
+      raise if expected
+
       false
     end
 

data/lib/simple_oauth/signature.rb

@@ -27,6 +27,10 @@ module SimpleOAuth
     # Registry of signature method implementations
     @registry = {}
 
+    # The registry key of each name a signature method was registered under, so a lookup by that
+    # name, as nearly every lookup is, needs no normalizing and allocates nothing
+    @names = {}
+
     class << self
       # Registers a custom signature method
       #
@@ -48,7 +52,9 @@ module SimpleOAuth
       #     )
       #   end
       def register(name, rsa: false, verify: nil, digest: DEFAULT_DIGEST, &block)
-        @registry[normalize_name(name)] = {implementation: block, rsa: rsa, verifier: verify, digest: digest}
+        key = normalize_name(name)
+        @names[name] = key
+        @registry[key] = {implementation: block, rsa: rsa, verifier: verify, digest: digest}
       end
 
       # Checks if a signature method is registered
@@ -59,7 +65,7 @@ module SimpleOAuth
       # @example
       #   SimpleOAuth::Signature.registered?("HMAC-SHA1") # => true
       def registered?(name)
-        @registry.key?(normalize_name(name))
+        @registry.key?(registry_key(name))
       end
 
       # Returns list of registered signature method names
@@ -139,7 +145,9 @@ module SimpleOAuth
       # @example
       #   SimpleOAuth::Signature.unregister("HMAC-SHA512")
       def unregister(name)
-        @registry.delete(normalize_name(name))
+        key = registry_key(name)
+        @names.delete_if { |_, registered| registered.eql?(key) }
+        @registry.delete(key)
       end
 
       # Resets the registry to only built-in methods (useful for testing)
@@ -150,6 +158,7 @@ module SimpleOAuth
       #   SimpleOAuth::Signature.reset!
       def reset!
         @registry.clear
+        @names.clear
         register_builtin_methods
       end
 
@@ -188,12 +197,25 @@ module SimpleOAuth
       # @return [Hash] the registry entry
       # @raise [ArgumentError] if the signature method is not registered
       def fetch(name)
-        @registry.fetch(normalize_name(name)) do
+        @registry.fetch(registry_key(name)) do
           raise ArgumentError, "Unknown signature method: #{name}. " \
                                "Registered methods: #{@registry.keys.join(", ")}"
         end
       end
 
+      # Finds the registry key for a signature method name
+      #
+      # A name a method was registered under is found in the index of those names. Any other
+      # spelling is normalized, without being added to the index, so names from received headers
+      # cannot grow it.
+      #
+      # @api private
+      # @param name [String] the signature method name
+      # @return [String] the registry key (lowercase, dashes to underscores)
+      def registry_key(name)
+        @names[name] || normalize_name(name)
+      end
+
       # Normalizes signature method name for registry lookup
       #
       # @api private

data/lib/simple_oauth/version.rb

@@ -3,5 +3,5 @@
 # OAuth 1.0 header generation library
 module SimpleOAuth
   # The current version of the SimpleOAuth gem
-  VERSION = "1.0.2"
+  VERSION = "1.0.4"
 end

data/sig/simple_oauth/header/verification.rbs

@@ -0,0 +1,28 @@
+module SimpleOAuth
+  class Header
+    # What the Verification module needs from the header that includes it
+    interface _Verifiable
+      def options: () -> Header::oauth_options
+    end
+
+    # Checks of the signature method a received header claims, before it is verified with it
+    module Verification : _Verifiable
+      # The first byte of a key in DER, which encodes every key as an ASN.1 SEQUENCE
+      ASN1_SEQUENCE: Integer
+
+      # The start of the line that opens every key in PEM
+      PEM_BOUNDARY: String
+
+      private
+
+      # Checks that the header claims a signature method the verifier accepts
+      def signature_method_acceptable?: (Header::oauth_options verifying, String? expected) -> bool
+      # Checks that the header claims the signature method the verifier names
+      def expected_signature_method?: (String claimed, String expected) -> bool
+      # Checks whether a verifying key is encoded as a key could be
+      def key_encoded?: (String key) -> bool
+      # Checks whether a verifying key is an RSA key
+      def rsa_key?: (String key) -> bool
+    end
+  end
+end

data/sig/simple_oauth/signature.rbs

@@ -19,6 +19,9 @@ module SimpleOAuth
     # Registry of signature method implementations (class-level instance variable)
     self.@registry: Hash[String, registry_entry]
 
+    # The registry key of each name a signature method was registered under
+    self.@names: Hash[String | Symbol, String]
+
     # Registers a custom signature method
     def self.register: (String | Symbol name, ?rsa: bool, ?verify: verifier_block?, ?digest: String) { (untyped, String) -> String } -> void
 
@@ -57,6 +60,9 @@ module SimpleOAuth
     # Looks up a registered signature method
     def self.fetch: (String | Symbol name) -> registry_entry
 
+    # Finds the registry key for a signature method name
+    def self.registry_key: (String | Symbol name) -> String
+
     # Normalizes signature method name for registry lookup
     def self.normalize_name: (String | Symbol name) -> String
 

data/sig/simple_oauth.rbs

@@ -65,6 +65,8 @@ module SimpleOAuth
     # The signature method that sends the secrets themselves, which verifying accepts only when named
     PLAINTEXT_SIGNATURE_METHOD: String
 
+
+
     # What from_request needs from a request object, such as a Net::HTTPRequest
     interface _Request
       def method: () -> String
@@ -98,6 +100,9 @@ module SimpleOAuth
     # Parameter and attribute normalization from the Params module
     include Params
 
+    # Checks of the signature method a received header claims
+    include Verification
+
     # Class methods from ClassMethods module
     extend ClassMethods
 
@@ -151,14 +156,8 @@ module SimpleOAuth
     # The key for signing and verifying
     def signing_key: (oauth_options options) -> String?
 
-    # Checks that the header claims a signature method the verifier accepts
-    def signature_method_acceptable?: (oauth_options verifying, String? expected) -> bool
-
-    # Checks that the header claims the signature method the verifier names
-    def expected_signature_method?: (String claimed, String expected) -> bool
-
-    # Checks whether a verifying key is an RSA key
-    def rsa_key?: (String? key) -> bool
+    # Verifies the signature with the method the header claims
+    def signature_valid?: (oauth_options verifying, String? expected) -> bool
 
     # Checks the body against the oauth_body_hash the header carries
     def body_hash_valid?: () -> bool

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: simple_oauth
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.4
 platform: ruby
 authors:
 - Steve Richert
@@ -32,6 +32,7 @@ files:
 - lib/simple_oauth/header.rb
 - lib/simple_oauth/header/class_methods.rb
 - lib/simple_oauth/header/params.rb
+- lib/simple_oauth/header/verification.rb
 - lib/simple_oauth/oauth2.rb
 - lib/simple_oauth/oauth2/authorization_response.rb
 - lib/simple_oauth/oauth2/client.rb
@@ -47,6 +48,7 @@ files:
 - sig/simple_oauth.rbs
 - sig/simple_oauth/header/class_methods.rbs
 - sig/simple_oauth/header/params.rbs
+- sig/simple_oauth/header/verification.rbs
 - sig/simple_oauth/oauth2.rbs
 - sig/simple_oauth/parser.rbs
 - sig/simple_oauth/signature.rbs