sinatra-cors 0.2.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: ff5b1f839cff23f60932ac3e449d8f429550dcae
-  data.tar.gz: 618991731d2f808e37b028bb884fc59a275e02d5
+SHA256:
+  metadata.gz: 99b095a00fa82a4c2cdfe85bdb60179e5869cd1937cffbe109d699547be45b57
+  data.tar.gz: d150dc04b51d2af46cf5d45a8c97a2ef1502c75f79b3b209c50375416ad2cc5b
 SHA512:
-  metadata.gz: 5a7f3ae81a92f2beb2b1b8c28bdfdd9d787b9fbb4c86030e4cbec0bdc9d89d06e7d0aeef1749606717a566cb3d75195b02060f2d5995c273d6635667daf880a6
-  data.tar.gz: 5aa1f60d221502d4922e54cd08f24d43be12cd62236407e55ec1a678cb7feac3967eeb799e695e83a7bb00f0f9d3e674618c4f805597cfc9c2580f1ae733cd2b
+  metadata.gz: 6e0ac7acb9160da93efa2e7d354fa3660af188de53279c964e605654d9750e51270c6c5f1febf7d083c126e1d1ae502ffb6d86be8685321dd580eaa340091e14
+  data.tar.gz: df317fc37d8ac9ead35addd46ece5ef59ca3261fc61078e0b10ad74b0cf784644f71030cf058d6314f02e8efe8c747e3176439e92ac3e4a2a748cb6ff5cbbe64

data/lib/sinatra/cors.rb

@@ -5,6 +5,11 @@ module Sinatra
     module Helpers
       def cors
         if is_cors_request?
+          unless origin_is_allowed?
+            logger.warn bad_origin_message
+            return
+          end
+
           if is_preflight_request?
             unless method_is_allowed?
               logger.warn bad_method_message
@@ -16,19 +21,14 @@ module Sinatra
               return
             end
 
-            response.headers["Access-Control-Allow-Headers"] = request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"]
-            response.headers["Access-Control-Allow-Methods"] = request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"]
+            response.headers["Access-Control-Allow-Headers"] = request_headers if request_headers
+            response.headers["Access-Control-Allow-Methods"] = request_method
             response.headers["Access-Control-Max-Age"] = settings.max_age if settings.max_age?
           else
             response.headers["Access-Control-Expose-Headers"] = settings.expose_headers if settings.expose_headers?
           end
 
-          if origin_is_allowed?
-            response.headers["Access-Control-Allow-Origin"] = request.env["HTTP_ORIGIN"]
-          else
-            logger.warn bad_origin_message
-            response.headers["Access-Control-Allow-Origin"] = "null"
-          end
+          response.headers["Access-Control-Allow-Origin"] = request.env["HTTP_ORIGIN"]
           response.headers["Access-Control-Allow-Credentials"] = settings.allow_credentials.to_s if settings.allow_credentials?
         end
       end
@@ -42,19 +42,52 @@ module Sinatra
       end
 
       def method_is_allowed?
-        allow_methods = settings.allow_methods.split & response.headers["Allow"].split
-        request_method = request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"]
-        allow_methods.include? request_method
+        allow_methods =
+          settings.allow_methods.upcase.split(/\s*,\s*/) &
+          response.headers["Allow"].upcase.split(/\s*,\s*/)
+        allow_methods.include? request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"].upcase
       end
 
       def headers_are_allowed?
         allow_headers = settings.allow_headers
         request_headers = request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"] || ""
-        (request_headers.split - allow_headers.split).empty?
+        (request_headers.downcase.split(/\s*,\s*/) - allow_headers.downcase.split(/\s*,\s*/)).empty?
       end
 
       def origin_is_allowed?
-        settings.allow_origin == "*" || settings.allow_origin.split.include?(request.env["HTTP_ORIGIN"])
+        request_origin = request.env["HTTP_ORIGIN"]
+
+        settings.allow_origin == "*" || [settings.allow_origin]
+          .flatten
+          .flat_map { |origin| origin.is_a?(String) ? origin.downcase.split : origin }
+          .any? do |origin|
+            if origin.is_a?(Regexp)
+              origin.match?(request_origin)
+            else
+              origin.eql?(request_origin)
+            end
+          end
+      end
+
+      def allowed_methods
+        matches = []
+        settings.routes.each do |method, routes|
+          routes.each do |route|
+            process_route(route[0], route[1]) do |application, pattern|
+              matches << method
+            end
+          end
+        end
+
+        matches.uniq
+      end
+
+      def request_headers
+        request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"]
+      end
+
+      def request_method
+        request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"]
       end
 
       private
@@ -74,7 +107,10 @@ to requests with these headers, you can add them to the `allow_headers` sinatra
       end
 
       def bad_origin_message
-        "This CORS request was rejected because the client is making the request from '#{request.env["HTTP_ORIGIN"]}', but the server only allows requests from '#{settings.allow_origin}'.  To allow the server to respond to requests from this origin, you can add it to the `allow_origin` sinatra setting."
+        "This CORS request was rejected because the client is making the request from \
+'#{request.env["HTTP_ORIGIN"]}', but the server only allows requests from '#{settings.allow_origin}'.  \
+To allow the server to respond to requests from this origin, you can add it to the `allow_origin` \
+sinatra setting."
       end
     end
 
@@ -93,18 +129,11 @@ to requests with these headers, you can add them to the `allow_headers` sinatra
       end
 
       app.options "*", is_cors_preflight: true do
-        matches = []
-        settings.routes.each do |method, routes|
-          routes.each do |route|
-            process_route(route[0], route[1], route[2]) do |application, pattern|
-              matches << method
-            end
-          end
-        end
+        allow = allowed_methods
 
-        pass if matches.size == 1
+        pass if allow.size == 1
 
-        response.headers["Allow"] = matches.join " "
+        response.headers["Allow"] = allow.join ","
       end
 
       app.after do
@@ -112,4 +141,6 @@ to requests with these headers, you can add them to the `allow_headers` sinatra
       end
     end
   end
+
+  register Cors
 end

metadata

@@ -1,21 +1,21 @@
 --- !ruby/object:Gem::Specification
 name: sinatra-cors
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Jason Desrosiers
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-28 00:00:00.000000000 Z
+date: 2020-07-26 00:00:00.000000000 Z
 dependencies: []
 description: 'This Sinatra plugin supports the full CORS spec including automatic
   support for CORS preflight (OPTIONS) requests.  It uses CORS security best practices.  The
   plugin logs to the default logger to guide you in setting things up properly.  It
   will tell you why a CORS request failed and tell you how to fix it.
 
-'
+  '
 email: jdesrosi@gmail.com
 executables: []
 extensions: []
@@ -41,8 +41,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: CORS support for Sinatra applications