sinatra-my-params 0.0.10 → 0.0.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8b53c81f8e6331c9f40d1b36cd45393132c6345478ae80132def61c44f5e6bd
-  data.tar.gz: d049d0ec154d84196d13ac5db1ffe7d07ca8926e8c9a8e84f1ae0d7707b9a79c
+  metadata.gz: 6b1f2c6fc4b59ce732264ff359866988b740c93b3dd585c43dcd57ee0834a8a1
+  data.tar.gz: b9f6692a739211d236c32b1658a66dd71b2f0e4e40ecb22010d63031bc7c03a8
 SHA512:
-  metadata.gz: c424f3ff45c18ada07d4e9377177793849c665ae69b6198ab1742c533b3c1dc647ff302b69e987e1d10caa87024787fa9197c940807e8c2367e54db9a31f1661
-  data.tar.gz: 4ea6c14c51e42bc649ad6251503173a9765188f3281bd7c56e3cd7aa2bb8aa62dc2c0e24b2fb8560c0fe06ed6868ad60675b0ea34c3462bae4cb520823250309
+  metadata.gz: 906f99e74e6bede4cbf4ee24dbf281a08d1c4c0856ea18a2434e445c01f0f028aa5b165e8a3219716043b4be82141744e2a10894b5aada1f677c9e0960d504cc
+  data.tar.gz: a07cdd0764f4f0c39bf83c17aca176204d9469ebc2583bbba7804a12d55f3fc60e8f07896536df5a7fc4f8961082ed91d05e1da8e9a9a9a2cb05ecd8bcc0557c

data/lib/permit_params.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require 'date'
+require 'time'
+
 module PermitParams
   class InvalidParameterError < StandardError
     attr_accessor :param, :options
@@ -8,7 +11,7 @@ module PermitParams
   def permitted_params(params, permitted = {}, strong_validation = false, options = {})
     return params if permitted.empty?
 
-    coerced_params = Hash.new({})
+    coerced_params = {}
 
     params.each do |key, value|
       next unless permitted?(permitted: permitted, key: key, value: value)
@@ -30,6 +33,14 @@ module PermitParams
   Any = :any
   Shape = :shape
 
+  # Mirrors the fix Ruby itself shipped for CVE-2021-41817 (ReDoS in
+  # Date/Time/DateTime parsing methods): never hand an unbounded,
+  # attacker-controlled string to a parser that uses backtracking regexes.
+  PARSE_LENGTH_LIMIT = 128
+
+  DATE_TIME_TYPES = [Date, Time, DateTime].freeze
+  NUMERIC_PARSE_TYPES = [Integer, Float].freeze
+
   def permitted?(permitted:, key:, value:)
     permitted.keys.map(&:to_s).include?(key.to_s) && !value.nil?
   end
@@ -44,6 +55,11 @@ module PermitParams
       rescue StandardError
         false
       end
+
+      if param.is_a?(String) && (DATE_TIME_TYPES.include?(type) || NUMERIC_PARSE_TYPES.include?(type))
+        raise ArgumentError, "'#{type}' input exceeds #{PARSE_LENGTH_LIMIT} bytes" if param.bytesize > PARSE_LENGTH_LIMIT
+      end
+
       return coerce_integer(param, options) if type == Integer
       return Float(param) if type == Float
       return String(param) if type == String
@@ -56,8 +72,14 @@ module PermitParams
       return coerce_boolean(param) if [TrueClass, FalseClass, Boolean].include? type
 
       nil
-    rescue ArgumentError
+    rescue StandardError
+      # Any failure while coercing untrusted input (malformed value,
+      # unexpected nested shape, missing stdlib constant, etc.) must never
+      # crash the caller's request handler - it's either rejected loudly
+      # (strong_validation) or dropped silently, same as an invalid value.
       raise InvalidParameterError, "'#{param}' is not a valid #{type}" if strong_validation
+
+      nil
     end
   end
 
@@ -88,10 +110,13 @@ module PermitParams
   end
 
   def coerce_boolean(param)
-    coerced = if /^(false|f|no|n|0)$/i === param.to_s
+    # \A/\z (not ^/$) anchor to the start/end of the *whole string*. In Ruby
+    # ^ and $ only anchor to line boundaries, so e.g. "true\nDROP TABLE..."
+    # would incorrectly match as a clean boolean with ^/$.
+    coerced = if /\A(false|f|no|n|0)\z/i === param.to_s
                 false
               else
-                /^(true|t|yes|y|1)$/i === param.to_s ? true : nil
+                /\A(true|t|yes|y|1)\z/i === param.to_s ? true : nil
               end
     raise ArgumentError if coerced.nil?
 
@@ -109,11 +134,18 @@ module PermitParams
   end
 
   def coerce_shape(param, options = {})
-    hash = coerce_hash(param)
+    hash = coerce_hash(param, options)
     has_shape?(hash, options[:shape]) ? hash : nil
   end
 
   def has_shape?(hash, shape)
+    # `hash` can be nil (coerce_hash gave up on a malformed string) and
+    # `shape` can be nil/non-Hash (caller forgot to pass shape:, or an
+    # attacker sent an unexpected nested hash the shape never described).
+    # Either used to raise NoMethodError deep inside a supposedly "safe"
+    # input filter, crashing the whole request. Reject instead of raising.
+    return false unless hash.is_a?(Hash) && shape.is_a?(Hash)
+
     hash.all? do |k, v|
       v.is_a?(Hash) ? has_shape?(v, shape[k]) : shape[k] === v
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sinatra-my-params
 version: !ruby/object:Gem::Version
-  version: 0.0.10
+  version: 0.0.11
 platform: ruby
 authors:
 - Marco Aviles
@@ -39,7 +39,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 3
 summary: permit_params!