sinatra-my-params 0.0.9 → 0.0.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8391c458014310cc388fc93e899320baa879567e50ca8cb875e3a19e20ae5984
-  data.tar.gz: a928880e81d7f1cfb6d91d2da10347398f8eca11b85bf808eca3c12af8f7a675
+  metadata.gz: 6b1f2c6fc4b59ce732264ff359866988b740c93b3dd585c43dcd57ee0834a8a1
+  data.tar.gz: b9f6692a739211d236c32b1658a66dd71b2f0e4e40ecb22010d63031bc7c03a8
 SHA512:
-  metadata.gz: c18faa501799088dcf64962e616789b38a78176f4b0fdfc3b0c123e157b3f799ee7638243d6fb522ab55de945d296206d0c71e46436c4ff30444e5ee95ba8300
-  data.tar.gz: 257127aa4473a46ee13031cef5251f9b94cbb7195444130e0cb6011fc25376bab83a09e52a5c5b03c1e2e02e7a923d3fe942702c88370b65824b3ecf87fb3a11
+  metadata.gz: 906f99e74e6bede4cbf4ee24dbf281a08d1c4c0856ea18a2434e445c01f0f028aa5b165e8a3219716043b4be82141744e2a10894b5aada1f677c9e0960d504cc
+  data.tar.gz: a07cdd0764f4f0c39bf83c17aca176204d9469ebc2583bbba7804a12d55f3fc60e8f07896536df5a7fc4f8961082ed91d05e1da8e9a9a9a2cb05ecd8bcc0557c

data/lib/permit_params.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require 'date'
+require 'time'
+
 module PermitParams
   class InvalidParameterError < StandardError
     attr_accessor :param, :options
@@ -8,7 +11,7 @@ module PermitParams
   def permitted_params(params, permitted = {}, strong_validation = false, options = {})
     return params if permitted.empty?
 
-    coerced_params = Hash.new({})
+    coerced_params = {}
 
     params.each do |key, value|
       next unless permitted?(permitted: permitted, key: key, value: value)
@@ -30,6 +33,14 @@ module PermitParams
   Any = :any
   Shape = :shape
 
+  # Mirrors the fix Ruby itself shipped for CVE-2021-41817 (ReDoS in
+  # Date/Time/DateTime parsing methods): never hand an unbounded,
+  # attacker-controlled string to a parser that uses backtracking regexes.
+  PARSE_LENGTH_LIMIT = 128
+
+  DATE_TIME_TYPES = [Date, Time, DateTime].freeze
+  NUMERIC_PARSE_TYPES = [Integer, Float].freeze
+
   def permitted?(permitted:, key:, value:)
     permitted.keys.map(&:to_s).include?(key.to_s) && !value.nil?
   end
@@ -44,6 +55,11 @@ module PermitParams
       rescue StandardError
         false
       end
+
+      if param.is_a?(String) && (DATE_TIME_TYPES.include?(type) || NUMERIC_PARSE_TYPES.include?(type))
+        raise ArgumentError, "'#{type}' input exceeds #{PARSE_LENGTH_LIMIT} bytes" if param.bytesize > PARSE_LENGTH_LIMIT
+      end
+
       return coerce_integer(param, options) if type == Integer
       return Float(param) if type == Float
       return String(param) if type == String
@@ -56,8 +72,14 @@ module PermitParams
       return coerce_boolean(param) if [TrueClass, FalseClass, Boolean].include? type
 
       nil
-    rescue ArgumentError
+    rescue StandardError
+      # Any failure while coercing untrusted input (malformed value,
+      # unexpected nested shape, missing stdlib constant, etc.) must never
+      # crash the caller's request handler - it's either rejected loudly
+      # (strong_validation) or dropped silently, same as an invalid value.
       raise InvalidParameterError, "'#{param}' is not a valid #{type}" if strong_validation
+
+      nil
     end
   end
 
@@ -66,35 +88,64 @@ module PermitParams
   end
 
   def coerce_array(param, options = {})
-    Array(param.split(options[:delimiter] || ',').map(&:strip))
+    delimiter = valid_delimiter?(param, options[:delimiter])
+    return unless delimiter
+
+    Array(param.split(delimiter).map(&:strip))
   end
 
   def coerce_hash(param, options = {})
     return param if param.is_a?(Hash)
 
-    key_value = param.split(options[:delimiter] || ',').map(&:strip).map do |c|
-      c.split(options[:separator] || ':').map(&:strip)
+    delimiter =  valid_delimiter?(param, options[:delimiter])
+    return unless delimiter
+
+    separator = valid_separator?(param, options[:separator])
+    return unless separator
+
+    key_value = param.split(delimiter).map(&:strip).map do |c|
+      c.split(separator).map(&:strip)
     end
     Hash[key_value]
   end
 
   def coerce_boolean(param)
-    coerced = if /^(false|f|no|n|0)$/i === param.to_s
+    # \A/\z (not ^/$) anchor to the start/end of the *whole string*. In Ruby
+    # ^ and $ only anchor to line boundaries, so e.g. "true\nDROP TABLE..."
+    # would incorrectly match as a clean boolean with ^/$.
+    coerced = if /\A(false|f|no|n|0)\z/i === param.to_s
                 false
               else
-                /^(true|t|yes|y|1)$/i === param.to_s ? true : nil
+                /\A(true|t|yes|y|1)\z/i === param.to_s ? true : nil
               end
     raise ArgumentError if coerced.nil?
 
     coerced
   end
 
+  def valid_delimiter?(param, delimiter)
+    delimiter ||= ','
+    delimiter if delimiter && param.include?(delimiter)
+  end
+
+  def valid_separator?(param, separator)
+    separator ||= ':'
+    separator if separator && param.include?(separator)
+  end
+
   def coerce_shape(param, options = {})
-    hash = coerce_hash(param)
+    hash = coerce_hash(param, options)
     has_shape?(hash, options[:shape]) ? hash : nil
   end
 
   def has_shape?(hash, shape)
+    # `hash` can be nil (coerce_hash gave up on a malformed string) and
+    # `shape` can be nil/non-Hash (caller forgot to pass shape:, or an
+    # attacker sent an unexpected nested hash the shape never described).
+    # Either used to raise NoMethodError deep inside a supposedly "safe"
+    # input filter, crashing the whole request. Reject instead of raising.
+    return false unless hash.is_a?(Hash) && shape.is_a?(Hash)
+
     hash.all? do |k, v|
       v.is_a?(Hash) ? has_shape?(v, shape[k]) : shape[k] === v
     end

data/spec/permit_params_shape_spec.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'test/unit'
+require 'permit_params'
+require 'rspec'
+require 'rack/test'
+
+include PermitParams
+
+describe 'shape behaviours' do
+  it 'should return a hash when a pemitted is of shape' do
+    input = { param: { a: 1, b: 2 } }
+    expect(input).to eq permitted_params(
+      input,
+      { param: Shape },
+      false,
+      { shape: { a: Integer, b: Integer } }
+    )
+  end
+
+  it 'should return a hash when a pemitted is of Integer shape(deep)' do
+    input = { param: { a: { b: 2 } } }
+    expect(input).to eq permitted_params(
+      input,
+      { param: Shape },
+      false,
+      { shape: { a: { b: Integer } } }
+    )
+  end
+
+  it 'should return a hash when a pemitted is of Array shape(deep)' do
+    input = { param: { a: { b: [1, 2] } } }
+    expect(input).to eq permitted_params(
+      input,
+      { param: Shape },
+      false,
+      { shape: { a: { b: Array } } }
+    )
+  end
+
+  it 'should return a empty object when a pemitted is shape not defined' do
+    input = { param: { a: 1, b: 2 } }
+    expect({}).to eq permitted_params(
+      input,
+      { param: Shape },
+      false,
+      { shape: { a: Integer } }
+    )
+  end
+end

data/spec/permit_params_spec.rb

@@ -7,140 +7,128 @@ require 'rack/test'
 
 include PermitParams
 
-describe 'exceptions' do
+describe 'behaviours' do
   it 'should raise error when at least one param is invalid' do
-    input = { param_1: 'a' }
+    input = { param: 'a' }
     expect  do
-      permitted_params(input, { param_1: Integer }, true)
+      permitted_params(input, { param: Integer }, true)
     end.to raise_error(InvalidParameterError, "'a' is not a valid Integer")
   end
 
   it 'should allow all params when no restriction is given' do
-    input = { param_1: 'a string' }
+    input = { param: 'a string' }
     expect(input).to eq permitted_params(input)
   end
 
-  it 'should remove a string when a pemitted is integer' do
-    input = { param_1: 'a string' }
+  it 'should remove a string when permitted param is integer' do
+    input = { param: 'a string' }
     output = {}
-    expect(output).to eq permitted_params(input, { param_1: Integer })
+    expect(output).to eq permitted_params(input, { param: Integer })
   end
 
-  it 'should return an integer when a pemitted is integer' do
-    input = { param_1: 1 }
-    expect(input).to eq permitted_params(input, { param_1: Integer })
+  it 'should return an integer when permitted param is integer' do
+    input = { param: 1 }
+    expect(input).to eq permitted_params(input, { param: Integer })
   end
 
-  it 'should return an integer when a pemitted can be cast into integer' do
-    input = { param_1: '1' }
-    output = { param_1: 1 }
-    expect(output).to eq permitted_params(input, { param_1: Integer })
+  it 'should return an integer when permitted param can be cast into integer' do
+    input = { param: '1' }
+    output = { param: 1 }
+    expect(output).to eq permitted_params(input, { param: Integer })
   end
 
-  it 'should return a string when a pemitted is string' do
-    input = { param_1: 'a string' }
-    expect(input).to eq permitted_params(input, { param_1: String })
+  it 'should return a string when permitted param is string' do
+    input = { param: 'a string' }
+    expect(input).to eq permitted_params(input, { param: String })
   end
 
-  it 'should return a float when a pemitted is float' do
-    input = { param_1: 10.0 }
-    expect(input).to eq permitted_params(input, { param_1: Float })
+  it 'should return a float when permitted param is float' do
+    input = { param: 10.0 }
+    expect(input).to eq permitted_params(input, { param: Float })
   end
 
-  it 'should return a date when a pemitted is date' do
-    input = { param_1: Date.new }
-    expect(input).to eq permitted_params(input, { param_1: Date })
+  it 'should return a date when permitted param is date' do
+    input = { param: Date.new }
+    expect(input).to eq permitted_params(input, { param: Date })
   end
 
-  it 'should return a time when a pemitted is time' do
-    input = { param_1: Time.new }
-    expect(input).to eq permitted_params(input, { param_1: Time })
+  it 'should return a time when permitted param is time' do
+    input = { param: Time.new }
+    expect(input).to eq permitted_params(input, { param: Time })
   end
 
-  it 'should return a false(boolean) when a pemitted is boolean' do
-    input = { param_1: 'false' }
-    output = { param_1: false }
-    expect(output).to eq permitted_params(input, { param_1: Boolean })
+  it 'should return a false(boolean) when permitted param is boolean' do
+    input = { param: 'false' }
+    output = { param: false }
+    expect(output).to eq permitted_params(input, { param: Boolean })
   end
 
-  it 'should return a true(boolean) when a pemitted is boolean' do
-    input = { param_1: 'true' }
-    output = { param_1: true }
-    expect(output).to eq permitted_params(input, { param_1: Boolean })
+  it 'should return a true(boolean) when permitted param is boolean' do
+    input = { param: 'true' }
+    output = { param: true }
+    expect(output).to eq permitted_params(input, { param: Boolean })
   end
 
-  it 'should return an array when a pemitted is array' do
-    input = { param_1: [1, 2] }
-    expect(input).to eq permitted_params(input, { param_1: Array })
+  it 'should return an array when permitted param is array' do
+    input = { param: [1, 2] }
+    expect(input).to eq permitted_params(input, { param: Array })
   end
 
-  it 'should return an array when a pemitted is array' do
-    input = { param_1: '1, 2' }
-    output = { param_1: %w[1 2] }
-    expect(output).to eq permitted_params(input, { param_1: Array })
+  it 'should return an array when permitted param is array' do
+    input = { param: '1, 2' }
+    output = { param: %w[1 2] }
+    expect(output).to eq permitted_params(input, { param: Array })
   end
 
-  it 'should return an array when a pemitted is array' do
-    input = { param_1: '1; 2' }
-    output = { param_1: %w[1 2] }
-    expect(output).to eq permitted_params(input, { param_1: Array }, false, { delimiter: ';' })
+  it 'should return an array when permitted param is array' do
+    input = { param: '1; 2' }
+    output = { param: %w[1 2] }
+    expect(output).to eq permitted_params(input, { param: Array }, false, { delimiter: ';' })
   end
 
-  it 'should return a hash when a pemitted is hash' do
-    input = { param_1: 'a: 1, b: 2' }
-    output = { param_1: { 'a' => '1', 'b' => '2' } }
-    expect(output).to eq permitted_params(input, { param_1: Hash })
+  it 'should return an empty hash when permitted param is array with wrong delimiter' do
+    input = { param: '1; 2' }
+    output = {}
+    expect(output).to eq permitted_params(input, { param: Array }, false, { delimiter: ',' })
   end
 
-  it 'should return a hash when a pemitted is hash' do
-    input = { param_1: 'a: 1; b: 2' }
-    output = { param_1: { 'a' => '1', 'b' => '2' } }
-    expect(output).to eq permitted_params(input, { param_1: Hash }, false, { delimiter: ';' })
+  it 'should return a hash when permitted param is hash' do
+    input = { param: 'a: 1, b: 2' }
+    output = { param: { 'a' => '1', 'b' => '2' } }
+    expect(output).to eq permitted_params(input, { param: Hash })
   end
 
-  it 'should return a hash when a pemitted is hash' do
-    input = { param_1: { a: 1 } }
-    expect(input).to eq permitted_params(input, { param_1: Hash })
+  it 'should return a hash when permitted param is hash' do
+    input = { param: 'a: 1; b: 2' }
+    output = { param: { 'a' => '1', 'b' => '2' } }
+    expect(output).to eq permitted_params(input, { param: Hash }, false, { delimiter: ';' })
   end
 
-  it 'should return a hash when a pemitted is shape' do
-    input = { param_1: { a: 1, b: 2 } }
-    expect(input).to eq permitted_params(
-      input,
-      { param_1: Shape },
-      false,
-      { shape: { a: Integer, b: Integer } }
-    )
+  it 'should return an empty hash when permitted param is hash with wrong separator' do
+    input = { param: 'a: 1; b: 2' }
+    output = {}
+    expect(output).to eq permitted_params(input, { param: Hash }, false, { separator: '.' })
   end
 
-  it 'should return a hash when a pemitted is shape(deep)' do
-    input = { param_1: { a: { b: 2 } } }
-    expect(input).to eq permitted_params(
-      input,
-      { param_1: Shape },
-      false,
-      { shape: { a: { b: Integer } } }
-    )
+  it 'should return an empty hash when permitted param is hash with wrong delimiter' do
+    input = { param: 'a: 1; b: 2' }
+    output = {}
+    expect(output).to eq permitted_params(input, { param: Hash }, false, { delimiter: ',' })
   end
 
-  it 'should return a empty when a pemitted is shape not defined' do
-    input = { param_1: { a: 1, b: 2 } }
-    expect({}).to eq permitted_params(
-      input,
-      { param_1: Shape },
-      false,
-      { shape: { a: Integer } }
-    )
+  it 'should return a hash when permitted param is hash' do
+    input = { param: { a: 1 } }
+    expect(input).to eq permitted_params(input, { param: Hash })
   end
 
-  it 'should return a hash when a pemitted is hash' do
-    input = { param_1: { a: { b: 1 } } }
-    expect(input).to eq permitted_params(input, { param_1: Hash })
+  it 'should return a hash when permitted param is hash' do
+    input = { param: { a: { b: 1 } } }
+    expect(input).to eq permitted_params(input, { param: Hash })
   end
 
-  it 'should return a hash when a pemitted is hash' do
-    input = { param_1: { "a": 1 } }
-    expect(input).to eq permitted_params(input, { param_1: Hash })
+  it 'should return a hash when permitted param is hash' do
+    input = { param: { "a": 1 } }
+    expect(input).to eq permitted_params(input, { param: Hash })
   end
 
   it 'should return a several types for several inputs' do
@@ -167,21 +155,21 @@ describe 'exceptions' do
       end
     end
 
-    input = { param_1: '1' }
-    output = { param_1: '1' }
-    expect(output).to eq permitted_params(input, { param_1: Any })
+    input = { param: '1' }
+    output = { param: '1' }
+    expect(output).to eq permitted_params(input, { param: Any })
 
     input = {
-      param_1: TestClass.new(some_attribute: 'a string')
+      param: TestClass.new(some_attribute: 'a string')
     }
-    output = permitted_params(input, { param_1: Any })
-    expect(input[:param_1].some_attribute).to eq output[:param_1].some_attribute
+    output = permitted_params(input, { param: Any })
+    expect(input[:param].some_attribute).to eq output[:param].some_attribute
 
     input = {
-      param_1: TestClass.new(some_attribute: 1),
-      param_2: 2
+      param: TestClass.new(some_attribute: 1),
+      antoher_param: 2
     }
-    output = permitted_params(input, { param_1: Any })
-    expect(input[:param_1].some_attribute).to eq output[:param_1].some_attribute
+    output = permitted_params(input, { param: Any })
+    expect(input[:param].some_attribute).to eq output[:param].some_attribute
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sinatra-my-params
 version: !ruby/object:Gem::Version
-  version: 0.0.9
+  version: 0.0.11
 platform: ruby
 authors:
 - Marco Aviles
@@ -10,7 +10,7 @@ bindir: bin
 cert_chain: []
 date: 2021-09-19 00:00:00.000000000 Z
 dependencies: []
-description: A simple params sanitizer(originally created for sinatra)
+description: A simple params sanitizer (originally created for sinatra)
 email: gdmarav374@gmail.com
 executables: []
 extensions: []
@@ -19,6 +19,7 @@ files:
 - Rakefile
 - bin/permit_params
 - lib/permit_params.rb
+- spec/permit_params_shape_spec.rb
 - spec/permit_params_spec.rb
 homepage: https://github.com/mhero/sinatra-my-params
 licenses: []
@@ -38,9 +39,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 3
 summary: permit_params!
 test_files:
 - spec/permit_params_spec.rb
+- spec/permit_params_shape_spec.rb