snuffleupagus 0.0.4 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 68e2db1fb837ccce5226567bc8ad644d001d4bdb
-  data.tar.gz: 6aa0a6f6360a55c75ed1bf1a8680e8c36743c27e
+SHA256:
+  metadata.gz: a5c80cc86ec5c07d58eb1fa6287556951aece8f295df96637b68158ccd2f45c4
+  data.tar.gz: 73727b009732dd19becd8b9de8445e1479d3e41613256965d18c468bf3d11328
 SHA512:
-  metadata.gz: f65cce422e5ed05068a9f8e72c723298d1b7cbd581201014a091bc86ec46a9975c6d19c55521bc9e2510b78f946c87d42c1788749b85430223775d5739b8ea42
-  data.tar.gz: abe49c714541338737ef2ca9a11f65b0a9d1c0a710d35c8e42b6b6e7d3963cf8486a89802fdea0bdcefba643b0a2a94848cfab949f7ff7f936563ae5b3f1cde3
+  metadata.gz: e415b78f8922d193d697206295901e9e17324c480c29451ebd4c5f9b891ab368bda214c4dd3be01cf3c2fe2226cdcad2506f6859f13f6a85f77b4ebf865e5098
+  data.tar.gz: c78c98c4e9e3f35dec5226e633ea305ee630ab2bb46a3ca237bec82f8ae056cb345c11628aa65010ab73a9a715747962213b6a6453e523e741cb1d8a1c3a4ab0

data/.gitignore

@@ -1 +1,2 @@
 *.gem
+Gemfile.lock

data/.rubocop.yml

@@ -1,3 +1,7 @@
+AllCops:
+  NewCops: enable
+  TargetRubyVersion: 2.5
+
 Metrics/BlockLength:
   Exclude:
     - 'spec/**/*'

data/.travis.yml

@@ -1,15 +1,13 @@
 language: ruby
 
 rvm:
-  - 2.0
-  - 2.1
-  - 2.2
-  - 2.3
-  - 2.4
   - 2.5
+  - 2.6
+  - 2.7
 
 install:
   - bundle install --retry=3
 
 script:
   - bundle exec rubocop
+  - bundle exec rake

data/CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog
+
+## Unreleased
+- none
+
+## [0.1.1](releases/tag/v0.1.1) - 2020-10-21
+### Added
+- Add context to the create/check token to avoid replay in different contexts
+
+## [0.0.9](releases/tag/v0.0.9) - 2020-03-01
+### Fixed
+- Address CVE-2020-8130 - rake OS command injection vulnerability
+
+## [0.0.8](releases/tag/v0.0.8) - 2018-03-01
+### Added
+- Rake to gemfile dev dependencies
+
+## [0.0.7](releases/tag/v0.0.7) - 2018-03-01
+### Fixed
+- Fix missing openssl require
+
+## [0.0.6](releases/tag/v0.0.6) - 2018-03-01
+### Fixed
+- Fix Rakefile execute permission
+### Removed
+- gibberish require
+- gemfile.lock file
+
+## [0.0.5](releases/tag/v0.0.5) - 2018-03-01
+### Fixed
+- Rakefile configuration
+
+## [0.0.4](releases/tag/v0.0.4) - 2018-03-01
+### Added
+- Initial Rakefile
+- Rspec and Rubocop
+- Travis CI configuration
+
+## [0.0.3](releases/tag/v0.0.3) - 2018-03-01
+### Removed
+- Dependency on Gibberish gem
+
+## [0.0.2](releases/tag/v0.0.2) - 2014-09-23
+### Updated
+- Token validity to 2 minutes …
+
+## [0.0.1](releases/tag/v0.0.1) - 2014-08-28
+### Added
+- Initial release

data/Gemfile

@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 source 'http://rubygems.org'
 gemspec

data/README.md

@@ -5,7 +5,7 @@ A little simple.. auth token generator
 
 Handles basic time-limited authentication token creation / validation
 
-Uses Gibberish::AES with 256 bit CBC encryption
+Uses OpenSSL AES with 256 bit CBC encryption
 
 ![Snuffy](/Snuffy.png "Snuffleupagus")
 
@@ -14,7 +14,7 @@ Uses Gibberish::AES with 256 bit CBC encryption
 Include it in your Gemfile:
 
 ```ruby
-gem 'snuffleupagus', :git => 'git@github.com:TutoringAustralasia/snuffleupagus.git'
+gem 'snuffleupagus'
 ```
 
 ## Basic Usage

data/Rakefile

@@ -1,3 +1,7 @@
+#!/usr/bin/env rake
+# frozen_string_literal: true
+
+require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 
 RSpec::Core::RakeTask.new(:spec)

data/lib/snuffleupagus.rb

@@ -1,3 +1,3 @@
-require 'gibberish'
+# frozen_string_literal: true
 
 require 'snuffleupagus/auth_token'

data/lib/snuffleupagus/auth_token.rb

@@ -1,3 +1,7 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
 module Snuffleupagus
   # Handles basic time-limited authentication token creation / validation
   #
@@ -20,18 +24,20 @@ module Snuffleupagus
   class AuthToken
     def initialize(key)
       @key = key
-      @cipher = OpenSSL::Cipher::AES256.new :CBC
+      @cipher = OpenSSL::Cipher.new('aes-256-cbc')
     end
 
-    def create_token
-      encode encrypt "#{CONSTANT}#{Time.now.to_i}"
+    def create_token(context)
+      encode encrypt "#{CONSTANT}#{context}#{Time.now.to_i}"
     end
 
-    def check_token(token)
-      return false unless token && token.is_a?(String)
+    def token_valid?(token, context)
+      return false unless token.is_a? String
+
       decoded = decrypt decode token
-      match = /^#{CONSTANT}([0-9]+)$/.match decoded
+      match = /\A#{CONSTANT}#{Regexp.escape(context)}([0-9]+)\z/.match decoded
       return false unless match
+
       (match[1].to_i - Time.now.to_i).abs < MAX_VALID_TIME_DIFFERENCE
     rescue StandardError
       false
@@ -39,7 +45,7 @@ module Snuffleupagus
 
     private
 
-    CONSTANT = 'date:'.freeze
+    CONSTANT = 'date:'
     MAX_VALID_TIME_DIFFERENCE = 120 # tokens are only valid for 2 minutes
 
     attr_reader :cipher
@@ -53,6 +59,7 @@ module Snuffleupagus
 
     def decrypt(data)
       raise ArgumentError, 'Data is too short' unless data.length >= 16
+
       salt = data[8..15]
       data = data[16..-1]
       setup_cipher(:decrypt, salt)

data/lib/snuffleupagus/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Snuffleupagus
-  VERSION = '0.0.4'.freeze
+  VERSION = '0.1.1'
 end

data/snuffleupagus.gemspec

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require File.expand_path('lib/snuffleupagus/version', File.dirname(__FILE__))
 
 Gem::Specification.new do |s|
@@ -6,13 +8,15 @@ Gem::Specification.new do |s|
   s.platform                  = Gem::Platform::RUBY
   s.authors                   = ['Andrew Bromwich']
   s.email                     = ['abromwich@studiosity.com']
-  s.homepage                  = 'https://studiosity.com'
+  s.homepage                  = 'https://github.com/Studiosity/snuffleupagus'
   s.description               = 'Simple auth token generator/validator'
   s.summary                   = "snuffleupagus-#{s.version}"
   s.required_rubygems_version = '> 1.3.6'
+  s.required_ruby_version     = ['>= 2.5.0', '< 2.8.0']
 
-  s.add_development_dependency 'rspec', '~> 0'
-  s.add_development_dependency 'rubocop', '~> 0'
+  s.add_development_dependency 'rake', '~> 12.3', '>= 12.3.3'
+  s.add_development_dependency 'rspec', '~> 3'
+  s.add_development_dependency 'rubocop', '~> 0.49'
   s.add_development_dependency 'timecop', '~> 0'
 
   s.files = `git ls-files`.split($OUTPUT_RECORD_SEPARATOR)

data/spec/snuffleupagus_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require './lib/snuffleupagus'
 require 'timecop'
 
@@ -5,58 +7,73 @@ describe Snuffleupagus::AuthToken do
   let(:snuffy) { Snuffleupagus::AuthToken.new('sup3r4w3s0m3p4ssw0rd') }
 
   describe '#create_token' do
-    subject { snuffy.create_token }
+    subject { snuffy.create_token 'my-context' }
 
     it { is_expected.to be_a String }
-    it { expect(subject.length).to eq 64 }
-    it { is_expected.to match(/\A[a-f0-9]{64}\z/) }
+    it { expect(subject.length).to eq 96 }
+    it { is_expected.to match(/\A[a-f0-9]{96}\z/) }
   end
 
-  describe '#check_token' do
-    subject { snuffy.check_token(token) }
+  describe '#token_valid?' do
+    subject { snuffy.token_valid?(token, 'my-context') }
 
     context 'with a valid token' do
-      let(:token) { snuffy.create_token }
+      let(:token) { snuffy.create_token 'my-context' }
+
       it { is_expected.to be_truthy }
     end
 
+    context 'when the context doesnt match' do
+      let(:token) { snuffy.create_token 'another-context' }
+
+      it { is_expected.to be_falsey }
+    end
+
     context 'with an invalid token' do
       let(:token) { 'F00B44' }
+
       it { is_expected.to be_falsey }
     end
 
     context 'with an empty token' do
       let(:token) { '' }
+
       it { is_expected.to be_falsey }
     end
 
     context 'with a nil token' do
       let(:token) { nil }
+
       it { is_expected.to be_falsey }
     end
 
     context 'testing expired tokens' do
-      let(:token) { snuffy.create_token }
+      let(:token) { snuffy.create_token 'my-context' }
+
       before { token } # pre-load the token
       after { Timecop.return }
 
       context 'just inside the time difference (expired token)' do
         before { Timecop.freeze Time.now - 119 }
+
         it { is_expected.to be_truthy }
       end
 
       context 'just outside the time difference (expired token)' do
         before { Timecop.freeze Time.now - 120 }
+
         it { is_expected.to be_falsey }
       end
 
       context 'just inside the time difference (future token)' do
         before { Timecop.freeze Time.now + 119 }
+
         it { is_expected.to be_truthy }
       end
 
       context 'just outside the time difference (future token)' do
         before { Timecop.freeze Time.now + 120 }
+
         it { is_expected.to be_falsey }
       end
     end

metadata

@@ -1,43 +1,63 @@
 --- !ruby/object:Gem::Specification
 name: snuffleupagus
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.1.1
 platform: ruby
 authors:
 - Andrew Bromwich
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-03-01 00:00:00.000000000 Z
+date: 2020-10-21 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 12.3.3
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.49'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.49'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
@@ -62,8 +82,8 @@ files:
 - ".gitignore"
 - ".rubocop.yml"
 - ".travis.yml"
+- CHANGELOG.md
 - Gemfile
-- Gemfile.lock
 - README.md
 - Rakefile
 - Snuffy.png
@@ -72,7 +92,7 @@ files:
 - lib/snuffleupagus/version.rb
 - snuffleupagus.gemspec
 - spec/snuffleupagus_spec.rb
-homepage: https://studiosity.com
+homepage: https://github.com/Studiosity/snuffleupagus
 licenses: []
 metadata: {}
 post_install_message: 
@@ -83,16 +103,18 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.5.0
+  - - "<"
+    - !ruby/object:Gem::Version
+      version: 2.8.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">"
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
-summary: snuffleupagus-0.0.4
+summary: snuffleupagus-0.1.1
 test_files: []

data/Gemfile.lock

@@ -1,50 +0,0 @@
-PATH
-  remote: .
-  specs:
-    snuffleupagus (0.0.3)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    ast (2.4.0)
-    diff-lcs (1.3)
-    parallel (1.12.1)
-    parser (2.5.0.2)
-      ast (~> 2.4.0)
-    powerpack (0.1.1)
-    rainbow (3.0.0)
-    rspec (3.7.0)
-      rspec-core (~> 3.7.0)
-      rspec-expectations (~> 3.7.0)
-      rspec-mocks (~> 3.7.0)
-    rspec-core (3.7.1)
-      rspec-support (~> 3.7.0)
-    rspec-expectations (3.7.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.7.0)
-    rspec-mocks (3.7.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.7.0)
-    rspec-support (3.7.1)
-    rubocop (0.52.1)
-      parallel (~> 1.10)
-      parser (>= 2.4.0.2, < 3.0)
-      powerpack (~> 0.1)
-      rainbow (>= 2.2.2, < 4.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
-    ruby-progressbar (1.9.0)
-    timecop (0.4.4)
-    unicode-display_width (1.3.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  rspec
-  rubocop
-  snuffleupagus!
-  timecop
-
-BUNDLED WITH
-   1.16.1