snuffleupagus 0.0.8 → 0.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 108756d43bb84e9a10603bf720ab9a8bb12936fa
-  data.tar.gz: 72f6d67541fda70e9ee8d3c2ea8c09417cf77ed9
+SHA256:
+  metadata.gz: c1c6a2515a503d2226e53e92350f9c156a81afc58614a68f17247693285406d8
+  data.tar.gz: 40111852cdb8cfd511accf2713981abf912004bb0db43f3e44a4954c7a8f8303
 SHA512:
-  metadata.gz: 8eb8595d52ef88e2dd869347d236bc489c048d9d0fc7ce83b32a77d31b23889b37d6de9cf31a303849b075005f860ae79cf9157071ff9b5f4ce39f59cfa90ada
-  data.tar.gz: 970370c5025c5b119743fd01c31163b9b625dbb329affec325bab414d4170135e4a0835679485a70c86b0681b9b08891f1e5c38d47d38108c492dc54d0d97fb6
+  metadata.gz: 397d54ee616139744d8802a38fc7e32cc7ad937eb32a011fd3d9dc5bb70126673dbc678e0b10b753dc9240c0f9e260806f450d1fdbafc981210f5d9abebf9e9f
+  data.tar.gz: e824f45b6b6e912dafd8a881ddbd2e915586033000c6f82f363aa78a8cd8d5faad83d0ae4299a9dfc2de8a3a46c7c696ced05c27b21aa0954c37942f3f7a57cd

data/.travis.yml

@@ -1,11 +1,10 @@
 language: ruby
 
 rvm:
-  - 2.1
-  - 2.2
   - 2.3
   - 2.4
   - 2.5
+  - 2.6
 
 install:
   - bundle install --retry=3

data/CHANGELOG.md

@@ -0,0 +1,45 @@
+# Changelog
+
+## Unreleased
+- none
+
+## [0.0.9](releases/tag/v0.0.9) - 2020-03-01
+### Fixed
+- Address CVE-2020-8130 - rake OS command injection vulnerability
+
+## [0.0.8](releases/tag/v0.0.8) - 2018-03-01
+### Added
+- Rake to gemfile dev dependencies
+
+## [0.0.7](releases/tag/v0.0.7) - 2018-03-01
+### Fixed
+- Fix missing openssl require
+
+## [0.0.6](releases/tag/v0.0.6) - 2018-03-01
+### Fixed
+- Fix Rakefile execute permission
+### Removed
+- gibberish require
+- gemfile.lock file
+
+## [0.0.5](releases/tag/v0.0.5) - 2018-03-01
+### Fixed
+- Rakefile configuration
+
+## [0.0.4](releases/tag/v0.0.4) - 2018-03-01
+### Added
+- Initial Rakefile
+- Rspec and Rubocop
+- Travis CI configuration
+
+## [0.0.3](releases/tag/v0.0.3) - 2018-03-01
+### Removed
+- Dependency on Gibberish gem
+
+## [0.0.2](releases/tag/v0.0.2) - 2014-09-23
+### Updated
+- Token validity to 2 minutes …
+
+## [0.0.1](releases/tag/v0.0.1) - 2014-08-28
+### Added
+- Initial release

data/Gemfile

@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 source 'http://rubygems.org'
 gemspec

data/README.md

@@ -5,7 +5,7 @@ A little simple.. auth token generator
 
 Handles basic time-limited authentication token creation / validation
 
-Uses Gibberish::AES with 256 bit CBC encryption
+Uses OpenSSL AES with 256 bit CBC encryption
 
 ![Snuffy](/Snuffy.png "Snuffleupagus")
 
@@ -14,7 +14,7 @@ Uses Gibberish::AES with 256 bit CBC encryption
 Include it in your Gemfile:
 
 ```ruby
-gem 'snuffleupagus', :git => 'git@github.com:TutoringAustralasia/snuffleupagus.git'
+gem 'snuffleupagus'
 ```
 
 ## Basic Usage

data/Rakefile

@@ -1,4 +1,5 @@
 #!/usr/bin/env rake
+# frozen_string_literal: true
 
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'

data/lib/snuffleupagus.rb

@@ -1 +1,3 @@
+# frozen_string_literal: true
+
 require 'snuffleupagus/auth_token'

data/lib/snuffleupagus/auth_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'openssl'
 
 module Snuffleupagus
@@ -30,10 +32,12 @@ module Snuffleupagus
     end
 
     def check_token(token)
-      return false unless token && token.is_a?(String)
+      return false unless token&.is_a?(String)
+
       decoded = decrypt decode token
       match = /^#{CONSTANT}([0-9]+)$/.match decoded
       return false unless match
+
       (match[1].to_i - Time.now.to_i).abs < MAX_VALID_TIME_DIFFERENCE
     rescue StandardError
       false
@@ -41,7 +45,7 @@ module Snuffleupagus
 
     private
 
-    CONSTANT = 'date:'.freeze
+    CONSTANT = 'date:'
     MAX_VALID_TIME_DIFFERENCE = 120 # tokens are only valid for 2 minutes
 
     attr_reader :cipher
@@ -55,6 +59,7 @@ module Snuffleupagus
 
     def decrypt(data)
       raise ArgumentError, 'Data is too short' unless data.length >= 16
+
       salt = data[8..15]
       data = data[16..-1]
       setup_cipher(:decrypt, salt)

data/lib/snuffleupagus/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Snuffleupagus
-  VERSION = '0.0.8'.freeze
+  VERSION = '0.0.9'
 end

data/snuffleupagus.gemspec

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require File.expand_path('lib/snuffleupagus/version', File.dirname(__FILE__))
 
 Gem::Specification.new do |s|
@@ -6,12 +8,12 @@ Gem::Specification.new do |s|
   s.platform                  = Gem::Platform::RUBY
   s.authors                   = ['Andrew Bromwich']
   s.email                     = ['abromwich@studiosity.com']
-  s.homepage                  = 'https://studiosity.com'
+  s.homepage                  = 'https://github.com/Studiosity/snuffleupagus'
   s.description               = 'Simple auth token generator/validator'
   s.summary                   = "snuffleupagus-#{s.version}"
   s.required_rubygems_version = '> 1.3.6'
 
-  s.add_development_dependency 'rake', '>= 10.0'
+  s.add_development_dependency 'rake', '~> 12.3', '>= 12.3.3'
   s.add_development_dependency 'rspec', '~> 3'
   s.add_development_dependency 'rubocop', '~> 0.49'
   s.add_development_dependency 'timecop', '~> 0'

data/spec/snuffleupagus_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require './lib/snuffleupagus'
 require 'timecop'
 

metadata

@@ -1,29 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: snuffleupagus
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.0.9
 platform: ruby
 authors:
 - Andrew Bromwich
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-03-01 00:00:00.000000000 Z
+date: 2020-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -76,8 +82,8 @@ files:
 - ".gitignore"
 - ".rubocop.yml"
 - ".travis.yml"
+- CHANGELOG.md
 - Gemfile
-- Gemfile.lock
 - README.md
 - Rakefile
 - Snuffy.png
@@ -86,7 +92,7 @@ files:
 - lib/snuffleupagus/version.rb
 - snuffleupagus.gemspec
 - spec/snuffleupagus_spec.rb
-homepage: https://studiosity.com
+homepage: https://github.com/Studiosity/snuffleupagus
 licenses: []
 metadata: {}
 post_install_message: 
@@ -104,9 +110,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
-summary: snuffleupagus-0.0.8
+summary: snuffleupagus-0.0.9
 test_files: []