spree_api 5.3.4 → 5.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8103cf9477d203a505f580a267a96ad940babc92b4dd09814d86dba03e330300
-  data.tar.gz: 98f44fdc93e9c4cad74c52ccb58b2b82d62064c53dc9f7fa9d963ca78ed37b41
+  metadata.gz: 24f0ef390d5a4363b8d7bb9a77f6e3e8eb537a3919c0b74b94682b4f254b1ed9
+  data.tar.gz: 8a54e5469420cd4fdc3f4b4175eb25067a7a2216556ccad38905c2430bd06d09
 SHA512:
-  metadata.gz: 8b63700e0591ed1aa8f55837aec0f9492016f7cd35ccf3b202e8dcb764a35d82188cb7fc2cac64ff99c1f0a07b05142b59c48be48b01629810dfe4a2bd0cecaa
-  data.tar.gz: 5d8809fcfe387e374449bb285df5c10df363a2e972e8b3c0fba5c2d7644841e437e70b166bd981765801390c706361bdcb2423c2922a0c7e588735a5d9adf2f9
+  metadata.gz: c1fe8ffb17fdd946ee89ae01930a536e9621bdac29d62ee0c32c7c849723cf96d8ca30ea85e3edd69e4b59cf63fc06f9388d632b8c86efce6884ec6367c199a2
+  data.tar.gz: 64ea2b60038cbb1754f71c68b5c98aee5fac5cf20c8c6985bf7de6ac555321783ed502995381a7661bcbb89c34938620b3bab7afe7a312924d438f3689473016

data/app/jobs/spree/webhook_delivery_job.rb

@@ -6,10 +6,13 @@ module Spree
 
     retry_on StandardError, wait: :polynomially_longer, attempts: 5
 
-    def perform(delivery_id, secret_key)
+    # Accept optional second argument for backward compatibility with jobs
+    # enqueued before this change was deployed.
+    def perform(delivery_id, _deprecated_secret_key = nil)
       delivery = Spree::WebhookDelivery.find_by(id: delivery_id)
       return if delivery.nil?
 
+      secret_key = delivery.webhook_endpoint.secret_key
       Spree::Webhooks::DeliverWebhook.call(delivery: delivery, secret_key: secret_key)
     end
   end

data/app/services/spree/webhooks/deliver_webhook.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'net/http'
+require 'ssrf_filter'
 require 'openssl'
 
 module Spree
@@ -49,21 +49,21 @@ module Spree
       private
 
       def make_request
-        uri = URI.parse(@delivery.url)
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == 'https'
-        http.verify_mode = ssl_verify_mode
-        http.open_timeout = TIMEOUT
-        http.read_timeout = TIMEOUT
-
-        request = Net::HTTP::Post.new(uri.request_uri)
-        request['Content-Type'] = 'application/json'
-        request['User-Agent'] = 'Spree-Webhooks/1.0'
-        request['X-Spree-Webhook-Signature'] = generate_signature
-        request['X-Spree-Webhook-Event'] = @delivery.event_name
-        request.body = @delivery.payload.to_json
-
-        http.request(request)
+        SsrfFilter.post(
+          @delivery.url,
+          headers: {
+            'Content-Type' => 'application/json',
+            'User-Agent' => 'Spree-Webhooks/1.0',
+            'X-Spree-Webhook-Signature' => generate_signature,
+            'X-Spree-Webhook-Event' => @delivery.event_name
+          },
+          body: @delivery.payload.to_json,
+          http_options: {
+            open_timeout: TIMEOUT,
+            read_timeout: TIMEOUT,
+            verify_mode: ssl_verify_mode
+          }
+        )
       end
 
       def generate_signature

data/app/subscribers/spree/webhook_event_subscriber.rb

@@ -48,7 +48,7 @@ module Spree
       )
 
       # Queue the delivery job
-      Spree::WebhookDeliveryJob.perform_later(delivery.id, endpoint.secret_key)
+      Spree::WebhookDeliveryJob.perform_later(delivery.id)
     rescue StandardError => e
       Rails.logger.error "[Spree Webhooks] Error queuing delivery for endpoint #{endpoint.id}: #{e.message}"
       Rails.error.report(e)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.3.4
+  version: 5.3.5
 platform: ruby
 authors:
 - Ryan Bigg
@@ -115,14 +115,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.3.4
+        version: 5.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.3.4
+        version: 5.3.5
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -368,9 +368,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.3.4
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.3.5
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.3.4
+  source_code_uri: https://github.com/spree/spree/tree/v5.3.5
 rdoc_options: []
 require_paths:
 - lib