strict-forgery-protection 0.0.7 → 0.0.8

data/lib/forgery_protection/controller_extension.rb

@@ -12,6 +12,10 @@ module ForgeryProtection
 
     protected
 
+    def handle_unverified_request
+      raise AttemptError, 'Encountered unverified request'
+    end
+
     def verify_authenticity_token
       super.tap { @forgery_protection_invoked = true }
     end

data/lib/forgery_protection/version.rb

@@ -1,3 +1,3 @@
 module ForgeryProtection
-  VERSION = '0.0.7'
+  VERSION = '0.0.8'
 end

data/test/controller_test.rb

@@ -66,11 +66,16 @@ class ControllerTest < ActionController::TestCase
   end
 
   def test_unverified_get_write
-    assert_raises(ForgeryProtection::AttemptError) { get :write, :id => Post.last, :authenticity_token => 'bad token', :message => 'bye' }
+    # GET requests do not perform authenticity verification, since such requests are not intended to change server state. Still, people
+    # write applications that have GET requests change the state all the time. While we cannot offer full protection, we at least trip
+    # up the developer after the update has taken place in hopes that to draw attention to the problem and that they will fix it.
+    assert_raises(ForgeryProtection::AttemptError) { get :write, :id => Post.last, :authenticity_token => 'bad token', :message => 'xsrf exploit' }
   end
 
   def test_unverified_post_write
-    assert_raises(ForgeryProtection::AttemptError) { post :write, :id => Post.last, :authenticity_token => 'bad token', :message => 'bye' }
+    assert_raises(ForgeryProtection::AttemptError) { post :write, :id => Post.last, :authenticity_token => 'bad token', :message => 'xsrf exploit' }
+
+    assert_not_equal 'xsrf exploit', Post.last.message, 'Should prevent exploit update'
   end
 
   def test_unprotected_writes

data/test/unverified_request_handling_test.rb

@@ -0,0 +1,18 @@
+require 'test_helper'
+
+class UnverifiedRequestHandlingTest < ControllerTest
+  class DefaultController < ActionController::Base
+  end
+
+  class RaisingExceptionController < ActionController::Base
+    private
+
+    def verify_unverified_request
+      raise 'Bad error!'
+    end
+  end
+
+  def test_default_controller
+
+  end
+end

metadata

@@ -2,14 +2,14 @@
 name: strict-forgery-protection
 version: !ruby/object:Gem::Version
   prerelease:
-  version: 0.0.7
+  version: 0.0.8
 platform: ruby
 authors:
 - Dmitry Ratnikov
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2012-05-10 00:00:00.000000000Z
+date: 2012-06-18 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -37,8 +37,9 @@ files:
 - lib/forgery_protection/version.rb
 - test/controller_test.rb
 - test/db_events_test.rb
-- test/test.sqlite3
 - test/test_helper.rb
+- test/test.sqlite3
+- test/unverified_request_handling_test.rb
 homepage: http://github.com/ratnikov/strict-forgery-protection
 licenses: []
 post_install_message:
@@ -66,6 +67,7 @@ summary: Extends Rails to be strict CSRF token protection
 test_files:
 - test/controller_test.rb
 - test/db_events_test.rb
-- test/test.sqlite3
 - test/test_helper.rb
+- test/test.sqlite3
+- test/unverified_request_handling_test.rb
 ...