subdomainbox 0.3.3 → 0.3.4

data/README.md

@@ -1,7 +1,7 @@
 subdomainbox
 ============
 
-Subdomain boxing was inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html). Subdomain boxing limits the reach of any XSS attacks. If an attacker manages to insert javascript onto a page of your application, the javascript on that page will be unable to read data from or post data to any pages on different subdomains in your application. POST protection is achieved by creating a separate CSRF token for each subdomain. CSRF protection is also strengthened by changing the CSRF token based on session id.
+Subdomain boxing was inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html). Subdomain boxing limits the reach of any XSS attacks. If an attacker manages to insert javascript onto a page of your application, the javascript on that page will be unable to read data from or post data to any pages on different subdomains in your application. POST protection is achieved by creating a separate CSRF token for each subdomain. CSRF protection is also strengthened by changing the CSRF token based on session id (request.session_options[:id]).
 
 The subdomainbox gem is simple to add even to existing Rails applications:
 

data/VERSION

@@ -1 +1 @@
-0.3.3
+0.3.4

data/lib/subdomainbox.rb

@@ -18,9 +18,8 @@ module ActionController
 
     def subdomainbox(box_definitions)
       @remove_default_subdomainbox = true
-      allowed = subdomainbox_process_definitions(box_definitions)
-      subdomain_match = subdomainbox_find_subdomain_match(allowed)
-      subdomainbox_no_subdomain_match!(allowed) if subdomain_match.nil?
+      subdomain_match = subdomainbox_find_subdomain_match(box_definitions)
+      subdomainbox_no_subdomain_match!(box_definitions) if subdomain_match.nil?
     end
 
     # for controllers that need to be accessed from many places, that don't need boxing
@@ -41,34 +40,32 @@ module ActionController
 
     private
 
-    def subdomainbox_no_subdomain_match!(allowed)
-      if request.format == 'text/html'
-        if request.get?
-          flash[:alert] = flash.now[:alert]
-          flash[:notice] = flash.now[:notice]
-          flash[:info] = flash.now[:info]
-
-          default_definition = allowed.first
-          if default_definition.first == ''
-            redirect_to(request.protocol + request.domain + request.port_string + request.fullpath)
-          else
-            allowed_id_name = default_definition.pop
-            allowed_id_name = allowed_id_name if allowed_id_name
-            default_definition << params[allowed_id_name]
-            default_definition.compact!
-            default_definition.pop if default_definition.length == 2
-
-            redirect_to(request.protocol + default_definition.join + '.' + request.domain + request.port_string + request.fullpath)
-          end
+    def subdomainbox_no_subdomain_match!(box_definitions)
+      if request.format == 'text/html' && request.get?
+        flash[:alert] = flash.now[:alert]
+        flash[:notice] = flash.now[:notice]
+        flash[:info] = flash.now[:info]
+
+        allowed = subdomainbox_process_definitions(box_definitions)
+        default_definition = allowed.first
+        if default_definition.first == ''
+          redirect_to(request.protocol + request.domain + request.port_string + request.fullpath)
         else
-          raise SubdomainboxDomainViolation.new
+          allowed_id_name = default_definition.pop
+          allowed_id_name = allowed_id_name if allowed_id_name
+          default_definition << params[allowed_id_name]
+          default_definition.compact!
+          default_definition.pop if default_definition.length == 2
+
+          redirect_to(request.protocol + default_definition.join + '.' + request.domain + request.port_string + request.fullpath)
         end
       else
-        raise SubdomainboxDomainViolation.new
+        raise SubdomainboxDomainViolation.new("subdomain box: #{box_definitions}\nrequest subdomain: #{request.subdomain}")
       end
     end
 
-    def subdomainbox_find_subdomain_match(allowed)
+    def subdomainbox_find_subdomain_match(box_definitions)
+      allowed = subdomainbox_process_definitions(box_definitions)
       matches = allowed.collect do |allowed_subdomain, separator, allowed_id_name|
         subdomainbox_check_subdomain(allowed_subdomain, separator, allowed_id_name)
       end

data/spec/subdomainbox_spec.rb

@@ -297,6 +297,16 @@ describe ActionController::Base do
               controller.subdomainbox(['activities', 'pets'])
             }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
           end
+
+          it "the exception message should indicate the allowed and the requested subdomains" do
+            request.stub(:subdomain).and_return('houses.abc')
+            begin
+              controller.subdomainbox(['activities', 'pets'])
+            rescue ActionController::Base::SubdomainboxDomainViolation => e
+              e.message.should include('["activities", "pets"]')
+              e.message.should include('houses.abc')
+            end
+          end
         end
       end
 

data/subdomainbox.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "subdomainbox"
-  s.version = "0.3.3"
+  s.version = "0.3.4"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Daniel Nelson"]
-  s.date = "2013-03-16"
+  s.date = "2013-03-17"
   s.description = "use subdomains to prevent XSS from accessing your entire application if it should happen to be injected into some page in your app"
   s.email = "dnelson@centresource.com"
   s.extra_rdoc_files = [

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: subdomainbox
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.3.4
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-16 00:00:00.000000000 Z
+date: 2013-03-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: uuidtools
-  requirement: &2156188260 !ruby/object:Gem::Requirement
+  requirement: &2160198280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2156188260
+  version_requirements: *2160198280
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &2156187400 !ruby/object:Gem::Requirement
+  requirement: &2160196760 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - =
@@ -32,10 +32,10 @@ dependencies:
         version: 2.10.0
   type: :development
   prerelease: false
-  version_requirements: *2156187400
+  version_requirements: *2160196760
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &2156186760 !ruby/object:Gem::Requirement
+  requirement: &2160193740 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: 1.8.4
   type: :development
   prerelease: false
-  version_requirements: *2156186760
+  version_requirements: *2160193740
 - !ruby/object:Gem::Dependency
   name: pry
-  requirement: &2156095860 !ruby/object:Gem::Requirement
+  requirement: &2160192440 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,10 +54,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2156095860
+  version_requirements: *2160192440
 - !ruby/object:Gem::Dependency
   name: pry-nav
-  requirement: &2156091720 !ruby/object:Gem::Requirement
+  requirement: &2160212580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +65,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2156091720
+  version_requirements: *2160212580
 - !ruby/object:Gem::Dependency
   name: pry-stack_explorer
-  requirement: &2152127700 !ruby/object:Gem::Requirement
+  requirement: &2160211400 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,7 +76,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152127700
+  version_requirements: *2160211400
 description: use subdomains to prevent XSS from accessing your entire application
   if it should happen to be injected into some page in your app
 email: dnelson@centresource.com
@@ -117,7 +117,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 21616900788936139
+      hash: 3532359577434066762
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: