tcat 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ed5fe975474cdb30f8d660719b0a59d0ea5f1813b4e86433c95cd2ee82c795e
-  data.tar.gz: 025bf6aa6cfc46a4437d72e1d8abc966853606c1ba58b56ea5f6334a541b063e
+  metadata.gz: 588b8dd9b49b05b35d28384cb85c3bc4e87b38852a04c3da8ce5b35ce59739bc
+  data.tar.gz: cd704ade306674058f6fd4c8de240d7570f54dba29ad7e1dfe30afb3b0119d40
 SHA512:
-  metadata.gz: b59a640cf706df074a2daa9bac89dfed2d96b1cfa1720278afe00b66ca8991cf64c096e4fca3701b05e7f43009b71f5f2e57186c902b339000d76db6098f4b13
-  data.tar.gz: 4d678f18e49855e6faf85ac8f4b0969f7c3c6d7d8a176686cd31ecc875e871a36ac3452a19dc9e5c7cd02ef559fdccf4e727085984c52d0066456f1b8b27302c
+  metadata.gz: 8617ad7c2b5bec16c3d7c94fd39175b45417a869feb6a74f0a1fab3590860c44d4a7e61a49b908982ae65f4b856504de3e61c9f96ba082c0ef0736cf936a59ca
+  data.tar.gz: '059ea7b7711cae4a2d146a23470016048edfb6e5c5d8951822ba17be8bd792355b1f9d29a73cc1b40e604884b332ac1548e453fb66f3cc22cff6c43198c510c7'

data/README.md

@@ -270,6 +270,13 @@ This gem is available as open source under the terms of the [MIT License](https:
 
 ## Changelog
 
+### 0.4.1
+
+- Security hardening: `Tcat::Query` now uses `SecureRandom` (CSPRNG) instead of `rand` for the per-request freshness component embedded in the encrypted `secret` payload
+- Encryption: `Tcat::EncryptionService` explicitly disables OpenSSL's built-in cipher padding so the manually applied PKCS#7 padding cannot be double-applied if the cipher pipeline ever changes
+- `Tcat::WorkerClient` warns when `worker_url` uses `http://` against a non-localhost host so a misconfigured deployment cannot silently leak the Bearer token over plaintext
+- Worker: added `[observability.logs]` (`enabled = false`, `invocation_logs = true`) to `wrangler.toml`
+
 ### 0.4.0
 
 - `Tcat::Query#status_code`, `#history`, `#latest_status` now accept an optional tracking-number argument, mirroring `Tcat::WorkerClient`'s shape

data/lib/tcat/encryption_service.rb

@@ -34,6 +34,9 @@ module Tcat
     def setup_cipher
       cipher = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
       cipher.encrypt
+      # PKCS#7 padding is applied manually in #pad_message; turn off OpenSSL's
+      # built-in padding so a future cipher.final call cannot double-pad.
+      cipher.padding = 0
       cipher.key = @secret_key
       cipher
     end

data/lib/tcat/query.rb

@@ -2,6 +2,7 @@
 
 require 'net/http'
 require 'base64'
+require 'securerandom'
 require 'ox'
 require_relative 'http_client'
 require_relative 'encryption_service'
@@ -108,7 +109,8 @@ module Tcat
     end
 
     def random
-      rand(10_000..99_999).to_s
+      # CSPRNG so the per-request freshness component is unpredictable.
+      (SecureRandom.random_number(90_000) + 10_000).to_s
     end
 
     def source_string

data/lib/tcat/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tcat
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

data/lib/tcat/worker_client.rb

@@ -99,15 +99,29 @@ module Tcat
 
     private
 
+    LOCAL_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
+    private_constant :LOCAL_HOSTS
+
     def validate_url!
       uri = URI.parse(@worker_url)
       unless %w[http https].include?(uri.scheme)
         raise ArgumentError, 'Invalid Worker URL: must be http or https'
       end
+
+      warn_if_insecure(uri)
     rescue URI::InvalidURIError => e
       raise ArgumentError, "Invalid Worker URL: #{e.message}"
     end
 
+    def warn_if_insecure(uri)
+      return if uri.scheme == 'https'
+      return if LOCAL_HOSTS.include?(uri.host)
+
+      warn '[Tcat::WorkerClient] WARNING: worker_url uses http://; ' \
+           'requests and any Authorization token will be sent in plaintext. ' \
+           'Use https:// in production.'
+    end
+
     def make_request(uri)
       response = setup_http(uri).request(build_request(uri))
       raise APIError, "HTTP #{response.code}: #{response.message}" unless response.is_a?(Net::HTTPSuccess)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tcat
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Zac