RubyGems - unified_csrf_prevention - Versions diffs - 1.0.0 - Mend

unified_csrf_prevention 1.0.0

Files changed (46) hide show

checksums.yaml +7 -0
data/.gitignore +5 -0
data/.rspec +1 -0
data/.rubocop.yml +24 -0
data/Appraisals +17 -0
data/CHANGELOG.md +6 -0
data/Gemfile +5 -0
data/MIT-LICENSE +21 -0
data/README.md +90 -0
data/Rakefile +3 -0
data/lib/unified_csrf_prevention/core.rb +48 -0
data/lib/unified_csrf_prevention/middleware.rb +48 -0
data/lib/unified_csrf_prevention/railtie.rb +22 -0
data/lib/unified_csrf_prevention/request_forgery_protection.rb +68 -0
data/lib/unified_csrf_prevention/version.rb +5 -0
data/lib/unified_csrf_prevention.rb +8 -0
data/spec/controllers/dummy_controller_spec.rb +211 -0
data/spec/dummy/app/controllers/application_controller.rb +5 -0
data/spec/dummy/app/controllers/dummy_controller.rb +11 -0
data/spec/dummy/app/views/dummy/index.html.erb +1 -0
data/spec/dummy/app/views/layouts/application.html.erb +12 -0
data/spec/dummy/config/application.rb +32 -0
data/spec/dummy/config/boot.rb +3 -0
data/spec/dummy/config/environment.rb +5 -0
data/spec/dummy/config/environments/test.rb +44 -0
data/spec/dummy/config/initializers/backtrace_silencers.rb +7 -0
data/spec/dummy/config/initializers/cookies_serializer.rb +3 -0
data/spec/dummy/config/initializers/filter_parameter_logging.rb +4 -0
data/spec/dummy/config/initializers/inflections.rb +16 -0
data/spec/dummy/config/initializers/mime_types.rb +4 -0
data/spec/dummy/config/initializers/session_store.rb +3 -0
data/spec/dummy/config/initializers/to_time_preserves_timezone.rb +10 -0
data/spec/dummy/config/initializers/wrap_parameters.rb +9 -0
data/spec/dummy/config/routes.rb +5 -0
data/spec/dummy/config/secrets.yml +22 -0
data/spec/dummy/config.ru +4 -0
data/spec/dummy/log/.keep +0 -0
data/spec/rails_helper.rb +9 -0
data/spec/spec_helper.rb +22 -0
data/spec/support/shared_context/for_controllers.rb +53 -0
data/spec/support/shared_examples/for_controllers.rb +77 -0
data/spec/support/shared_examples/for_middleware.rb +35 -0
data/spec/xing/csrf_protection/core_spec.rb +100 -0
data/spec/xing/csrf_protection/middleware_spec.rb +44 -0
data/unified_csrf_prevention.gemspec +34 -0
metadata +215 -0

data/spec/dummy/app/controllers/application_controller.rb ADDED Viewed

@@ -0,0 +1,5 @@
+require 'unified_csrf_prevention'
+class ApplicationController < ActionController::Base
+  protect_from_forgery with: :exception
+end

data/spec/dummy/app/controllers/dummy_controller.rb ADDED Viewed

@@ -0,0 +1,11 @@
+class DummyController < ApplicationController
+  def index; end
+  def success
+    head :ok
+  end
+  def update
+    head :ok
+  end
+end

data/spec/dummy/app/views/dummy/index.html.erb ADDED Viewed

	@@ -0,0 +1 @@
1	+ <%= form_tag %>

data/spec/dummy/app/views/layouts/application.html.erb ADDED Viewed

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Dummy App</title>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+<%= yield %>
+</body>
+</html>

data/spec/dummy/config/application.rb ADDED Viewed

@@ -0,0 +1,32 @@
+require File.expand_path('../boot', __FILE__)
+require "rails"
+# Pick the frameworks you want:
+# require "active_model/railtie"
+# require "active_job/railtie"
+# require "active_record/railtie"
+require "action_controller/railtie"
+# require "action_mailer/railtie"
+require "action_view/railtie"
+# require "sprockets/railtie"
+# require "rails/test_unit/railtie"
+# Require the gems listed in Gemfile, including any gems
+# you've limited to :test, :development, or :production.
+Bundler.require(*Rails.groups)
+module Dummy
+  class Application < Rails::Application
+    # Settings in config/environments/* take precedence over those specified here.
+    # Application configuration should go into files in config/initializers
+    # -- all .rb files in that directory are automatically loaded.
+    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
+    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
+    # config.time_zone = 'Central Time (US & Canada)'
+    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
+    # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s]
+    # config.i18n.default_locale = :de
+  end
+end

data/spec/dummy/config/boot.rb ADDED Viewed

@@ -0,0 +1,3 @@
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
+require 'bundler/setup' # Set up gems listed in the Gemfile.

data/spec/dummy/config/environment.rb ADDED Viewed

@@ -0,0 +1,5 @@
+# Load the Rails application.
+require File.expand_path('../application', __FILE__)
+# Initialize the Rails application.
+Rails.application.initialize!

data/spec/dummy/config/environments/test.rb ADDED Viewed

@@ -0,0 +1,44 @@
+Rails.application.configure do
+  # Settings specified here will take precedence over those in config/application.rb.
+  # The test environment is used exclusively to run your application's
+  # test suite. You never need to work with it otherwise. Remember that
+  # your test database is "scratch space" for the test suite and is wiped
+  # and recreated between test runs. Don't rely on the data there!
+  config.cache_classes = true
+  # Do not eager load code on boot. This avoids loading your whole application
+  # just for the purpose of running a single test. If you are using a tool that
+  # preloads Rails for running tests, you may have to set it to true.
+  config.eager_load = false
+  # Configure static file server for tests with Cache-Control for performance.
+  config.serve_static_files   = true
+  config.static_cache_control = 'public, max-age=3600'
+  # Show full error reports and disable caching.
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+  # Raise exceptions instead of rendering exception templates.
+  config.action_dispatch.show_exceptions = false
+  # Enable request forgery protection in test environment.
+  config.action_controller.allow_forgery_protection = true
+  # Tell Action Mailer not to deliver emails to the real world.
+  # The :test delivery method accumulates sent emails in the
+  # ActionMailer::Base.deliveries array.
+  # config.action_mailer.delivery_method = :test
+  # Randomize the order test cases are executed.
+  config.active_support.test_order = :random
+  # Print deprecation notices to the stderr.
+  config.active_support.deprecation = :stderr
+  # Raises error for missing translations
+  # config.action_view.raise_on_missing_translations = true
+  config.unified_csrf_prevention_key = 'protected to the max'
+end

data/spec/dummy/config/initializers/backtrace_silencers.rb ADDED Viewed

@@ -0,0 +1,7 @@
+# Be sure to restart your server when you modify this file.
+# You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.
+# Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ }
+# You can also remove all the silencers if you're trying to debug a problem that might stem from framework code.
+# Rails.backtrace_cleaner.remove_silencers!

data/spec/dummy/config/initializers/cookies_serializer.rb ADDED Viewed

@@ -0,0 +1,3 @@
+# Be sure to restart your server when you modify this file.
+Rails.application.config.action_dispatch.cookies_serializer = :json

data/spec/dummy/config/initializers/filter_parameter_logging.rb ADDED Viewed

@@ -0,0 +1,4 @@
+# Be sure to restart your server when you modify this file.
+# Configure sensitive parameters which will be filtered from the log file.
+Rails.application.config.filter_parameters += [:password]

data/spec/dummy/config/initializers/inflections.rb ADDED Viewed

@@ -0,0 +1,16 @@
+# Be sure to restart your server when you modify this file.
+# Add new inflection rules using the following format. Inflections
+# are locale specific, and you may define rules for as many different
+# locales as you wish. All of these examples are active by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.plural /^(ox)$/i, '\1en'
+#   inflect.singular /^(ox)en/i, '\1'
+#   inflect.irregular 'person', 'people'
+#   inflect.uncountable %w( fish sheep )
+# end
+# These inflection rules are supported but not enabled by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.acronym 'RESTful'
+# end

data/spec/dummy/config/initializers/mime_types.rb ADDED Viewed

@@ -0,0 +1,4 @@
+# Be sure to restart your server when you modify this file.
+# Add new mime types for use in respond_to blocks:
+# Mime::Type.register "text/richtext", :rtf

data/spec/dummy/config/initializers/session_store.rb ADDED Viewed

@@ -0,0 +1,3 @@
+# Be sure to restart your server when you modify this file.
+Rails.application.config.session_store :disabled

data/spec/dummy/config/initializers/to_time_preserves_timezone.rb ADDED Viewed

@@ -0,0 +1,10 @@
+# Be sure to restart your server when you modify this file.
+# Preserve the timezone of the receiver when calling to `to_time`.
+# Ruby 2.4 will change the behavior of `to_time` to preserve the timezone
+# when converting to an instance of `Time` instead of the previous behavior
+# of converting to the local system timezone.
+#
+# Rails 5.0 introduced this config option so that apps made with earlier
+# versions of Rails are not affected when upgrading.
+ActiveSupport.to_time_preserves_timezone = true

data/spec/dummy/config/initializers/wrap_parameters.rb ADDED Viewed

@@ -0,0 +1,9 @@
+# Be sure to restart your server when you modify this file.
+# This file contains settings for ActionController::ParamsWrapper which
+# is enabled by default.
+# Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array.
+ActiveSupport.on_load(:action_controller) do
+  wrap_parameters format: [:json] if respond_to?(:wrap_parameters)
+end

data/spec/dummy/config/routes.rb ADDED Viewed

@@ -0,0 +1,5 @@
+Rails.application.routes.draw do
+  get  '/'        => 'dummy#index'
+  post '/'        => 'dummy#update'
+  get  '/success' => 'dummy#success'
+end

data/spec/dummy/config/secrets.yml ADDED Viewed

@@ -0,0 +1,22 @@
+# Be sure to restart your server when you modify this file.
+# Your secret key is used for verifying the integrity of signed cookies.
+# If you change this key, all old signed cookies will become invalid!
+# Make sure the secret is at least 30 characters and all random,
+# no regular words or you'll be exposed to dictionary attacks.
+# You can use `rake secret` to generate a secure secret key.
+# Make sure the secrets in this file are kept private
+# if you're sharing your code publicly.
+development:
+  secret_key_base: e20fedf9cf9b2c879b4865d7b0c9485e262ddb5fe169b9b8fcae0ada5c1a7525e0f9a41e80fbb6a44c6f9ea367199d0671d187ae3ffea2199f47e41a2593360b
+test:
+  secret_key_base: 3683f82c161cabc21d5d60e3b23aa6ec3b74b4601d0ea0dbc35baf027c8eaee0194d24391954cd5cba71cafaa8f39820c267bf827117dd21c753ca43058113c6
+# Do not keep production secrets in the repository,
+# instead read values from the environment.
+production:
+  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

data/spec/dummy/config.ru ADDED Viewed

@@ -0,0 +1,4 @@
+# This file is used by Rack-based servers to start the application.
+require ::File.expand_path('../config/environment', __FILE__)
+run Rails.application

data/spec/dummy/log/.keep ADDED Viewed

File without changes

data/spec/rails_helper.rb ADDED Viewed

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+ENV['RAILS_ENV'] ||= 'test'
+require 'spec_helper'
+require File.expand_path('../dummy/config/environment', __FILE__)
+require 'rspec/rails'
+Dir[File.expand_path('**/*.rb', './spec/support/')].each { |f| require f }

data/spec/spec_helper.rb ADDED Viewed

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+require 'unified_csrf_prevention'
+RSpec.configure do |config|
+  config.expect_with :rspec do |expectations|
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+  config.mock_with :rspec do |mocks|
+    mocks.verify_partial_doubles = true
+  end
+  config.shared_context_metadata_behavior = :apply_to_host_groups
+  config.filter_run_when_matching :focus
+  config.warnings = true
+  config.order = :random
+  Kernel.srand config.seed
+end

data/spec/support/shared_context/for_controllers.rb ADDED Viewed

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+shared_context 'with token and checksum' do
+  let(:token) { 'A token should be 32 bytes long.' }
+  let(:checksum) { 'a checksum' }
+  before do
+    allow(UnifiedCsrfPrevention::Core).to receive(:valid_token?).and_return(false)
+    allow(UnifiedCsrfPrevention::Core).to receive(:valid_token?).with(token, checksum).and_return(valid_token?)
+    request.cookies['csrf_token'] = token
+    request.cookies['csrf_checksum'] = checksum
+  end
+end
+shared_context 'empty update request' do
+  let(:perform_request) do
+    post :update
+  end
+end
+shared_context 'update request with a csrf token form parameter' do
+  let(:perform_request) do
+    post_with_params :update, params: { authenticity_token: token }
+  end
+end
+shared_context 'update request with a fetched csrf token form parameter' do
+  render_views
+  let(:perform_request) do
+    get :index
+    actual_token = response.body.match(%r{<input type="hidden" name="authenticity_token" value="([^"]+)" />})[1]
+    post_with_params :update, params: { authenticity_token: actual_token }
+  end
+end
+shared_context 'update request with a csrf token header' do
+  let(:perform_request) do
+    request.headers['X-CSRF-Token'] = token
+    post :update
+  end
+end
+# rspec-rails `post` interface is different starting from Rails 5
+# https://relishapp.com/rspec/rspec-rails/docs/request-specs/request-spec#specify-managing-a-widget-with-rails-integration-methods
+POST_RAILS_5 = Gem.loaded_specs['rails']&.version.to_s.to_i >= 5
+def post_with_params(action, params:)
+  post action, POST_RAILS_5 ? { params: params } : params
+end

data/spec/support/shared_examples/for_controllers.rb ADDED Viewed

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+TOKEN_INPUT_REGEXP = %r{<input type="hidden" name="authenticity_token" value="([^"]+)" />}
+TOKEN_META_REGEXP  = %r{<meta name="csrf-token" content="([^"]+)" />}
+shared_examples 'an action that outputs the csrf token' do
+  let(:real_form_token) do
+    encoded_token = response.body.match(TOKEN_INPUT_REGEXP)[1]
+    decode_token(encoded_token)
+  end
+  let(:real_meta_token) do
+    encoded_token = response.body.match(TOKEN_META_REGEXP)[1]
+    decode_token(encoded_token)
+  end
+  it 'renders form with a new token' do
+    perform_request
+    expect(response.body).to match(TOKEN_INPUT_REGEXP)
+    expect(real_form_token).to eq(output_token)
+  end
+  it 'renders csrf meta tags with a new token' do
+    perform_request
+    expect(response.body).to match(%r{<meta name="csrf-param" content="authenticity_token" />})
+    expect(response.body).to match(TOKEN_META_REGEXP)
+    expect(real_meta_token).to eq(output_token)
+  end
+end
+shared_examples 'an action that outputs the csrf cookies' do
+  it 'sets the token for the middleware' do
+    begin
+      perform_request
+    rescue ActionController::InvalidAuthenticityToken
+      nil
+    end
+    expect(request.env).to include('unified_csrf_prevention.token' => output_token)
+  end
+end
+shared_examples 'an action that does not output the csrf cookies' do
+  it 'does not set the token for the middleware' do
+    begin
+      perform_request
+    rescue ActionController::InvalidAuthenticityToken
+      nil
+    end
+    expect(request.env).not_to include('unified_csrf_prevention.token')
+  end
+end
+shared_examples 'an action that responds with a csrf validation error' do
+  it do
+    expect { perform_request }.to raise_error ActionController::InvalidAuthenticityToken
+  end
+end
+shared_examples 'an action that responds with OK' do
+  it do
+    perform_request
+    expect(response).to be_ok
+  end
+end
+# Code parts were taken from ActionController::RequestForgeryProtection
+def decode_token(encoded_masked_token)
+  masked_token = Base64.strict_decode64(encoded_masked_token)
+  one_time_pad = masked_token[0...ActionController::RequestForgeryProtection::AUTHENTICITY_TOKEN_LENGTH]
+  encrypted_csrf_token = masked_token[ActionController::RequestForgeryProtection::AUTHENTICITY_TOKEN_LENGTH..-1]
+  one_time_pad.bytes.zip(encrypted_csrf_token.bytes).map { |(c1, c2)| c1 ^ c2 }.pack('c*')
+end

data/spec/support/shared_examples/for_middleware.rb ADDED Viewed

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+shared_examples 'a middleware that does not set any cookie' do
+  it { is_expected.to be_ok }
+  it 'does not output Set-Cookie header' do
+    expect(subject.headers).not_to include('Set-Cookie')
+  end
+end
+shared_examples 'a middleware that sets secure csrf cookies' do
+  it { is_expected.to be_ok }
+  it 'sets the csrf cookie headers' do
+    expect(subject.headers).to include('Set-Cookie' => %r{^csrf_token=#{token}; path=/; secure; SameSite=Strict$})
+    expect(subject.headers).to include('Set-Cookie' => %r{^csrf_checksum=#{checksum}; path=/; secure; HttpOnly; SameSite=Strict$})
+  end
+end
+shared_examples 'a middleware that logs generated csrf token' do
+  before { allow(Rails.logger).to receive(:info) }
+  it { is_expected.to be_ok }
+  it 'logs the token' do
+    subject
+    expect(Rails.logger).to have_received(:info).with("Set CSRF token: #{token}")
+  end
+end
+shared_examples 'a middleware that sets insecure csrf cookies' do
+  it { is_expected.to be_ok }
+  it 'sets the csrf cookie headers' do
+    expect(subject.headers).to include('Set-Cookie' => %r{^csrf_token=#{token}; path=/; SameSite=Strict$})
+    expect(subject.headers).to include('Set-Cookie' => %r{^csrf_checksum=#{checksum}; path=/; HttpOnly; SameSite=Strict$})
+  end
+end