url_signature 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 403aa1e79b5d5f67e7179061d8458f0121dd1a0541efb43af01854a109d7d8c5
-  data.tar.gz: 7c1de86c5265f134981ea8872c7a7875c617510b338e12b2674e0bd11ecb8875
+  metadata.gz: 28eb510b8d3f69206776772eb78bca149e5118d4e0c05f7a33e60abee6a46e6f
+  data.tar.gz: 36c435b613159f5f97f3d10d71dd57b2b556e9da04ea001a0c86ea9e35b041ad
 SHA512:
-  metadata.gz: 70d88e10de08b6653c911c47a85b298c0dba0de6a927ec9fc41af3c72fb9732d9e0e31bdcb35bcff86ffdb97b53b89795ff22e7471313d6533bfcd7ec7b6880e
-  data.tar.gz: 1e80fbb63970e492e61332f030d30f9de64dc8d128f4232bfd230f8ac22d3748bcf15fc631e6e9ab0b11007dd71b658d6c93c7adcbd59a3f53a6fc17ac712ddd
+  metadata.gz: 57db4831d7a9c8100efe175825e6aa2fb367cb1a42c37bc851318b47cadfee22f2a797c357eb4aca46fa70f1b26b3849e200dedcc626785f33d9ee442a3b0e0e
+  data.tar.gz: de3b6114aced1d7f0ded1ec5d637b08f18f837348d8fa754a52c0c679ff71d09ec1ad688624bcdb6055df285cbca6baecd5d446d3fa6d4860769bd54b9cbac53

data/CHANGELOG.md

@@ -11,6 +11,10 @@ Prefix your message with one of the following:
 - [Security] in case of vulnerabilities.
 -->
 
+## v0.0.2 - 2020-11-04
+
+- [Changed] Replace HMAC algorithm with a proc that can be customized.
+
 ## v0.0.1 - 2020-11-04
 
 - Initial release.

data/README.md

@@ -36,8 +36,9 @@ arguments are:
 - `params`: Any additional params you want to add as query strings.
 - `expires`: Any integer representing an epoch time. Urls won't be verified
   after this date. By default, urls don't expire.
-- `algorithm`: The hashing algorithm that will be used. By default, SHA256 will
-  be used.
+- `hmac_proc`: `Proc` that will generate the signature. By default, it generates
+  a `base64url(sha512_hmac(data))` signature (with no padding). The proc will be
+  called with two parameters: `key` and `data`.
 - `signature_param`: The signature's param name. By default it's `signature`.
 - `expires_param`: The expires' param name. By default it's `expires`.
 
@@ -45,7 +46,7 @@ arguments are:
 key = "secret"
 
 signed_url = SignedURL.call("https://nandovieira.com", key: key)
-#=> "https://nandovieira.com/?signature=87fdf44a5109c54edff2e0258b354e32ba5baf3dd21ec5af82f08b82ce362fbf"
+#=> "https://nandovieira.com/?signature=87fdf44a5109c54edff2e0258b354e32ba5b..."
 ```
 
 You can use the method `SignedURL.verified?(url, **kwargs)` to verify if a
@@ -79,7 +80,7 @@ signed_url = SignedURL.call(
   key: secret,
   expires: Time.now.to_i + 120
 )
-#=> "https://nandovieira.com/?expires=1604477596&signature=7ac5eaee20d316c6cd3f81db14cde98c3c669d423a32d2c546730cbb0dcbc6f2"
+#=> "https://nandovieira.com/?expires=1604477596&signature=7ac5eaee20d316..."
 ```
 
 ## Maintainer

data/lib/url_signature.rb

@@ -3,6 +3,7 @@
 require "uri"
 require "cgi"
 require "openssl"
+require "base64"
 
 module URLSignature
   require "url_signature/version"
@@ -12,6 +13,13 @@ module URLSignature
   ExpiredURL = Class.new(StandardError)
   InvalidSignature = Class.new(StandardError)
 
+  HMAC_PROC = lambda do |key, data|
+    Base64.urlsafe_encode64(
+      OpenSSL::HMAC.digest("SHA256", key, data.to_s),
+      padding: false
+    )
+  end
+
   # Create a new signed url.
   def self.call(
     url,
@@ -20,12 +28,12 @@ module URLSignature
     expires: 0,
     signature_param: "signature",
     expires_param: "expires",
-    algorithm: "SHA256"
+    hmac_proc: HMAC_PROC
   )
     expires = expires.to_i
     params[expires_param] = expires if expires.positive?
     url = build_url(url, params)
-    signature = OpenSSL::HMAC.hexdigest(algorithm, key, url.to_s)
+    signature = hmac_proc.call(key, url)
     url.add_query(signature_param, signature)
     url.to_s
   end
@@ -33,14 +41,14 @@ module URLSignature
   def self.verified?(
     url,
     key:,
-    algorithm: "SHA256",
     expires_param: "expires",
-    signature_param: "signature"
+    signature_param: "signature",
+    hmac_proc: HMAC_PROC
   )
     verify!(
       url,
       key: key,
-      algorithm: algorithm,
+      hmac_proc: hmac_proc,
       expires_param: expires_param,
       signature_param: signature_param
     )
@@ -48,21 +56,30 @@ module URLSignature
     false
   end
 
-  def self.verify!(
+  def self.verify!( # rubocop:disable Metrics/MethodLength
     url,
     key:,
-    algorithm: "SHA256",
+    hmac_proc: HMAC_PROC,
     expires_param: "expires",
     signature_param: "signature"
   )
     url = build_url(url)
-    actual_signature, * = url.remove_query(signature_param)
-    expected_signature = OpenSSL::HMAC.hexdigest(algorithm, key, url.to_s)
+    actual_url = url.to_s
+
+    url.remove_query(signature_param)
+
+    expected_url = call(
+      url.to_s,
+      key: key,
+      expires_param: expires_param,
+      hmac_proc: hmac_proc,
+      signature_param: signature_param
+    )
 
     expires = url.params[expires_param]&.first.to_i
 
     raise ExpiredURL if expires.positive? && expires < Time.now.to_i
-    raise InvalidSignature unless actual_signature == expected_signature
+    raise InvalidSignature unless actual_url == expected_url
 
     true
   end

data/lib/url_signature/url.rb

@@ -40,6 +40,8 @@ module URLSignature
       return if params.empty?
 
       query = params.each_with_object([]) do |(param, value), buffer|
+        param = param.to_s
+
         if param.include?("[")
           value.each {|v| buffer << "#{encode(param)}=#{encode(v)}" }
         else

data/lib/url_signature/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module URLSignature
-  VERSION = "0.0.1"
+  VERSION = "0.0.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: url_signature
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Nando Vieira
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-11-04 00:00:00.000000000 Z
+date: 2020-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -143,10 +143,10 @@ licenses:
 metadata:
   homepage_uri: https://github.com/fnando/url_signature
   bug_tracker_uri: https://github.com/fnando/url_signature/issues
-  source_code_uri: https://github.com/fnando/url_signature/tree/v0.0.1
-  changelog_uri: https://github.com/fnando/url_signature/tree/v0.0.1/CHANGELOG.md
-  documentation_uri: https://github.com/fnando/url_signature/tree/v0.0.1/README.md
-  license_uri: https://github.com/fnando/url_signature/tree/v0.0.1/LICENSE.md
+  source_code_uri: https://github.com/fnando/url_signature/tree/v0.0.2
+  changelog_uri: https://github.com/fnando/url_signature/tree/v0.0.2/CHANGELOG.md
+  documentation_uri: https://github.com/fnando/url_signature/tree/v0.0.2/README.md
+  license_uri: https://github.com/fnando/url_signature/tree/v0.0.2/LICENSE.md
 post_install_message:
 rdoc_options: []
 require_paths: