urlcrypt 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43b85d8e2005d9c5fb0b2181f9865acb54c85123b9e4aeac7c7c66360aedbdfd
-  data.tar.gz: '008bc1517bf2fd48531d97bdfa4738520b59c855f145716238bd92edc5ba52bc'
+  metadata.gz: 4b88fc478e4e9f1be07a35951eb871bfa2cacc5ca3d6478d95dff1ea24df138d
+  data.tar.gz: 6f01a73f86568c9baec085265539c0b889007ea570273b78609924fc1939a865
 SHA512:
-  metadata.gz: 9c663737786ae94458f6a28442936fd6bdcdde71bbb198d13c1693d151a028d03d647ff080ccdb2b243fa49310b6cc97b95ea305abc28fd22d46d918f10e00e0
-  data.tar.gz: 92567f8985d16055720cea95be351e0a675c764734ae9aba366cb85f360d763d623e44136385c09edece332765eb417f5f79be943a2046abcf466323baf6b110
+  metadata.gz: b1a7d56dd3bcf4e27a396d3949e9e8cd546cc70a68bff62444ffee6d6e7a8bc1c8370ae94ba28fc24e4d37c01c979cd989d81370854dd7d10aff1489dac39ec7
+  data.tar.gz: a1322a2ebf8c4965c1f6945ba7bf9e61fde1566d5ea33fc05668897a0eb5c3133a83f5dc23ea5d649b7024b06dfec9b8dd0f0f79f04bd8b525919e81be7e636b

data/README.md

@@ -20,7 +20,7 @@ that doesn't have other authentication or persistence mechanisms (like cookies):
   * Links that come with an expiration date (à la S3)
   * Mini-apps that don't persist data on the server
 
-Works with Ruby 2.1+
+Works with Ruby 2.6+
 
 **Important**: As a general guideline, URL lengths shouldn't exceed about 2000
 characters in length, as URLs longer than that will not work in some browsers
@@ -41,18 +41,21 @@ Add to your Gemfile:
 gem 'urlcrypt', '~> 0.1.1', require: 'URLcrypt'
 ```
 
+Then, set `ENV['urlcrypt_key']` to the default encryption key you will be using. This should be at least a 256-bit AES key, see below. **To ensure your strings are encoded, URLcrypt uses `ENV.fetch` to check for the variable, so it _must_ be set.**
+
 ## Example
 
 ```ruby
-# encrypt and encode with 256-bit AES
-# one-time setup, set this to a securely random key with at least 256 bits, see below
-URLcrypt.key = '...'
-
-# now encrypt and decrypt!
+# encrypt and decrypt using the default key from ENV['urlcrypt_key']!
 URLcrypt.encrypt('chunky bacon!')        # => "sgmt40kbmnh1663nvwknxk5l0mZ6Av2ndhgw80rkypnp17xmmg5hy"
 URLcrypt.decrypt('sgmt40kbmnh1663nvwknxk5l0mZ6Av2ndhgw80rkypnp17xmmg5hy')
   # => "chunky bacon!"
 
+# If needed, you can specify a custom key per-call
+URLcrypt.encrypt('chunky bacon!', key: '...')        # => "....."
+URLcrypt.decrypt('sgmt40kbmnh1663nvwknxk5l0mZ6Av2ndhgw80rkypnp17xmmg5hy', key: '...')
+# => "chunky bacon!"
+
 # encoding without encryption (don't use for anything sensitive!), doesn't need key set
 URLcrypt.encode('chunky bacon!')          # => "mnAhk6tlp2qg2yldn8xcc"
 URLcrypt.decode('mnAhk6tlp2qg2yldn8xcc')  # => "chunky bacon!"
@@ -70,7 +73,7 @@ ba7f56f8f9873b1653d7f032cc474938fd749ee8fbbf731a7c41d698826aca3cebfffa832be7e6bc
 To use the key with URLcrypt, you'll need to convert that from a hex string into a real byte array:
 
 ```ruby
-URLcrypt::key = ['longhexkeygoeshere'].pack('H*')
+ENV['urlcrypt_key'] = ['longhexkeygoeshere'].pack('H*')
 ```
 
 ## Running the Test Suite

data/Rakefile

@@ -1,4 +1,4 @@
-# Copyright (c) 2013 Thomas Fuchs
+# Copyright (c) 2013-2022 Thomas Fuchs
 # Copyright (c) 2007-2011 Samuel Tesla
 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -33,12 +33,11 @@ gemspec = Gem::Specification.new do |s|
   s.email = "thomas@slash7.com"
   s.extra_rdoc_files = ["README.md"]
   s.files = FileList["Rakefile", "{config,lib,test}/**/*"]
-  s.has_rdoc = true
   s.name = 'urlcrypt'
   s.require_paths << 'lib'
   s.requirements << 'none'
   s.summary = "Securely encode and decode short pieces of arbitrary binary data in URLs."
-  s.version = "0.1.2"
+  s.version = "0.2.0"
 end
 
 Gem::PackageTask.new(gemspec) do |pkg|

data/lib/URLcrypt.rb

@@ -2,14 +2,10 @@ require 'openssl'
 
 module URLcrypt
   # avoid vowels to not generate four-letter words, etc.
-  # this is important because those words can trigger spam 
+  # this is important because those words can trigger spam
   # filters when URLs are used in emails
   TABLE = "1bcd2fgh3jklmn4pqrstAvwxyz567890".freeze
 
-  def self.key=(key)
-    @key = key
-  end
-
   class Chunk
     def initialize(bytes)
       @bytes = bytes
@@ -31,7 +27,11 @@ module URLcrypt
       [(0..n-1).to_a.reverse.collect {|i| TABLE[(c >> i * 5) & 0x1f].chr},
        ("=" * (8-n))] # TODO: remove '=' padding generation
     end
-    
+  end
+
+  def self.key=(key)
+    warn "`URLcrypt.key=` is deprecated. See the README on using environment variables with URLcrypt."
+    ENV['urlcrypt_key'] = [key].pack('H*')
   end
 
   def self.chunks(str, size)
@@ -52,27 +52,26 @@ module URLcrypt
   def self.decode(data)
     chunks(data, 8).collect(&:decode).flatten.join
   end
-  
-  def self.decrypt(data)
+
+  def self.decrypt(data, key: ENV.fetch('urlcrypt_key'))
     iv, encrypted = data.split('Z').map{|part| decode(part)}
     fail DecryptError, "not a valid string to decrypt" unless iv && encrypted
-    decrypter = cipher(:decrypt)
+    decrypter = cipher(:decrypt, key: key)
     decrypter.iv = iv
-    decrypter.update(encrypted) + decrypter.final 
+    decrypter.update(encrypted) + decrypter.final
   end
-    
-  def self.encrypt(data)
-    crypter = cipher(:encrypt)
+
+  def self.encrypt(data, key: ENV.fetch('urlcrypt_key'))
+    crypter = cipher(:encrypt, key: key)
     crypter.iv = iv = crypter.random_iv
     "#{encode(iv)}Z#{encode(crypter.update(data) + crypter.final)}"
   end
-  
-  private 
-    
-    def self.cipher(mode)
+
+  private
+    def self.cipher(mode, key:)
       cipher = OpenSSL::Cipher.new('aes-256-cbc')
       cipher.send(mode)
-      cipher.key = @key.byteslice(0,cipher.key_len)
+      cipher.key = key.byteslice(0,cipher.key_len)
       cipher
     end
 

data/test/URLcrypt_test.rb

@@ -23,23 +23,9 @@ class TestURLcrypt < TestClass
       assert_decoding(encoded, original)
     end
   end
-  
-  def test_encryption
-    # pack() converts this secret into a byte array
-    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d'].pack('H*')
-    URLcrypt::key = secret
 
-    assert_equal  OpenSSL::Cipher.new('aes-256-cbc').key_len, secret.bytesize
-
-    original  = "hello world!"
-    encrypted = URLcrypt::encrypt(original)
-    assert_equal(URLcrypt::decrypt(encrypted), original)
-  end
-
-  def test_decrypt_error
-    error = assert_raises(URLcrypt::DecryptError) do
-      ::URLcrypt::decrypt("just some plaintext")
-    end
-    assert_equal error.message, "not a valid string to decrypt"
+  def test_key_deprecation
+    URLcrypt.key = 'aaaa'
+    assert_equal "\xAA\xAA", ENV.fetch('urlcrypt_key')
   end
 end

data/test/encryption_test.rb

@@ -0,0 +1,120 @@
+# encoding: utf-8
+require 'test_helper'
+
+class URLcryptEncryptionTest < TestClass
+  def teardown
+    ENV["urlcrypt_key"] = nil
+  end
+
+  def test_requires_ENV_if_no_key_provided
+    error = assert_raises(KeyError) do
+      ::URLcrypt::decrypt("just some plaintext")
+    end
+    assert_equal error.message, "key not found: \"urlcrypt_key\""
+
+    error = assert_raises(KeyError) do
+      ::URLcrypt::encrypt("just some plaintext")
+    end
+    assert_equal error.message, "key not found: \"urlcrypt_key\""
+  end
+
+  def test_encryption_with_ENV_key
+    # pack() converts this secret into a byte array
+    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d'].pack('H*')
+    ENV['urlcrypt_key'] = secret
+
+    assert_equal  OpenSSL::Cipher.new('aes-256-cbc').key_len, secret.bytesize
+
+    original  = "hello world!"
+    encrypted = URLcrypt::encrypt(original)
+    assert_equal(URLcrypt::decrypt(encrypted), original)
+  end
+
+  def test_decrypt_error_with_ENV_key
+    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d'].pack('H*')
+    ENV['urlcrypt_key'] = secret
+    error = assert_raises(URLcrypt::DecryptError) do
+      ::URLcrypt::decrypt("just some plaintext")
+    end
+    assert_equal error.message, "not a valid string to decrypt"
+  end
+
+  def test_encryption_with_explicit_key
+    # pack() converts this secret into a byte array
+    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d'].pack('H*')
+
+    assert_equal  OpenSSL::Cipher.new('aes-256-cbc').key_len, secret.bytesize
+
+    original  = "hello world!"
+    encrypted = URLcrypt::encrypt(original, key: secret)
+    assert_equal(URLcrypt::decrypt(encrypted, key: secret), original)
+  end
+
+  def test_decrypt_error_with_explicit_key
+    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d'].pack('H*')
+    error = assert_raises(URLcrypt::DecryptError) do
+      ::URLcrypt::decrypt("just some plaintext", key: secret)
+    end
+    assert_equal error.message, "not a valid string to decrypt"
+  end
+
+  def test_threads_with_ENV_keys
+    # pack() converts this secret into a byte array
+    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d'].pack('H*')
+    ENV['urlcrypt_key'] = secret
+
+    assert_equal  OpenSSL::Cipher.new('aes-256-cbc').key_len, secret.bytesize
+
+    parent_string  = "hello world!"
+    parent_encrypted = URLcrypt::encrypt(parent_string)
+    assert_equal(URLcrypt::decrypt(parent_encrypted), parent_string)
+
+    threads = 100.times.map do |n|
+      Thread.new{
+        original = "Test String #{n}"
+        encrypted = URLcrypt::encrypt(original)
+        assert_equal(URLcrypt::decrypt(encrypted), original)
+
+        thread_encrypted = URLcrypt::encrypt(parent_string)
+
+        assert_equal(URLcrypt::decrypt(thread_encrypted), parent_string)
+        assert_equal(URLcrypt::decrypt(parent_encrypted), parent_string)
+      }
+    end
+
+    threads.each { |thr| thr.join }
+  end
+
+  def test_threads_with_explicit_per_thread_keys
+    threads = 100.times.map do |n|
+      Thread.new{
+        key = ["d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d-secret-key-#{n}"].pack('H*')
+        original = "Test String #{n}"
+        encrypted = URLcrypt::encrypt(original, key: key)
+        assert_equal(URLcrypt::decrypt(encrypted, key: key), original)
+      }
+    end
+
+    threads.each { |thr| thr.join }
+  end
+
+  def test_threads_with_explicit_per_thread_keys_overriding_ENV_variable
+    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d'].pack('H*')
+    ENV['urlcrypt_key'] = secret
+
+    threads = 100.times.map do |n|
+      Thread.new{
+        key = ["d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d-secret-key-#{n}"].pack('H*')
+
+        original = "Test String #{n}"
+        encrypted = URLcrypt::encrypt(original, key: key)
+        assert_equal(URLcrypt::decrypt(encrypted, key: key), original)
+
+        parent_encryption = URLcrypt::encrypt(original)
+        refute_equal parent_encryption, encrypted
+      }
+    end
+
+    threads.each { |thr| thr.join }
+  end
+end

data/test/regression_test.rb

@@ -1,36 +1,31 @@
 # encoding: utf-8
 class URLcryptRegressionTest < TestClass
+  def setup
+    # this key was generated via rake secret in a rails app, the pack() converts it into a byte array
+    @secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d721968887a19bdb01af8f59eb5a90d256bd9903355c20b0b4b39bf4048b9b17b'].pack('H*')
+  end
+
   def test_encryption_and_decryption
     original = '{"some":"json_data","token":"dfsfsdfsdf"}'
-    encrypted = URLcrypt.encrypt(original)
+    encrypted = URLcrypt.encrypt(original, key: @secret)
 
-    encrypted = URLcrypt::encrypt(original)
-    assert_equal(URLcrypt::decrypt(encrypted), original)
+    assert_equal(URLcrypt::decrypt(encrypted, key: @secret), original)
   end
 
   def test_encryption_with_too_long_key
-    # this key was generated via rake secret in a rails app, the pack() converts it into a byte array
-    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d721968887a19bdb01af8f59eb5a90d256bd9903355c20b0b4b39bf4048b9b17b'].pack('H*')
-    URLcrypt::key = secret
-
-    assert OpenSSL::Cipher.new('aes-256-cbc').key_len < secret.bytesize
+    assert OpenSSL::Cipher.new('aes-256-cbc').key_len < @secret.bytesize
 
     original  = "hello world!"
-    encrypted = URLcrypt::encrypt(original)
-    assert_equal(URLcrypt::decrypt(encrypted), original)
+    encrypted = URLcrypt::encrypt(original, key: @secret)
+    assert_equal(URLcrypt::decrypt(encrypted, key: @secret), original)
   end
 
   def test_encryption_and_decryption_with_too_long_key
-    # this key was generated via rake secret in a rails app, the pack() converts it into a byte array
-    secret = ['d25883a27b9a639da85ea7e159b661218799c9efa63069fac13a6778c954fb6d721968887a19bdb01af8f59eb5a90d256bd9903355c20b0b4b39bf4048b9b17b'].pack('H*')
-    URLcrypt::key = secret
-
-    assert OpenSSL::Cipher.new('aes-256-cbc').key_len < secret.bytesize
+    assert OpenSSL::Cipher.new('aes-256-cbc').key_len < @secret.bytesize
 
     original = '{"some":"json_data","token":"dfsfsdfsdf"}'
-    encrypted = URLcrypt.encrypt(original)
+    encrypted = URLcrypt.encrypt(original, key: @secret)
 
-    encrypted = URLcrypt::encrypt(original)
-    assert_equal(URLcrypt::decrypt(encrypted), original)
+    assert_equal(URLcrypt::decrypt(encrypted, key: @secret), original)
   end
 end

data/test/test_helper.rb

@@ -2,12 +2,12 @@
 require 'bundler'
 Bundler.require(:default, :test)
 
-require 'coveralls'
-Coveralls.wear!
+require 'simplecov'
+SimpleCov.start
 
-require 'test/unit'
+require "minitest/autorun"
 
-class TestClass < Test::Unit::TestCase
+class TestClass < Minitest::Test
   require 'URLcrypt'
 
   def assert_bytes_equal(string1, string2)
@@ -15,7 +15,7 @@ class TestClass < Test::Unit::TestCase
     bytes2 = string2.bytes.to_a.join(':')
     assert_equal(bytes1, bytes2)
   end
-  
+
   def assert_decoding(encoded, plain)
     decoded = URLcrypt.decode(encoded)
     assert_bytes_equal(plain, decoded)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: urlcrypt
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Thomas Fuchs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-02 00:00:00.000000000 Z
+date: 2022-02-24 00:00:00.000000000 Z
 dependencies: []
 description: 
 email: thomas@slash7.com
@@ -22,6 +22,7 @@ files:
 - config/environment.rb
 - lib/URLcrypt.rb
 - test/URLcrypt_test.rb
+- test/encryption_test.rb
 - test/regression_test.rb
 - test/test_helper.rb
 homepage: 
@@ -44,7 +45,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.1.2
+rubygems_version: 3.1.6
 signing_key: 
 specification_version: 4
 summary: Securely encode and decode short pieces of arbitrary binary data in URLs.