usps-jwt_auth 1.2.2 → 1.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17662af2194b354229fdc800d007e1121fb3a34dbb65bcf1a8e1df2ec0011087
-  data.tar.gz: 7a2017a06711cb9a4714b111a4a2ee85ca3ede7c7e9d0d851e098d1dd83fa302
+  metadata.gz: 6ce721a644d600d1c0d4f628bd17a1588631ce652bbf0cc5393a2cba5a21e931
+  data.tar.gz: 14d6701e1890f6c43b0c77d0c42b9b7b35a7ee32a0fd2935ed358720fa9f5882
 SHA512:
-  metadata.gz: 33b3ce36812329c3d25a890fd1c5d0c8b591671fef159fd602276b5217f238c021e65c60512e1ea75dc5addc07d6b1f56b0b6c2329c027cfe79362f9752752c4
-  data.tar.gz: e7e2aed19988c5148ad9550e20b94e018ac1fad129704badbce18a35f027d9c5da231b1570d7eb9821d08838921af238fed223cdd7412b72e5f2b9dab69a7f41
+  metadata.gz: e85979fd43fdca1b7a625cbb8ac3c93e71e1d82eaa002805ea4fe396cc2fd05adcbdc996c058ba99089566842643b9399ff9ea00f81f92c7991f2f2726fd989d
+  data.tar.gz: a25da72d317735201c4363ec8e0ba02485a5725049c886df3ee0e1a0319f6a60e79ec3f2cbf64eb16ad1ec0597097cadf1af826aa052d1275faf96d18fbd4411

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    usps-jwt_auth (1.2.2)
+    usps-jwt_auth (1.2.4)
       activesupport (~> 8.0)
       colorize (~> 1.1)
       fileutils (~> 1.7)

data/lib/usps/jwt_auth/concern.rb

@@ -75,18 +75,30 @@ module Usps
       def set_new_jwt
         return if params[:jwt].blank? || @set_new_jwt
 
-        store_jwt(params[:jwt])
-        # An unverifiable token (e.g. a key we cannot resolve) clears the jwt and returns
-        # nil; fall through so the visitor is sent to login rather than into the app.
-        return unless ensure_valid_jwt_has_valid_member!
+        # Nothing is stored until the token is verified, so a bad one can't disturb the current
+        # session. Fall through, and a visitor with no session is sent to login.
+        return unless ensure_valid_jwt_has_valid_member!(params[:jwt])
 
+        store_jwt(params[:jwt])
         redirect_to_path!
         @set_new_jwt = true
       end
 
+      # Back to where the login began, with the query it began with. The query rides through the login
+      # as a single `query_string` parameter, and is unpacked here rather than handed on still packed.
+      # It is re-encoded rather than passed through as received, so the redirect stays well-formed
+      # whatever arrives.
       def redirect_to_path!
-        path = params[:path] || root_path
-        redirect_to(params.key?(:query_string) ? "#{path}?query_string=#{CGI.escape(params[:query_string])}" : path)
+        path = local_path(params[:path])
+        pairs = URI.decode_www_form(params[:query_string].to_s).reject { |key, _value| key.empty? }
+
+        redirect_to(pairs.empty? ? path : "#{path}?#{URI.encode_www_form(pairs)}")
+      end
+
+      # Anything but a single leading slash could point the redirect at another host, which Rails
+      # answers with a 500.
+      def local_path(path)
+        path.is_a?(String) && path.match?(%r{\A/(?![/\\])[^\x00-\x1f\x7f]*\z}) ? path : root_path
       end
 
       def store_jwt(token)
@@ -107,36 +119,38 @@ module Usps
         session[:jwt] || cookies[:jwt]
       end
 
-      def jwt
-        Decode.decode(
-          fetch_jwt,
-          audience: [JwtAuth.config.audience],
-          issuer: Regexp.union(JwtAuth.config.issuers)
-        )
+      def jwt = decode_jwt(fetch_jwt)
+
+      def decode_jwt(token)
+        Decode.decode(token, audience: [JwtAuth.config.audience], issuer: Regexp.union(JwtAuth.config.issuers))
       end
 
       def redirect_to_login
         return if @set_new_jwt
 
-        url = 'https://www.usps.org/jwt/'
-        local = "#{url}?local&port=#{ENV.fetch('PORT', '3000')}"
-        production = "#{url}?application=#{JwtAuth.config.audience}"
-        url = JwtAuth.config.environment.development? ? local : production
-        url = "#{url}&path=#{request.path}"
+        # Escaped so the path can't add parameters of its own to the login request.
+        url = "#{login_url}&path=#{CGI.escape(request.path)}"
         url = "#{url}&query_string=#{CGI.escape(request.query_string)}" if request.query_string.present?
 
         redirect_to(url, allow_other_host: true)
       end
 
-      def ensure_valid_jwt_has_valid_member!
-        fetch_jwt
-        jwt_user
+      def login_url
+        url = 'https://www.usps.org/jwt/'
+        return "#{url}?local&port=#{ENV.fetch('PORT', '3000')}" if JwtAuth.config.environment.development?
+
+        "#{url}?application=#{JwtAuth.config.audience}"
+      end
+
+      def ensure_valid_jwt_has_valid_member!(token)
+        certificate = decode_jwt(token)['certificate']
+        # A blank certificate claim is malformed and must never resolve to a member.
+        JwtAuth.config.find_member.call(certificate) if certificate.present?
       rescue JWT::DecodeError
-        # The token cannot be verified (e.g. an unresolvable key). Drop it and report
-        # "not signed in" so the caller redirects to login — never let this escape as an
-        # unhandled 500, which the error page would re-trigger when it re-authenticates.
-        clear_jwt
-        @current_user = nil
+        # The token cannot be verified (e.g. an unresolvable key). Report it as invalid so the
+        # caller falls through — never let this escape as an unhandled 500, which the error page
+        # would re-trigger when it re-authenticates.
+        nil
       rescue ActiveRecord::RecordNotFound
         reset_session
         clear_jwt

data/lib/usps/jwt_auth/decode.rb

@@ -12,6 +12,7 @@ module Usps
       # Keep a slow or unreachable store from tying up the caller (e.g. a web worker).
       OPEN_TIMEOUT = 2
       READ_TIMEOUT = 2
+      KEY_NAME = /\A[A-Za-z0-9_-]{1,128}\z/
 
       def self.decode(token, audience: [], issuer: nil)
         new.decode(token, audience: audience, issuer: issuer)
@@ -29,21 +30,21 @@ module Usps
       end
 
       def decode(token, audience: [], issuer: nil)
-        result = JWT.decode(
-          token,
-          public_key(token),
-          true,
-          self.class.token_options(audience:, issuer:)
-        )
-        result[0]['data']
+        payload, = JWT.decode(token, public_key(token), true, self.class.token_options(audience:, issuer:))
+        return payload['data'] if payload['data'].is_a?(Hash)
+
+        raise JWT::DecodeError, 'Token has no data'
+      rescue ArgumentError, TypeError, NoMethodError, OpenSSL::PKey::PKeyError => e
+        # Whatever a token holds, callers only need to handle JWT::DecodeError.
+        raise JWT::DecodeError, "Unreadable token: #{e.class}"
       end
 
     private
 
       # Resolve the public key the token names by its fingerprint. Fast path is the local
       # cache; on a miss we fetch it once from the shared store and cache it permanently
-      # (a fingerprint maps to one key forever). The store is treated as untrusted — see
-      # cache_verified_key — so a tampered key can never be trusted.
+      # (a fingerprint maps to one key forever). A token can name any key in the store, so
+      # write access to the store is as sensitive as a signing key.
       def public_key(token)
         fingerprint = fingerprint(token)
         OpenSSL::PKey::RSA.new(File.read(cache_path(fingerprint)))
@@ -70,9 +71,9 @@ module Usps
         raise JWT::VerificationError, "Could not fetch public key for token fingerprint: #{e.message}"
       end
 
-      # Trust nothing the store returns until the key reproduces the fingerprint the token
-      # names. Without this check a compromised store/CDN could serve an attacker key under a
-      # known fingerprint and forge valid tokens. Only verified keys are written to the cache.
+      # Use nothing the store returns until the key reproduces the fingerprint the token names.
+      # This stops the store or CDN swapping in a different key for a known fingerprint. Only
+      # verified keys are written to the cache.
       def cache_verified_key(fingerprint, pem)
         key = OpenSSL::PKey::RSA.new(pem)
         unless Fingerprint.for(key.public_key) == fingerprint
@@ -105,8 +106,13 @@ module Usps
         response.body
       end
 
+      # Read before the signature is checked, so this claim can only ever name a key file. Its
+      # alphabet leaves no way to form a path.
       def fingerprint(token)
-        JWT.decode(token, nil, false)[0]['key']
+        name = JWT.decode(token, nil, false)[0]['key']
+        return name if name.is_a?(String) && name.match?(KEY_NAME)
+
+        raise JWT::VerificationError, 'Token names an invalid key'
       end
     end
   end

data/lib/usps/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module JwtAuth
-    VERSION = '1.2.2'
+    VERSION = '1.2.4'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 1.2.2
+  version: 1.2.4
 platform: ruby
 authors:
 - Julian Fiander