diff options
author | Rafael França <rafael@franca.dev> | 2019-07-24 14:16:03 -0400 |
---|---|---|
committer | GitHub <noreply@github.com> | 2019-07-24 14:16:03 -0400 |
commit | bcc3d625b446142842d26f4c8a32740a4cafc60b (patch) | |
tree | 8521fcbccc039b3a1fdfe38f1e6e12b00867420d /activesupport/lib | |
parent | 89ba95b69a4b79f3469254b6fbb164491df9454a (diff) | |
parent | 123bcf5faa6d6963862a33489b2d678d6ef3c137 (diff) | |
download | rails-bcc3d625b446142842d26f4c8a32740a4cafc60b.tar.gz rails-bcc3d625b446142842d26f4c8a32740a4cafc60b.tar.bz2 rails-bcc3d625b446142842d26f4c8a32740a4cafc60b.zip |
Merge pull request #36434 from Edouard-chin/ec-securecompare-rotation
Introduce a new ActiveSupport::SecureCompareRotator class:
Diffstat (limited to 'activesupport/lib')
-rw-r--r-- | activesupport/lib/active_support/secure_compare_rotator.rb | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/activesupport/lib/active_support/secure_compare_rotator.rb b/activesupport/lib/active_support/secure_compare_rotator.rb new file mode 100644 index 0000000000..14a0aee947 --- /dev/null +++ b/activesupport/lib/active_support/secure_compare_rotator.rb @@ -0,0 +1,52 @@ +# frozen_string_literal: true + +require "active_support/security_utils" +require "active_support/messages/rotator" + +module ActiveSupport + # The ActiveSupport::SecureCompareRotator is a wrapper around +ActiveSupport::SecurityUtils.secure_compare+ + # and allows you to rotate a previously defined value to a new one. + # + # It can be used as follow: + # + # rotator = ActiveSupport::SecureCompareRotator.new('new_production_value') + # rotator.rotate('previous_production_value') + # rotator.secure_compare!('previous_production_value') + # + # One real use case example would be to rotate a basic auth credentials: + # + # class MyController < ApplicationController + # def authenticate_request + # rotator = ActiveSupport::SecureComparerotator.new('new_password') + # rotator.rotate('old_password') + # + # authenticate_or_request_with_http_basic do |username, password| + # rotator.secure_compare!(password) + # rescue ActiveSupport::SecureCompareRotator::InvalidMatch + # false + # end + # end + # end + class SecureCompareRotator + include SecurityUtils + prepend Messages::Rotator + + InvalidMatch = Class.new(StandardError) + + def initialize(value, **_options) + @value = value + end + + def secure_compare!(other_value, on_rotation: @rotation) + secure_compare(@value, other_value) || + run_rotations(on_rotation) { |wrapper| wrapper.secure_compare!(other_value) } || + raise(InvalidMatch) + end + + private + + def build_rotation(previous_value, _options) + self.class.new(previous_value) + end + end +end |