Merge pull request #31289 from witlessbird/fips-compatibility

Initial support for running Rails on FIPS-certified systems

7 files changed, 72 insertions, 3 deletions

diff --git a/activesupport/CHANGELOG.md b/activesupport/CHANGELOG.md
index 668c726e1f..abbadd404f 100644
--- a/activesupport/CHANGELOG.md
+++ b/activesupport/CHANGELOG.md
@@ -1,3 +1,10 @@
+*   Introduced `ActiveSupport::Digest` that allows to specify hash function implementation
+    and defaults to `Digest::MD5`.
+
+    Replaced calls to `::Digest::MD5.hexdigest` with calls to `ActiveSupport::Digest.hexdigest`.
+
+    *Dmitri Dolguikh*
+ 
 ## Rails 5.2.0.beta2 (November 28, 2017) ##
 
 *   No changes.
diff --git a/activesupport/lib/active_support.rb b/activesupport/lib/active_support.rb
index 68be94f99d..16b9a5bc1d 100644
--- a/activesupport/lib/active_support.rb
+++ b/activesupport/lib/active_support.rb
@@ -53,6 +53,7 @@ module ActiveSupport
     autoload :Callbacks
     autoload :Configurable
     autoload :Deprecation
+    autoload :Digest
     autoload :Gzip
     autoload :Inflector
     autoload :JSON
diff --git a/activesupport/lib/active_support/cache/file_store.rb b/activesupport/lib/active_support/cache/file_store.rb
index 0812cc34c7..a0f44aac0f 100644
--- a/activesupport/lib/active_support/cache/file_store.rb
+++ b/activesupport/lib/active_support/cache/file_store.rb
@@ -121,7 +121,7 @@ module ActiveSupport
           fname = URI.encode_www_form_component(key)
 
           if fname.size > FILEPATH_MAX_SIZE
-            fname = Digest::MD5.hexdigest(key)
+            fname = ActiveSupport::Digest.hexdigest(key)
           end
 
           hash = Zlib.adler32(fname)
diff --git a/activesupport/lib/active_support/cache/mem_cache_store.rb b/activesupport/lib/active_support/cache/mem_cache_store.rb
index 50f072388d..df8bc8e43e 100644
--- a/activesupport/lib/active_support/cache/mem_cache_store.rb
+++ b/activesupport/lib/active_support/cache/mem_cache_store.rb
@@ -7,7 +7,6 @@ rescue LoadError => e
   raise e
 end
 
-require "digest/md5"
 require "active_support/core_ext/marshal"
 require "active_support/core_ext/array/extract_options"
 
@@ -183,7 +182,7 @@ module ActiveSupport
           key = super.dup
           key = key.force_encoding(Encoding::ASCII_8BIT)
           key = key.gsub(ESCAPE_KEY_CHARS) { |match| "%#{match.getbyte(0).to_s(16).upcase}" }
-          key = "#{key[0, 213]}:md5:#{Digest::MD5.hexdigest(key)}" if key.size > 250
+          key = "#{key[0, 213]}:md5:#{ActiveSupport::Digest.hexdigest(key)}" if key.size > 250
           key
         end
 
diff --git a/activesupport/lib/active_support/digest.rb b/activesupport/lib/active_support/digest.rb
new file mode 100644
index 0000000000..4dac32d420
--- /dev/null
+++ b/activesupport/lib/active_support/digest.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module ActiveSupport
+  class Digest #:nodoc:
+    class <<self
+      def hash_digest_class
+        @hash_digest_class || ::Digest::MD5
+      end
+
+      def hash_digest_class=(klass)
+        raise ArgumentError, "#{klass} is expected to implement hexdigest class method" unless klass.respond_to?(:hexdigest)
+        @hash_digest_class = klass
+      end
+
+      def hexdigest(arg)
+        new.hexdigest(arg)
+      end
+    end
+
+    def initialize(digest_class: nil)
+      @digest_class = digest_class || self.class.hash_digest_class
+    end
+
+    def hexdigest(arg)
+      @digest_class.hexdigest(arg).truncate(32)
+    end
+  end
+end
diff --git a/activesupport/lib/active_support/railtie.rb b/activesupport/lib/active_support/railtie.rb
index 8560eae110..3488721df9 100644
--- a/activesupport/lib/active_support/railtie.rb
+++ b/activesupport/lib/active_support/railtie.rb
@@ -66,5 +66,12 @@ module ActiveSupport
         ActiveSupport.send(k, v) if ActiveSupport.respond_to? k
       end
     end
+
+    initializer "active_support.set_hash_digest_class" do |app|
+      if app.config.active_support.respond_to?(:use_hash_digest_class) && app.config.active_support.use_hash_digest_class
+        ActiveSupport::Digest.hash_digest_class =
+          app.config.active_support.use_hash_digest_class
+      end
+    end
   end
 end
diff --git a/activesupport/test/digest_test.rb b/activesupport/test/digest_test.rb
new file mode 100644
index 0000000000..5dec75b9fe
--- /dev/null
+++ b/activesupport/test/digest_test.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "abstract_unit"
+require "openssl"
+
+class DigestTest < ActiveSupport::TestCase
+  class InvalidDigest; end
+  def test_with_default_hash_digest_class
+    assert_equal ::Digest::MD5.hexdigest("hello friend"), ActiveSupport::Digest.hexdigest("hello friend")
+  end
+
+  def test_with_custom_hash_digest_class
+    original_hash_digest_class = ActiveSupport::Digest.hash_digest_class
+
+    ActiveSupport::Digest.hash_digest_class = ::Digest::SHA1
+    digest = ActiveSupport::Digest.hexdigest("hello friend")
+
+    assert_equal 32, digest.length
+    assert_equal ::Digest::SHA1.hexdigest("hello friend").truncate(32), digest
+  ensure
+    ActiveSupport::Digest.hash_digest_class = original_hash_digest_class
+  end
+
+  def test_should_raise_argument_error_if_custom_digest_is_missing_hexdigest_method
+    assert_raises(ArgumentError) { ActiveSupport::Digest.hash_digest_class = InvalidDigest }
+  end
+end