aboutsummaryrefslogtreecommitdiffstats
path: root/activesupport/lib/active_support/message_encryptor.rb
Commit message (Collapse)AuthorAgeFilesLines
* document metadata support added to message encryptor and message verifierAssain2017-07-241-0/+32
| | | | [ci skip]
* Add expires_at, expires_in, and purpose meta_data to messages.Assain2017-07-191-5/+6
|
* [Active Support] `rubocop -a --only Layout/EmptyLineAfterMagicComment`Koichi ITO2017-07-111-0/+1
|
* Merge pull request #29730 from bdewater/update-encryptor-docsKasper Timm Hansen2017-07-091-5/+6
|\ | | | | Update MessageEncryptor example to use dynamic key length
| * [ci skip] update MessageEncryptor example to use the key length as returned ↵Bart de Water2017-07-091-5/+6
| | | | | | | | by OpenSSL
* | Use frozen-string-literal in ActiveSupportKir Shatrov2017-07-091-0/+1
| |
* | Merge branch 'master' into require_relative_2017Xavier Noria2017-07-021-1/+1
|\ \
| * | Revert "Merge pull request #29540 from kirs/rubocop-frozen-string"Matthew Draper2017-07-021-1/+0
| | | | | | | | | | | | | | | This reverts commit 3420a14590c0e6915d8b6c242887f74adb4120f9, reversing changes made to afb66a5a598ce4ac74ad84b125a5abf046dcf5aa.
| * | Merge pull request #29540 from kirs/rubocop-frozen-stringMatthew Draper2017-07-021-0/+1
| |\ \ | | | | | | | | | | | | Enforce frozen string in Rubocop
| | * | Enforce frozen string in RubocopKir Shatrov2017-07-011-0/+1
| | |/
| * / Make ActiveSupport frozen string literal friendly.Pat Allan2017-06-201-1/+1
| |/ | | | | | | | | | | | | The ActiveSupport test suite only passes currently if it uses the latest unreleased commits for dalli, and a patch for Builder: https://github.com/tenderlove/builder/pull/6 Beyond that, all external dependencies (at least, to the extent they’re used by ActiveSupport) are happy, including Nokogiri as of 1.8.0.
* / [Active Support] require => require_relativeAkira Matsuda2017-07-011-2/+2
|/
* Fix `Message::Encryptor` default cipher [ci skip]yuuji.yaginuma2017-06-121-1/+1
| | | | Follow up of #29263
* set message_encryptor default cipher to aes-256-gcmAssain2017-06-121-4/+14
| | | | - Introduce a method to select default cipher, and maintain backward compatibility
* Merge pull request #29086 from mikeycgto/message-encryptor-auth-tag-checkKasper Timm Hansen2017-05-151-1/+1
|\ | | | | | | | | Message encryptor auth tag check Fixes MessageEncryptor when used in AEAD mode. Specifically, we need to check if the `auth_tag` is nil. This may arise when an AEAD encryptor is used to decrypt a ciphertext generated from a different mode, such as CBC-HMAC. Basically, the number of double dashes will differ and `auth_tag` may be nil in this case.
| * Fix for AEAD auth_tag check in MessageEncryptorMichael Coyne2017-05-151-1/+1
| | | | | | | | | | | | | | | | | | When MessageEncryptor tries to +decrypt_and_verify+ ciphertexts generated in a different mode (such CBC-HMAC), the +auth_tag+ may be +nil+ and must explicitly check for it. See the discussion here: https://github.com/rails/rails/pull/28132#discussion_r116388462
* | Tweak 28412Jon Moss2017-03-151-1/+1
| | | | | | | | | | | | PR was merged before I could finished reviewing :grimacing: [ci skip]
* | Merge pull request #28412 from benoittgt/add_doc_for_message_encryptor_newRafael França2017-03-151-0/+5
|\ \ | | | | | | Add documentation about signature_key for MessageEncryptor.new [ci skip]
| * | Add documentation about signature_key for MessageEncryptor.new [ci skip]Benoit Tigeot2017-03-151-0/+5
| |/
* / Use DEFAULT_CIPHER constant in MessageEncryptorLukas Zapletal2017-03-011-1/+1
|/
* Make sure we generate keys that can be used with the cipherRafael Mendonça França2017-01-041-4/+4
| | | | | | | | | We use aes-256-cbc cipher by default and it only accepts keys with 32 bytes at max. Closes #27576. [ci skip]
* Start passing cipher from EncryptedCookieJar since we use it to determine ↵Vipul A M2016-09-011-0/+7
| | | | key length
* Add three new rubocop rulesRafael Mendonça França2016-08-161-1/+1
| | | | | | | | Style/SpaceBeforeBlockBraces Style/SpaceInsideBlockBraces Style/SpaceInsideHashLiteralBraces Fix all violations in the repository.
* normalizes indentation and whitespace across the projectXavier Noria2016-08-061-51/+51
|
* applies new string literal convention in activesupport/libXavier Noria2016-08-061-6/+6
| | | | | The current code base is not uniform. After some discussion, we have chosen to go with double quotes by default.
* Add rationale for manually checking auth_tag length, which got lost when ↵Bart de Water2016-07-271-0/+4
| | | | #25874 was squashed before merging [skip ci]
* Allow MessageEncryptor to take advantage of authenticated encryption modesBart de Water2016-07-211-4/+37
| | | | | | AEAD modes like `aes-256-gcm` provide both confidentiality and data authenticity, eliminating the need to use MessageVerifier to check if the encrypted data has been tampered with. Signed-off-by: Jeremy Daer <jeremydaer@gmail.com>
* use OpenSSL::Cipher instead of deprecated OpenSSL::Cipher::Cipher for cipher ↵Vipul A M2016-05-291-1/+1
| | | | | | creation. Based on https://github.com/rails/rails/pull/25192#discussion_r65018222 and http://ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/Cipher/Cipher.html
* update docs for MessageEncryptor#new to recommend a KDF [ci skip]Paul Kehrer2015-11-101-2/+2
|
* Freeze string literals when not mutated.schneems2015-07-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I wrote a utility that helps find areas where you could optimize your program using a frozen string instead of a string literal, it's called [let_it_go](https://github.com/schneems/let_it_go). After going through the output and adding `.freeze` I was able to eliminate the creation of 1,114 string objects on EVERY request to [codetriage](codetriage.com). How does this impact execution? To look at memory: ```ruby require 'get_process_mem' mem = GetProcessMem.new GC.start GC.disable 1_114.times { " " } before = mem.mb after = mem.mb GC.enable puts "Diff: #{after - before} mb" ``` Creating 1,114 string objects results in `Diff: 0.03125 mb` of RAM allocated on every request. Or 1mb every 32 requests. To look at raw speed: ```ruby require 'benchmark/ips' number_of_objects_reduced = 1_114 Benchmark.ips do |x| x.report("freeze") { number_of_objects_reduced.times { " ".freeze } } x.report("no-freeze") { number_of_objects_reduced.times { " " } } end ``` We get the results ``` Calculating ------------------------------------- freeze 1.428k i/100ms no-freeze 609.000 i/100ms ------------------------------------------------- freeze 14.363k (± 8.5%) i/s - 71.400k no-freeze 6.084k (± 8.1%) i/s - 30.450k ``` Now we can do some maths: ```ruby ips = 6_226k # iterations / 1 second call_time_before = 1.0 / ips # seconds per iteration ips = 15_254 # iterations / 1 second call_time_after = 1.0 / ips # seconds per iteration diff = call_time_before - call_time_after number_of_objects_reduced * diff * 100 # => 0.4530373333993266 miliseconds saved per request ``` So we're shaving off 1 second of execution time for every 220 requests. Is this going to be an insane speed boost to any Rails app: nope. Should we merge it: yep. p.s. If you know of a method call that doesn't modify a string input such as [String#gsub](https://github.com/schneems/let_it_go/blob/b0e2da69f0cca87ab581022baa43291cdf48638c/lib/let_it_go/core_ext/string.rb#L37) please [give me a pull request to the appropriate file](https://github.com/schneems/let_it_go/blob/b0e2da69f0cca87ab581022baa43291cdf48638c/lib/let_it_go/core_ext/string.rb#L37), or open an issue in LetItGo so we can track and freeze more strings. Keep those strings Frozen ![](https://www.dropbox.com/s/z4dj9fdsv213r4v/let-it-go.gif?dl=1)
* Add config option for cookies digestŁukasz Strzałkowski2014-08-121-1/+2
| | | | | | You can now configure custom digest for cookies in the same way as `serializer`: config.action_dispatch.cookies_digest = 'SHA256'
* Allow session serializer key in config.session_storeLukasz Sarnacki2014-01-291-1/+1
| | | | | | | | | | | | | MessageEncryptor has :serializer option, where any serializer object can be passed. This commit make it possible to set this serializer from configuration level. There are predefined serializers (:marshal_serializer, :json_serialzier) and custom serializer can be passed as String, Symbol (camelized and constantized in ActionDispatch::Session namepspace) or serializer object. Default :json_serializer was also added to generators to provide secure defalt.
* Use `Base.strict_decode64` instead of `Base.decode64` just as we do in encoding;Vipul A M2013-05-161-3/+3
| | | | Also reduce extra object allocation by creating string directly instead of join on Array
* Merge pull request #9980 from stouset/patch-1Andrew White2013-04-261-4/+5
|\ | | | | | | | | Improve poor security recommendation in docs [ci skip]
| * Improve poor security recommendation in docsStephen Touset2013-03-281-4/+5
| | | | | | | | | | As reported in #9960, the current documentation recommends an insecure practice for key generation from a password (a single round of SHA-256). The modified documentation uses ActiveSupport::KeyGenerator to perform proper key stretching.
* | Reorganize MessageEncryptorjgls2013-04-191-5/+4
|/ | | | | | | | | 1) According to OpenSSL's documentation, cipher.random_iv must be called after cipher.encrypt and already sets the generated IV on the cipher. 2) OpenSSL::CipherError was moved to OpenSSL::Cipher::CipherError in Ruby 1.8.7. Since Rails 4 requires at least Ruby 1.9.3, support for the old location can be dropped.
* Missing require extract_optionsAkira Matsuda2013-01-311-0/+1
|
* Replace comments' non-breaking spaces with spacesclaudiob2012-12-041-2/+2
| | | | | | | | | | Sometimes, on Mac OS X, programmers accidentally press Option+Space rather than just Space and don’t see the difference. The problem is that Option+Space writes a non-breaking space (0XA0) rather than a normal space (0x20). This commit removes all the non-breaking spaces inadvertently introduced in the comments of the code.
* Add cookie.encrypted which returns an EncryptedCookieJarSantiago Pastorino2012-11-031-2/+5
| | | | | | | | | How to use it? cookies.encrypted[:discount] = 45 => Set-Cookie: discount=ZS9ZZ1R4cG1pcUJ1bm80anhQang3dz09LS1mbDZDSU5scGdOT3ltQ2dTdlhSdWpRPT0%3D--ab54663c9f4e3bc340c790d6d2b71e92f5b60315; path=/ cookies.encrypted[:discount] => 45
* update AS docs [ci skip]Francesco Rodriguez2012-09-171-20/+22
|
* [ci skip] More docs for ActiveSupport::MessageEncryptorDaniel Fone2012-01-261-0/+14
|
* remove ActiveSupport::Base64 in favor of ::Base64Sergey Nartimov2012-01-021-3/+3
|
* deprecate Base64.encode64s from AS. Use Base64.strict_encode64 insteadVasiliy Ermolovich2011-12-271-1/+1
|
* Remove deprecations from Active Support.José Valim2011-12-201-17/+0
|
* Don't marshal dump twice when using encryptor.José Valim2011-11-091-1/+12
|
* Deprecated ActiveSupport::MessageEncryptor#encrypt and decrypt.José Valim2011-11-091-17/+32
|
* Fix typo in deprecation warning.Peter Suschlik2011-09-161-1/+1
|
* Use an options hash to specify digest/cipher algorithm and a serializer for ↵Willem van Bergen2011-09-151-7/+10
| | | | MessageVerifier and MessageEncryptor.
* Implement API suggestions of pull request.Willem van Bergen2011-09-151-6/+5
|
* Custom serializers and deserializers in MessageVerifier and MessageEncryptor.Willem van Bergen2011-09-151-2/+6
| | | | | By default, these classes use Marshal for serializing and deserializing messages. Unfortunately, the Marshal format is closely associated with Ruby internals and even changes between different interpreters. This makes the resulting message very hard to impossible to unserialize messages generated by these classes in other environments like node.js. This patch solves this by allowing you to set your own custom serializer and deserializer lambda functions. By default, it still uses Marshal to be backwards compatible.
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 08:28:11 +0000