aboutsummaryrefslogtreecommitdiffstats
path: root/activesupport/test/message_encryptor_test.rb
Commit message (Collapse)AuthorAgeFilesLines
* Allow MessageEncryptor to take advantage of authenticated encryption modesBart de Water2016-07-211-0/+18
| | | | | | AEAD modes like `aes-256-gcm` provide both confidentiality and data authenticity, eliminating the need to use MessageVerifier to check if the encrypted data has been tampered with. Signed-off-by: Jeremy Daer <jeremydaer@gmail.com>
* We default to using aes-256-cbc as our verification/signing cipher. It can ↵Vipul A M2016-06-271-2/+2
| | | | | | | | | | accept key lengths of 128, 192 or 256-bit, whereas currently we were providing twice the acceptable value. ruby < 2.4 allowed accepting these values, as extra key bits were ignored. Since https://github.com/ruby/ruby/commit/ce635262f53b760284d56bb1027baebaaec175d1 this now has a strict checking on key length. Default to key length 32 bytes, to match the compatible length for aes-256-cbc Fixes #25185
* Remove "rescue" clause around "require 'openssl'"claudiob2014-12-031-10/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some `require 'openssl'` statements were surrounded by `rescue` blocks to deal with Ruby versions that did not support `OpenSSL::Digest::SHA1` or `OpenSSL::PKCS5`. [As @jeremy explains](https://github.com/rails/rails/commit/a6a0904fcb12b876469c48b1c885aadafe9188cf#commitcomment-8826666) in the original commit: > If jruby didn't have jruby-openssl gem, the require wouldn't work. Not sure whether either of these are still relevant today. According to the [release notes for JRuby 1.7.13](http://www.jruby.org/2014/06/24/jruby-1-7-13.html): > jruby-openssl 0.9.5 bundled which means the above `rescue` block is not needed anymore. All the Ruby versions supported by the current version of Rails provide those OpenSSL libraries, so Travis CI should also be happy by removing the `rescue` blocks. --- Just to confirm, with JRuby: $ ruby --version #=> jruby 1.7.16.1 (1.9.3p392) 2014-10-28 4e93f31 on Java HotSpot(TM) 64-Bit Server VM 1.8.0_20-b26 +jit [darwin-x86_64] $ irb irb(main):001:0> require 'openssl' #=> true irb(main):002:0> OpenSSL::Digest::SHA1 #=> OpenSSL::Digest::SHA1 irb(main):003:0> OpenSSL::PKCS5 # => OpenSSL::PKCS5 And with Ruby 2.1: $ ruby --version #=> ruby 2.1.2p95 (2014-05-08 revision 45877) [x86_64-darwin13.0] $ irb irb(main):001:0> require 'openssl' #=> true irb(main):002:0> OpenSSL::Digest::SHA1 #=> OpenSSL::Digest::SHA1 irb(main):003:0> OpenSSL::PKCS5 #=> OpenSSL::PKCS5
* Merge pull request #10635 from vipulnsward/change_to_strictJeremy Kemper2013-12-061-1/+12
|\ | | | | Use `Base.strict_decode64` instead of `Base.decode64`
| * Use `Base.strict_decode64` instead of `Base.decode64` just as we do in encoding;Vipul A M2013-05-161-1/+12
| | | | | | | | Also reduce extra object allocation by creating string directly instead of join on Array
* | Standardize all JSON encoded times to use 3 decimal fractional secondsRyan Glover2013-11-071-1/+1
|/
* Fixed bad tests to clean up after themselves.Ryan Davis2013-05-031-1/+6
|
* s/messqage/message/ in message_encryptor_test.rbEzekiel Smithburg2013-01-091-2/+2
|
* Add cookie.encrypted which returns an EncryptedCookieJarSantiago Pastorino2012-11-031-1/+1
| | | | | | | | | How to use it? cookies.encrypted[:discount] = 45 => Set-Cookie: discount=ZS9ZZ1R4cG1pcUJ1bm80anhQang3dz09LS1mbDZDSU5scGdOT3ltQ2dTdlhSdWpRPT0%3D--ab54663c9f4e3bc340c790d6d2b71e92f5b60315; path=/ cookies.encrypted[:discount] => 45
* remove ActiveSupport::Base64 in favor of ::Base64Sergey Nartimov2012-01-021-3/+3
|
* deprecate Base64.encode64s from AS. Use Base64.strict_encode64 insteadVasiliy Ermolovich2011-12-271-1/+1
|
* Remove deprecations from Active Support.José Valim2011-12-201-6/+0
|
* Don't marshal dump twice when using encryptor.José Valim2011-11-091-2/+1
|
* Deprecated ActiveSupport::MessageEncryptor#encrypt and decrypt.José Valim2011-11-091-24/+36
|
* Test deprecation warning when not using an options hash as second parameter.Willem van Bergen2011-09-151-1/+7
|
* Use an options hash to specify digest/cipher algorithm and a serializer for ↵Willem van Bergen2011-09-151-3/+3
| | | | MessageVerifier and MessageEncryptor.
* Implement API suggestions of pull request.Willem van Bergen2011-09-151-3/+12
|
* Fixed tests so that they will also run properly in other timezones.Willem van Bergen2011-09-151-2/+2
|
* Custom serializers and deserializers in MessageVerifier and MessageEncryptor.Willem van Bergen2011-09-151-1/+9
| | | | | By default, these classes use Marshal for serializing and deserializing messages. Unfortunately, the Marshal format is closely associated with Ruby internals and even changes between different interpreters. This makes the resulting message very hard to impossible to unserialize messages generated by these classes in other environments like node.js. This patch solves this by allowing you to set your own custom serializer and deserializer lambda functions. By default, it still uses Marshal to be backwards compatible.
* Replace references to ActiveSupport::SecureRandom with just SecureRandom, ↵Jon Leighton2011-05-231-1/+1
| | | | and require 'securerandom' from the stdlib when active support is required.
* Deletes trailing whitespaces (over text files only find * -type f -exec sed ↵Santiago Pastorino2010-08-141-7/+7
| | | | 's/[ \t]*$//' -i {} \;)
* repair the activesupport message encryptor tests for me, do so in the same ↵Marius Nuennerich2010-05-011-0/+10
| | | | | | | | way as jeremy did with message verifier [#4517 state:committed] Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net>
* Ruby 1.9.2: marshaling round-trips Time#zoneJeremy Kemper2010-03-281-1/+1
|
* Repair time dependenciesJeremy Kemper2009-11-141-0/+1
|
* Ruby 1.9 compat: rename deprecated assert_raises to assert_raise.Jeremy Kemper2009-03-081-1/+1
| | | | [#1617 state:resolved]
* Add a MessageEncryptor, just like MessageVerifier but using symmetric key ↵Michael Koziarski2008-11-251-0/+46
encryption. The use of encryption prevents people from seeing any potentially secret values you've used. It also supports and encrypt_and_sign model to prevent people from tampering with the bits and creating random junk that gets fed to A motivated coder could use this to add an :encrypt=>true option to the cookie store.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-02 10:16:46 +0000