From ba9207f301332b6c3e748eb8fe46b7f6c9ced667 Mon Sep 17 00:00:00 2001 From: Dirkjan Bussink Date: Thu, 7 Jan 2021 16:54:57 +0100 Subject: [PATCH] Change the default digest for new apps to SHA256 As mentioned in https://github.com/rails/rails/pull/40770#issuecomment-748347066 we should default to SHA256 where SHA1 is used today. This switches over the ActiveSupport::Digest to use SHA256 for new applications. It also updates the constants to always refer to and use the OpenSSL constants as well, as also discussed in that PR. --- activesupport/lib/active_support/digest.rb | 4 +++- activesupport/lib/active_support/railtie.rb | 4 ++-- activesupport/test/digest_test.rb | 6 +++--- guides/source/configuring.md | 5 +++-- guides/source/upgrading_ruby_on_rails.md | 7 +++++++ railties/lib/rails/application/configuration.rb | 3 ++- .../initializers/new_framework_defaults_6_2.rb.tt | 12 +++++++++--- railties/test/application/configuration_test.rb | 14 +++++++------- .../application/per_request_digest_cache_test.rb | 2 +- 9 files changed, 37 insertions(+), 20 deletions(-) diff --git a/activesupport/lib/active_support/digest.rb b/activesupport/lib/active_support/digest.rb index fba10fbdcf..1bdc8224d9 100644 --- a/activesupport/lib/active_support/digest.rb +++ b/activesupport/lib/active_support/digest.rb @@ -1,10 +1,12 @@ # frozen_string_literal: true +require "openssl" + module ActiveSupport class Digest #:nodoc: class < elements. # Rails.application.config.action_view.button_to_generates_button_tag = false -# Change the digest class for they key generators to `OpenSSL::Digest::SHA256`. -# Changing this defaults means invalidate all encripted messages generated by +# Change the digest class for the key generators to `OpenSSL::Digest::SHA256`. +# Changing this default means invalidate all encrypted messages generated by # your application and, all the encrypted cookies. Only change this after you -# rotated all the messages using they key rotator. +# rotated all the messages using the key rotator. # # See upgrading guide for more information on how to build a rotator. # https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html # Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256 + +# Change the digest class for ActiveSupport::Digest. +# Changing this default means that for example Etags change and +# various cache keys leading to cache invalidation. +# +# Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256 diff --git a/railties/test/application/configuration_test.rb b/railties/test/application/configuration_test.rb index edbc3c2117..6c48a5b9b3 100644 --- a/railties/test/application/configuration_test.rb +++ b/railties/test/application/configuration_test.rb @@ -2257,18 +2257,18 @@ module ApplicationTests assert_equal true, ActiveSupport::MessageEncryptor.use_authenticated_message_encryption end - test "ActiveSupport::Digest.hash_digest_class is Digest::SHA1 by default for new apps" do + test "ActiveSupport::Digest.hash_digest_class is OpenSSL::Digest::SHA256 by default for new apps" do app "development" - assert_equal Digest::SHA1, ActiveSupport::Digest.hash_digest_class + assert_equal OpenSSL::Digest::SHA256, ActiveSupport::Digest.hash_digest_class end - test "ActiveSupport::Digest.hash_digest_class is Digest::MD5 by default for upgraded apps" do + test "ActiveSupport::Digest.hash_digest_class is OpenSSL::Digest::MD5 by default for upgraded apps" do remove_from_config '.*config\.load_defaults.*\n' app "development" - assert_equal Digest::MD5, ActiveSupport::Digest.hash_digest_class + assert_equal OpenSSL::Digest::MD5, ActiveSupport::Digest.hash_digest_class end test "ActiveSupport::Digest.hash_digest_class can be configured via config.active_support.use_sha1_digests" do @@ -2280,19 +2280,19 @@ module ApplicationTests app "development" - assert_equal Digest::SHA1, ActiveSupport::Digest.hash_digest_class + assert_equal OpenSSL::Digest::SHA1, ActiveSupport::Digest.hash_digest_class end test "ActiveSupport::Digest.hash_digest_class can be configured via config.active_support.hash_digest_class" do remove_from_config '.*config\.load_defaults.*\n' app_file "config/initializers/custom_digest_class.rb", <<-RUBY - Rails.application.config.active_support.hash_digest_class = Digest::SHA256 + Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256 RUBY app "development" - assert_equal Digest::SHA256, ActiveSupport::Digest.hash_digest_class + assert_equal OpenSSL::Digest::SHA256, ActiveSupport::Digest.hash_digest_class end test "ActiveSupport::KeyGenerator.hash_digest_class is OpenSSL::Digest::SHA256 by default for new apps" do diff --git a/railties/test/application/per_request_digest_cache_test.rb b/railties/test/application/per_request_digest_cache_test.rb index 84f0dd7a0d..2cbddd3284 100644 --- a/railties/test/application/per_request_digest_cache_test.rb +++ b/railties/test/application/per_request_digest_cache_test.rb @@ -57,7 +57,7 @@ class PerRequestDigestCacheTest < ActiveSupport::TestCase assert_equal 200, last_response.status values = ActionView::LookupContext::DetailsKey.digest_caches.first.values - assert_equal [ "effc8928d0b33535c8a21d24ec617161" ], values + assert_equal [ "ddb451d2c1b2374caa676005893bb776" ], values assert_equal %w(david dingus), last_response.body.split.map(&:strip) end