kotovalexarian-likes-github/sinatra
1
0
Fork 0
mirror of https://github.com/sinatra/sinatra synced 2023-03-27 23:18:01 -04:00
Code Releases Activity

Replace origin_whitelist with origin_permitted

Browse source
This commit is contained in:
rhymes 2020-07-11 18:01:34 +02:00
parent 380a833e2c
commit 166da3084d
No known key found for this signature in database
GPG key ID: A3853C53AF667707
2 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
rack-protection/lib/rack/protection/http_origin.rb
View file

@ -9,11 +9,11 @@ module Rack
# http://tools.ietf.org/html/draft-abarth-origin
#
# Does not accept unsafe HTTP requests when value of Origin HTTP request header
# does not match default or whitelisted URIs.
# does not match default or permitted URIs.
#
# If you want to whitelist a specific domain, you can pass in as the `:origin_whitelist` option:
# If you want to permit a specific domain, you can pass in as the `:origin_permitted` option:
#
# use Rack::Protection, origin_whitelist: ["http://localhost:3000", "http://127.0.01:3000"]
# use Rack::Protection, origin_permitted: ["http://localhost:3000", "http://127.0.01:3000"]
#
# The `:allow_if` option can also be set to a proc to use custom allow/deny logic.
class HttpOrigin < Base
@ -32,7 +32,14 @@ module Rack
return true unless origin = env['HTTP_ORIGIN']
return true if base_url(env) == origin
return true if options[:allow_if] && options[:allow_if].call(env)
Array(options[:origin_whitelist]).include? origin
if options.key? :origin_whitelist
warn "Rack::Protection origin_whitelist option is deprecated and will be removed, " \
"use origin_whitelist instead.\n"
end
permitted_origins = options[:origin_permitted] || options[:origin_whitelist]
Array(permitted_origins).include? origin
end
end

6
rack-protection/spec/lib/rack/protection/http_origin_spec.rb
View file

@ -15,7 +15,7 @@ describe Rack::Protection::HttpOrigin do
end
%w(GET HEAD).each do |method|
it "accepts #{method} requests with non-whitelisted Origin" do
it "accepts #{method} requests with non-permitted Origin" do
expect(send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://malicious.com')).to be_ok
end
end
@ -31,13 +31,13 @@ describe Rack::Protection::HttpOrigin do
end
%w(POST PUT DELETE).each do |method|
it "denies #{method} requests with non-whitelisted Origin" do
it "denies #{method} requests with non-permitted Origin" do
expect(send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://malicious.com')).not_to be_ok
end
it "accepts #{method} requests with whitelisted Origin" do
mock_app do
use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://www.friend.com']
use Rack::Protection::HttpOrigin, :origin_permitted => ['http://www.friend.com']
run DummyApp
end
expect(send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://www.friend.com')).to be_ok