Signing requests with nested hashes

[hariton]

There is one problem that I noticed in ruby 1.8 (ruby 1.9 has ordered hash so it's must be ok). Problem occurs when signing nested hashes (for nested hashes ordering does not work), for example:

query_hash = {
    :order => {:confirmer => 'zzzz', :user_id => '1', :product_id => '7477', :visit => Time.now},
    :client => {}
}

I think the easiest way - change this code:

def parameter_string
  ....
  hash.keys.sort.map { |k| "#{k}=#{hash[k]}" }.join("&")
end

with this one:

def parameter_string
  ....
  hash.to_param
end

Before that, dragging a couple of methods from activesupport:

class Object
  def to_query(key)
    require 'cgi' unless defined?(CGI) && defined?(CGI::escape)
    "#{CGI.escape(key.to_s).gsub(/%(5B|5D)/n) { [$1].pack('H*') }}=#{CGI.escape(to_param.to_s)}"
  end
end

class Hash
  def to_param(namespace = nil)
    collect do |key, value|
      value.to_query(namespace ? "#{namespace}[#{key}]" : key)
    end.sort * '&'
  end
end

etc (all from to_param.rb and to_query.rb)

Of course, in Rails apps enough to make their own small monkeypatch, but I know that your lovely gem is used even outside of the ruby-world... and even outside english-speaking world, as you can see )

[mloughran]

Hi Hariton. Thanks for the comments - I was just wondering what you're using signature for and why you need nested query parameters?

It's certainly the case that signature doesn't currently support nested parameter hashes - just {string -> string} ones. The keys are sorted so there is only one possible representation for a hash. Ruby 1.9 doesn't help in this respect, because the hash is merely sorted by insertion order, not alphanumeric by key.

I'm quite happy to accept a patch to add nested query hashing as long as the signature format is backwards compatible :)

Cheers, Martyn