Prevent timing attack on CSRF, completing wonderful pr by @eutopian #174
Conversation
|
@BobbyMcWho @nov do either of you have write access? 🙏 |
|
Let me fix this build error |
lib/omniauth/strategies/oauth2.rb
Outdated
| @@ -83,8 +83,7 @@ def token_params | |||
|
|
|||
| def callback_phase # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity | |||
| error = request.params["error_reason"] || request.params["error"] | |||
| if !options.provider_ignores_state && (request.params["state"].to_s.empty? || request.params["state"] != session.delete("omniauth.state")) | |||
| fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected")) | |||
| elsif !options.provider_ignores_state && (request.params["state"].to_s.empty? || !secure_compare(request.params["state"], session.delete("omniauth.state"))) | |||
There was a problem hiding this comment.
| elsif !options.provider_ignores_state && (request.params["state"].to_s.empty? || !secure_compare(request.params["state"], session.delete("omniauth.state"))) | |
| if !options.provider_ignores_state && (request.params["state"].to_s.empty? || !secure_compare(request.params["state"], session.delete("omniauth.state"))) |
There was a problem hiding this comment.
Thanks for the review. Looks like I didn't copy from the initial PR properly
|
Running specs locally it looks like there might be some more work to reconcile this PR with master. I'm looking into it |
|
Alright everything should be fixed now as far as I can tell. Specs pass locally. |
|
@BobbyMcWho thank you for the earlier review and code suggestion |
|
I will buy someone a coffee if they review this PR lol |
|
No coffee needed, I don't mind merging, but the whole release process is the headache |
|
Haha thank you for the review + merge |
|
I just haven't released on this laptop yet so I gotta do some pre requisite installs, that's all |
Attempting to complete the CSRF fix introduced in #123 by @eutopian
It looks like that PR has been untouched since 2021 so opening a new one that is up to date with latest master and implements the renamed test that was suggested