Update dependency omniauth to v2 [SECURITY] #133
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: Gemfile.lock |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.9.1->2.0.0GitHub Vulnerability Alerts
CVE-2020-36599
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
CVE-2015-9284
The request phase of the OmniAuth Ruby gem (1.9.2 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
As of v2 OmniAuth no longer has the vulnerable configuration by default, but it is still possible to configure OmniAuth in such a way that the web application becomes vulnerable to Cross-Site Request Forgery. There is a recommended remediation described here.
Release Notes
omniauth/omniauth (omniauth)
v2.0.0Compare Source
Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.
Many thanks to the folks who contributed in code and discussion for these changes.
OmniAuth now defaults to only POST as the allowed request_phase method.
Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
For detailed context, see:
#960
#809
Resolving CVE-2015-9284
This change also includes an additional configurable phase:
request_validation_phase.Rack/Sinatra
By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.
Rails
Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to what omniauth-rails_csrf_protection does.
Update: omniauth-rails_csrf_protection has released v1.0.0, which means if you're using this library already, you should be able to upgrade omniauth to the 2.0 series as long as omniauth-rails_csrf_protection is also upgraded
'~> 1.0'An example of creating your own non-dependency implementation is below, though I would recommend using the gem.
Example Rails App
If you're using Rails' form helpers, they automatically include an authenticity token.
If you are using hyperlinks or buttons styled to redirect to your login route, you should update these to be a submit input or a submit type button wrapped in a form.
GET
Because using GET for login poses concerns (see OWASP Cheatsheet), after upgrading OmniAuth will log a
:warnlevel log with every GET request to a login path when yourOmniAuth.config.allowed_request_methodsinclude:get.If you have a workflow that absolutely requires you to use GET for the request_phase, you can disable this warning using
It is very important that you do not do this just to circumvent having to change your inputs or login flow, as using GET for most auth workflows is not what you want.
Unhandled Exceptions
OmniAuth now catches exceptions raised during the options_call, request_call, callback_call, and other_phase, and passes them to the
OmniAuth.config.on_failurehandler. For most apps, this means they are passed to the default FailureEndpoint class that OmniAuth provides, and redirected to/auth/failure. If your app is wrapping OmniAuth in another middleware such as this example in Discourse, then you may need to instead write your own failure handler.Provider Namespacing
OmniAuth will no longer find constants from an ancestor class when looking for the strategy class. What this means is that
Will no longer find
::MyProvideras a strategy, and instead will only look under theOmniAuth::Strategiesnamespace for theMyProviderclass.Failure Route
The failure route will now respect a strategy's path_prefix option, meaning if your strategy uses
/externalinstead of/authas its path prefix, the failure route for that strategy will be/external/failure.Thread Safety
The OmniAuth middleware should now be thread-safe, as we run tests with rack-freeze to check for middleware mutability. This does not guarantee that the downstream strategy is thread-safe however. If you have concerns, ask your strategy maintainers.
Frozen Strings
OmniAuth will no longer throw errors if trying to run it in an app with
RUBYOPT="--enable-frozen-string-literal".Relative Root Apps
OmniAuth now respects the 'SCRIPT_NAME' env value, so if your app lives at
myapp.com/super, your request path will be/super/auth/provider, your callback path/super/auth/provider/callbackand your failure path/super/auth/failure.v1.9.2Compare Source
Backports a vulnerability fix that was included in Omniauth 2.0 release to the 1.9 channel.
https://nvd.nist.gov/vuln/detail/CVE-2020-36599
Current Omniauth security policy maintains v2.0 and v2.1 channels for security releases, and security patches should not be typically expected for the v1.9 channel.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.