documentation for the oauth2-server-php library

Brent Shaffer

Last update: Nov 24, 2022

Related tags

Authentication and Authorization oauth2-server-php-docs

Overview

OAuth2 Server PHP Documentation

This repository hosts the documentation for the oauth2-server-php library.

All submissions are welcome! To submit a change, fork this repo and send us a pull request.

Setup

Ruby 1.9 is required to build the site.

Get the nanoc gem, plus kramdown for markdown parsing:

bundle install

Compile the src into the output directory by running the following command:

nanoc compile

You can see the available commands with nanoc:

nanoc -h

Nanoc has some nice documentation to get you started. Though if you're mainly concerned with editing or adding content, you won't need to know much about nanoc.

Development

Nanoc compiles the site into static files living in ./output. It's smart enough not to try to compile unchanged files:

$ nanoc compile
Loading site data...
Compiling site...
   identical  [0.00s]  output/css/960.css
   identical  [0.00s]  output/css/pygments.css
   identical  [0.00s]  output/css/reset.css
   identical  [0.00s]  output/css/styles.css
   identical  [0.00s]  output/css/uv_active4d.css
      update  [0.28s]  output/index.html

Site compiled in 5.81s.

You can setup whatever you want to view the files. If you have the adsf gem, however (I hope so, it was in the Gemfile), you can start Webrick:

$ nanoc view
$ open http://localhost:3000

Compilation times got you down? Use autocompile!

$ nanoc autocompile

This starts a web server too, so there's no need to run nanoc view. One thing: remember to add trailing slashes to all nanoc links!

Deploy

$ rake publish

Styleguide

Not sure how to structure the docs? Here's what the structure of the API docs should look like:

# API title

## API endpoint title

    [VERB] /path/to/endpoint.json

### Parameters

name
: description

### Input (request json body)

<%= json :field => "sample value" %>

### Response

<%= headers 200, :pagination => true, 'X-Custom-Header' => "value" %>
<%= json :resource_name %>

Note: We're using Kramdown Markdown extensions, such as definition lists.

JSON Responses

We specify the JSON responses in ruby so that we don't have to write them by hand all over the docs. You can render the JSON for a resource like this:

<%= json :issue %>

This looks up GitHub::Resources::ISSUE in lib/resources.rb.

Some actions return arrays. You can modify the JSON by passing a block:

<%= json(:issue) { |hash| [hash] } %>

Terminal blocks

You can specify terminal blocks with pre.terminal elements. It'd be nice if Markdown could do this more cleanly...

<pre class="terminal">
$ curl foobar
....
</pre>

This isn't a curl tutorial though, I'm not sure every API call needs to show how to access it with curl.

Comments

$always_issue_new_refresh_token does not work in OAuth2\Server constructor$
always_issue_new_refresh_token does not work in OAuth2\Server constructor
Hi,

first: I love your library, it's really easy to create an OAuth2 token controller and application!

I found a small problem: In the docs it says that I can give the config setting 'always_issue_new_refresh_token' to the OAuth\Server constructor, see here: http://bshaffer.github.io/oauth2-server-php-docs/grant-types/refresh-token/

However, both of these configuration options can be sent in when the server is created using the server's configuration array: $server = new OAuth2\Server($storage, array( 'always_issue_new_refresh_token' => true, 'refresh_token_lifetime' => 2419200, ));

For me this does not work, and as far as I can see it is not supported in the code. This setting has to be done in the RefreshToken-constructor.

Now there are 2 solutions: correct the docs, or implement this feature. I don't know which is better.

Michael
opened by PHPGangsta 12
Add openid grant to server and fix .travis.yml

Updated documentation for OpenID Connect to add grant type.

Fixes #74. This will help a lot of people struggling with this missing line of code.

Also added Ruby version to Travis CI config to get builds working again.

opened by reb3r 5
cookbook misses id_token column

Following http://bshaffer.github.io/oauth2-server-php-docs/cookbook/ the step at Create_an_Authorize_Controller fails, until you run ALTER TABLE oauth_authorization_codes ADD COLUMN id_token VARCHAR(80); [not sure about 80 as size] Be sure to update the CREATE TABLE at the start of the cookbook. Note that you must display errors in php.ini, to see the problem (or view log).

opened by bingalls 5
Sql Fields Missing

Hello, Using the table scheme outlined: https://github.com/bshaffer/oauth2-server-php-docs/blob/master/content/cookbook/index.md#mysql--sqlite--postgresql--ms-sql-server causes an error.

It would appear supported_scopes and default_scope is missing from oauth_clients. I stumbled across this following the step-by-step walkthrough exactly.

Are there any more fields missing that you know of?

W

opened by awgeorge 5
Bump nokogiri from 1.6.8 to 1.10.8
Bumps nokogiri from 1.6.8 to 1.10.8.

Release notes

Sourced from nokogiri's releases.

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7 / 2019-12-03

Bug

[MRI] Ensure the patch applied in v1.10.6 works with GNU patch. #1954

1.10.6 / 2019-12-03

Bug

[MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

1.10.5 / 2019-10-31

Dependencies

[MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10

[MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915)

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

This CVE's public notice is sparklemotion/nokogiri#1915

1.10.3 / 2019-04-22

Security Notes
... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7 / 2019-12-03

Fixed

[MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6 / 2019-12-03

Fixed

[MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

1.10.5 / 2019-10-31

Security

[MRI] Vendored libxslt upgraded to v1.1.34 which addresses three CVEs for libxslt:

CVE-2019-13117

CVE-2019-13118

CVE-2019-18197

CVE-2019-19956

More details are available at #1943.

Dependencies

[MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10

[MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915).

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
... (truncated)

Commits

6ce10d1 version bump to v1.10.8

2320f5b update CHANGELOG for v1.10.8

4a77fdb remove patches from the hoe Manifest

570b6cb update to use rake-compiler ~1.1.0

2cdb68e backport libxml2 patch for CVE-2020-7595

e6b3229 version bump to v1.10.7

4f9d443 update CHANGELOG

80e67ef Fix the patch from #1953 to work with both git and patch

7cf1b85 Fix typo in generated metadata

d76180d add gem metadata

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 3
Storage/Memory simple question
Is possible create a server jwt using only memory storage? Because, I can not read the refresh token in memory. how is the $server->addGrantType( OAuth2\GrantType\RefreshToken ) in memory, for after so that I can then make a call to create a new access_token, all using Storage/Memory. Its possible?

ignore this structure of code

server.php $storage = new OAuth2\Storage\Memory(...) $server = new OAuth2\Server($storage)

method: token(){ return access_token, jwt and others } method: resource(){ if user is valid and show resource...} method: renewRefreshToken(){ here.. i need the idea for code }

in PDO storage, works with me.. but I want to test in memory.

Thanks
opened by luanmanfre 3
Fix curl command

the original command returned: {"error":"invalid_client","error_description":"The client credentials are invalid"}

opened by delboy1978uk 3
Unsupported operand types
In an attempt to get a simple test of the "Resource Owner Password" workflow working I ran into an Unsupported operand types PHP error in the AuthorizeController.php (line 74):

$clientData += array('redirect_uri' => null); // this should be set. We should create ClientData interface

I haven't dug deeply into this as I'm not sure how deep the rabbit hole goes but I did put a debug line in right before to check what my "query" string is in the request and I get the following:

[query] => Array ( [grant_type] => client_credentials [redirect_uri] => http://fake.url.com [username] => testclient [password] => testpass [client_id] => 1 )

This is what I was expecting it to send so I'm at a loss. I'm hoping that I'm doing something obviously wrong and someone can quickly point me to the fault. It might also be a bug? I don't know at this stage.
opened by yankeeinlondon 3
Bump rack from 2.0.1 to 2.0.8
Bumps rack from 2.0.1 to 2.0.8.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

Note: There are many unreleased changes in Rack (master is around 300 commits ahead of 2-0-stable), and below is not an exhaustive list. If you would like to help out and document some of the unreleased changes, PRs are welcome.

Added

Changed

Use Time#httpdate format for Expires, as proposed by RFC 7231. (@nanaya)

Make Utils.status_code raise an error when the status symbol is invalid instead of 500.

Rename Request::SCHEME_WHITELIST to Request::ALLOWED_SCHEMES.

Make Multipart::Parser.get_filename accept files with + in their name.

Add Falcon to the default handler fallbacks. (@ioquatix)

Update codebase to avoid string mutations in preparation for frozen_string_literals. (@pat)

Change MockRequest#env_for to rely on the input optionally responding to #size instead of #length. (@janko)

Rename Rack::File -> Rack::Files and add deprecation notice. (@postmodern).

Removed

Documentation

Update broken example in Session::Abstract::ID documentation. (tonytonyjan)

Add Padrino to the list of frameworks implmenting Rack. (@wikimatze)

Remove Mongrel from the suggested server options in the help output. (@tricknotes)

Replace HISTORY.md and NEWS.md with CHANGELOG.md. (@twitnithegirl)

Backfill CHANGELOG.md from 2.0.1 to 2.0.7 releases. (@drenmi)

[2.0.7] - 2019-04-02

Fixed

Remove calls to #eof? on Rack input in Multipart::Parser, as this breaks the specification. (@matthewd)

Preserve forwarded IP addresses for trusted proxy chains. (@SamSaffron)

[2.0.6] - 2018-11-05

Fixed

[CVE-2018-16470] Reduce buffer size of Multipart::Parser to avoid pathological parsing. (@tenderlove)

Fix a call to a non-existing method #accepts_html in the ShowExceptions middleware. (@tomelm)

[CVE-2018-16471] Whitelist HTTP and HTTPS schemes in Request#scheme to prevent a possible XSS attack. (@PatrickTulskie)

[2.0.5] - 2018-04-23

Fixed
... (truncated)

Commits

e7ee459 Bumping version

f1a79b2 Introduce a new base class to avoid breaking when upgrading

5b1cab6 Add a version prefix to the private id to make easier to migrate old values

1e96e0f Fallback to the public id when reading the session in the pool adapter

3ba123d Also drop the session with the public id when destroying sessions

6a04bbf Fallback to the legacy id when the new id is not found

dc45a06 Add the private id

73a5f79 revert conditionals to master

4e32262 remove NullSession

1c7e3b2 remove || raise and get closer to master

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 2
[Laravel] How can I change token expiration time?

I use this library and it's really great. The only problem that I have is that I want to extend default token expiration of one hour (3600). I don't see that any vendor configuration is deployed to Laravel's config folder. How can I do this? Thanks!

opened by gradosevic 2
Cannot find the Step-by-Step Walkthrough page

I've been following the instructions on http://bshaffer.github.io/oauth2-server-php-docs/cookbook/ It worked very fine until this morning. When I tried to open it again to continue the setup of my server, I just got a "404 Not found" while other pages on the cookbook work well. I just wonder if someone has renamed the page or temporarily moved it for modification. I'm kind of urgent in setting up my server. Hope this problem could be solved soon.

opened by Jinny-Wang 2
Wrong schema definition in documentation

Hi, I think, I foun a mistake in the schema definition of the "oauth_users" table. "username" is the primary key in this table so it needs to be NOT NULL. Page to documentation: https://bshaffer.github.io/oauth2-server-php-docs/cookbook/

opened by alexander-rebello 0
Bump nokogiri from 1.10.9 to 1.13.9
Bumps nokogiri from 1.10.9 to 1.13.9.

Release notes

Sourced from nokogiri's releases.

1.13.9 / 2022-10-18

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-2309, CVE-2022-40304, and CVE-2022-40303. See GHSA-2qc6-mcvw-92cw for more information.

[CRuby] Vendored zlib is updated to address CVE-2022-37434. Nokogiri was not affected by this vulnerability, but this version of zlib was being flagged up by some vulnerability scanners, see #2626 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.

[CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.

[CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

[CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @eightbitraptor and @peterzhu2118!)

[CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

sha256 checksums:

9b69829561d30c4461ea803baeaf3460e8b145cff7a26ce397119577a4083a02 nokogiri-1.13.9-aarch64-linux.gem e76ebb4b7b2e02c72b2d1541289f8b0679fb5984867cf199d89b8ef485764956 nokogiri-1.13.9-arm64-darwin.gem 15bae7d08bddeaa898d8e3f558723300137c26a2dc2632a1f89c8574c4467165 nokogiri-1.13.9-java.gem f6a1dbc7229184357f3129503530af73cc59ceba4932c700a458a561edbe04b9 nokogiri-1.13.9-x64-mingw-ucrt.gem 36d935d799baa4dc488024f71881ff0bc8b172cecdfc54781169c40ec02cbdb3 nokogiri-1.13.9-x64-mingw32.gem ebaf82aa9a11b8fafb67873d19ee48efb565040f04c898cdce8ca0cd53ff1a12 nokogiri-1.13.9-x86-linux.gem 11789a2a11b28bc028ee111f23311461104d8c4468d5b901ab7536b282504154 nokogiri-1.13.9-x86-mingw32.gem 01830e1646803ff91c0fe94bc768ff40082c6de8cfa563dafd01b3f7d5f9d795 nokogiri-1.13.9-x86_64-darwin.gem 8e93b8adec22958013799c8690d81c2cdf8a90b6f6e8150ab22e11895844d781 nokogiri-1.13.9-x86_64-linux.gem 96f37c1baf0234d3ae54c2c89aef7220d4a8a1b03d2675ff7723565b0a095531 nokogiri-1.13.9.gem

1.13.8 / 2022-07-23

Deprecated

XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.9 / 2022-10-18

Security

[CRuby] Vendored libxml2 is updated to address CVE-2022-2309, CVE-2022-40304, and CVE-2022-40303. See GHSA-2qc6-mcvw-92cw for more information.

[CRuby] Vendored zlib is updated to address CVE-2022-37434. Nokogiri was not affected by this vulnerability, but this version of zlib was being flagged up by some vulnerability scanners, see #2626 for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.

[CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.

[CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

[CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @eightbitraptor and @peterzhu2118!)

[CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

1.13.8 / 2022-07-23

Deprecated

XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

[CRuby] Calling XML::Reader#attributes is now safe to call. In Nokogiri <= 1.13.7 this method may segfault. [#2598, #2599]

1.13.7 / 2022-07-12

Fixed

XML::Node objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2578] (Thanks, @eightbitraptor!)

1.13.6 / 2022-05-08

Security

[CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

... (truncated)

Commits

897759c version bump to v1.13.9

aeb1ac3 doc: update CHANGELOG

c663e49 Merge pull request #2671 from sparklemotion/flavorjones-update-zlib-1.2.13_v1...

212e07d ext: hack to cross-compile zlib v1.2.13 on darwin

76dbc8c dep: update zlib to v1.2.13

24e3a9c doc: update CHANGELOG

4db3b4d Merge pull request #2668 from sparklemotion/flavorjones-namespace-scopes-comp...

73d73d6 fix: Document#remove_namespaces! use-after-free bug

5f58b34 fix: namespace nodes behave properly when compacted

b08a858 test: repro namespace_scopes compaction issue

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 0
Bump addressable from 2.7.0 to 2.8.1
Bumps addressable from 2.7.0 to 2.8.1.

Changelog

Sourced from addressable's changelog.

Addressable 2.8.1

refactor Addressable::URI.normalize_path to address linter offenses (#430)

remove redundant colon in Addressable::URI::CharacterClasses::AUTHORITY regex (#438)

update gemspec to reflect supported Ruby versions (#466, #464, #463)

compatibility w/ public_suffix 5.x (#466, #465, #460)

fixes "invalid byte sequence in UTF-8" exception when unencoding URLs containing non UTF-8 characters (#459)

Ractor compatibility (#449)

use the whole string instead of a single line for template match (#431)

force UTF-8 encoding only if needed (#341)

#460: sporkmonger/addressable#460 #463: sporkmonger/addressable#463 #464: sporkmonger/addressable#464 #465: sporkmonger/addressable#465 #466: sporkmonger/addressable#466

Addressable 2.8.0

fixes ReDoS vulnerability in Addressable::Template#match

no longer replaces + with spaces in queries for non-http(s) schemes

fixed encoding ipv6 literals

the :compacted flag for normalized_query now dedupes parameters

fix broken escape_component alias

dropping support for Ruby 2.0 and 2.1

adding Ruby 3.0 compatibility for development tasks

drop support for rack-mount and remove Addressable::Template#generate

performance improvements

switch CI/CD to GitHub Actions

Commits

8657465 Update version, gemspec, and CHANGELOG for 2.8.1 (#474)

4fc5bb6 CI: remove Ubuntu 18.04 job (#473)

860fede Force UTF-8 encoding only if needed (#341)

99810af Merge pull request #431 from ojab/ct-_do_not_parse_multiline_strings

7ce0f48 Merge branch 'main' into ct-_do_not_parse_multiline_strings

7ecf751 Merge pull request #449 from okeeblow/freeze_concatenated_strings

41f12dd Merge branch 'main' into freeze_concatenated_strings

068f673 Merge pull request #459 from jarthod/iso-encoding-problem

b4c9882 Merge branch 'main' into iso-encoding-problem

08d27e8 Merge pull request #471 from sporkmonger/sporkmonger-enable-codeql

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 0
Bump rack from 2.2.2 to 2.2.3.1
Bumps rack from 2.2.2 to 2.2.3.1.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[3.0.0] - Unreleased

Security

Do not use semicolon as GET parameter separator. (#1733, [@jeremyevans])

SPEC Changes

Response status must now be an integer greater than or equal to 100.

Response headers must now be an unfrozen hash.

Response header keys can no longer include uppercase characters.

Response header values can be an Array to handle multiple values (and no longer supports \n encoded headers).

Response body can now respond to #call (streaming body) instead of #each (enumerable body), for the equivalent of response hijacking in previous versions.

Middleware must no longer call #each on the body, but they can call #to_ary on the body if it responds to #to_ary.

rack.input is no longer required to be rewindable.

rack.multithread/rack.multiprocess/rack.run_once are no longer required environment keys.

SERVER_PROTOCOL is now a required key, matching the HTTP protocol used in the request.

Removed

Remove rack.multithread/rack.multiprocess/rack.run_once. These variables generally come too late to be useful. (#1720, [@ioquatix], [@jeremyevans]))

Remove deprecated Rack::Request::SCHEME_WHITELIST. ([@jeremyevans])

Remove internal cookie deletion using pattern matching, there are very few practical cases where it would be useful and browsers handle it correctly without us doing anything special. (#1844, [@ioquatix])

Added

Rack::Headers added to support lower-case header keys. ([@jeremyevans])

Rack::Utils#set_cookie_header now supports escape_key: false to avoid key escaping. ([@jeremyevans])

Rack::RewindableInput supports size. (@ahorek)

Rack::RewindableInput::Middleware added for making rack.input rewindable. ([@jeremyevans])

The RFC 7239 Forwarded header is now supported and considered by default when looking for information on forwarding, falling back to the X-Forwarded-* headers. Rack::Request.forwarded_priority accessor has been added for configuring the priority of which header to check. (#1423, [@jeremyevans])

Allow response headers to contain array of values. (#1598, [@ioquatix])

Changed

BREAKING CHANGE: Require status to be an Integer. (#1662, @olleolleolle)

BREAKING CHANGE: Query parsing now treats parameters without = as having the empty string value instead of nil value, to conform to the URL spec. (#1696, [@jeremyevans])

Relax validations around Rack::Request#host and Rack::Request#hostname. (#1606, @pvande)

Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. (#1658, [@ioquatix])

Removed options from Rack::Builder.parse_file and Rack::Builder.load_file. (#1663, [@ioquatix])

Rack::HTTP_VERSION has been removed and the HTTP_VERSION env setting is no longer set in the CGI and Webrick handlers. (#970, [@jeremyevans])

Rack::Request#[] and #[]= now warn even in non-verbose mode. (#1277, [@jeremyevans])

Decrease default allowed parameter recursion level from 100 to 32. (#1640, [@jeremyevans])

Attempting to parse a multipart response with an empty body now raises Rack::Multipart::EmptyContentError. (#1603, [@jeremyevans])

Rack::Utils.secure_compare uses OpenSSL's faster implementation if available. (#1711, @bdewater)

Rack::Request#POST now caches an empty hash if input content type is not parseable. (#749, [@jeremyevans])

... (truncated)

Commits

925a4a6 update changelog

70c0a24 bump version

434413f Escape untrusted text when logging

a872bcc Restrict broken mime parsing

1741c58 bump version

5ccca47 When parsing cookies, only decode the values

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump yajl-ruby from 1.4.1 to 1.4.3
Bumps yajl-ruby from 1.4.1 to 1.4.3.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0