From dbbe96d33349879cae4ea79d3b5d8db6b9619ea8 Mon Sep 17 00:00:00 2001 From: Pierre de La Morinerie Date: Thu, 3 Jan 2019 17:14:26 +0100 Subject: [PATCH] signature: replace RbNaCl by ActiveSupport::MessageVerifier --- app/services/signature_service.rb | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/app/services/signature_service.rb b/app/services/signature_service.rb index 716813aa9..4fafd51b2 100644 --- a/app/services/signature_service.rb +++ b/app/services/signature_service.rb @@ -1,28 +1,22 @@ class SignatureService class << self - def generate - RbNaCl::Util.bin2hex(RbNaCl::SigningKey.generate) - end - def verify(signature, message) - message = Base64.urlsafe_encode64(message) begin - signing_key.verify_key - .verify(RbNaCl::Util.hex2bin(signature), message) - rescue RbNaCl::BadSignatureError, RbNaCl::LengthError + decoded_message = verifier.verify(signature) + return message == decoded_message + rescue ActiveSupport::MessageVerifier::InvalidSignature return false end end def sign(message) - message = Base64.urlsafe_encode64(message) - RbNaCl::Util.bin2hex(signing_key.sign(message)) + verifier.generate(message) end private - def signing_key - @@signing_key ||= RbNaCl::SigningKey.new(RbNaCl::Util.hex2bin(Rails.application.secrets.signing_key)) + def verifier + @@verifier ||= ActiveSupport::MessageVerifier.new(Rails.application.secrets.signing_key) end end end