Module: Clavis::Security::InputValidator

Defined in:
lib/clavis/security/input_validator.rb

Constant Summary collapse

TOKEN_REGEX =

Regular expressions for validation

/\A[a-zA-Z0-9\-_.]+\z/
CODE_REGEX = 
%r{\A[a-zA-Z0-9\-_./=+]+\z}
STATE_REGEX = 
/\A[a-zA-Z0-9\-_.]+\z/
EMAIL_REGEX = 
/\A[\w+\-.]+@[a-z\d-]+(\.[a-z\d-]+)*\.[a-z]+\z/i
DANGEROUS_SCHEMES =

Dangerous schemes that should never be allowed

%w[javascript data vbscript file].freeze

Class Method Summary collapse

Class Method Details

.sanitize(input) ⇒ String

Sanitizes a string to prevent XSS

Parameters:

  • input (String) —

    The string to sanitize

Returns:

  • (String) —

    The sanitized string



154
155
156
157
158
159
160
161
162
163
164
165
166
167
 
# File 'lib/clavis/security/input_validator.rb', line 154

def sanitize(input)
  return "" if input.nil?
  return input unless input.is_a?(String)

  # Remove script tags and their content
  result = input.gsub(%r{<script\b[^>]*>.*?</script>}im, "")

  # Remove other potentially dangerous tags
  result = result.gsub(/<[^>]*>/, "")

  # Remove javascript: and data: URLs
  result = result.gsub(/javascript:/i, "")
  result.gsub(/data:/i, "")
end

.sanitize_hash(hash) ⇒ Hash

Sanitizes a hash to prevent XSS

Parameters:

  • hash (Hash) —

    The hash to sanitize

Returns:

  • (Hash) —

    The sanitized hash



172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
 
# File 'lib/clavis/security/input_validator.rb', line 172

def sanitize_hash(hash)
  return {} unless hash.is_a?(Hash)

  result = {}

  hash.each do |key, value|
    result[key] = if value.is_a?(Hash)
                    sanitize_hash(value)
                  elsif value.is_a?(Array)
                    value.map { |item| item.is_a?(Hash) ? sanitize_hash(item) : sanitize(item) }
                  else
                    sanitize(value)
                  end
  end

  result
end

.valid_code?(code) ⇒ Boolean

Validates an authorization code

Parameters:

  • code (String) —

    The code to validate

Returns:

  • (Boolean) —

    Whether the code is valid



58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'lib/clavis/security/input_validator.rb', line 58

def valid_code?(code)
  return false if code.nil? || code.empty?

  is_valid = CODE_REGEX.match?(code)

  # For now, be more permissive
  # Eventually, we should properly validate but the regex might need adjustment
  # based on the specific OAuth provider
  return true if code.length > 5 && code.length < 1000

  is_valid
end

.valid_email?(email) ⇒ Boolean

Validates an email address

Parameters:

  • email (String) —

    The email to validate

Returns:

  • (Boolean) —

    Whether the email is valid



83
84
85
86
87
 
# File 'lib/clavis/security/input_validator.rb', line 83

def valid_email?(email)
  return false if email.nil? || email.empty?

  EMAIL_REGEX.match?(email)
end

.valid_state?(state) ⇒ Boolean

Validates a state parameter

Parameters:

  • state (String) —

    The state to validate

Returns:

  • (Boolean) —

    Whether the state is valid



74
75
76
77
78
 
# File 'lib/clavis/security/input_validator.rb', line 74

def valid_state?(state)
  return false if state.nil? || state.empty?

  STATE_REGEX.match?(state)
end

.valid_token?(token) ⇒ Boolean

Validates an OAuth token

Parameters:

  • token (String) —

    The token to validate

Returns:

  • (Boolean) —

    Whether the token is valid



47
48
49
50
51
52
53
 
# File 'lib/clavis/security/input_validator.rb', line 47

def valid_token?(token)
  return false if token.nil? || token.empty?

  # Make token validation more permissive
  # Just check if it's a string with reasonable length
  token.is_a?(String) && token.length > 5
end

.valid_token_response?(response) ⇒ Boolean

Validates a token response

Parameters:

  • response (Hash) —

    The token response to validate

Returns:

  • (Boolean) —

    Whether the response is valid



92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/clavis/security/input_validator.rb', line 92

def valid_token_response?(response)
  return false unless response.is_a?(Hash)

  # Check for error response
  return false if response["error"] || response[:error]

  # Check for required fields
  access_token = response["access_token"] || response[:access_token]
  response["token_type"] || response[:token_type]

  # Be more permissive for debugging - just require an access_token
  return true if access_token && !access_token.empty?

  # Original strict validation:
  # return false unless access_token && token_type
  # return false unless valid_token?(access_token)
  #
  # # Validate optional fields if present
  # if (expires_in = response["expires_in"] || response[:expires_in]) &&
  #    !(expires_in.is_a?(Integer) && expires_in.positive?)
  #   return false
  # end
  #
  # if (refresh_token = response["refresh_token"] || response[:refresh_token]) && !valid_token?(refresh_token)
  #   return false
  # end
  #
  # if (id_token = response["id_token"] || response[:id_token]) && !valid_token?(id_token)
  #   return false
  # end

  true
end

.valid_url?(url, allowed_schemes: %w[http https])) ⇒ Boolean

Validates a URL

Parameters:

  • url (String) —

    The URL to validate

  • allowed_schemes (Array<String>) (defaults to: %w[http https])) —

    The allowed URL schemes

Returns:

  • (Boolean) —

    Whether the URL is valid



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/clavis/security/input_validator.rb', line 22

def valid_url?(url, allowed_schemes: %w[http https])
  return false if url.nil? || url.empty?

  begin
    uri = URI.parse(url)

    # Check if the URI has a scheme
    return false unless uri.scheme

    # Check if the scheme is allowed
    return false if DANGEROUS_SCHEMES.include?(uri.scheme.downcase)
    return false unless allowed_schemes.include?(uri.scheme.downcase)

    # Check if the URI has a host
    return false unless uri.host

    true
  rescue URI::InvalidURIError
    false
  end
end

.valid_userinfo_response?(response) ⇒ Boolean

Validates a userinfo response

Parameters:

  • response (Hash) —

    The userinfo response to validate

Returns:

  • (Boolean) —

    Whether the response is valid



129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
 
# File 'lib/clavis/security/input_validator.rb', line 129

def valid_userinfo_response?(response)
  return false unless response.is_a?(Hash)

  # Check for error response
  return false if response["error"] || response[:error]

  # Be more permissive - don't require specific fields
  # Only check for dangerous values

  # Sanitize all string values to prevent XSS
  response.each_value do |value|
    if value.is_a?(String) &&
       (value.include?("<script") ||
        value.include?("javascript:") ||
        value.include?("data:"))
      return false
    end
  end

  true
end