hawk - npm Package Compare versions

Comparing version 0.15.0 to 1.0.0

lib/utils.js

@@ -45,3 +45,10 @@ // Load modules
 
-    var hostHeaderRegex = /^(?:(?:\r\n)?[\t ])*([^:]+)(?::(\d+))?(?:(?:\r\n)?[\t ])*$/;     // Does not support IPv6
+    var hostHeaderRegex;
+    if (hostHeader[0] === '[') {
+        hostHeaderRegex = /^(?:(?:\r\n)?\s)*(\[[^\]]+\])(?::(\d+))?(?:(?:\r\n)?\s)*$/;      // IPv6
+    }
+    else {
+        hostHeaderRegex = /^(?:(?:\r\n)?\s)*([^:]+)(?::(\d+))?(?:(?:\r\n)?\s)*$/;           // IPv4, hostname
+    }
+    
     var hostParts = hostHeader.match(hostHeaderRegex);
@@ -48,0 +55,0 @@

package.json

 {
   "name": "hawk",
   "description": "HTTP Hawk Authentication Scheme",
-  "version": "0.15.0",
+  "version": "1.0.0",
   "author": "Eran Hammer <[e-mail]> (http://hueniverse.com)",
@@ -6,0 +6,0 @@ "contributors": [],

README.md

@@ -6,3 +6,3 @@ ![hawk Logo](https://raw.github.com/hueniverse/hawk/master/images/hawk.png)
 
-Current version: **0.15**
+Current version: **1.0**
 
@@ -34,2 +34,3 @@ [![Build Status](https://secure.travis-ci.org/hueniverse/hawk.png)](http://travis-ci.org/hueniverse/hawk)
   - [Bewit Limitations](#bewit-limitations)
+  - [Host Header Forgery](#host-header-forgery)
 <p></p>
@@ -234,3 +235,3 @@ - [**Frequently Asked Questions**](#frequently-asked-questions)
 GET
-/resource?a=1&b=2
+/resource/1?b=1&a=2
 example.com
@@ -299,3 +300,3 @@ 8000
 POST
-/resource?a=1&b=2
+/resource/1?a=1&b=2
 example.com
@@ -312,3 +313,3 @@ 8000
 ```
-POST /resource/1 HTTP/1.1
+POST /resource/1?a=1&b=2 HTTP/1.1
 Host: example.com:8000
@@ -532,3 +533,9 @@ Authorization: Hawk id="dh37fgj492je", ts="1353832234", nonce="j4h3g2", hash="Yi9LfIIFRtBEPt74PVmbTF/xVAwPn7ub15ePICfgnuY=", ext="some-app-ext-data", mac="aSe1DERmZuRl3pI36/9BdZmnErTw3sNzOOAUlfeKjVw="
 
+### Host Header Forgery
 
+Hawk validates the incoming request MAC against the incoming HTTP Host header. However, unless the optional `host` and `port`
+options are used with `server.authenticate()`, a malicous client can mint new host names pointing to the server's IP address and
+use that to craft an attack by sending a valid request that's meant for another hostname than the one used by the server. Server
+implementors must manually verify that the host header received matches their expectation (or use the options mentioned above).
+
 # Frequently Asked Questions
@@ -535,0 +542,0 @@

test/utils.js

@@ -60,2 +60,40 @@ // Load modules
             });
+
+            it('returns port 443 for non tls node request (IPv6)', function (done) {
+
+                var req = {
+                    method: 'POST',
+                    url: '/resource/4?filter=a',
+                    headers: {
+                        host: '[123:123:123]',
+                        'content-type': 'text/plain;x=y'
+                    },
+                    connection: {
+                        encrypted: true
+                    }
+                };
+
+                expect(Hawk.utils.parseHost(req, 'Host').port).to.equal(443);
+                done();
+            });
+
+            it('parses IPv6 headers', function (done) {
+
+                var req = {
+                    method: 'POST',
+                    url: '/resource/4?filter=a',
+                    headers: {
+                        host: '[123:123:123]:8000',
+                        'content-type': 'text/plain;x=y'
+                    },
+                    connection: {
+                        encrypted: true
+                    }
+                };
+
+                var host = Hawk.utils.parseHost(req, 'Host');
+                expect(host.port).to.equal('8000');
+                expect(host.name).to.equal('[123:123:123]');
+                done();
+            });
         });
@@ -62,0 +100,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

282565

increased by0.72%

Lines of code

3507

increased by1.1%

Number of low quality alerts

1

decreased by-50%

Number of lines in readme file

628

increased by1.13%

No dependency changes