[Security] Bump omniauth from 1.9.1 to 2.0.0

[dependabot-preview]

Bumps omniauth from 1.9.1 to 2.0.0. This update includes a security fix.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

CSRF vulnerability in OmniAuth's request phase The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery (CSRF) when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

In order to mitigate this vulnerability, Rails users should consider using the omniauth-rails_csrf_protection gem.

More info is available here: https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284

Patched versions: >= 2.0.0 Unaffected versions: none

Release notes

Sourced from omniauth's releases.

v2.0.0

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
For detailed context, see:
#960
#809
Resolving CVE-2015-9284

This change also includes an additional configurable phase: request_validation_phase.

Rack/Sinatra

By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.

Rails

Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to what omniauth-rails_csrf_protection does.

# Derived from https://github.com/cookpad/omniauth-rails_csrf_protection/blob/master/lib/omniauth/rails_csrf_protection/token_verifier.rb
# This specific implementation has been pared down and should not be taken as the most correct way to do this.
class TokenVerifier
  include ActiveSupport::Configurable
  include ActionController::RequestForgeryProtection
def call(env)
@request = ActionDispatch::Request.new(env.dup)
raise OmniAuth::AuthenticityError unless verified_request?
end
private
attr_reader :request
delegate :params, :session, to: :request
end
in an initializer
OmniAuth.config.request_validation_phase = TokenVerifier.new

Example Rails App

Alternatively, if you're already using the omniauth-rails_csrf_protection gem, I have a PR open (cookpad/omniauth-rails_csrf_protection#9) that you can use my branch to automatically configure the request_validation_phase.

If you're using Rails' form helpers, they automatically include an authenticity token.

If you are using hyperlinks or buttons styled to redirect to your login route, you should update these to be a submit input or a submit type button wrapped in a form.

- <a href='/auth/developer'>Login with Developer</a>
+ <%= form_tag('/auth/developer', method: 'post') do %>
+  <button type='submit'>Login with Developer</button>
</tr></table> ... (truncated)

Commits

• 29c8216 Merge pull request #1021 from omniauth/2_0-indev
• fe26931 Release 2.0.0
• 8a6b7a6 Merge pull request #1016 from BobbyMcWho/add-to-readme
• 19b3d34 Add v2.0.0 text
• 97714aa Tag version
• 1956a95 Fix deprecation warnings
• 1b784ff Wrap mock_call in rescue
• 49ca577 Merge pull request #1015 from omniauth/make-sure-strategy-passes-rack-freeze
• e405613 Freeze omniauth in test to verify thread safety
• d4c1ff0 Dup options when a strategy is dup'd or cloned
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[pezholio]

So, there's a PR in draft for Omniauth-Rails_csrf_protection, which needs to be merged and released before we can merge this. We've already mitigated this security issue, so this isn't urgent. I'm keeping an eye on the rails_csrf_protection PR, so as soon as that's in, we can merge this.

[leeky]

The recently-released v1.0.0 of omniauth-rails_csrf_protection means the tests are now passing, so LGTM