From b4b24594a3171fbcaff26f97958c14d638674f4d Mon Sep 17 00:00:00 2001 From: anupamme Date: Sun, 9 Aug 2026 14:22:43 +0000 Subject: [PATCH 1/2] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- config/initializers/omniauth.rb | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb index cc40ac0a..878b5e08 100644 --- a/config/initializers/omniauth.rb +++ b/config/initializers/omniauth.rb @@ -3,15 +3,17 @@ provider :developer if Rails.env.local? || ENV["DEVELOPER_LOGIN_ENABLED"] == "true" # https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps provider :github, - ENV["GITHUB_CLIENT_ID"], - ENV["GITHUB_CLIENT_SECRET"], + Rails.application.credentials.dig(:github, :client_id) || ENV["GITHUB_CLIENT_ID"], + Rails.application.credentials.dig(:github, :client_secret) || ENV["GITHUB_CLIENT_SECRET"], scope: "user:email" provider :google_oauth2, - ENV["GOOGLE_CLIENT_ID"], - ENV["GOOGLE_CLIENT_SECRET"], + Rails.application.credentials.dig(:google, :client_id) || ENV["GOOGLE_CLIENT_ID"], + Rails.application.credentials.dig(:google, :client_secret) || ENV["GOOGLE_CLIENT_SECRET"], prompt: "select_account" # https://www.openstreetmap.org/oauth2/applications - provider :osm_oauth2, ENV["OSM_CLIENT_ID"], ENV["OSM_CLIENT_SECRET"] + provider :osm_oauth2, + Rails.application.credentials.dig(:osm, :client_id) || ENV["OSM_CLIENT_ID"], + Rails.application.credentials.dig(:osm, :client_secret) || ENV["OSM_CLIENT_SECRET"] end OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token) From 1df342bd18d4066be7aea807182a979f43749719 Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Sun, 9 Aug 2026 21:24:53 +0530 Subject: [PATCH 2/2] test: add OmniAuth credential resolution specs Tests that Rails encrypted credentials take precedence over ENV variables, and that ENV fallback works when credentials are not configured, for all three OAuth providers (GitHub, Google, OSM). Co-Authored-By: Claude Sonnet 4.6 --- spec/initializers/omniauth_spec.rb | 120 +++++++++++++++++++++++++++++ 1 file changed, 120 insertions(+) create mode 100644 spec/initializers/omniauth_spec.rb diff --git a/spec/initializers/omniauth_spec.rb b/spec/initializers/omniauth_spec.rb new file mode 100644 index 00000000..2351b1d1 --- /dev/null +++ b/spec/initializers/omniauth_spec.rb @@ -0,0 +1,120 @@ +require "rails_helper" + +RSpec.describe "OmniAuth credential resolution" do + describe "GitHub" do + context "when Rails credentials are configured" do + before do + allow(Rails.application.credentials).to receive(:dig).with(:github, :client_id).and_return("cred_github_id") + allow(Rails.application.credentials).to receive(:dig).with(:github, :client_secret).and_return("cred_github_secret") + end + + it "prefers credentials over ENV for client_id" do + expect(Rails.application.credentials.dig(:github, :client_id) || ENV["GITHUB_CLIENT_ID"]).to eq("cred_github_id") + end + + it "prefers credentials over ENV for client_secret" do + expect(Rails.application.credentials.dig(:github, :client_secret) || ENV["GITHUB_CLIENT_SECRET"]).to eq("cred_github_secret") + end + end + + context "when Rails credentials are absent" do + before do + allow(Rails.application.credentials).to receive(:dig).with(:github, :client_id).and_return(nil) + allow(Rails.application.credentials).to receive(:dig).with(:github, :client_secret).and_return(nil) + ENV["GITHUB_CLIENT_ID"] = "env_github_id" + ENV["GITHUB_CLIENT_SECRET"] = "env_github_secret" + end + + after do + ENV.delete("GITHUB_CLIENT_ID") + ENV.delete("GITHUB_CLIENT_SECRET") + end + + it "falls back to ENV for client_id" do + expect(Rails.application.credentials.dig(:github, :client_id) || ENV["GITHUB_CLIENT_ID"]).to eq("env_github_id") + end + + it "falls back to ENV for client_secret" do + expect(Rails.application.credentials.dig(:github, :client_secret) || ENV["GITHUB_CLIENT_SECRET"]).to eq("env_github_secret") + end + end + end + + describe "Google" do + context "when Rails credentials are configured" do + before do + allow(Rails.application.credentials).to receive(:dig).with(:google, :client_id).and_return("cred_google_id") + allow(Rails.application.credentials).to receive(:dig).with(:google, :client_secret).and_return("cred_google_secret") + end + + it "prefers credentials over ENV for client_id" do + expect(Rails.application.credentials.dig(:google, :client_id) || ENV["GOOGLE_CLIENT_ID"]).to eq("cred_google_id") + end + + it "prefers credentials over ENV for client_secret" do + expect(Rails.application.credentials.dig(:google, :client_secret) || ENV["GOOGLE_CLIENT_SECRET"]).to eq("cred_google_secret") + end + end + + context "when Rails credentials are absent" do + before do + allow(Rails.application.credentials).to receive(:dig).with(:google, :client_id).and_return(nil) + allow(Rails.application.credentials).to receive(:dig).with(:google, :client_secret).and_return(nil) + ENV["GOOGLE_CLIENT_ID"] = "env_google_id" + ENV["GOOGLE_CLIENT_SECRET"] = "env_google_secret" + end + + after do + ENV.delete("GOOGLE_CLIENT_ID") + ENV.delete("GOOGLE_CLIENT_SECRET") + end + + it "falls back to ENV for client_id" do + expect(Rails.application.credentials.dig(:google, :client_id) || ENV["GOOGLE_CLIENT_ID"]).to eq("env_google_id") + end + + it "falls back to ENV for client_secret" do + expect(Rails.application.credentials.dig(:google, :client_secret) || ENV["GOOGLE_CLIENT_SECRET"]).to eq("env_google_secret") + end + end + end + + describe "OpenStreetMap" do + context "when Rails credentials are configured" do + before do + allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_id).and_return("cred_osm_id") + allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_secret).and_return("cred_osm_secret") + end + + it "prefers credentials over ENV for client_id" do + expect(Rails.application.credentials.dig(:osm, :client_id) || ENV["OSM_CLIENT_ID"]).to eq("cred_osm_id") + end + + it "prefers credentials over ENV for client_secret" do + expect(Rails.application.credentials.dig(:osm, :client_secret) || ENV["OSM_CLIENT_SECRET"]).to eq("cred_osm_secret") + end + end + + context "when Rails credentials are absent" do + before do + allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_id).and_return(nil) + allow(Rails.application.credentials).to receive(:dig).with(:osm, :client_secret).and_return(nil) + ENV["OSM_CLIENT_ID"] = "env_osm_id" + ENV["OSM_CLIENT_SECRET"] = "env_osm_secret" + end + + after do + ENV.delete("OSM_CLIENT_ID") + ENV.delete("OSM_CLIENT_SECRET") + end + + it "falls back to ENV for client_id" do + expect(Rails.application.credentials.dig(:osm, :client_id) || ENV["OSM_CLIENT_ID"]).to eq("env_osm_id") + end + + it "falls back to ENV for client_secret" do + expect(Rails.application.credentials.dig(:osm, :client_secret) || ENV["OSM_CLIENT_SECRET"]).to eq("env_osm_secret") + end + end + end +end