[Security] Bump doorkeeper from 5.2.1 to 5.5.1

[dependabot-preview]

Bumps doorkeeper from 5.2.1 to 5.5.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

Doorkeeper application secret information disclosure vulnerability Information disclosure vulnerability. Allows an attacker to see all Doorkeeper::Application model attribute values (including secrets) after authorizing an application to their user.

An application is vulnerable if the authorized applications controller is enabled (GET /oauth/authorized_applications.json).

Recommended additional hardening for >= 5.1 is to enable application secrets hashing. This would render the exposed secret useless.

Patched versions: ~> 5.0.3; ~> 5.1.1; ~> 5.2.5; >= 5.3.2 Unaffected versions: < 5.0.0

Release notes

Sourced from doorkeeper's releases.

v5.5.1

• #1496 Revoke old_refresh_token if previous_refresh_token is present.
• #1495 Fix respond_to undefined in API-only mode
• #1488 Verify client authentication for Resource Owner Password Grant when config.skip_client_authentication_for_password_grant is set and the client credentials are sent in a HTTP Basic auth header.

v5.5.0

• #1482 Simplify TokenInfoController to be overridable (extract response rendering).
• #1478 Fix ownership association and Rake tasks when custom models configured.
• #1477 Respect ActiveRecord::Base.pluralize_table_names for Doorkeeper table names.

v5.5.0.rc2

• #1473 Enable Applications and AuthorizedApplications controllers in API mode.

  [IMPORTANT] you can still skip these controllers using skip_controllers in use_doorkeeper inside routes.rb. Please do it in case you don't need them.

• #1472 Fix establish_connection configuration for custom defined models.

• #1471 Add support for Ruby 3.0.

• #1469 Check if redirect_uri exists.

• #1465 Memoize nil doorkeeper_token.

• #1459 Use built-in Ruby option to remove padding in PKCE code challenge value.

• #1457 Make owner_id a bigint for newly-generated owner migrations

• #1452 Empty previous_refresh_token only if present.

• #1440 Validate empty host in redirect_uri.

• #1438 Add form post response mode.

• #1458 Make config.skip_client_authentication_for_password_grant a long term configuration option.

v5.5.0.rc1

• #1435 Make error response not redirectable when client is unauthorized

• #1426 Ensure ActiveRecord callbacks are executed on token revocation.

• #1407 Remove redundant and complex to support helpers froms tests (should_have_json, etc).

• #1416 Don't add introspection route if token introspection completely disabled.

• #1410 Properly memoize current_resource_owner value (consider nil and false values).

• #1415 Ignore PKCE params for non-PKCE grants.

• #1418 Add ability to register custom OAuth Grant Flows.

• #1420 Require client authentication for Resource Owner Password Grant as stated in OAuth RFC.

  [IMPORTANT] you need to create a new OAuth client (Doorkeeper::Application) if yoo didn't have it before and use client credentials in HTTP Basic auth if you previously used this grant flow without client authentication. For migration purposes you could enable skip_client_authentication_for_password_grant configuration option to true, but such behavior (as well as configuration option) would be completely removed in a future version of Doorkeeper. All the users of your provider application now need to include client credentials when they use this grant flow.

• #1421 Add Resource Owner instance to authorization hook context for custom_access_token_expires_in configuration option to allow resource owner based Access Tokens TTL.

... (truncated)

Changelog

Sourced from doorkeeper's changelog.

5.5.1

• #1496 Revoke old_refresh_token if previous_refresh_token is present.
• #1495 Fix respond_to undefined in API-only mode
• #1488 Verify client authentication for Resource Owner Password Grant when config.skip_client_authentication_for_password_grant is set and the client credentials are sent in a HTTP Basic auth header.

5.5.0

• #1482 Simplify TokenInfoController to be overridable (extract response rendering).
• #1478 Fix ownership association and Rake tasks when custom models configured.
• #1477 Respect ActiveRecord::Base.pluralize_table_names for Doorkeeper table names.

5.5.0.rc2

• #1473 Enable Applications and AuthorizedApplications controllers in API mode.

  [IMPORTANT] you can still skip these controllers using skip_controllers in use_doorkeeper inside routes.rb. Please do it in case you don't need them.

• #1472 Fix establish_connection configuration for custom defined models.

• #1471 Add support for Ruby 3.0.

• #1469 Check if redirect_uri exists.

• #1465 Memoize nil doorkeeper_token.

• #1459 Use built-in Ruby option to remove padding in PKCE code challenge value.

• #1457 Make owner_id a bigint for newly-generated owner migrations

• #1452 Empty previous_refresh_token only if present.

• #1440 Validate empty host in redirect_uri.

• #1438 Add form post response mode.

• #1458 Make config.skip_client_authentication_for_password_grant a long term configuration option.

5.5.0.rc1

• #1435 Make error response not redirectable when client is unauthorized

• #1426 Ensure ActiveRecord callbacks are executed on token revocation.

• #1407 Remove redundant and complex to support helpers froms tests (should_have_json, etc).

• #1416 Don't add introspection route if token introspection completely disabled.

• #1410 Properly memoize current_resource_owner value (consider nil and false values).

• #1415 Ignore PKCE params for non-PKCE grants.

• #1418 Add ability to register custom OAuth Grant Flows.

• #1420 Require client authentication for Resource Owner Password Grant as stated in OAuth RFC.

  [IMPORTANT] you need to create a new OAuth client (Doorkeeper::Application) if you didn't have it before and use client credentials in HTTP Basic auth if you previously used this grant flow without client authentication. To opt out of this you could set the skip_client_authentication_for_password_grant configuration option to true, but note that this is in violation of the OAuth spec and represents a security risk. All the users of your provider application now need to include client credentials when they use this grant flow.

... (truncated)

Commits

• 73a2b1c Release 5.5.1 🎉
• eb0de6e Merge pull request #1496 from rono23/revoke-old_refresh_token-if-present
• 996a3c9 Revoke old_refresh_token if previous_refresh_token is present
• d413f42 Merge pull request #1495 from Matthijsy/bugfix/api-only-applications
• 8b5109e Make respond_to available when api only
• e048bed Fix version for gemfile
• dfb50a9 Update RSpec Rails
• 2a55a2e Merge pull request #1491 from doorkeeper-gem/dependabot/bundler/rspec-rails-t...
• a3ca6c1 Update rspec-rails requirement from ~> 4.0 to ~> 5.0
• 266eb92 Merge pull request #1488 from toupeira/invalid-client-credentials-basic-auth
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #461.