omniauthのsecurity alertを解決した

CVE 2015 9284の脆弱性へ対応 https://nvd.nist.gov/vuln/detail/CVE-2015-9284 参考 https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284 omniauth/omniauth#960
esminc · Feb 26, 2020 · d38028f · d38028f
1 parent de2e5cb
commit d38028f
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/Gemfile b/Gemfile
@@ -23,6 +23,7 @@ gem 'material_icons'
 gem 'materialize-sass'
 gem 'omniauth'
 gem 'omniauth-google-oauth2'
+gem 'omniauth-rails_csrf_protection'
 gem 'pg'
 gem 'puma'
 gem 'rails-i18n'

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -188,6 +188,9 @@ GEM
     omniauth-oauth2 (1.6.0)
       oauth2 (~> 1.1)
       omniauth (~> 1.9)
+    omniauth-rails_csrf_protection (0.1.2)
+      actionpack (>= 4.2)
+      omniauth (>= 1.3.1)
     orm_adapter (0.5.0)
     parallel (1.19.1)
     parser (2.7.0.0)
@@ -393,6 +396,7 @@ DEPENDENCIES
   materialize-sass
   omniauth
   omniauth-google-oauth2
+  omniauth-rails_csrf_protection
   pg
   pry-byebug
   pry-doc

diff --git a/app/views/devise/shared/_links.html.slim b/app/views/devise/shared/_links.html.slim
@@ -2,4 +2,4 @@
   - resource_class.omniauth_providers.each do |provider|
     .signin
       p @esm.co.jpのアカウントでサインインしてください。
-      = link_to image_tag('btn_google_signin.png', width: 300), omniauth_authorize_path(resource_name, provider), id: 'signin-link'
+      = link_to image_tag('btn_google_signin.png', width: 300), omniauth_authorize_path(resource_name, provider), method: :post, id: 'signin-link'