Security: Attempt to block auth of nil tokens, etc.

Some Rails authentication systems have suffered from a vulnerability
involving nil or blank login tokens:

  http://www.rorsecurity.info/2007/10/28/restful_authentication-login-security/

This patch includes a bunch of test cases testing for possible attacks
along these lines, and some sanity-checking code in our authentication
methods.

Note that the tests and the code don't really "line up" here--most of
the test methods passed already, and most of the sanity-checking code
is probably unnecessary.  But again, better safe than sorry.

app/models/user.rb

@@ -32,6 +32,7 @@ def self.find_admins(*args)
 
   # Authenticates a user by their login name and unencrypted password.  Returns the user or nil.
   def self.authenticate_for(site, login, password)
+    return nil if site.nil? || login.nil? || login.blank? || password.nil? || password.blank?
     u = find(:first, @@membership_options.merge(
       :conditions => ['users.login = ? and (memberships.site_id = ? or users.admin = ?)', login, site.id, true]))
     u && u.authenticated?(password) ? u : nil
@@ -55,6 +56,7 @@ def self.find_all_by_site_with_deleted(site, options = {})
   end
 
   def self.find_by_token(site, token)
+    return nil if site.nil? || token.nil? || token.blank?
     find(:first, @@membership_options.merge(:conditions => ['token = ? and token_expires_at > ? and (memberships.site_id = ? or users.admin = ?)', token, Time.now.utc, site.id, true]))
   end
 

spec/models/user_spec.rb

@@ -0,0 +1,45 @@
+require File.dirname(__FILE__) + '/../spec_helper'
+
+describe User do
+  before :each do
+    @site = Site.make
+  end
+
+  def make_admin_with_token token
+    user = User.make(:token_expires_at => 1.day.from_now, :admin => true)
+    user.token = token # May be nil, so we can't pass to User.make.
+    user.save!
+  end
+
+  it "should not find users with nil token" do
+    # This test always passed, before we did anything specific to fix it.
+    make_admin_with_token nil
+    User.find_by_token(@site, nil).should be_nil
+  end
+
+  it "should not find users with empty token" do
+    make_admin_with_token ''
+    User.find_by_token(@site, '').should be_nil
+  end
+
+  def make_admin_with_login_and_password login, password
+    User.make(:login => login, :password => password, :admin => true)
+  end
+
+  it "should not find users with empty login" do
+    begin
+      make_admin_with_login_and_password '', 'foo'
+      User.authenticate_for(@site, '', 'foo').should be_nil
+    rescue ActiveRecord::RecordInvalid # This is OK, too.
+    end
+  end
+
+  it "should not find users with empty password" do
+    begin
+      make_admin_with_login_and_password 'joe', ''
+      User.authenticate_for(@site, 'joe', '').should be_nil
+    rescue ActiveRecord::RecordInvalid # This is OK, too.
+    end
+  end
+end
+