Ominauth github returns unverified email addresses

[SamSaffron]

Github API will return unverified email addresses and omniauth github forwards this on, instead gem should check "verified" true https://developer.github.com/v3/users/emails/#list-email-addresses-for-a-user before sending back emails. Its a huge security hole cause people can easily impersonate.

[guilhermesimoes]

I'd rather omniauth-github return an email_verified field. Otherwise people will end up complaining about missing emails (just like they do with omniauth-facebook).

But I agree, this is a security hole.

[SamSaffron]

an unverified email allows for a severe security issue,

should be called unverified_email at a minimum

[mbleigh]

Just seeing this. Yes, we need to do something about this. I'm torn as to which method to pursue since OpenID Connect is using an "email_verified" boolean but in general OmniAuth providers are built to assume that email is trustworthy.

[appletonwebb]

@mbleigh have you had the chance to take a further look at this?

[sirwolfgang]

In favor of convention over configuration the default email address should be verified. It is assumed that the email on most Ominauth providers is to be trusted. While this is admittedly concerning, I think its best to be secure by default. Listing unverified emails is useful for handling the edge cases.

[nileshtrivedi]

I see that this PR was merged 7 days ago: 3412544 but there hasn't been a release with this fix yet.

@mbleigh When will this release happen? Discourse and other apps are having to maintain their own forks because of this pending fix.

[chrisvfritz]

I'm also requesting a new release for this critical feature. For apps that access the GitHub API on behalf of users, which I'm guessing is most apps that include this gem, many requests will return errors until the email address is verified.

[tmilewski]

Working on getting access to push an update to RubyGems.

In the meantime, this will work...
gem 'omniauth-github', git: 'https://github.com/intridea/omniauth-github.git', tag: '1.2.0'

[SamSaffron]

@tmilewski if you are stuck in 2-3 weeks and old gem owner can not be found try contacting @arthurnn

It is a security release after all which makes it a bit more important...

[arthurnn]

@mbleigh is the only gem owner of this gem on rubygems.org.
Let's wait for him. I will try to talk to him too.

[tmilewski]

@SamSaffron @arthurnn It's now live!

https://rubygems.org/gems/omniauth-github/versions/1.2.0