2021-03-30 06:08:46 +08:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
|
2017-04-28 03:53:12 +08:00
|
|
|
#
|
|
|
|
|
# Copyright (C) 2014 - present Instructure, Inc.
|
|
|
|
|
#
|
|
|
|
|
# This file is part of Canvas.
|
|
|
|
|
#
|
|
|
|
|
# Canvas is free software: you can redistribute it and/or modify it under
|
|
|
|
|
# the terms of the GNU Affero General Public License as published by the Free
|
|
|
|
|
# Software Foundation, version 3 of the License.
|
|
|
|
|
#
|
|
|
|
|
# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
|
|
|
|
|
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
|
|
|
|
|
# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
|
|
|
|
|
# details.
|
|
|
|
|
#
|
|
|
|
|
# You should have received a copy of the GNU Affero General Public License along
|
|
|
|
|
# with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
2023-01-30 22:07:47 +08:00
|
|
|
# NOTE: Indented gems are meant to indicate optional dependencies of parent gems
|
2020-02-07 22:44:34 +08:00
|
|
|
|
2022-10-03 21:44:25 +08:00
|
|
|
gem "bootsnap", "1.13.0", require: false
|
2023-03-31 02:03:30 +08:00
|
|
|
gem "rails", "~> 7.0.4"
|
2023-01-30 22:07:47 +08:00
|
|
|
gem "tzinfo", "2.0.4"
|
2023-05-04 03:03:42 +08:00
|
|
|
gem "switchman", "~> 3.5"
|
2023-01-30 22:07:47 +08:00
|
|
|
gem "guardrail", "3.0.2"
|
2023-05-03 01:01:05 +08:00
|
|
|
gem "switchman-inst-jobs", "4.0.13"
|
2023-01-30 22:07:47 +08:00
|
|
|
gem "irb", "1.4.1"
|
2015-12-18 01:14:52 +08:00
|
|
|
|
2022-06-02 23:00:41 +08:00
|
|
|
gem "academic_benchmarks", "1.1.2", require: false
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "active_model-better_errors", "1.6.7", require: "active_model/better_errors"
|
2023-04-29 04:59:51 +08:00
|
|
|
gem "active_model_serializers",
|
|
|
|
|
"0.9.0alpha1",
|
|
|
|
|
github: "rails-api/active_model_serializers",
|
|
|
|
|
ref: "61882e1e4127facfe92e49057aec71edbe981829"
|
2022-03-31 02:30:31 +08:00
|
|
|
gem "activerecord-pg-extensions", "0.4.4"
|
2023-03-31 02:26:52 +08:00
|
|
|
gem "addressable", "~> 2.8", require: false
|
2021-05-26 08:45:11 +08:00
|
|
|
gem "after_transaction_commit", "2.2.2"
|
2022-06-02 23:00:41 +08:00
|
|
|
gem "authlogic", "6.4.2"
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "scrypt", "3.0.7"
|
2023-03-31 02:09:51 +08:00
|
|
|
gem "aws-sdk-dynamodb", "~> 1.83"
|
|
|
|
|
gem "aws-sdk-kinesis", "~> 1.45", require: false
|
|
|
|
|
gem "aws-sdk-kms", "~> 1.63", require: false
|
|
|
|
|
gem "aws-sdk-s3", "~> 1.119", require: false
|
|
|
|
|
gem "aws-sdk-sns", "~> 1.60", require: false
|
|
|
|
|
gem "aws-sdk-sqs", "~> 1.53", require: false
|
2019-07-10 05:33:18 +08:00
|
|
|
gem "barby", "0.6.8", require: false
|
2021-04-09 01:41:54 +08:00
|
|
|
gem "rqrcode", "1.2.0", require: false
|
2022-12-21 03:06:59 +08:00
|
|
|
gem "chunky_png", "1.4.0", require: false
|
2020-11-17 01:25:42 +08:00
|
|
|
gem "bcrypt", "3.1.16"
|
2022-12-21 23:23:44 +08:00
|
|
|
gem "bigdecimal", "3.1.3"
|
2020-11-17 07:24:04 +08:00
|
|
|
gem "browser", "5.1.0", require: false
|
2020-02-22 01:38:15 +08:00
|
|
|
gem "builder", "3.2.4"
|
2022-12-21 01:58:22 +08:00
|
|
|
gem "business_time", "0.13.0"
|
2022-03-23 03:44:28 +08:00
|
|
|
gem "canvas_connect", "0.3.16"
|
|
|
|
|
gem "canvas_webex", "0.18.2"
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "crocodoc-ruby", "0.0.1", require: false
|
2020-11-17 23:48:23 +08:00
|
|
|
gem "ddtrace", "0.42.0", require: false
|
2022-01-21 10:46:36 +08:00
|
|
|
gem "docx", "0.6.2"
|
2022-06-02 23:00:41 +08:00
|
|
|
gem "encrypted_cookie_store-instructure", "1.2.12", require: "encrypted_cookie_store"
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "folio-pagination", "0.0.12", require: "folio/rails"
|
2022-02-02 04:01:57 +08:00
|
|
|
gem "ffi", "1.14.2", require: false
|
2021-09-28 23:52:21 +08:00
|
|
|
gem "gepub", "1.0.15"
|
2021-07-09 15:40:31 +08:00
|
|
|
gem "apollo-federation", "1.1.5"
|
2021-07-28 13:49:16 +08:00
|
|
|
gem "graphql", "1.12.14"
|
2020-11-17 01:25:42 +08:00
|
|
|
gem "graphql-batch", "0.4.3"
|
2017-01-03 05:36:48 +08:00
|
|
|
gem "hashery", "2.1.2", require: false
|
2020-02-22 01:38:15 +08:00
|
|
|
gem "highline", "2.0.3", require: false
|
2023-05-10 02:57:47 +08:00
|
|
|
gem "httparty", "~> 0.21"
|
2023-03-30 05:46:02 +08:00
|
|
|
gem "i18n", "~> 1.12"
|
2022-12-21 01:58:40 +08:00
|
|
|
gem "i18nliner", "0.2.2", github: "instructure/i18nliner", ref: "ruby3"
|
2020-11-18 00:04:40 +08:00
|
|
|
gem "icalendar", "2.7.0", require: false
|
2022-08-03 05:18:45 +08:00
|
|
|
gem "diplomat", "2.6.3", require: false
|
2023-01-04 03:53:14 +08:00
|
|
|
gem "ims-lti", "2.3.3", require: "ims"
|
2022-06-03 05:59:47 +08:00
|
|
|
gem "rrule", "0.4.4", require: false
|
Convert newlines to CRLFs in params used in signature base strings
LTI 1 launches (and LTI 2 launches using the same OAuth 1 signature
method) use a form with hidden fields to send the parameters to the LTI
tool. Browsers always send newlines in hidden input fields (i.e. params
encoded as form data) as carriage return + line feed (%0D%0A = "\r\n").
As a result, if any launch parameters include newlines, the tool will
get "%0D%0A" in the query params for them.
Currently, though, we calculate the base string as if the newlines in
the parameters are just "%0A". This commit changes the newlines to CRLF
before-hand to simulate what browsers do. (I then use the CRLF'd version
for the actual parameters ... this eliminates any possibility of any
differences due to weird mixed LF and CRLF endings or anything, and
browsers don't add extra CRs if endings are already CRLF.)
refs INTEROP-7387
flag=none
Test plan:
** SETUP **
- on line 210 of app/controllers/lti/message_controller.rb, right before
the end of the lti2_basic_launch method, add the following line:
Lti::Logging.lti_1_launch_generated(message.message_authenticator.base_string)
- have the following LTI tools installed:
- an LTI 2 tool with the Canvas.placements.similarityDetection
placement (that should be in the MessageHandler's 'capabilities')
- an LTI 1 tool with extension_setting "oauth_compliant"
- an LTI 1 tool without extension_setting "oauth_compliant" (and
double-check sure disable_lti_post_only "Don't Move LTI Query Params
to POST Body" feature flag is off)
- For the LTI 2 tool, add "ResourceLink.description" to the
MessageHandler's "capabilities".
- For the LTI 1 tools, have a custom parameter
with the value "$ResourceLink.description" (there might be a way to
sent this as resourcelink_description instead of a custom parameter, I
don't know what it is) and give it the similarity_detection placement
- Open the copyasfetch_verify_oauth_signature.rb script (attached to the
ticket). Find the secrets for your LTI 1 and LTI 2 tools as described
in the script. Adjust the `secret_for_url()` method there for your
tools.
** LAUNCHING AND TESTING **
- Launch the tools in the following ways in a browser that supports
"copy as fetch" (Chrome and Firefox do). (Note that you don't need the
tools running / working, we just need to look at the launch.)
- for the LTI 2 tools and LTI 1 tools, create a new assignment. In the
text field add some bullet points. Under Submission Type choose
Online -> Text Entry. Then choose the tool in the Similarity
Detection dropdown. The tool will launch.
- For the LTI 1 tools, also make assignments with the description with
bullet points but of type LTI assignment by choosing the tool. Then
launch the assignment.
- For each launch, verify the base string for the launch as follows.
- In the logs, the base string is logged:
grep base.string log/development.log
Check that newlines are encoded as %0D%0A (which when double-encoded
in the base string is %250D%250A). If you want, to unencode one
level you can use:
ruby -e 'require "cgi"; puts CGI.unescape(ARGF.read.split("&").last)'
- Go to dev tools, find the launch in the Network tab, right click and
choose "copy as fetch". Save to a file and pipe into the
copyasfetch_verify_oauth_signature.rb script. It will tell you if
the expected signature matches the one used in the launch. Also
verify that the base string used includes CRLFs, i.e. "%250D%250A".
Change-Id: I7d70f7740612ad25cb3ff61940d05e97a5a87aea
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/290806
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Alexis Nast <alexis.nast@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
QA-Review: Xander Moffatt <xmoffatt@instructure.com>
2022-04-29 21:34:21 +08:00
|
|
|
|
2021-11-17 08:20:21 +08:00
|
|
|
gem "inst_access", "0.1.1"
|
2021-07-30 04:00:30 +08:00
|
|
|
gem "inst_statsd", "2.2.0"
|
2023-05-03 01:01:05 +08:00
|
|
|
gem "inst-jobs", "~> 3.1"
|
2021-09-30 22:33:11 +08:00
|
|
|
gem "inst-jobs-autoscaling", "2.1.1"
|
2022-05-27 05:00:43 +08:00
|
|
|
gem "inst-jobs-statsd", "2.2.0"
|
2021-01-16 04:17:24 +08:00
|
|
|
# if updating json gem it will need to be hotfixed because if a newer version of
|
|
|
|
|
# the json gem is installed, it will always use that one even before bundler
|
|
|
|
|
# gets activated. Updating the gem in it's own commit will make this easier.
|
2022-08-18 23:44:07 +08:00
|
|
|
gem "json", "~> 2.6.1"
|
2023-04-05 03:06:36 +08:00
|
|
|
gem "json_schemer", "~> 0.2"
|
2020-11-18 00:07:59 +08:00
|
|
|
gem "json-jwt", "1.13.0", require: false
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "link_header", "0.0.8"
|
2022-12-22 03:45:22 +08:00
|
|
|
gem "mail", "2.7.1", require: false
|
2023-01-04 06:23:31 +08:00
|
|
|
gem "marginalia", "1.11.1", require: false
|
2020-02-22 01:38:15 +08:00
|
|
|
gem "mime-types", "3.3.1"
|
2020-11-18 00:09:02 +08:00
|
|
|
gem "mini_magick", "4.11.0"
|
2020-11-18 00:18:31 +08:00
|
|
|
gem "multi_json", "1.15.0"
|
2020-10-13 05:32:34 +08:00
|
|
|
gem "net-ldap", "0.16.3", require: false
|
2022-12-13 04:57:51 +08:00
|
|
|
gem "net-imap", "0.2.3", require: false
|
|
|
|
|
gem "net-pop", "0.1.1", require: false
|
|
|
|
|
gem "net-smtp", "0.3.1", require: false
|
|
|
|
|
gem "nokogiri", "1.13.8", require: false
|
2017-12-22 05:37:44 +08:00
|
|
|
gem "oauth", "0.5.4", require: false
|
2020-02-22 01:38:15 +08:00
|
|
|
gem "oauth2", "1.4.4", require: false
|
2020-11-17 01:25:42 +08:00
|
|
|
gem "oj", "3.10.16"
|
2022-06-02 23:00:41 +08:00
|
|
|
gem "outrigger", "3.0.1"
|
2023-05-02 04:31:06 +08:00
|
|
|
gem "parallel", "1.22.1", require: false
|
2022-01-21 10:46:36 +08:00
|
|
|
gem "pdf-reader", "2.5.0"
|
2022-12-13 04:57:51 +08:00
|
|
|
gem "pg_query", "2.2.0"
|
2023-04-07 05:57:09 +08:00
|
|
|
gem "prawn-emoji", "~> 5.3", require: false
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "prawn-rails", "1.3.0"
|
2023-02-23 06:45:32 +08:00
|
|
|
gem "matrix", "0.4.2" # Used to be a default gem but is no more, but prawn depends on it implicitly
|
2023-03-17 23:24:47 +08:00
|
|
|
gem "prosopite", "~> 1.3"
|
2020-06-17 01:18:01 +08:00
|
|
|
gem "rack", "2.2.3"
|
2020-11-03 06:45:06 +08:00
|
|
|
gem "rack-brotli", "1.0.0"
|
2020-02-22 00:33:10 +08:00
|
|
|
gem "rack-test", "1.1.0"
|
2023-03-29 06:59:13 +08:00
|
|
|
gem "rake", "~> 13.0"
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "rails-observers", "0.1.5"
|
2021-09-28 23:52:21 +08:00
|
|
|
gem "ratom-nokogiri", "0.10.11", require: false
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "redcarpet", "3.5.0", require: false
|
2023-05-02 04:31:06 +08:00
|
|
|
gem "regexp_parser", "2.7.0", require: false
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "retriable", "1.4.1"
|
2015-04-09 01:21:08 +08:00
|
|
|
gem "ritex", "1.0.1", require: false
|
2020-11-18 00:34:04 +08:00
|
|
|
gem "rotp", "6.2.0", require: false
|
2022-12-13 23:43:39 +08:00
|
|
|
gem "rss", "0.2.9", require: false
|
2017-01-03 05:40:07 +08:00
|
|
|
gem "ruby-duration", "3.2.3", require: false
|
2021-04-28 03:00:07 +08:00
|
|
|
gem "ruby2_keywords", "0.0.3"
|
2015-04-09 01:21:08 +08:00
|
|
|
gem "rubycas-client", "2.3.9", require: false
|
2022-01-21 10:46:36 +08:00
|
|
|
gem "ruby-rtf", "0.0.5"
|
2020-10-27 00:50:40 +08:00
|
|
|
gem "rubyzip", "2.3.0", require: "zip"
|
2022-06-02 23:00:41 +08:00
|
|
|
gem "saml2", "3.1.2"
|
2021-11-11 04:17:16 +08:00
|
|
|
gem "sanitize", "6.0.0", require: false
|
2022-02-15 06:22:34 +08:00
|
|
|
gem "sentry-ruby", "5.1.0"
|
|
|
|
|
gem "sentry-rails", "5.1.0"
|
|
|
|
|
gem "sentry-inst_jobs", "1.0.2"
|
2020-02-06 03:56:53 +08:00
|
|
|
gem "simple_oauth", "0.3.1", require: false
|
2020-06-11 00:08:05 +08:00
|
|
|
gem "twilio-ruby", "5.36.0", require: false
|
2020-11-18 03:46:35 +08:00
|
|
|
gem "vault", "0.15.0", require: false
|
2017-09-18 23:19:55 +08:00
|
|
|
gem "vericite_api", "1.5.3"
|
2021-11-30 10:34:05 +08:00
|
|
|
gem "wcag_color_contrast", "0.1.0"
|
2023-04-29 04:59:51 +08:00
|
|
|
gem "week_of_month",
|
|
|
|
|
"1.2.5",
|
|
|
|
|
github: "instructure/week-of-month",
|
|
|
|
|
ref: "b3013639e9474f302b5a6f27e4e45313e8d24902"
|
2020-02-29 10:39:18 +08:00
|
|
|
gem "will_paginate", "3.3.0", require: false # required for folio-pagination
|
2020-02-07 22:44:34 +08:00
|
|
|
|
2021-05-25 03:22:39 +08:00
|
|
|
gem "faraday", "0.17.4"
|
|
|
|
|
|
2021-08-20 03:57:45 +08:00
|
|
|
path "gems" do
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "activesupport-suspend_callbacks"
|
|
|
|
|
gem "acts_as_list"
|
|
|
|
|
gem "adheres_to_policy"
|
|
|
|
|
gem "attachment_fu"
|
|
|
|
|
gem "autoextend"
|
|
|
|
|
gem "bookmarked_collection"
|
|
|
|
|
gem "broadcast_policy"
|
|
|
|
|
gem "canvas_breach_mitigation"
|
2021-02-25 02:46:52 +08:00
|
|
|
gem "canvas_cache"
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "canvas_color"
|
|
|
|
|
gem "canvas_crummy"
|
|
|
|
|
gem "canvas_dynamodb"
|
2021-03-06 00:05:49 +08:00
|
|
|
gem "canvas_errors"
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "canvas_ext"
|
|
|
|
|
gem "canvas_http"
|
|
|
|
|
gem "canvas_kaltura"
|
|
|
|
|
gem "canvas_panda_pub"
|
|
|
|
|
gem "canvas_partman"
|
|
|
|
|
gem "canvas_mimetype_fu"
|
|
|
|
|
gem "canvas_quiz_statistics"
|
|
|
|
|
gem "canvas_sanitize"
|
2021-02-26 23:33:26 +08:00
|
|
|
gem "canvas_security"
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "canvas_slug"
|
|
|
|
|
gem "canvas_sort"
|
|
|
|
|
gem "canvas_stringex"
|
|
|
|
|
gem "canvas_text_helper"
|
|
|
|
|
gem "canvas_time"
|
|
|
|
|
gem "canvas_unzip"
|
2021-02-23 01:51:59 +08:00
|
|
|
gem "config_file"
|
2023-01-30 22:07:47 +08:00
|
|
|
gem "csv_diff"
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "diigo"
|
2021-02-13 04:11:53 +08:00
|
|
|
gem "dynamic_settings"
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "event_stream"
|
|
|
|
|
gem "google_drive"
|
|
|
|
|
gem "html_text_helper"
|
|
|
|
|
gem "incoming_mail_processor"
|
|
|
|
|
gem "json_token"
|
|
|
|
|
gem "linked_in"
|
|
|
|
|
gem "live_events"
|
|
|
|
|
gem "lti-advantage"
|
|
|
|
|
gem "lti_outbound"
|
|
|
|
|
gem "multipart"
|
|
|
|
|
gem "paginated_collection"
|
2021-02-27 23:13:52 +08:00
|
|
|
gem "request_context"
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "stringify_ids"
|
2017-09-18 23:19:55 +08:00
|
|
|
gem "turnitin_api"
|
2020-02-07 22:44:34 +08:00
|
|
|
gem "twitter"
|
|
|
|
|
gem "utf8_cleaner"
|
|
|
|
|
gem "workflow"
|
|
|
|
|
end
|