recaptcha-5.12.3/ 0000755 0000041 0000041 00000000000 14402147736 013574 5 ustar www-data www-data recaptcha-5.12.3/README.md 0000644 0000041 0000041 00000071667 14402147736 015074 0 ustar www-data www-data
# reCAPTCHA
[](https://badge.fury.io/rb/recaptcha)
Author: Jason L Perry (http://ambethia.com)
Copyright: Copyright (c) 2007-2013 Jason L Perry
License: [MIT](http://creativecommons.org/licenses/MIT/)
Info: https://github.com/ambethia/recaptcha
Bugs: https://github.com/ambethia/recaptcha/issues
This gem provides helper methods for the [reCAPTCHA API](https://www.google.com/recaptcha). In your
views you can use the `recaptcha_tags` method to embed the needed javascript, and you can validate
in your controllers with `verify_recaptcha` or `verify_recaptcha!`, which raises an error on
failure.
# Table of Contents
1. [Obtaining a key](#obtaining-a-key)
2. [Rails Installation](#rails-installation)
3. [Sinatra / Rack / Ruby Installation](#sinatra--rack--ruby-installation)
4. [reCAPTCHA V2 API & Usage](#recaptcha-v2-api-and-usage)
- [`recaptcha_tags`](#recaptcha_tags)
- [`verify_recaptcha`](#verify_recaptcha)
- [`invisible_recaptcha_tags`](#invisible_recaptcha_tags)
5. [reCAPTCHA V3 API & Usage](#recaptcha-v3-api-and-usage)
- [`recaptcha_v3`](#recaptcha_v3)
- [`verify_recaptcha` (use with v3)](#verify_recaptcha-use-with-v3)
- [`recaptcha_reply`](#recaptcha_reply)
6. [I18n Support](#i18n-support)
7. [Testing](#testing)
8. [Alternative API Key Setup](#alternative-api-key-setup)
## Obtaining a key
Go to the [reCAPTCHA admin console](https://www.google.com/recaptcha/admin) to obtain a reCAPTCHA API key.
The reCAPTCHA type(s) that you choose for your key will determine which methods to use below.
| reCAPTCHA type | Methods to use | Description |
|----------------------------------------------|----------------|-------------|
| v3 | [`recaptcha_v3`](#recaptcha_v3) | Verify requests with a [score](https://developers.google.com/recaptcha/docs/v3#score)
| v2 Checkbox ("I'm not a robot" Checkbox) | [`recaptcha_tags`](#recaptcha_tags) | Validate requests with the "I'm not a robot" checkbox |
| v2 Invisible (Invisible reCAPTCHA badge) | [`invisible_recaptcha_tags`](#invisible_recaptcha_tags) | Validate requests in the background |
Note: You can _only_ use methods that match your key's type. You cannot use v2 methods with a v3
key or use `recaptcha_tags` with a v2 Invisible key, for example. Otherwise you will get an
error like "Invalid key type" or "This site key is not enabled for the invisible captcha."
Note: Enter `localhost` or `127.0.0.1` as the domain if using in development with `localhost:3000`.
## Rails Installation
**If you are having issues with Rails 7, Turbo, and Stimulus, make sure to check [this Wiki page](https://github.com/ambethia/recaptcha/wiki/Recaptcha-with-Turbo-and-Stimulus)!**
```ruby
gem "recaptcha"
```
You can keep keys out of the code base with environment variables or with Rails [secrets](https://api.rubyonrails.org/classes/Rails/Application.html#method-i-secrets).
In development, you can use the [dotenv](https://github.com/bkeepers/dotenv) gem. (Make sure to add it above `gem 'recaptcha'`.)
See [Alternative API key setup](#alternative-api-key-setup) for more ways to configure or override
keys. See also the
[Configuration](https://www.rubydoc.info/github/ambethia/recaptcha/master/Recaptcha/Configuration)
documentation.
```shell
export RECAPTCHA_SITE_KEY = '6Lc6BAAAAAAAAChqRbQZcn_yyyyyyyyyyyyyyyyy'
export RECAPTCHA_SECRET_KEY = '6Lc6BAAAAAAAAKN3DRm6VA_xxxxxxxxxxxxxxxxx'
```
If you have an Enterprise API key:
```shell
export RECAPTCHA_ENTERPRISE = 'true'
export RECAPTCHA_ENTERPRISE_API_KEY = 'AIzvFyE3TU-g4K_Kozr9F1smEzZSGBVOfLKyupA'
export RECAPTCHA_ENTERPRISE_PROJECT_ID = 'my-project'
```
Add `recaptcha_tags` to the forms you want to protect:
```erb
<%= form_for @foo do |f| %>
# …
<%= recaptcha_tags %>
# …
<% end %>
```
Then, add `verify_recaptcha` logic to each form action that you've protected:
```ruby
# app/controllers/users_controller.rb
@user = User.new(params[:user].permit(:name))
if verify_recaptcha(model: @user) && @user.save
redirect_to @user
else
render 'new'
end
```
Please note that this setup uses [`reCAPTCHA_v2`](#recaptcha-v2-api-and-usage). For a `recaptcha_v3` use, please refer to [`reCAPTCHA_v3 setup`](#examples).
## Sinatra / Rack / Ruby installation
See [sinatra demo](/demo/sinatra) for details.
- add `gem 'recaptcha'` to `Gemfile`
- set env variables
- `include Recaptcha::Adapters::ViewMethods` where you need `recaptcha_tags`
- `include Recaptcha::Adapters::ControllerMethods` where you need `verify_recaptcha`
## reCAPTCHA v2 API and Usage
### `recaptcha_tags`
Use this when your key's reCAPTCHA type is "v2 Checkbox".
The following options are available:
| Option | Description |
|---------------------|-------------|
| `:theme` | Specify the theme to be used per the API. Available options: `dark` and `light`. (default: `light`) |
| `:ajax` | Render the dynamic AJAX captcha per the API. (default: `false`) |
| `:site_key` | Override site API key from configuration |
| `:error` | Override the error code returned from the reCAPTCHA API (default: `nil`) |
| `:size` | Specify a size (default: `nil`) |
| `:nonce` | Optional. Sets nonce attribute for script. Can be generated via `SecureRandom.base64(32)`. (default: `nil`) |
| `:id` | Specify an html id attribute (default: `nil`) |
| `:callback` | Optional. Name of success callback function, executed when the user submits a successful response |
| `:expired_callback` | Optional. Name of expiration callback function, executed when the reCAPTCHA response expires and the user needs to re-verify. |
| `:error_callback` | Optional. Name of error callback function, executed when reCAPTCHA encounters an error (e.g. network connectivity) |
| `:noscript` | Include `
HTML
end
html.respond_to?(:html_safe) ? html.html_safe : html
end
def self.invisible_recaptcha_tags(custom)
options = {callback: 'invisibleRecaptchaSubmit', ui: :button}.merge(custom)
text = options.delete(:text)
html, tag_attributes = components(options.dup)
html << default_callback(options) if default_callback_required?(options)
case options[:ui]
when :button
html << %(\n)
when :invisible
html << %(\n)
when :input
html << %(\n)
else
raise(RecaptchaError, "ReCAPTCHA ui `#{options[:ui]}` is not valid.")
end
html.respond_to?(:html_safe) ? html.html_safe : html
end
def self.to_error_message(key)
default = DEFAULT_ERRORS.fetch(key) { raise ArgumentError "Unknown reCAPTCHA error - #{key}" }
to_message("recaptcha.errors.#{key}", default)
end
if defined?(I18n)
def self.to_message(key, default)
I18n.translate(key, default: default)
end
else
def self.to_message(_key, default)
default
end
end
private_class_method def self.components(options)
html = +''
attributes = {}
fallback_uri = +''
options = options.dup
env = options.delete(:env)
class_attribute = options.delete(:class)
site_key = options.delete(:site_key)
hl = options.delete(:hl)
onload = options.delete(:onload)
render = options.delete(:render)
script_async = options.delete(:script_async)
script_defer = options.delete(:script_defer)
nonce = options.delete(:nonce)
skip_script = (options.delete(:script) == false) || (options.delete(:external_script) == false)
ui = options.delete(:ui)
data_attribute_keys = [:badge, :theme, :type, :callback, :expired_callback, :error_callback, :size]
data_attribute_keys << :tabindex unless ui == :button
data_attributes = {}
data_attribute_keys.each do |data_attribute|
value = options.delete(data_attribute)
data_attributes["data-#{data_attribute.to_s.tr('_', '-')}"] = value if value
end
unless Recaptcha.skip_env?(env)
site_key ||= Recaptcha.configuration.site_key!
script_url = Recaptcha.configuration.api_server_url
query_params = hash_to_query(
hl: hl,
onload: onload,
render: render
)
script_url += "?#{query_params}" unless query_params.empty?
async_attr = "async" if script_async != false
defer_attr = "defer" if script_defer != false
nonce_attr = " nonce='#{nonce}'" if nonce
html << %(\n) unless skip_script
fallback_uri = %(#{script_url.chomp(".js")}/fallback?k=#{site_key})
attributes["data-sitekey"] = site_key
attributes.merge! data_attributes
end
# The remaining options will be added as attributes on the tag.
attributes["class"] = "g-recaptcha #{class_attribute}"
tag_attributes = attributes.merge(options).map { |k, v| %(#{k}="#{v}") }.join(" ")
[html, tag_attributes, fallback_uri]
end
# v3
# Renders a script that calls `grecaptcha.execute` or
# `grecaptcha.enterprise.execute` for the given `site_key` and `action` and
# calls the `callback` with the resulting response token.
private_class_method def self.recaptcha_v3_inline_script(site_key, action, callback, id, options = {})
nonce = options[:nonce]
nonce_attr = " nonce='#{nonce}'" if nonce
<<-HTML
// Define function so that we can call it again later if we need to reset it
// This executes reCAPTCHA and then calls our callback.
function #{recaptcha_v3_execute_function_name(action)}() {
#{recaptcha_ready_method_name}(function() {
#{recaptcha_execute_method_name}('#{site_key}', {action: '#{action}'}).then(function(token) {
#{callback}('#{id}', token)
});
});
};
// Invoke immediately
#{recaptcha_v3_execute_function_name(action)}()
// Async variant so you can await this function from another async function (no need for
// an explicit callback function then!)
// Returns a Promise that resolves with the response token.
async function #{recaptcha_v3_async_execute_function_name(action)}() {
return new Promise((resolve, reject) => {
#{recaptcha_ready_method_name}(async function() {
resolve(await #{recaptcha_execute_method_name}('#{site_key}', {action: '#{action}'}))
});
})
};
#{recaptcha_v3_define_default_callback(callback) if recaptcha_v3_define_default_callback?(callback, action, options)}
HTML
end
private_class_method def self.recaptcha_v3_onload_script(site_key, action, callback, id, options = {})
nonce = options[:nonce]
nonce_attr = " nonce='#{nonce}'" if nonce
<<-HTML
function #{recaptcha_v3_execute_function_name(action)}() {
#{recaptcha_ready_method_name}(function() {
#{recaptcha_execute_method_name}('#{site_key}', {action: '#{action}'}).then(function(token) {
#{callback}('#{id}', token)
});
});
};
#{recaptcha_v3_define_default_callback(callback) if recaptcha_v3_define_default_callback?(callback, action, options)}
HTML
end
private_class_method def self.recaptcha_v3_inline_script?(options)
!Recaptcha.skip_env?(options[:env]) &&
options[:script] != false &&
options[:inline_script] != false
end
private_class_method def self.recaptcha_v3_define_default_callback(callback)
<<-HTML
var #{callback} = function(id, token) {
var element = document.getElementById(id);
element.value = token;
}
HTML
end
# Returns true if we should be adding the default callback.
# That is, if the given callback name is the default callback name (for the given action) and we
# are not skipping inline scripts for any reason.
private_class_method def self.recaptcha_v3_define_default_callback?(callback, action, options)
callback == recaptcha_v3_default_callback_name(action) &&
recaptcha_v3_inline_script?(options)
end
# Returns the name of the JavaScript function that actually executes the
# reCAPTCHA code (calls `grecaptcha.execute` or
# `grecaptcha.enterprise.execute`). You can call it again later to reset it.
def self.recaptcha_v3_execute_function_name(action)
"executeRecaptchaFor#{sanitize_action_for_js(action)}"
end
# Returns the name of an async JavaScript function that executes the reCAPTCHA code.
def self.recaptcha_v3_async_execute_function_name(action)
"#{recaptcha_v3_execute_function_name(action)}Async"
end
def self.recaptcha_v3_default_callback_name(action)
"setInputWithRecaptchaResponseTokenFor#{sanitize_action_for_js(action)}"
end
# v2
private_class_method def self.default_callback(options = {})
nonce = options[:nonce]
nonce_attr = " nonce='#{nonce}'" if nonce
selector_attr = options[:id] ? "##{options[:id]}" : ".g-recaptcha"
<<-HTML
var invisibleRecaptchaSubmit = function () {
var closestForm = function (ele) {
var curEle = ele.parentNode;
while (curEle.nodeName !== 'FORM' && curEle.nodeName !== 'BODY'){
curEle = curEle.parentNode;
}
return curEle.nodeName === 'FORM' ? curEle : null
};
var el = document.querySelector("#{selector_attr}")
if (!!el) {
var form = closestForm(el);
if (form) {
form.submit();
}
}
};
HTML
end
def self.recaptcha_execute_method_name
Recaptcha.configuration.enterprise ? "grecaptcha.enterprise.execute" : "grecaptcha.execute"
end
def self.recaptcha_ready_method_name
Recaptcha.configuration.enterprise ? "grecaptcha.enterprise.ready" : "grecaptcha.ready"
end
private_class_method def self.default_callback_required?(options)
options[:callback] == 'invisibleRecaptchaSubmit' &&
!Recaptcha.skip_env?(options[:env]) &&
options[:script] != false &&
options[:inline_script] != false
end
# Returns a camelized string that is safe for use in a JavaScript variable/function name.
# sanitize_action_for_js('my/action') => 'MyAction'
private_class_method def self.sanitize_action_for_js(action)
action.to_s.gsub(/\W/, '_').split(/\/|_/).map(&:capitalize).join
end
# Returns a dasherized string that is safe for use as an HTML ID
# dasherize_action('my/action') => 'my-action'
private_class_method def self.dasherize_action(action)
action.to_s.gsub(/\W/, '-').tr('_', '-')
end
private_class_method def self.hash_to_query(hash)
hash.delete_if { |_, val| val.nil? || val.empty? }.to_a.map { |pair| pair.join('=') }.join('&')
end
end
end
recaptcha-5.12.3/lib/recaptcha/configuration.rb 0000644 0000041 0000041 00000005675 14402147736 021505 0 ustar www-data www-data # frozen_string_literal: true
module Recaptcha
# This class enables detailed configuration of the recaptcha services.
#
# By calling
#
# Recaptcha.configuration # => instance of Recaptcha::Configuration
#
# or
# Recaptcha.configure do |config|
# config # => instance of Recaptcha::Configuration
# end
#
# you are able to perform configuration updates.
#
# Your are able to customize all attributes listed below. All values have
# sensitive default and will very likely not need to be changed.
#
# Please note that the site and secret key for the reCAPTCHA API Access
# have no useful default value. The keys may be set via the Shell enviroment
# or using this configuration. Settings within this configuration always take
# precedence.
#
# Setting the keys with this Configuration
#
# Recaptcha.configure do |config|
# config.site_key = '6Lc6BAAAAAAAAChqRbQZcn_yyyyyyyyyyyyyyyyy'
# config.secret_key = '6Lc6BAAAAAAAAKN3DRm6VA_xxxxxxxxxxxxxxxxx'
# end
#
class Configuration
DEFAULTS = {
'free_server_url' => 'https://www.recaptcha.net/recaptcha/api.js',
'enterprise_server_url' => 'https://www.recaptcha.net/recaptcha/enterprise.js',
'free_verify_url' => 'https://www.recaptcha.net/recaptcha/api/siteverify',
'enterprise_verify_url' => 'https://recaptchaenterprise.googleapis.com/v1/projects'
}.freeze
attr_accessor :default_env, :skip_verify_env, :proxy, :secret_key, :site_key, :handle_timeouts_gracefully,
:hostname, :enterprise, :enterprise_api_key, :enterprise_project_id, :response_limit
attr_writer :api_server_url, :verify_url
def initialize # :nodoc:
@default_env = ENV['RAILS_ENV'] || ENV['RACK_ENV'] || (Rails.env if defined? Rails.env)
@skip_verify_env = %w[test cucumber]
@handle_timeouts_gracefully = true
@secret_key = ENV['RECAPTCHA_SECRET_KEY']
@site_key = ENV['RECAPTCHA_SITE_KEY']
@enterprise = ENV['RECAPTCHA_ENTERPRISE'] == 'true'
@enterprise_api_key = ENV['RECAPTCHA_ENTERPRISE_API_KEY']
@enterprise_project_id = ENV['RECAPTCHA_ENTERPRISE_PROJECT_ID']
@verify_url = nil
@api_server_url = nil
@response_limit = 4000
end
def secret_key!
secret_key || raise(RecaptchaError, "No secret key specified.")
end
def site_key!
site_key || raise(RecaptchaError, "No site key specified.")
end
def enterprise_api_key!
enterprise_api_key || raise(RecaptchaError, "No Enterprise API key specified.")
end
def enterprise_project_id!
enterprise_project_id || raise(RecaptchaError, "No Enterprise project ID specified.")
end
def api_server_url
@api_server_url || (enterprise ? DEFAULTS.fetch('enterprise_server_url') : DEFAULTS.fetch('free_server_url'))
end
def verify_url
@verify_url || (enterprise ? DEFAULTS.fetch('enterprise_verify_url') : DEFAULTS.fetch('free_verify_url'))
end
end
end
recaptcha-5.12.3/lib/recaptcha/rails.rb 0000644 0000041 0000041 00000000140 14402147736 017726 0 ustar www-data www-data # frozen_string_literal: true
# deprecated, but let's not blow everyone up
require 'recaptcha'
recaptcha-5.12.3/lib/recaptcha.rb 0000644 0000041 0000041 00000012637 14402147736 016632 0 ustar www-data www-data # frozen_string_literal: true
require 'json'
require 'net/http'
require 'uri'
require 'recaptcha/configuration'
require 'recaptcha/helpers'
require 'recaptcha/adapters/controller_methods'
require 'recaptcha/adapters/view_methods'
if defined?(Rails)
require 'recaptcha/railtie'
end
module Recaptcha
DEFAULT_TIMEOUT = 3
class RecaptchaError < StandardError
end
class VerifyError < RecaptchaError
end
# Gives access to the current Configuration.
def self.configuration
@configuration ||= Configuration.new
end
# Allows easy setting of multiple configuration options. See Configuration
# for all available options.
#--
# The temp assignment is only used to get a nicer rdoc. Feel free to remove
# this hack.
#++
def self.configure
config = configuration
yield(config)
end
def self.with_configuration(config)
original_config = {}
config.each do |key, value|
original_config[key] = configuration.send(key)
configuration.send("#{key}=", value)
end
yield if block_given?
ensure
original_config.each { |key, value| configuration.send("#{key}=", value) }
end
def self.skip_env?(env)
configuration.skip_verify_env.include?(env || configuration.default_env)
end
def self.invalid_response?(resp)
resp.empty? || resp.length > configuration.response_limit
end
def self.verify_via_api_call(response, options)
if Recaptcha.configuration.enterprise
verify_via_api_call_enterprise(response, options)
else
verify_via_api_call_free(response, options)
end
end
def self.verify_via_api_call_enterprise(response, options)
site_key = options.fetch(:site_key) { configuration.site_key! }
api_key = options.fetch(:enterprise_api_key) { configuration.enterprise_api_key! }
project_id = options.fetch(:enterprise_project_id) { configuration.enterprise_project_id! }
query_params = { 'key' => api_key }
body = { 'event' => { 'token' => response, 'siteKey' => site_key } }
body['event']['expectedAction'] = options[:action] if options.key?(:action)
body['event']['userIpAddress'] = options[:remote_ip] if options.key?(:remote_ip)
reply = api_verification_enterprise(query_params, body, project_id, timeout: options[:timeout])
score = reply.dig('riskAnalysis', 'score')
token_properties = reply['tokenProperties']
success = !token_properties.nil? &&
token_properties['valid'].to_s == 'true' &&
hostname_valid?(token_properties['hostname'], options[:hostname]) &&
action_valid?(token_properties['action'], options[:action]) &&
score_above_threshold?(score, options[:minimum_score]) &&
score_below_threshold?(score, options[:maximum_score])
if options[:with_reply] == true
[success, reply]
else
success
end
end
def self.verify_via_api_call_free(response, options)
secret_key = options.fetch(:secret_key) { configuration.secret_key! }
verify_hash = { 'secret' => secret_key, 'response' => response }
verify_hash['remoteip'] = options[:remote_ip] if options.key?(:remote_ip)
reply = api_verification_free(verify_hash, timeout: options[:timeout])
success = reply['success'].to_s == 'true' &&
hostname_valid?(reply['hostname'], options[:hostname]) &&
action_valid?(reply['action'], options[:action]) &&
score_above_threshold?(reply['score'], options[:minimum_score]) &&
score_below_threshold?(reply['score'], options[:maximum_score])
if options[:with_reply] == true
[success, reply]
else
success
end
end
def self.hostname_valid?(hostname, validation)
validation ||= configuration.hostname
case validation
when nil, FalseClass then true
when String then validation == hostname
else validation.call(hostname)
end
end
def self.action_valid?(action, expected_action)
case expected_action
when nil, FalseClass then true
else action == expected_action
end
end
def self.score_above_threshold?(score, minimum_score)
!minimum_score || (score && score >= minimum_score)
end
def self.score_below_threshold?(score, maximum_score)
!maximum_score || (score && score <= maximum_score)
end
def self.http_client_for(uri:, timeout: nil)
timeout ||= DEFAULT_TIMEOUT
http = if configuration.proxy
proxy_server = URI.parse(configuration.proxy)
Net::HTTP::Proxy(proxy_server.host, proxy_server.port, proxy_server.user, proxy_server.password)
else
Net::HTTP
end
instance = http.new(uri.host, uri.port)
instance.read_timeout = instance.open_timeout = timeout
instance.use_ssl = true if uri.port == 443
instance
end
def self.api_verification_free(verify_hash, timeout: nil)
query = URI.encode_www_form(verify_hash)
uri = URI.parse("#{configuration.verify_url}?#{query}")
http_instance = http_client_for(uri: uri, timeout: timeout)
request = Net::HTTP::Get.new(uri.request_uri)
JSON.parse(http_instance.request(request).body)
end
def self.api_verification_enterprise(query_params, body, project_id, timeout: nil)
query = URI.encode_www_form(query_params)
uri = URI.parse("#{configuration.verify_url}/#{project_id}/assessments?#{query}")
http_instance = http_client_for(uri: uri, timeout: timeout)
request = Net::HTTP::Post.new(uri.request_uri)
request['Content-Type'] = 'application/json; charset=utf-8'
request.body = JSON.generate(body)
JSON.parse(http_instance.request(request).body)
end
end
recaptcha-5.12.3/rails/ 0000755 0000041 0000041 00000000000 14402147736 014706 5 ustar www-data www-data recaptcha-5.12.3/rails/locales/ 0000755 0000041 0000041 00000000000 14402147736 016330 5 ustar www-data www-data recaptcha-5.12.3/rails/locales/ja.yml 0000644 0000041 0000041 00000000405 14402147736 017444 0 ustar www-data www-data ja:
recaptcha:
errors:
verification_failed: reCAPTCHA認証に失敗しました。もう一度お試しください。
recaptcha_unreachable: reCAPTCHAのレスポンスを検証できませんでした。もう一度お試しください。
recaptcha-5.12.3/rails/locales/fr.yml 0000644 0000041 0000041 00000000362 14402147736 017463 0 ustar www-data www-data fr:
recaptcha:
errors:
verification_failed: La vérification reCAPTCHA a échoué, veuillez essayer à nouveau.
recaptcha_unreachable: Oops, nous n'avons pas pu valider votre réponse reCAPTCHA. Veuillez essayer à nouveau.
recaptcha-5.12.3/rails/locales/en.yml 0000644 0000041 0000041 00000000315 14402147736 017454 0 ustar www-data www-data en:
recaptcha:
errors:
verification_failed: reCAPTCHA verification failed, please try again.
recaptcha_unreachable: Oops, we failed to validate your reCAPTCHA response. Please try again.
recaptcha-5.12.3/rails/locales/nl.yml 0000644 0000041 0000041 00000000333 14402147736 017463 0 ustar www-data www-data nl:
recaptcha:
errors:
verification_failed: reCAPTCHA-verificatie mislukt, probeer het opnieuw.
recaptcha_unreachable: Oeps, we hebben uw reCAPTCHA-antwoord niet kunnen valideren. Probeer het opnieuw.