Merge pull request #1035 from jlhonora/master

Disable SSL v2 and v3 if ssl enabled

Gemfile

@@ -24,6 +24,7 @@ end
 
 group :test do
   gem 'sqlite3', :platform => [:ruby, :mswin, :mingw]
+  gem 'webmock'
 
   platforms :ruby do
     gem 'pg'

gemfiles/Gemfile.rails3.2

@@ -24,6 +24,7 @@ end
 
 group :test do
   gem 'sqlite3', :platform => [:ruby, :mswin, :mingw]
+  gem 'webmock'
 
   platforms :ruby do
     gem 'pg'

gemfiles/Gemfile.rails4.1

@@ -24,6 +24,7 @@ end
 
 group :test do
   gem 'sqlite3', :platform => [:ruby, :mswin, :mingw]
+  gem 'webmock'
 
   platforms :ruby do
     gem 'pg'

gemfiles/Gemfile.ruby1.9.3

@@ -16,6 +16,7 @@ group :development, :test do
   gem 'test-unit' # install newer version with omit() method
 
   gem 'debugger'
+  gem 'webmock'
 
   platforms :jruby do
     gem 'jruby-openssl'

lib/geocoder/lookups/base.rb

@@ -274,6 +274,7 @@ module Geocoder
         uri = URI.parse(query_url(query))
         Geocoder.log(:debug, "Geocoder: HTTP request being made for #{uri.to_s}")
         http_client.start(uri.host, uri.port, use_ssl: use_ssl?, open_timeout: configuration.timeout, read_timeout: configuration.timeout) do |client|
+          configure_ssl!(client) if use_ssl?
           req = Net::HTTP::Get.new(uri.request_uri, configuration.http_headers)
           if configuration.basic_auth[:user] and configuration.basic_auth[:password]
             req.basic_auth(
@@ -297,6 +298,8 @@ module Geocoder
         end
       end
 
+      def configure_ssl!(client); end
+
       def check_api_key_configuration!(query)
         key_parts = query.lookup.required_api_key_parts
         if key_parts.size > Array(configuration.api_key).size

lib/geocoder/lookups/google.rb

@@ -27,6 +27,17 @@ module Geocoder::Lookup
 
     private # ---------------------------------------------------------------
 
+    def configure_ssl!(client)
+      client.instance_eval {
+        @ssl_context = OpenSSL::SSL::SSLContext.new
+        options = OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
+        if OpenSSL::SSL.const_defined?('OP_NO_COMPRESSION')
+          options |= OpenSSL::SSL::OP_NO_COMPRESSION
+        end
+        @ssl_context.set_params({options: options})
+      }
+    end
+
     def valid_response?(response)
       json = parse_json(response.body)
       status = json["status"] if json

test/test_helper.rb

@@ -120,6 +120,9 @@ module Geocoder
         fixture_exists?(filename) ? filename : default_fixture_filename
       end
 
+      # This alias allows us to use this method in further tests
+      # to actually test http requests
+      alias_method :actual_make_api_request, :make_api_request
       remove_method(:make_api_request)
 
       def make_api_request(query)

test/unit/lookups/google_test.rb

@@ -111,4 +111,19 @@ class GoogleTest < GeocoderTestCase
     query = Geocoder::Query.new("Madison Square Garden, New York, NY")
     assert_match(/^https:/, query.url)
   end
+
+  def test_actual_make_api_request_with_https
+    Geocoder.configure(use_https: true, lookup: :google)
+
+    require 'webmock/test_unit'
+    WebMock.enable!
+    stub_all = WebMock.stub_request(:any, /.*/).to_return(status: 200)
+
+    g = Geocoder::Lookup::Google.new
+    g.send(:actual_make_api_request, Geocoder::Query.new('test location'))
+    assert_requested(stub_all)
+
+    WebMock.reset!
+    WebMock.disable!
+  end
 end