Security

Security is important and challenging. This document describes why we think GoogleMapsGeocoder is adequately secure.

Assurance case summary

As a PORO wrapper for the Google Maps API, GoogleMapsGeocoder is designed to be as safe as Google Maps, but no safer. Within this constraint, we believe the scope for vulnerability is limited because:

• authentication and authorization are mediated only through Google's API keys

• the library is stateless: between each request/response cycle, no session state is maintained; the GoogleMapsGeocoder instance is read-only. To make another request, another GoogleMapsGeocoder must be initalized.

• any input potentially derived from users is escaped and parsed as a URI: an invalid URI will throw a URI::InvalidURIError, while a valid URI will be dispatched to Google Maps, effectively achieving security parity with the API.

Beyond the security concerns around this single network call, any remaining vulnerabilities will pertain to the Ruby runtime itself. We address the latter concerns by:

• requiring only fully supported Ruby versions

• integrating Dependabot to patch known vulnerabilities automatically

• releasing security updates on a monthly cadence

Help wanted!

Sadly, perfection is rare; we really want your help. If you find a vulnerability, please file a vulnerability report. For technical background on the code, see Implementation.