aws-sdk-rails 5.1.0 → 5.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de037ab8aa7c27156e7074ab7aaf7999d32ebb468c26c938c35031618912af2c
-  data.tar.gz: 61bc484c0d053a05fb1ad108c636a67be5fb76a2c0d9152d126657b9b3099baf
+  metadata.gz: 877222ef0a2075585720421300bd93c84591249678bafb02edf1e01962e63051
+  data.tar.gz: caed28f5f0bb7f604b5b2aeee08e59d5b8e6ad3612b4f9e8189b0a22e448ceeb
 SHA512:
-  metadata.gz: 89e5f84d363bb63b0d3c7520405acb03f46a283a6ea03d711547e5ecfc686e9435d232312d228c9cf61809f58fb6dc247a29793b56274cb94c5f9adee5910e72
-  data.tar.gz: aedc388ff0285d30d741b6ec6d2114af167b119f5f02b5da2be1a9858028e81bbbbfd152b3802c1482c9b50b9d5fdb57c96449c80a31d4c9d304e2aad306eb52
+  metadata.gz: fc56e477c15a69e1773f305806118ba2aa7357840f68edbe6b491c569cdcb98ff417ad45abe38f620e5bc6b3c0010e00a1b0bedf987006f8ead442ab2dea4597
+  data.tar.gz: 33ede8ffc209b921330121a0f7642d1af4a97ce299dcc7613899f0b0322ec0e4e99b1ed098e601c08402496666a890d030502f9b41fe540c199d10f7bf6fa325

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+5.2.0 (2026-08-11)
+------------------
+
+* Issue - The `ElasticBeanstalkSQSD` middleware's Docker host check now only consults `remote_addr`, the raw TCP peer address, instead of also accepting `remote_ip`. `remote_ip` is derived from the client-supplied `X-Forwarded-For` header whenever the peer address is itself private, so a request from any private address could name the Docker gateway and be treated as local. Loopback peer addresses are accepted by the check, so requests proxied over loopback are unaffected.
+* Issue - Only classes inheriting from `ActiveJob::Base` are executed by the `ElasticBeanstalkSQSD` middleware, preventing arbitrary classes named in an SQS message from being instantiated and run. Job class and periodic task names are validated as constant paths and resolved without searching the namespace's ancestors, so a request cannot name a constant outside the intended namespace.
+* Feature - Adds a new configuration object for elastic beanstalk sqsd middleware, with an optional `job_class_allowlist` configuration to `ElasticBeanstalkSQSD` middleware to restrict which job classes can be dispatched. When set, the allowlist is checked before the class name is resolved, so an excluded class is never loaded.
+
 5.1.0 (2024-12-05)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-5.1.0
+5.2.0

data/lib/aws/rails/middleware/elastic_beanstalk_sqsd/configuration.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Aws
+  module Rails
+    module Middleware
+      class ElasticBeanstalkSQSD
+        # Configuration for the {ElasticBeanstalkSQSD} middleware.
+        #
+        # Use {ElasticBeanstalkSQSD.config} to access the singleton config
+        # instance and {ElasticBeanstalkSQSD.configure} to configure in code:
+        #
+        #     Aws::Rails::Middleware::ElasticBeanstalkSQSD.configure do |config|
+        #       config.job_class_allowlist = [SendReceiptJob, ProcessOrderJob]
+        #     end
+        #
+        class Configuration
+          # @return [Array<Class, String>, nil] Optional list of job classes
+          #   permitted to be executed. When set, only classes in this list
+          #   will be dispatched. When nil, any class inheriting from
+          #   ActiveJob::Base is allowed. Entries may be given as Class objects
+          #   or Strings; matching is by class name, so an allowlisted class is
+          #   still recognized after a Zeitwerk reload replaces the class object.
+          attr_accessor :job_class_allowlist
+        end
+      end
+    end
+  end
+end

data/lib/aws/rails/middleware/elastic_beanstalk_sqsd.rb

@@ -4,7 +4,42 @@ module Aws
   module Rails
     module Middleware
       # Middleware to handle requests from the SQS Daemon present on Elastic Beanstalk worker environments.
-      class ElasticBeanstalkSQSD
+      #
+      # See {Configuration} for the available options and {configure} for
+      # setting them in code.
+      class ElasticBeanstalkSQSD # rubocop:disable Metrics/ClassLength
+        # Raised when a job message names a class that cannot be executed -
+        # the name is not a well-formed constant path, it is not in the
+        # configured job_class_allowlist, or it does not inherit from
+        # ActiveJob::Base.
+        class InvalidJobClassError < StandardError; end
+
+        # A job class name is an (optionally namespaced) constant path and
+        # nothing else. Names that cannot match this can never name a job
+        # class, so rejecting them keeps them out of the constant lookup.
+        JOB_CLASS_NAME_PATTERN = /\A[A-Z]\w*(::[A-Z]\w*)*\z/.freeze
+
+        class << self
+          # Yields the middleware configuration for customization.
+          #
+          # @example Restrict job dispatch to specific classes
+          #   Aws::Rails::Middleware::ElasticBeanstalkSQSD.configure do |config|
+          #     config.job_class_allowlist = [SendReceiptJob, ProcessOrderJob]
+          #   end
+          #
+          # @yieldparam [Configuration] config
+          # @return [Configuration]
+          def configure
+            yield(config) if block_given?
+            config
+          end
+
+          # @return [Configuration] the current middleware configuration.
+          def config
+            @config ||= Configuration.new
+          end
+        end
+
         def initialize(app)
           @app = app
           @logger = ::Rails.logger
@@ -22,7 +57,9 @@ module Aws
 
           @logger.debug('aws-sdk-rails middleware detected call from Elastic Beanstalk SQS Daemon.')
 
-          # Only accept requests from this user agent if it is from localhost or a docker host in case of forgery.
+          # Best-effort source check. On Docker-based EB platforms this is unreliable
+          # because all traffic arrives via the docker bridge. Use job_class_allowlist
+          # and network-level controls (security groups) as the primary safeguards.
           unless request.local? || sent_from_docker_host?(request)
             @logger.warn('SQSD request detected from untrusted address; returning 403 forbidden.')
             return forbidden_response
@@ -78,43 +115,55 @@ module Aws
           # Jobs queued from the SQS adapter contain the JSON message in the request body.
           job = ::ActiveSupport::JSON.decode(request.body.string)
           job_name = job['job_class']
+          # Scope the rescue to resolution only. A NameError raised from inside
+          # the job's own #perform must not be mislabeled as a class-resolution
+          # failure, so ::ActiveJob::Base.execute runs outside the begin/rescue.
+          begin
+            resolve_job_class(job_name)
+          rescue NameError, InvalidJobClassError => e
+            return unresolved_job_class_response(job_name, e)
+          end
           @logger.debug("Executing job: #{job_name}")
           ::ActiveJob::Base.execute(job)
           [200, { 'Content-Type' => 'text/plain' }, ["Successfully ran job #{job_name}."]]
-        rescue NameError => e
-          @logger.error("Job #{job_name} could not resolve to a class that inherits from Active Job.")
-          @logger.error("Error: #{e}")
-          internal_error_response
         end
 
         # Execute a job using the thread pool executor
         def _execute_job_background(request)
           job_data = ::ActiveSupport::JSON.decode(request.body.string)
-          @logger.debug("Queuing background job: #{job_data['job_class']}")
+          job_name = job_data['job_class']
+          resolve_job_class(job_name)
+          @logger.debug("Queuing background job: #{job_name}")
           @executor.post(job_data) do |job|
             ::ActiveJob::Base.execute(job)
           end
-          [200, { 'Content-Type' => 'text/plain' }, ["Successfully queued job #{job_data['job_class']}"]]
+          [200, { 'Content-Type' => 'text/plain' }, ["Successfully queued job #{job_name}"]]
         rescue Concurrent::RejectedExecutionError
           msg = 'No capacity to execute job.'
           @logger.info(msg)
           [429, { 'Content-Type' => 'text/plain' }, [msg]]
+        rescue NameError, InvalidJobClassError => e
+          unresolved_job_class_response(job_name, e)
         end
 
         def execute_periodic_task(request)
           # The beanstalk worker SQS Daemon will add the 'X-Aws-Sqsd-Taskname' for periodic tasks set in cron.yaml.
           job_name = request.headers['X-Aws-Sqsd-Taskname']
-          job = job_name.constantize.new
+          # Resolve once and reuse the class, rather than resolving the name a
+          # second time with another constantize (which also left a check-then-
+          # act gap between what was validated and what ran). Scope the rescue
+          # to resolution only, so a NameError from inside the task's own
+          # #perform is not mislabeled as a cron-name resolution failure.
+          begin
+            job = resolve_job_class(job_name).new
+          rescue NameError, InvalidJobClassError => e
+            return unresolved_periodic_task_response(job_name, e)
+          end
           if @executor
             _execute_periodic_task_background(job)
           else
             _execute_periodic_task_now(job)
           end
-        rescue NameError => e
-          @logger.error("Periodic task #{job_name} could not resolve to an Active Job class " \
-                        '- check the cron name spelling and set the path as / in cron.yaml.')
-          @logger.error("Error: #{e}.")
-          internal_error_response
         end
 
         def _execute_periodic_task_now(job)
@@ -138,6 +187,19 @@ module Aws
           [500, { 'Content-Type' => 'text/plain' }, [message]]
         end
 
+        def unresolved_job_class_response(job_name, error)
+          @logger.error("Job #{job_name} could not resolve to a class that inherits from Active Job.")
+          @logger.error("Error: #{error}")
+          internal_error_response
+        end
+
+        def unresolved_periodic_task_response(job_name, error)
+          @logger.error("Periodic task #{job_name} could not resolve to an Active Job class " \
+                        '- check the cron name spelling and set the path as / in cron.yaml.')
+          @logger.error("Error: #{error}.")
+          internal_error_response
+        end
+
         def forbidden_response
           message = 'Request with aws-sqsd user agent was made from untrusted address.'
           [403, { 'Content-Type' => 'text/plain' }, [message]]
@@ -156,6 +218,48 @@ module Aws
           request.headers['X-Aws-Sqsd-Taskname'].present? && request.fullpath == '/'
         end
 
+        # Resolves +name+ to a job class, raising InvalidJobClassError if it is
+        # not a well-formed constant path, is not in the configured allowlist,
+        # or does not name a class inheriting from ActiveJob::Base. Returns the
+        # resolved class so callers can reuse it without resolving the name a
+        # second time.
+        #
+        # Checks are ordered so that the least trusting one runs first. Merely
+        # resolving a constant is not inert: under Zeitwerk it triggers
+        # autoloading, which runs the body of whichever file defines it. So the
+        # name is matched against the allowlist as a String, before any lookup,
+        # and an excluded name never reaches the constant resolver at all.
+        def resolve_job_class(name)
+          name = name.to_s
+          raise InvalidJobClassError, "#{name.inspect} is not a valid job class name" unless
+            JOB_CLASS_NAME_PATTERN.match?(name)
+
+          allowlist = self.class.config.job_class_allowlist
+          # Match by class name, not object identity: in development Zeitwerk
+          # reloads produce a new class object with the same name, so an
+          # allowlist of Class objects would reject every job after a reload.
+          if allowlist && !allowlist.map(&:to_s).include?(name)
+            raise InvalidJobClassError, "#{name} is not in the configured job_class_allowlist"
+          end
+
+          klass = constantize_job_class(name)
+          unless klass.is_a?(Class) && klass < ::ActiveJob::Base
+            raise InvalidJobClassError, "#{name} is not a valid job class (must inherit from ActiveJob::Base)"
+          end
+
+          klass
+        end
+
+        # Resolves an already-validated name. +inherit+ is false so that each
+        # segment must be defined directly on the preceding one: a name such as
+        # 'SomeJob::Foo' cannot resolve Foo from SomeJob's ancestors when
+        # SomeJob itself does not define it.
+        def constantize_job_class(name)
+          # CodeQL [rb/code-injection] Name is validated against JOB_CLASS_NAME_PATTERN
+          # and the allowlist above, and the result is checked for ActiveJob::Base ancestry below.
+          Object.const_get(name, false)
+        end
+
         def sent_from_docker_host?(request)
           app_runs_in_docker_container? && ip_originates_from_docker_host?(request)
         end
@@ -172,16 +276,24 @@ module Aws
           File.exist?('/proc/self/mountinfo') && File.read('/proc/self/mountinfo') =~ %r{/docker/containers/}
         end
 
+        # Only consults remote_addr, the raw TCP peer address. remote_ip is
+        # derived from X-Forwarded-For whenever the peer is itself private, and
+        # the docker gateway range (172.16.0.0/12) is one Rack treats as a
+        # trusted proxy to see through - so a request from any private peer can
+        # set remote_ip to the gateway with a header alone. Loopback is accepted
+        # here because such a request is genuinely local; request.local? rejects
+        # it only on the forgeable half of its check.
         def ip_originates_from_docker_host?(request)
-          default_docker_ips.include?(request.remote_ip) ||
-            default_docker_ips.include?(request.remote_addr)
+          remote_addr = request.remote_addr
+          default_docker_ips.include?(remote_addr) ||
+            ::ActionDispatch::Request::LOCALHOST.match?(remote_addr)
         end
 
         def default_docker_ips
           @default_docker_ips ||= build_default_docker_ips
         end
 
-        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable Metrics/AbcSize, Style/FileOpen
         def build_default_docker_ips
           default_gw_ips = ['172.17.0.1']
 
@@ -198,7 +310,7 @@ module Aws
 
           default_gw_ips
         end
-        # rubocop:enable Metrics/AbcSize
+        # rubocop:enable Metrics/AbcSize, Style/FileOpen
       end
     end
   end

data/lib/aws-sdk-rails.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'aws/rails/middleware/elastic_beanstalk_sqsd/configuration'
 require_relative 'aws/rails/middleware/elastic_beanstalk_sqsd'
 require_relative 'aws/rails/railtie'
 require_relative 'aws/rails/notifications'

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-rails
 version: !ruby/object:Gem::Version
-  version: 5.1.0
+  version: 5.2.0
 platform: ruby
 authors:
 - Amazon Web Services
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core
@@ -50,13 +49,13 @@ files:
 - VERSION
 - lib/aws-sdk-rails.rb
 - lib/aws/rails/middleware/elastic_beanstalk_sqsd.rb
+- lib/aws/rails/middleware/elastic_beanstalk_sqsd/configuration.rb
 - lib/aws/rails/notifications.rb
 - lib/aws/rails/railtie.rb
 homepage: https://github.com/aws/aws-sdk-rails
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -71,8 +70,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.9
-signing_key:
+rubygems_version: 4.0.16
 specification_version: 4
 summary: AWS SDK for Ruby on Rails Railtie
 test_files: []