beskar 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d34b14d657d818c36c3c2a91210c4ad4ab04ffd6b1087eeab9bb18bf3486c56c
-  data.tar.gz: a42dc485e08761ff3a6260fa21e7f280f7655f59e9acf3bc20edd056c9878988
+  metadata.gz: d9899541c9baa5b2c2a0ac7106dba36f9fff668962e5b70e11d34efa483a7d76
+  data.tar.gz: 6f7e9d0f5f725ea486974958a517ec32a725e5a2723efa7bb5e8738e794b39ca
 SHA512:
-  metadata.gz: 50bf70930298ab5fc0e31d803ce8f12245155a1f8d590efb5b8f6322256dc54928dbc1991ff2733c88d69958033f037918d2af57d6eb63d681ab1279b0c4c88c
-  data.tar.gz: 202b467246bd2797218131c462a1b8f9fa6aa3a0712b7126abfcb0192247a459aa50eedbaa20c340f9b8d608fb85320a24bbe575fa90d796ecf91d6ccd5326e1
+  metadata.gz: 6f79580e66cc3c2e777d10b65fb14e4e7bc6bc7ea2abb86763cea85b059f439867a2a8167f41896bbed907b6d8cfdcbf9ca00407407cc22881ac42ea69e09b63
+  data.tar.gz: 1cede8ef21ba6c4a3704cac25b055e42719c543fdfdefd10916e56576f0b18f644723ac73528979a20a4a0c489d8178b656d38cf8d0bc072f1d2d1c901354ebe

data/CHANGELOG.md

@@ -11,6 +11,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## 0.2.1 - 2026-11-04
+
+Bug fixes for monitor mode and requests without a client address, plus
+requested-path evidence for WAF threats in the dashboard.
+
+### Changed
+
+- WAF events and ban metadata now retain `waf_analysis.request_path`: the
+  requested path with its original percent encoding, limited to 1,024 characters.
+  Queries and fragments are removed and host `request_path` filters apply. Event
+  and ban details show it beside the matched rules, and the events list has a
+  Requested Path column. Records created before this release show "Not recorded".
+- The dashboard overview labels top threat IPs as "in the selected period".
+
+### Fixed
+
+- Monitor mode and whitelisted addresses no longer deny a login when one request
+  sets a second user on a scope. Each user is recorded as a login of its own.
+  Enforcement still denies it as `identity_changed`.
+- A request with no usable client address no longer raises
+  `IPAddr::InvalidAddressError` in the middleware. `RequestContext.ip` returns nil,
+  and the middleware passes the request to the application without ban or WAF
+  checks. A login from such a request succeeds without an audit row. Logins
+  through non-password Warden strategies (such as OAuth) from such a request also
+  reach authentication; rate limiting with no applicable tier is now an allowed
+  no-op instead of raising `ArgumentError`.
+
 ## 0.2.0 - 2026-09-21
 
 Security hardening, coordinated enforcement, and auditable administration.

data/app/views/beskar/banned_ips/show.html.erb

@@ -181,6 +181,10 @@
   </div>
 </div>
 
+<% if @banned_ip.reason == "waf_violation" %>
+  <%= render "beskar/shared/waf_analysis", analysis: @banned_ip.metadata["waf_analysis"], banned: true %>
+<% end %>
+
 <!-- Metadata -->
 <% if @banned_ip.metadata.present? && @banned_ip.metadata.any? %>
   <div class="card">
@@ -210,6 +214,7 @@
               <th>User</th>
               <th>Risk Score</th>
               <th>Details</th>
+              <th>Requested Path</th>
               <th>Actions</th>
             </tr>
           </thead>
@@ -255,6 +260,10 @@
                     <%= event.details || event.metadata&.dig("message") || "-" %>
                   </div>
                 </td>
+                <td style="font-family: monospace; font-size: 12px; overflow-wrap: anywhere; max-width: 300px;">
+                  <% analysis = event.metadata["waf_analysis"] %>
+                  <%= analysis.is_a?(Hash) ? analysis["request_path"].presence || "Not recorded" : "-" %>
+                </td>
                 <td>
                   <%= link_to "View", security_event_path(event), class: "btn btn-sm btn-secondary" %>
                 </td>

data/app/views/beskar/dashboard/index.html.erb

@@ -206,10 +206,10 @@
   <!-- Top Threats & Active Bans -->
   <div style="display: flex; flex-direction: column; gap: 1.5rem;">
     <!-- Top Threat IPs -->
-    <div class="card">
+    <div class="card" id="top-threat-ips">
       <div class="card-header">
         <h3 class="card-title">Top Threat IPs</h3>
-        <div class="card-subtitle">Most active suspicious IPs</div>
+        <div class="card-subtitle">Most active suspicious IPs in the selected period</div>
       </div>
       <div class="card-body">
         <div style="display: flex; flex-direction: column; gap: 0.75rem;">

data/app/views/beskar/security_events/index.html.erb

@@ -125,6 +125,7 @@
             <th>ID</th>
             <th>Timestamp</th>
             <th>Event Type</th>
+            <th>Requested Path</th>
             <th>IP Address</th>
             <th>User</th>
             <th>Risk Score</th>
@@ -157,6 +158,14 @@
                     <%= event.event_type %>
                   </div>
                 </td>
+                <td data-request-path style="font-family: monospace; font-size: 12px; max-width: 300px; overflow-wrap: anywhere;">
+                  <% analysis = event.metadata["waf_analysis"] %>
+                  <% if event.event_type == "waf_violation" %>
+                    <%= analysis.is_a?(Hash) ? analysis["request_path"].presence || "Not recorded" : "Not recorded" %>
+                  <% else %>
+                    <%= event.metadata["request_path"].presence || "-" %>
+                  <% end %>
+                </td>
                 <td>
                   <div style="font-family: monospace; font-size: 13px;">
                     <%= event.ip_address %>
@@ -223,7 +232,7 @@
             <% end %>
           <% else %>
             <tr>
-              <td colspan="8" style="text-align: center; padding: 3rem;">
+              <td colspan="9" style="text-align: center; padding: 3rem;">
                 <div style="color: #697386;">
                   <svg width="48" height="48" fill="currentColor" viewBox="0 0 24 24" style="margin: 0 auto 1rem;">
                     <path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-2 15l-5-5 1.41-1.41L10 14.17l7.59-7.59L19 8l-9 9z"/>

data/app/views/beskar/security_events/show.html.erb

@@ -151,6 +151,10 @@
   </div>
 </div>
 
+<% if @event.event_type == "waf_violation" %>
+  <%= render "beskar/shared/waf_analysis", analysis: @event.metadata["waf_analysis"] %>
+<% end %>
+
 <!-- Metadata -->
 <% if @event.metadata.present? && @event.metadata.any? %>
   <div class="card">

data/app/views/beskar/shared/_waf_analysis.html.erb

@@ -0,0 +1,25 @@
+<% analysis = analysis.is_a?(Hash) ? analysis : {} %>
+<div class="card" data-waf-analysis>
+  <div class="card-header">
+    <h3 class="card-title">WAF Analysis</h3>
+  </div>
+  <div class="card-body">
+    <p><strong><%= local_assigns[:banned] ? "Request that triggered the ban" : "Requested path" %></strong></p>
+    <div style="font-family: monospace; font-size: 13px; background: #F4F5F7; padding: 0.75rem; border-radius: 6px; overflow-wrap: anywhere;">
+      <% if analysis["request_path"].present? %>
+        <span><%= analysis["request_method"] %></span>
+        <span data-request-path><%= analysis["request_path"] %></span>
+      <% else %>
+        <span data-request-path>Not recorded</span>
+      <% end %>
+    </div>
+    <% if analysis["patterns"].is_a?(Array) %>
+      <ul>
+        <% analysis["patterns"].each do |pattern| %>
+          <% next unless pattern.is_a?(Hash) %>
+          <li><%= pattern["description"] %> (<%= pattern["rule_id"] %>, <%= pattern["severity"] %>)</li>
+        <% end %>
+      </ul>
+    <% end %>
+  </div>
+</div>

data/docs/README.md

@@ -24,7 +24,7 @@ changes from open findings and production validation still required.
 - [Risk scoring](guides/risk-scoring.md) — factors, geographic evidence, and
   heuristic limitations.
 - [Audit data and WAF](guides/audit-and-waf.md) — filtering, exports, scanner
-  matching, and privacy boundaries.
+  matching, requested-path evidence, and privacy boundaries.
 - [Audit lifecycle](guides/audit-lifecycle.md) — unchanged event retention,
   administrative permissions, actor/reason history, and migrations.
 - [Dashboard and search](guides/dashboard-and-search.md) — reporting, search,

data/docs/guides/audit-and-waf.md

@@ -11,10 +11,22 @@ historical. See [Repair status](../audits/repair-status.md) for remaining findin
 
 WAF matching uses request data transiently. Persisted WAF evidence contains rule
 IDs, static descriptions/categories, severity, rules version, decoding-pass count,
-an allowlisted HTTP method/exception class, timestamps, and scores. The event
-retains the Rails-resolved IP for attribution, subject to host audit filters.
-Raw/canonical paths, query strings, exception messages, and User-Agent headers are
-not copied into WAF events, ban metadata, state, or WAF messages. Public
+an allowlisted HTTP method/exception class, a bounded requested path, timestamps,
+and scores. The event retains the Rails-resolved IP for attribution, subject to
+host audit filters.
+Events and ban metadata retain `waf_analysis.request_path`: the requested path
+with its original percent encoding, limited to 1,024 characters with a trailing
+ellipsis when truncated. Queries and fragments are removed, invalid UTF-8 is
+repaired, controls are replaced, and host `request_path` filters apply. Event
+and ban details show this path beside the matched rules; the events list includes
+a Requested Path column, as do related events on ban details. Older records show
+"Not recorded" because discarded
+paths cannot be recovered. The ban's analysis identifies the triggering request,
+not every request contributing to the cumulative score.
+
+Canonical matching paths, query strings, exception messages, and User-Agent headers
+are not copied into WAF evidence. Paths remain excluded from enforcement state
+and WAF log messages. Public
 `record_violation` calls also project old-style analysis onto this bounded schema.
 The state API strips legacy raw-path/description fields on reads and on the next
 normal write; it does not bulk-rewrite historical database contents.
@@ -119,7 +131,8 @@ It does not parse request bodies or implement JavaScript challenges/honeypots.
   Ordinary `.well-known` routes are not scanner signatures.
 - Ignore arbitrary query text. Only a flat, exact `format` query key with an
   allowlisted executable value is checked; queries over 8,192 bytes are skipped.
-- Retain matched rule IDs with `rules_version: 1`, not the matching input.
+- Retain matched rule IDs with `rules_version: 1` and a bounded requested path,
+  without the decoded matching input or query values.
 
 Use narrow exclusions for legitimate host routes:
 

data/lib/beskar/middleware/request_analyzer.rb

@@ -11,6 +11,12 @@ module Beskar
 
         Beskar::Logger.debug("[RequestAnalyzer] Processing request from IP: #{ip_address}", component: :Middleware)
 
+        # A request with no usable address has nothing to ban or score.
+        unless ip_address
+          processing_host = true
+          return @app.call(env)
+        end
+
         # 1. Check if IP is whitelisted (whitelisted IPs skip blocking but still get logged)
         is_whitelisted = Beskar::Services::IpWhitelist.whitelisted?(ip_address)
 
@@ -153,6 +159,8 @@ module Beskar
       end
 
       def handle_rails_exception(request, exception, ip_address, is_whitelisted)
+        return unless ip_address
+
         # Analyze the exception using WAF
         waf_analysis = Beskar::Services::Waf.analyze_exception(exception, request)
 

data/lib/beskar/services/authentication_attempt.rb

@@ -73,8 +73,15 @@ module Beskar
       # Charge that account once, independently of the already reserved IP tier.
       def bind_user!(resource)
         if user && user != resource
-          deny!(:identity_changed)
-          return
+          if RequestContext.enforce?(ip_address)
+            deny!(:identity_changed)
+            return
+          end
+          # Observation never denies a login: the second identity is recorded
+          # as a login of its own, with its own account count and audit event.
+          @user = nil
+          self.event = nil
+          self.completed = false
         end
         unless user
           @user = resource

data/lib/beskar/services/rate_limiter.rb

@@ -95,6 +95,10 @@ module Beskar
         end
 
         def reserve(keys)
+          # No applicable tier (for example an addressless request with global
+          # limiting disabled): nothing to count, so admission is a no-op.
+          return most_restrictive_result([]) if keys.empty?
+
           configs = keys.to_h { |tier, _| [tier, config_for(tier)] }
           ttl = [configs.values.map { |config| config[:period].to_f }.max, BACKOFF_DELAYS.last].max + 60
           SecurityState.mutate(keys.values, ttl: ttl) do |state|

data/lib/beskar/services/request_context.rb

@@ -6,6 +6,9 @@ module Beskar
     module RequestContext
       module_function
 
+      # Nil when the request has no usable address, for example an in-process Rack
+      # client with a blank REMOTE_ADDR. Rails falls back to REMOTE_ADDR when
+      # forwarded headers are invalid, so a remote client cannot cause this.
       def ip(request)
         value = if request.respond_to?(:remote_ip)
           request.remote_ip
@@ -15,6 +18,8 @@ module Beskar
           request.ip
         end
         IPAddr.new(value.to_s).to_s
+      rescue IPAddr::Error
+        nil
       end
 
       def text(value, limit: 500)

data/lib/beskar/services/waf.rb

@@ -213,7 +213,7 @@ module Beskar
         def analysis_for(request, input, patterns)
           {threat_detected: true, patterns: patterns, highest_severity: calculate_highest_severity(patterns),
            ip_address: RequestContext.ip(request), request_method: input.method, rules_version: RULES_VERSION,
-           decoding_passes: input.decoding_passes, timestamp: Time.current}
+           request_path: input.audit_path, decoding_passes: input.decoding_passes, timestamp: Time.current}
         end
 
         # A public caller may supply an old-style analysis containing raw URLs
@@ -241,6 +241,7 @@ module Beskar
           raise ArgumentError, "WAF analysis requires matched rules" if result[:patterns].empty?
           result[:exception_class] = analysis[:exception_class] if EXCEPTION_RULES.key?(analysis[:exception_class])
           result[:request_method] = analysis[:request_method] if %w[GET HEAD POST PUT PATCH DELETE OPTIONS CONNECT TRACE OTHER].include?(analysis[:request_method])
+          result[:request_path] = WafRequest.audit_path(analysis[:request_path]) if analysis[:request_path].is_a?(String)
           result
         end
 
@@ -383,6 +384,7 @@ module Beskar
               permanent: duration.nil?,
               details: "WAF score: #{current_score.round(2)} (#{violation_count} violations) - #{analysis_result[:patterns].map { |p| p[:description] }.join(", ")}",
               metadata: {
+                waf_analysis: analysis_result,
                 violation_count: violation_count,
                 risk_score: current_score.round(2),
                 patterns: analysis_result[:patterns],

data/lib/beskar/services/waf_request.rb

@@ -2,12 +2,22 @@ require "uri"
 
 module Beskar
   module Services
-    # Matching input only. Never copy these raw/canonical paths or query values
-    # into audit records, state, or logs; those contain rule identifiers instead.
+    # Canonical paths are for matching only. Audit paths preserve the requested
+    # encoding, are bounded and filtered, and exclude queries and fragments.
     class WafRequest
       MAX_BYTES = 8192
       attr_reader :path, :problem, :method, :decoding_passes
 
+      def self.audit_path(value)
+        return unless value.is_a?(String)
+        path = value.byteslice(0, 4096).b.split(/[?#]/, 2).first.to_s.force_encoding(Encoding::UTF_8)
+        AuditData.field(:request_path, path, limit: 1024)
+      end
+
+      def audit_path
+        self.class.audit_path(@request.path)
+      end
+
       def initialize(request)
         @request = request
         @method = request.respond_to?(:request_method) ? request.request_method.to_s.upcase : "GET"

data/lib/beskar/version.rb

@@ -1,3 +1,3 @@
 module Beskar
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

data/lib/generators/beskar/install/templates/initializer.rb.tt

@@ -143,8 +143,9 @@ Beskar.configure do |config|
   # config.waf[:request_exclusions] = [
   #   {path: %r{\A/wp-content/}, methods: ["GET", "HEAD"], categories: [:wordpress_static]}
   # ]
-  # WAF evidence excludes raw URLs and exception messages. Audit fields honor
-  # Rails filter_parameters. See docs/guides/audit-and-waf.md before opting into :all errors.
+  # WAF evidence retains bounded paths, excluding queries and exception messages.
+  # Audit fields honor Rails filter_parameters. See docs/guides/audit-and-waf.md
+  # before opting into :all errors.
   #
   # === Exponential Decay Configuration ===
   # Violations decay over time based on severity (reduces false positives)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: beskar
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Maciej Litwiniuk
@@ -169,6 +169,7 @@ files:
 - app/views/beskar/security_events/index.html.erb
 - app/views/beskar/security_events/show.html.erb
 - app/views/beskar/shared/_export_form.html.erb
+- app/views/beskar/shared/_waf_analysis.html.erb
 - app/views/layouts/beskar/_behavior.html.erb
 - app/views/layouts/beskar/application.html.erb
 - config/locales/en.yml