clean_room 0.2.0 → 0.2.1

data/lib/clean_room.rb

@@ -1,5 +1,4 @@
 require "clean_room/air_lock"
-require "clean_room/dsl"
 require "clean_room/exceptions"
 require "clean_room/filter"
 require "clean_room/version"

data/lib/clean_room/air_lock.rb

@@ -1,29 +1,61 @@
 module CleanRoom
   module AirLock
-    class Parameters
+    module Parameters
+      def self.included(base)
+        base.extend ClassMethods
+        base.clean_room_rules = {}
+      end
+
+      def params
+        @_params ||= HashWithIndifferentAccess.new(CleanRoom::Filter.clean(request.parameters, nested_rules: self.class.clean_room_rules))
+      end
+
+      def params=(val)
+        @_params = val.is_a?(Hash) ? HashWithIndifferentAccess.new(CleanRoom::Filter.clean(val, nested_rules: self.class.clean_room_rules)) : val
+      end
+
       class << self
-        def activate
-          ActionController::Base.send :include, CleanParameters
+        def clean_room_rules(rules = {})
+          clean_room_rules = rules
         end
       end
     end
 
-    class ModelBasedFilter
-      class << self
-        def filter(parameters)
-          # TODO: check the parameter names against the model sanitization rules, when no rules found do a 'normal' sanitization
-          HashWithIndifferentAccess.new(CleanRoom::Filter.clean(parameters))
+    module Model
+      def self.included(base)
+        base.extend ClassMethods
+        base.sanitizable_attributes = {}
+
+        if base.respond_to? :before_validate
+          base.before_validate :sanitize_attributes
         end
       end
-    end
 
-    module CleanParameters
-      def params
-        @_params ||= ModelBasedFilter.filter(request.parameters)
+      def sanitize_attributes
+        self.class.sanitizable_attributes.each do |name, rules|
+          sanitize_attribute name, rules
+        end
       end
 
-      def params=(val)
-        @_params = val.is_a?(Hash) ? ModelBasedFilter.filter(val) : val
+      def sanitize_attribute(name, rules = {})
+        current_value = self.send(name)
+        cleaned_value = Filter.clean(current_value, rules)
+
+        raise Exceptions::Contaminated.new("#{name} contained unacceptable data") if rules[:raise] && (current_value != cleaned_value)
+        self.send("#{name}=".to_sym, cleaned_value)
+      end
+
+      module ClassMethods
+        attr_accessor :sanitizable_attributes
+
+        def sanitize_attribute(name, rules = {})
+          name = name.to_sym
+          if instance_methods.include?(name) && instance_methods.include?("#{name}=".to_sym)
+            sanitizable_attributes[name] = rules
+          else
+            raise Exceptions::InvalidAttribute.new("#{self.class} does not respond to '#{name}(=)'")
+          end
+        end
       end
     end
   end

data/lib/clean_room/filter.rb

@@ -7,54 +7,59 @@ module CleanRoom
     class << self
       include SanitizeUrl
 
-      def clean(dirty_value, options = {})
-        determine_and_filter(dirty_value, options)
+      def clean(dirty_value, rules = {})
+        determine_and_filter(dirty_value, rules)
       end
 
       private
 
-      def determine_and_filter(dirty_value, options)
+      def determine_and_filter(dirty_value, rules)
+        nested_rules = rules[:nested_rules] || {}
 
         case dirty_value
         when Array
-          dirty_value.map{ |dv| determine_and_filter(dv, options) }
+          dirty_value.map{ |dv| determine_and_filter(dv, rules) }
         when Hash
-          Hash[dirty_value.map {|k,dv| [determine_and_filter(k, allow: (k.is_a?(Symbol) ? :symbol : :string)),determine_and_filter(dv, options)]}]
+          Hash[dirty_value.map {|k,dv| [determine_and_filter(k, allow: (k.is_a?(Symbol) ? :symbol : :string)),determine_and_filter(dv, nested_rules[k] ? nested_rules[k] : rules)]}]
         when Fixnum
           dirty_value
         when Symbol
-          filter(dirty_value, options).to_sym
+          filter(dirty_value, rule: :symbol)
         when FalseClass
           false
         when NilClass
           nil
         else
-          filter(dirty_value, options)
+          filter(dirty_value, rules)
         end
       end
 
-      def filter(dirty_value, options)
+      def filter(dirty_value, rules)
         dirty_value = dirty_value.to_s
-        case (options[:allow] || :plain_text)
+        intermediate_value = case (rules[:rule] || :plain_text)
         when :html
-          Sanitize.clean(dirty_value, Sanitize::Config::RELAXED)
+          sql_injection(Sanitize.clean(dirty_value, Sanitize::Config::RELAXED))
         when :simple_html
-          Sanitize.clean(dirty_value, Sanitize::Config::BASIC)
+          sql_injection(Sanitize.clean(dirty_value, Sanitize::Config::BASIC))
         when :strict
-          regex =  /[^#{options[:character_class] || "a-zA-Z0-9 "}]/
+          regex =  /[^#{rules[:character_class] || "a-zA-Z0-9 "}]/
           Sanitize.clean(dirty_value).gsub(regex, "")
         when :url
-          sanitize_url(dirty_value)
+          sql_injection(sanitize_url(dirty_value))
         when :symbol
-          Sanitize.clean(dirty_value).gsub(/[^a-zA-Z0-9]/, "").to_sym
+          sql_injection(Sanitize.clean(dirty_value)).gsub(/[^a-zA-Z0-9]/, "").to_sym
         when :fixnum
           Sanitize.clean(dirty_value).gsub(/[^0-9]\.\,/, "").gsub(",",".").to_i
         when :float
           Sanitize.clean(dirty_value).gsub(/[^0-9\.\,]/, "").gsub(",",".").to_f
         else
-          Sanitize.clean(dirty_value)
+          sql_injection(Sanitize.clean(dirty_value))
         end
       end
+
+      def sql_injection(dirty_value)
+        dirty_value.gsub(/(\'|\-\-|\#)[\s;\(\)]*(AND|OR|SELECT|DROP|INSERT|UPDATE|DELETE|UNION).*/, "")
+      end
     end
   end
-end
+end

data/lib/clean_room/version.rb

@@ -1,3 +1,3 @@
 module CleanRoom
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

data/test/clean_room_test.rb

@@ -4,11 +4,11 @@ class CleanRoomTest < MiniTest::Unit::TestCase
   def test_can_be_included
 
     test_class = Class.new do 
-      include CleanRoom::DSL
+      include CleanRoom::AirLock::Model
     end
 
     test_class = Class.new do 
-      include CleanRoom::DSL
+      include CleanRoom::AirLock::Model
       attr_accessor :field1
 
       sanitize_attribute :field1
@@ -16,7 +16,7 @@ class CleanRoomTest < MiniTest::Unit::TestCase
 
     assert_raises CleanRoom::Exceptions::InvalidAttribute do
       test_class = Class.new do 
-        include CleanRoom::DSL
+        include CleanRoom::AirLock::Model
 
         sanitize_attribute :field1
       end
@@ -38,8 +38,17 @@ class CleanRoomTest < MiniTest::Unit::TestCase
     assert_equal [{"test1" => "test3"},"test2"], CleanRoom::Filter.clean([{"<b>test1</b>" => "<b>test3</b>"},"<b>test2</b>"])
     assert_equal [{test1: "test3"},"test2"], CleanRoom::Filter.clean([{:"<b>te * st1</b>" => "<b>test3</b>"},"<b>test2</b>"])
     assert_equal ["123.", "456.3", "789.8"], CleanRoom::Filter.clean(["<b>123.</b>","456.3", 789.8])
-    assert_equal [123, 456, 789], CleanRoom::Filter.clean(["<b>123.</b>","456.3", 789.8], allow: :fixnum)
-    assert_equal [123.0, 456.3, 789.8], CleanRoom::Filter.clean(["<b>123.</b>","456.3", 789.8], allow: :float)
+    assert_equal [123, 456, 789], CleanRoom::Filter.clean(["<b>123.</b>","456.3", 789.8], rule: :fixnum)
+    assert_equal [123.0, 456.3, 789.8], CleanRoom::Filter.clean(["<b>123.</b>","456.3", 789.8], rule: :float)
+
+    # SQL injection
+    assert_equal "test", CleanRoom::Filter.clean("test'   ; DROP TABLE ")
+    assert_equal "test", CleanRoom::Filter.clean("test'DROP TABLE `sdfdsf`")
+    assert_equal "", CleanRoom::Filter.clean("'DROP TABLE `sdfdsf`")
+
+    # nested rules
+    assert_equal({"test" => {"integer" => "4324.1"}}, CleanRoom::Filter.clean({"test" => {"integer" => "4324.1"}}))
+    assert_equal({"test" => {"integer" => 4324}}, CleanRoom::Filter.clean({"test" => {"integer" => "4324.1"}}, nested_rules: {"integer" => {rule: :fixnum}}))
   end
 
   def attribute_test(field, value_in, value_out)
@@ -51,15 +60,15 @@ class CleanRoomTest < MiniTest::Unit::TestCase
 
   def object_generator
     test_class = Class.new do 
-      include CleanRoom::DSL
+      include CleanRoom::AirLock::Model
       attr_accessor :normal, :strict, :very_strict, :simple_html, :html, :url
 
       sanitize_attribute :normal
-      sanitize_attribute :strict, allow: :strict
-      sanitize_attribute :very_strict, allow: :strict, character_class: "a-z"
-      sanitize_attribute :simple_html, allow: :simple_html
-      sanitize_attribute :html, allow: :html
-      sanitize_attribute :url, allow: :url
+      sanitize_attribute :strict, rule: :strict
+      sanitize_attribute :very_strict, rule: :strict, character_class: "a-z"
+      sanitize_attribute :simple_html, rule: :simple_html
+      sanitize_attribute :html, rule: :html
+      sanitize_attribute :url, rule: :url
     end
 
     test_class.new
@@ -72,7 +81,7 @@ class CleanRoomTest < MiniTest::Unit::TestCase
         def self.before_validate(method_name)
           puts method_name
         end
-        include CleanRoom::DSL
+        include CleanRoom::AirLock::Model
       end
     end
   end  

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clean_room
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-06-19 00:00:00.000000000 Z
+date: 2012-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sanitize
-  requirement: &70156494356660 !ruby/object:Gem::Requirement
+  requirement: &70210935928440 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: 2.0.0
   type: :runtime
   prerelease: false
-  version_requirements: *70156494356660
+  version_requirements: *70210935928440
 - !ruby/object:Gem::Dependency
   name: sanitize-url
-  requirement: &70156494356120 !ruby/object:Gem::Requirement
+  requirement: &70210935927900 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,10 @@ dependencies:
         version: 0.1.4
   type: :runtime
   prerelease: false
-  version_requirements: *70156494356120
+  version_requirements: *70210935927900
 - !ruby/object:Gem::Dependency
   name: pry
-  requirement: &70156494355660 !ruby/object:Gem::Requirement
+  requirement: &70210935927440 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,7 +43,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70156494355660
+  version_requirements: *70210935927440
 description: Work in progress, this will be a generic attribute sanitizer which can
   be used for sanitizing models and other objects holding data
 email:
@@ -60,7 +60,6 @@ files:
 - clean_room.gemspec
 - lib/clean_room.rb
 - lib/clean_room/air_lock.rb
-- lib/clean_room/dsl.rb
 - lib/clean_room/exceptions.rb
 - lib/clean_room/filter.rb
 - lib/clean_room/version.rb

data/lib/clean_room/dsl.rb

@@ -1,40 +0,0 @@
-module CleanRoom
-  module DSL
-
-    def self.included(base)
-      base.extend ClassMethods
-      base.sanitizable_attributes = {}
-
-      if base.respond_to? :before_validate
-        base.before_validate :sanitize_attributes
-      end
-    end
-
-    def sanitize_attributes
-      self.class.sanitizable_attributes.each do |name, options|
-        sanitize_attribute name, options
-      end
-    end
-
-    def sanitize_attribute(name, options = {})
-      current_value = self.send(name)
-      cleaned_value = Filter.clean(current_value, options)
-
-      raise Exceptions::Contaminated.new("#{name} contained unacceptable data") if options[:raise] && (current_value != cleaned_value)
-      self.send("#{name}=".to_sym, cleaned_value)
-    end
-
-    module ClassMethods
-      attr_accessor :sanitizable_attributes
-
-      def sanitize_attribute(name, options = {})
-        name = name.to_sym
-        if instance_methods.include?(name) && instance_methods.include?("#{name}=".to_sym)
-          sanitizable_attributes[name] = options
-        else
-          raise Exceptions::InvalidAttribute.new("#{self.class} does not respond to '#{name}(=)'")
-        end
-      end
-    end
-  end
-end