cloudflare-rails 0.6.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36383a493815fd8b730a9df1ad3c15971d093c05a01ed49b367f8e1cbec8ebfb
-  data.tar.gz: 6d63be05883d0c1e03d8327662f974b93fb96895de1cf90443ead603641a29a4
+  metadata.gz: 19b8e746b7848a5f7939ac311619b2dc627ff07f2cdb6007ddbd71497be5d730
+  data.tar.gz: 991cb0373e17a7c80e8559122073037d3a67f6f81463db9370d9fe4bf3864c63
 SHA512:
-  metadata.gz: ca4f1e277840208cb02a27f1e79053761e636d7d7ca31f7aebe75d9714cca8aac22233cc30bbe20c0d29b1fc8ed44413cf71ea7f3e77684fb7ecfdeebfeb26e1
-  data.tar.gz: 28b93626c352d0dab043dd8cd90dc8ecc2f227cb3a98686ffa167c5c3741ec44e840038a108602763197dd7c003b857ae01d8b923da4f7e6c619b442e02511fe
+  metadata.gz: 7cfa2d90ec57a59bbaaad61332a90e987c6b7f076a9367139e90cd7d6f568f728dbb6774b37577b93ac5f7ee27cfc4991b3d55c77bf947be89afb3ee1f849db9
+  data.tar.gz: 8dde5529c4dc355ecefa04a1b75ed82efee4e27678d75e5f0de6c7106a2b8b2ba3c0d69eeb27d8bb254a94630bbacc31bd6d84973bb9a678f3598d03814ba542

data/.circleci/config.yml

@@ -7,7 +7,7 @@ jobs:
   build:
     docker:
       # specify the version you desire here
-      - image: circleci/ruby:2.6.3
+      - image: circleci/ruby:2.7.0
 
     working_directory: ~/repo
 

data/.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+- package-ecosystem: bundler
+  directory: "/"
+  schedule:
+    interval: daily
+    time: "13:00"
+  open-pull-requests-limit: 10

data/.rspec

@@ -1,4 +1,4 @@
 --format d
 --color
 --format RspecJunitFormatter
---out tmp/rspec/rspec-<%= File.basename ENV['BUNDLE_GEMFILE'] %><%= ENV["RACK_ATTACK"]  ? '-rack-attack' : '' %>.xml
+--out tmp/rspec/rspec-<%= File.basename ENV['BUNDLE_GEMFILE'] %><%= ENV["RACK_ATTACK"]  ? "-rack-attack-#{ENV["RACK_ATTACK"]}" : '' %>.xml

data/Appraisals

@@ -1,15 +1,19 @@
 appraise "rails-5.0" do
-  gem "rails", "5.0"
+  gem "rails", "~> 5.0.0"
 end
 
 appraise "rails-5.1" do
-  gem "rails", "5.1"
+  gem "rails", "~> 5.1.0"
 end
 
 appraise "rails-5.2" do
-  gem "rails", "5.2"
+  gem "rails", "~> 5.2.0"
 end
 
 appraise "rails-6.0" do
-  gem "rails", "6.0.0.rc2"
+  gem "rails", "~> 6.0.0"
+end
+
+appraise "rails-6.1" do
+  gem "rails", "~> 6.1.0"
 end

data/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+## [2.0.0] - 2021-02-17
+### Breaking Changes
+- Removed broad dependency on `rails`, replaced with explicit dependencies for `railties`, `activesupport`, and `actionpack` ( [issue](https://github.com/modosc/cloudflare-rails/issues/34) and [pr](https://github.com/modosc/cloudflare-rails/pull/35))
+
+## [1.0.0] - 2020-09-29
+### Added
+
+- Fix various [loading order issues](https://github.com/modosc/cloudflare-rails/pull/25).

data/README.md

@@ -3,9 +3,7 @@ This gem correctly configures Rails for [CloudFlare](https://www.cloudflare.com)
 
 ## Rails Compatibility
 
-For Rails 5, use >= `0.2.x`
-
-For Rails 4.2, use `0.1.x`
+This gem requires `railties`, `activesupport`, and `actionpack` >= 5. The last version that supports Rails 4.2 is `0.1.x`.
 
 ## Installation
 
@@ -25,22 +23,22 @@ And then execute:
 
 ## Problem
 
-Using Cloudflare means it's hard to identify the IP address of incoming requests since all requests are proxied through Cloudflare's infrastructure. Cloudflare provides a [CF-Connecting-IP](https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-) header which can be used to identify the originating IP address of a request. However, this header alone doesn't verify a request is legitimate. If an attacker has found the actual IP address of your server they could spoof this header and masquerade as legitimate traffic. 
+Using Cloudflare means it's hard to identify the IP address of incoming requests since all requests are proxied through Cloudflare's infrastructure. Cloudflare provides a [CF-Connecting-IP](https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-) header which can be used to identify the originating IP address of a request. However, this header alone doesn't verify a request is legitimate. If an attacker has found the actual IP address of your server they could spoof this header and masquerade as legitimate traffic.
 
-`cloudflare-rails` mitigates this attack by checking that the originating ip address of any incoming connecting is from one of Cloudflare's ip address ranges. If so, the incoming `X-Forwarded-For` header is trusted and used as the ip address provided to `rack` and `rails` (via `request.ip` and `request.remote_ip`). If the incoming connection does not originate from a Cloudflare server then the `X-Forwarded-For` header is ignored and the actual remote ip address is used.
+`cloudflare-rails` mitigates this attack by checking that the originating ip address of any incoming connection is from one of Cloudflare's ip address ranges. If so, the incoming `X-Forwarded-For` header is trusted and used as the ip address provided to `rack` and `rails` (via `request.ip` and `request.remote_ip`). If the incoming connection does not originate from a Cloudflare server then the `X-Forwarded-For` header is ignored and the actual remote ip address is used.
 
 ## Usage
-This code will fetch CloudFlare's current [IPv4](https://www.cloudflare.com/ips-v4) and [IPv6](https://www.cloudflare.com/ips-v6) lists, store them in `Rails.cache`, and add them to `config.cloudflare.ips`. The `X-Forwarded-For` header will then be trusted only from those ip addresses. 
+This code will fetch CloudFlare's current [IPv4](https://www.cloudflare.com/ips-v4) and [IPv6](https://www.cloudflare.com/ips-v6) lists, store them in `Rails.cache`, and add them to `config.cloudflare.ips`. The `X-Forwarded-For` header will then be trusted only from those ip addresses.
 
 You can configure the HTTP `timeout` and `expires_in` cache parameters inside of your rails config:
-```
+```ruby
 config.cloudflare.expires_in = 12.hours # default value
 config.cloudflare.timeout = 5.seconds # default value
 ```
 
 ## Alternatives
 
-[actionpack-cloudflare](https://github.com/customink/actionpack-cloudflare) simpler approach using the `CF-Connecting-IP` header. 
+[actionpack-cloudflare](https://github.com/customink/actionpack-cloudflare) simpler approach using the `CF-Connecting-IP` header.
 
 ## Development
 

data/Rakefile

@@ -9,10 +9,16 @@ task :without_rack_attack do
   Rake::Task["spec"].invoke
 end
 
-task :with_rack_attack do
-  ENV['RACK_ATTACK'] = '1'
+task :with_rack_attack_first do
+  ENV['RACK_ATTACK'] = 'first'
   Rake::Task["spec"].reenable
   Rake::Task["spec"].invoke
 end
 
-task :default => [:without_rack_attack, :with_rack_attack]
+task :with_rack_attack_last do
+  ENV['RACK_ATTACK'] = 'last'
+  Rake::Task["spec"].reenable
+  Rake::Task["spec"].invoke
+end
+
+task :default => [:without_rack_attack, :with_rack_attack_first, :with_rack_attack_last]

data/cloudflare-rails.gemspec

@@ -20,19 +20,21 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 1.10"
-  spec.add_development_dependency "rake", "~> 12.3.1"
+  spec.add_development_dependency "bundler", "~> 2.1.2"
+  spec.add_development_dependency "rake", "~> 13.0.1"
   spec.add_development_dependency "rspec_junit_formatter", "~> 0.4.1"
-  spec.add_development_dependency "rspec-rails", "~> 3.8.2"
-  spec.add_development_dependency "rspec", "~> 3.8.0"
-  spec.add_development_dependency "rubocop-airbnb", "~> 2.0.0"
-  spec.add_development_dependency "webmock", "~> 3.6.0"
-  spec.add_development_dependency "rack-attack", "~> 6.1.0"
+  spec.add_development_dependency "rspec-rails", "~> 4.0.0"
+  spec.add_development_dependency "rspec", "~> 3.10.0"
+  spec.add_development_dependency "rubocop-airbnb", "~> 3.0.2"
+  spec.add_development_dependency "webmock", "~> 3.11.0"
+  spec.add_development_dependency "rack-attack", "~> 6.5.0"
   spec.add_development_dependency "pry-byebug"
   spec.add_development_dependency "appraisal"
 
   spec.add_dependency "httparty"
-  spec.add_dependency "rails", ">= 5.0", "< 6.1.0"
+  spec.add_dependency "railties", ">= 5.0", "< 6.2.0"
+  spec.add_dependency "activesupport", ">= 5.0", "< 6.2.0"
+  spec.add_dependency "actionpack", ">= 5.0", "< 6.2.0"
 
   # we need Module#prepend
   spec.required_ruby_version = '>= 2.0'

data/gemfiles/rails_5.0.gemfile

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.0"
+gem "rails", "~> 5.0.0"
 
 gemspec path: "../"

data/gemfiles/rails_5.1.gemfile

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.1"
+gem "rails", "~> 5.1.0"
 
 gemspec path: "../"

data/gemfiles/rails_5.2.gemfile

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.2"
+gem "rails", "~> 5.2.0"
 
 gemspec path: "../"

data/gemfiles/rails_6.0.gemfile

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "rails", "6.0.0.rc2"
+gem "rails", "~> 6.0.0"
 
 gemspec path: "../"

data/gemfiles/rails_6.1.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 6.1.0"
+
+gemspec path: "../"

data/lib/cloudflare/rails/railtie.rb

@@ -1,3 +1,4 @@
+require "active_support/core_ext/integer/time"
 require "httparty"
 
 module Cloudflare
@@ -11,15 +12,6 @@ module Cloudflare
         end
       end
 
-      Rack::Request::Helpers.prepend CheckTrustedProxies
-
-      # rack-attack Rack::Request before the above is run, so if rack-attack is loaded we need to
-      # prepend our module there as well, see:
-      # https://github.com/kickstarter/rack-attack/blob/4fc4d79c9d2697ec21263109af23f11ea93a23ce/lib/rack/attack/request.rb
-      if defined? Rack::Attack::Request
-        Rack::Attack::Request.prepend CheckTrustedProxies
-      end
-
       # patch ActionDispatch::RemoteIP to use our cloudflare ips - this way
       # request.remote_ip is correct inside of rails
       module RemoteIpProxies
@@ -28,8 +20,6 @@ module Cloudflare
         end
       end
 
-      ActionDispatch::RemoteIp.prepend RemoteIpProxies
-
       class Importer
         include HTTParty
         base_uri 'https://www.cloudflare.com'
@@ -89,10 +79,22 @@ module Cloudflare
           rescue Importer::ResponseError => e
             ::Rails.logger.error "Cloudflare::Rails: Couldn't import #{type} blocks from CloudFlare: #{e.response}"
           rescue StandardError => e
-            ::Rails.logger.error "Cloudflare::Rails: Got exception: #{e} for type:#{type}"
+            ::Rails.logger.error "Cloudflare::Rails: Got exception: #{e} for type: #{type}"
           end
         end
       end
+      initializer "my_railtie.configure_rails_initialization" do
+        Rack::Request::Helpers.prepend CheckTrustedProxies
+
+        ObjectSpace.each_object(Class).
+          select do |c|
+            c.included_modules.include?(Rack::Request::Helpers) &&
+            !c.included_modules.include?(CheckTrustedProxies)
+          end.
+          map { |c| c .prepend CheckTrustedProxies }
+
+        ActionDispatch::RemoteIp.prepend RemoteIpProxies
+      end
     end
   end
 end

data/lib/cloudflare/rails/version.rb

@@ -1,5 +1,5 @@
 module Cloudflare
   module Rails
-    VERSION = "0.6.0".freeze
+    VERSION = "2.0.0".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-rails
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 2.0.0
 platform: ruby
 authors:
 - jonathan schatz
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-08-11 00:00:00.000000000 Z
+date: 2021-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.10'
+        version: 2.1.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.10'
+        version: 2.1.2
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 12.3.1
+        version: 13.0.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 12.3.1
+        version: 13.0.1
 - !ruby/object:Gem::Dependency
   name: rspec_junit_formatter
   requirement: !ruby/object:Gem::Requirement
@@ -58,70 +58,70 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.2
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.2
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: 3.10.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: 3.10.0
 - !ruby/object:Gem::Dependency
   name: rubocop-airbnb
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.0.0
+        version: 3.0.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.0.0
+        version: 3.0.2
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.6.0
+        version: 3.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.6.0
+        version: 3.11.0
 - !ruby/object:Gem::Dependency
   name: rack-attack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 6.5.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 6.5.0
 - !ruby/object:Gem::Dependency
   name: pry-byebug
   requirement: !ruby/object:Gem::Requirement
@@ -165,7 +165,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -173,7 +173,7 @@ dependencies:
         version: '5.0'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 6.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -183,7 +183,47 @@ dependencies:
         version: '5.0'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 6.2.0
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 6.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 6.2.0
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 6.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 6.2.0
 description: ''
 email:
 - modosc@users.noreply.github.com
@@ -192,6 +232,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".circleci/config.yml"
+- ".github/dependabot.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
@@ -199,6 +240,7 @@ files:
 - ".rubocop_todo.yml"
 - ".travis.yml"
 - Appraisals
+- CHANGELOG.md
 - Gemfile
 - LICENSE
 - README.md
@@ -211,6 +253,7 @@ files:
 - gemfiles/rails_5.1.gemfile
 - gemfiles/rails_5.2.gemfile
 - gemfiles/rails_6.0.gemfile
+- gemfiles/rails_6.1.gemfile
 - lib/cloudflare/rails.rb
 - lib/cloudflare/rails/railtie.rb
 - lib/cloudflare/rails/version.rb
@@ -218,7 +261,7 @@ homepage: https://github.com/modosc/cloudflare-rails
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -233,8 +276,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.4
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: This gem configures Rails for CloudFlare so that request.ip and request.remote_ip
   and work correctly.