decidim-cdtb 0.6.2 → 0.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c986754e258f5c89f059019e2eff8a989cb15972c8958a0aef8519246a1c974
-  data.tar.gz: a930aa3920de4ffaa6549d86831dcc9f328b8e4be9eab69a3d0e99a4367ba7ad
+  metadata.gz: 87cfa078ca5fb059a580e029b4319a64d192a0b02e3cfd1136c2dd5d8d30a8e2
+  data.tar.gz: 2859c2bb9f9b079a672fe10600347bee48652daf70ec6810d412741765f00fdb
 SHA512:
-  metadata.gz: 9ae0c57f0806d1d074969b6a4e6f5780d4cac4a6843d0696cc65c1235025e604eb5e6a1c866260a99fd15099b019aee936932888c0cdf0de345622b5a32d684d
-  data.tar.gz: 187bcef080e8308048ee7250a8b7b226dc21ff644e875ac254a33164df150338a491d000e79b73058f04aea8bf03d639a1ce76707df340679a0af05610215122
+  metadata.gz: 48af433b8ce336f0f1f78a293a0ab129543e556b574f749e8b561e149f3fda247a59a4126cd6e512e35e127e17be921f22a0ad8abc78ad687a52419e4ff74cdd
+  data.tar.gz: df959a73420d0db727c237ed5c37edbe69e79f224a2bd7bf71f335dafc02d79b3a491718763ab3b2d6ac13716825c5f3cd475e55da2f35268e821c59e9c00ffa

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## [0.6.3] - 2026-10-16 (minor)
+
+- Implement RackAttack feature to block abuse reported IPs.
+- Improve RackAttack tests and compatibility with subnets.
+
 ## [0.6.2] - 2026-09-10 (minor)
 
 - Prevent `cdtb:users:remove` from enqueueing the admin block notification email when blocking users while preserving auditability and moderation records.

data/Gemfile.lock

@@ -141,7 +141,7 @@ GIT
 PATH
   remote: .
   specs:
-    decidim-cdtb (0.6.2)
+    decidim-cdtb (0.6.3)
       decidim (>= 0.29.0)
       rails (>= 6)
       ruby-progressbar

data/config/initializers/cdtb_rack_attack.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require "cdtb/ip_parser"
+require "csv"
+require "ipaddr"
 
 unless ENV["CDTB_RACK_ATTACK_DISABLED"].to_i.positive? || %w[development test].include?(Rails.env)
   require "rack/attack"
@@ -36,14 +38,38 @@ unless ENV["CDTB_RACK_ATTACK_DISABLED"].to_i.positive? || %w[development test].i
   end
 
   Rack::Attack.blocklist("cdtb:block all PHP RQs") do |request|
-    request.path.end_with?("*.php")
+    request.path.end_with?(".php")
+  end
+
+  ABUSE_REPORTED_IPS_CSV_PATH= ENV.fetch("ABUSE_REPORTED_IPS_CSV_PATH", nil)
+  if ABUSE_REPORTED_IPS_CSV_PATH.present? && File.exist?(ABUSE_REPORTED_IPS_CSV_PATH)
+    ABUSE_REPORTED_IPS_CACHE_KEY= ["cdtb", "reported_ips", ABUSE_REPORTED_IPS_CSV_PATH].freeze
+    Rack::Attack.blocklist("block IPs in reported website") do |request|
+      ip= Cdtb::IpParser.extract_ip(request)
+
+      reported_ips = Rails.cache.fetch(ABUSE_REPORTED_IPS_CACHE_KEY, expires_in: 1.hour) do
+        if ABUSE_REPORTED_IPS_CSV_PATH.present? && File.exist?(ABUSE_REPORTED_IPS_CSV_PATH)
+          CSV.read(ABUSE_REPORTED_IPS_CSV_PATH).flatten.compact.map(&:strip).reject(&:blank?)
+        else
+          []
+        end
+      end
+
+      reported_ips.any? { |reported_ip| ip.start_with?(reported_ip) }
+    end
   end
 
   if ENV["RACK_ATTACK_BLOCKED_IPS"].present?
-    blocked_ips_and_subnets= ENV["RACK_ATTACK_BLOCKED_IPS"].split(",")
+    blocked_ips_and_subnets= ENV["RACK_ATTACK_BLOCKED_IPS"].split(",").filter_map do |ip_or_subnet|
+      IPAddr.new(ip_or_subnet.strip)
+    rescue IPAddr::InvalidAddressError
+      nil
+    end
     Rack::Attack.blocklist("cdtb:block all unaccepted IPs") do |request|
-      ip= Cdtb::IpParser.extract_ip(request)
-      blocked_ips_and_subnets.any? { |ip_or_subnet| ip.start_with?(ip_or_subnet) }
+      request_ip= IPAddr.new(Cdtb::IpParser.extract_ip(request))
+      blocked_ips_and_subnets.any? { |ip_or_subnet| ip_or_subnet.include?(request_ip) }
+    rescue IPAddr::InvalidAddressError
+      false
     end
   end
 end

data/lib/cdtb/ip_parser.rb

@@ -4,6 +4,8 @@ module Cdtb
   # Parses IPs from Rack::Request objects, discarding the port.
   module IpParser
     def self.decorate_rack_request
+      return if Rack::Request.ancestors.include?(Cdtb::IpParser)
+
       Rack::Request.class_eval do
         include Cdtb::IpParser
 

data/lib/decidim/cdtb/version.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   module Cdtb
-    VERSION = "0.6.2"
+    VERSION = "0.6.3"
     DECIDIM_MIN_VERSION = ">= 0.29.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: decidim-cdtb
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.6.3
 platform: ruby
 authors:
 - Oliver Valls
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-21 00:00:00.000000000 Z
+date: 2026-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: decidim