geocoder 1.2.7 → 1.2.8

data/lib/geocoder/lookups/bing.rb

@@ -43,9 +43,9 @@ module Geocoder::Lookup
       if doc['statusCode'] == 200
         return doc['resourceSets'].first['estimatedTotal'] > 0 ? doc['resourceSets'].first['resources'] : []
       elsif doc['statusCode'] == 401 and doc["authenticationResultCode"] == "InvalidCredentials"
-        raise_error(Geocoder::InvalidApiKey) || warn("Invalid Bing API key.")
+        raise_error(Geocoder::InvalidApiKey) || Geocoder.log(:warn, "Invalid Bing API key.")
       else
-        warn "Bing Geocoding API error: #{doc['statusCode']} (#{doc['statusDescription']})."
+        Geocoder.log(:warn, "Bing Geocoding API error: #{doc['statusCode']} (#{doc['statusDescription']}).")
       end
       return []
     end
@@ -55,5 +55,18 @@ module Geocoder::Lookup
         key: configuration.api_key
       }.merge(super)
     end
+
+    def check_response_for_errors!(response)
+      super
+      if response['x-ms-bm-ws-info'].to_i == 1
+        # Occasionally, the servers processing service requests can be overloaded,
+        # and you may receive some responses that contain no results for queries that
+        # you would normally receive a result. To identify this situation,
+        # check the HTTP headers of the response. If the HTTP header X-MS-BM-WS-INFO is set to 1,
+        # it is best to wait a few seconds and try again.
+        raise_error(Geocoder::ServiceUnavailable) ||
+          Geocoder.log(:warn, "Bing Geocoding API error: Service Unavailable")
+      end
+    end
   end
 end

data/lib/geocoder/lookups/esri.rb

@@ -21,7 +21,7 @@ module Geocoder::Lookup
       return [] unless doc = fetch_data(query)
 
       if (!query.reverse_geocode?)
-        return [] if doc['locations'].empty?
+        return [] if !doc['locations'] || doc['locations'].empty?
       end
 
       if (doc['error'].nil?)

data/lib/geocoder/lookups/geocoder_ca.rb

@@ -21,7 +21,7 @@ module Geocoder::Lookup
       elsif doc['error']['code'] == "005"
         # "Postal Code is not in the proper Format" => no results, just shut up
       else
-        warn "Geocoder.ca service error: #{doc['error']['code']} (#{doc['error']['description']})."
+        Geocoder.log(:warn, "Geocoder.ca service error: #{doc['error']['code']} (#{doc['error']['description']}).")
       end
       return []
     end
@@ -51,4 +51,3 @@ module Geocoder::Lookup
     end
   end
 end
-

data/lib/geocoder/lookups/geocodio.rb

@@ -19,13 +19,13 @@ module Geocoder::Lookup
       
       if doc['error'] == 'Invalid API key'
         raise_error(Geocoder::InvalidApiKey) ||
-          warn("Geocodio service error: invalid API key.")
+          Geocoder.log(:warn, "Geocodio service error: invalid API key.")
       elsif doc['error'].match(/You have reached your daily maximum/)
         raise_error(Geocoder::OverQueryLimitError, doc['error']) ||
-          warn("Geocodio service error: #{doc['error']}.")
+          Geocoder.log(:warn, "Geocodio service error: #{doc['error']}.")
       else
         raise_error(Geocoder::InvalidRequest, doc['error']) ||
-          warn("Geocodio service error: #{doc['error']}.")
+          Geocoder.log(:warn, "Geocodio service error: #{doc['error']}.")
       end
       []
     end

data/lib/geocoder/lookups/google.rb

@@ -30,13 +30,13 @@ module Geocoder::Lookup
         return doc['results']
       when "OVER_QUERY_LIMIT"
         raise_error(Geocoder::OverQueryLimitError) ||
-          warn("Google Geocoding API error: over query limit.")
+          Geocoder.log(:warn, "Google Geocoding API error: over query limit.")
       when "REQUEST_DENIED"
         raise_error(Geocoder::RequestDenied) ||
-          warn("Google Geocoding API error: request denied.")
+          Geocoder.log(:warn, "Google Geocoding API error: request denied.")
       when "INVALID_REQUEST"
         raise_error(Geocoder::InvalidRequest) ||
-          warn("Google Geocoding API error: invalid request.")
+          Geocoder.log(:warn, "Google Geocoding API error: invalid request.")
       end
       return []
     end

data/lib/geocoder/lookups/google_places_details.rb

@@ -29,11 +29,11 @@ module Geocoder
         when "OK"
           return [doc["result"]]
         when "OVER_QUERY_LIMIT"
-          raise_error(Geocoder::OverQueryLimitError) || warn("Google Places Details API error: over query limit.")
+          raise_error(Geocoder::OverQueryLimitError) || Geocoder.log(:warn, "Google Places Details API error: over query limit.")
         when "REQUEST_DENIED"
-          raise_error(Geocoder::RequestDenied) || warn("Google Places Details API error: request denied.")
+          raise_error(Geocoder::RequestDenied) || Geocoder.log(:warn, "Google Places Details API error: request denied.")
         when "INVALID_REQUEST"
-          raise_error(Geocoder::InvalidRequest) || warn("Google Places Details API error: invalid request.")
+          raise_error(Geocoder::InvalidRequest) || Geocoder.log(:warn, "Google Places Details API error: invalid request.")
         end
 
         []

data/lib/geocoder/lookups/mapquest.rb

@@ -45,13 +45,13 @@ module Geocoder::Lookup
       case doc['info']['statuscode']
       when 400 # Error with input
         raise_error(Geocoder::InvalidRequest, messages) ||
-          warn("Mapquest Geocoding API error: #{messages}")
+          Geocoder.log(:warn, "Mapquest Geocoding API error: #{messages}")
       when 403 # Key related error
         raise_error(Geocoder::InvalidApiKey, messages) ||
-          warn("Mapquest Geocoding API error: #{messages}")
+          Geocoder.log(:warn, "Mapquest Geocoding API error: #{messages}")
       when 500 # Unknown error
         raise_error(Geocoder::Error, messages) ||
-          warn("Mapquest Geocoding API error: #{messages}")
+          Geocoder.log(:warn, "Mapquest Geocoding API error: #{messages}")
       end
       []
     end

data/lib/geocoder/lookups/maxmind.rb

@@ -64,7 +64,7 @@ module Geocoder::Lookup
         if !data_contains_error?(doc)
           return [doc]
         elsif doc.last == "INVALID_LICENSE_KEY"
-          raise_error(Geocoder::InvalidApiKey) || warn("Invalid MaxMind API key.")
+          raise_error(Geocoder::InvalidApiKey) || Geocoder.log(:warn, "Invalid MaxMind API key.")
         end
       end
       return []

data/lib/geocoder/lookups/maxmind_geoip2.rb

@@ -0,0 +1,69 @@
+require 'geocoder/lookups/base'
+require 'geocoder/results/maxmind_geoip2'
+
+module Geocoder::Lookup
+  class MaxmindGeoip2 < Base
+
+    def name
+      "MaxMind GeoIP2"
+    end
+
+    def use_ssl?
+      # Maxmind's GeoIP2 Precision Services only supports HTTPS,
+      # otherwise a `404 Not Found` HTTP response will be returned
+      true
+    end
+
+    def query_url(query)
+      "#{protocol}://geoip.maxmind.com/geoip/v2.1/#{configured_service!}/#{URI.escape(query.sanitized_text.strip)}"
+    end
+
+    private # ---------------------------------------------------------------
+
+    ##
+    # Return the name of the configured service, or raise an exception.
+    #
+    def configured_service!
+      if s = configuration[:service] and services.include?(s) and configuration[:basic_auth][:user] and configuration[:basic_auth][:password]
+        return s
+      else
+        raise(
+          Geocoder::ConfigurationError,
+          "When using MaxMind GeoIP2 you MUST specify a service name and basic_auth: " +
+          "Geocoder.configure(:maxmind_geoip2 => {:service => ...}, " +
+          ":basic_auth => {:user ..., :password => ...}), " +
+          "where service is one of: #{services.inspect}"
+        )
+      end
+    end
+
+    def data_contains_error?(doc)
+      (["code", "error"] - doc.keys).empty?
+    end
+
+    ##
+    # Service names used in URL.
+    #
+    def services
+      [
+        :country,
+        :city,
+        :insights,
+      ]
+    end
+
+    def results(query)
+      # don't look up a loopback address
+      return [] if query.loopback_ip_address?
+      doc = fetch_data(query)
+      if doc
+        if !data_contains_error?(doc)
+          return [doc]
+        else
+          Geocoder.log(:warn, "MaxMind GeoIP2 Geocoding API error: #{doc['code']} (#{doc['error']}).")
+        end
+      end
+      return []
+    end
+  end
+end

data/lib/geocoder/lookups/nominatim.rb

@@ -27,7 +27,7 @@ module Geocoder::Lookup
 
     def parse_raw_data(raw_data)
       if raw_data.include?("Bandwidth limit exceeded")
-        raise_error(Geocoder::OverQueryLimitError) || warn("Over API query limit.")
+        raise_error(Geocoder::OverQueryLimitError) || Geocoder.log(:warn, "Over API query limit.")
       else
         super(raw_data)
       end

data/lib/geocoder/lookups/opencagedata.rb

@@ -26,16 +26,16 @@ module Geocoder::Lookup
       case doc['status']['code']
       when 400 # Error with input
         raise_error(Geocoder::InvalidRequest, messages) ||
-          warn("Opencagedata Geocoding API error: #{messages}")
+          Geocoder.log(:warn, "Opencagedata Geocoding API error: #{messages}")
       when 403 # Key related error
         raise_error(Geocoder::InvalidApiKey, messages) ||
-          warn("Opencagedata Geocoding API error: #{messages}")
+          Geocoder.log(:warn, "Opencagedata Geocoding API error: #{messages}")
       when 402 # Quata Exceeded
           raise_error(Geocoder::OverQueryLimitError, messages) ||
-          warn("Opencagedata Geocoding API error: #{messages}")
+          Geocoder.log(:warn, "Opencagedata Geocoding API error: #{messages}")
       when 500 # Unknown error
         raise_error(Geocoder::Error, messages) ||
-          warn("Opencagedata Geocoding API error: #{messages}")
+          Geocoder.log(:warn, "Opencagedata Geocoding API error: #{messages}")
       end
 
       return doc["results"]

data/lib/geocoder/lookups/pointpin.rb

@@ -28,14 +28,14 @@ module Geocoder::Lookup
         elsif doc['error']
           case doc['error']
           when "Invalid IP address"
-            raise_error(Geocoder::InvalidRequest) || warn("Invalid Pointpin request.")
+            raise_error(Geocoder::InvalidRequest) || Geocoder.log(:warn, "Invalid Pointpin request.")
           when "Invalid API key"
-            raise_error(Geocoder::InvalidApiKey) || warn("Invalid Pointpin API key.")
+            raise_error(Geocoder::InvalidApiKey) || Geocoder.log(:warn, "Invalid Pointpin API key.")
           when "Address not found"
-            warn("Address not found.")
+            Geocoder.log(:warn, "Address not found.")
           end
         else
-          raise_error(Geocoder::Error) || warn("Pointpin server error")
+          raise_error(Geocoder::Error) || Geocoder.log(:warn, "Pointpin server error")
         end
       end
       

data/lib/geocoder/lookups/postcode_anywhere_uk.rb

@@ -33,11 +33,11 @@ module Geocoder::Lookup
     def raise_exception_for_response(response)
       case response['Error']
       when *DAILY_LIMIT_EXEEDED_ERROR_CODES
-        raise_error(Geocoder::OverQueryLimitError, response['Cause']) || warn(response['Cause'])
+        raise_error(Geocoder::OverQueryLimitError, response['Cause']) || Geocoder.log(:warn, response['Cause'])
       when INVALID_API_KEY_ERROR_CODE
-        raise_error(Geocoder::InvalidApiKey, response['Cause']) || warn(response['Cause'])
+        raise_error(Geocoder::InvalidApiKey, response['Cause']) || Geocoder.log(:warn, response['Cause'])
       else # anything else just raise general error with the api cause
-        raise_error(Geocoder::Error, response['Cause']) || warn(response['Cause'])
+        raise_error(Geocoder::Error, response['Cause']) || Geocoder.log(:warn, response['Cause'])
       end
     end
 

data/lib/geocoder/lookups/yahoo.rb

@@ -37,7 +37,7 @@ module Geocoder::Lookup
           return []
         end
       else
-        warn "Yahoo Geocoding API error: #{doc['responsecode']} (#{doc['reason']})."
+        Geocoder.log(:warn, "Yahoo Geocoding API error: #{doc['responsecode']} (#{doc['reason']}).")
         return []
       end
     end
@@ -52,9 +52,9 @@ module Geocoder::Lookup
     def parse_raw_data(raw_data)
       if raw_data.match(/^<\?xml/)
         if raw_data.include?("Rate Limit Exceeded")
-          raise_error(Geocoder::OverQueryLimitError) || warn("Over API query limit.")
+          raise_error(Geocoder::OverQueryLimitError) || Geocoder.log(:warn, "Over API query limit.")
         elsif raw_data =~ /<yahoo:description>(Please provide valid credentials.*)<\/yahoo:description>/i
-          raise_error(Geocoder::InvalidApiKey) || warn("Invalid API key. Error response: #{$1}")
+          raise_error(Geocoder::InvalidApiKey) || Geocoder.log(:warn, "Invalid API key. Error response: #{$1}")
         end
       else
         super(raw_data)

data/lib/geocoder/lookups/yandex.rb

@@ -22,9 +22,9 @@ module Geocoder::Lookup
       return [] unless doc = fetch_data(query)
       if err = doc['error']
         if err["status"] == 401 and err["message"] == "invalid key"
-          raise_error(Geocoder::InvalidApiKey) || warn("Invalid API key.")
+          raise_error(Geocoder::InvalidApiKey) || Geocoder.log(:warn, "Invalid API key.")
         else
-          warn "Yandex Geocoding API error: #{err['status']} (#{err['message']})."
+          Geocoder.log(:warn, "Yandex Geocoding API error: #{err['status']} (#{err['message']}).")
         end
         return []
       end
@@ -32,7 +32,7 @@ module Geocoder::Lookup
         meta = doc['metaDataProperty']['GeocoderResponseMetaData']
         return meta['found'].to_i > 0 ? doc['featureMember'] : []
       else
-        warn "Yandex Geocoding API error: unexpected response format."
+        Geocoder.log(:warn, "Yandex Geocoding API error: unexpected response format.")
         return []
       end
     end

data/lib/geocoder/query.rb

@@ -32,7 +32,7 @@ module Geocoder
     # appropriate to the Query text.
     #
     def lookup
-      if ip_address?
+      if !options[:street_address] and (options[:ip_address] or ip_address?)
         name = options[:ip_lookup] || Configuration.ip_lookup || Geocoder::Lookup.ip_services.first
       else
         name = options[:lookup] || Configuration.lookup || Geocoder::Lookup.street_services.first

data/lib/geocoder/request.rb

@@ -1,21 +1,79 @@
 module Geocoder
   module Request
 
+    # The location() method is vulnerable to trivial IP spoofing.
+    #   Don't use it in authorization/authentication code, or any
+    #   other security-sensitive application.  Use safe_location
+    #   instead.
     def location
-      @location ||= begin
-        detected_ip = env['HTTP_X_REAL_IP'] || (
-          env['HTTP_X_FORWARDED_FOR'] &&
-          env['HTTP_X_FORWARDED_FOR'].split(",").first.strip
-        )
-        detected_ip = IpAddress.new(detected_ip.to_s)
-        if detected_ip.valid? and !detected_ip.loopback?
-          real_ip = detected_ip.to_s
-        else
-          real_ip = self.ip
+      @location ||= Geocoder.search(geocoder_spoofable_ip, ip_address: true).first
+    end
+
+    # This safe_location() protects you from trivial IP spoofing.
+    #   For requests that go through a proxy that you haven't
+    #   whitelisted as trusted in your Rack config, you will get the
+    #   location for the IP of the last untrusted proxy in the chain,
+    #   not the original client IP.  You WILL NOT get the location
+    #   corresponding to the original client IP for any request sent
+    #   through a non-whitelisted proxy.
+    def safe_location
+      @location ||= Geocoder.search(ip, ip_address: true).first
+    end
+
+    # There's a whole zoo of nonstandard headers added by various
+    #   proxy softwares to indicate original client IP.
+    # ANY of these can be trivially spoofed!
+    #   (except REMOTE_ADDR, which should by set by your server,
+    #    and is included at the end as a fallback.
+    # Order does matter: we're following the convention established in
+    #   ActionDispatch::RemoteIp::GetIp::calculate_ip()
+    #   https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/remote_ip.rb
+    #   where the forwarded_for headers, possibly containing lists,
+    #   are arbitrarily preferred over headers expected to contain a
+    #   single address.
+    GEOCODER_CANDIDATE_HEADERS = ['HTTP_X_FORWARDED_FOR',
+                                  'HTTP_X_FORWARDED',
+                                  'HTTP_FORWARDED_FOR',
+                                  'HTTP_FORWARDED',
+                                  'HTTP_X_CLIENT_IP',
+                                  'HTTP_CLIENT_IP',
+                                  'HTTP_X_REAL_IP',
+                                  'HTTP_X_CLUSTER_CLIENT_IP',
+                                  'REMOTE_ADDR']
+
+    def geocoder_spoofable_ip
+
+      # We could use a more sophisticated IP-guessing algorithm here,
+      # in which we'd try to resolve the use of different headers by
+      # different proxies.  The idea is that by comparing IPs repeated
+      # in different headers, you can sometimes decide which header
+      # was used by a proxy further along in the chain, and thus
+      # prefer the headers used earlier.  However, the gains might not
+      # be worth the performance tradeoff, since this method is likely
+      # to be called on every request in a lot of applications.
+      GEOCODER_CANDIDATE_HEADERS.each do |header|
+        if @env.has_key? header
+          addrs = geocoder_split_ip_addresses(@env[header])
+          addrs = geocoder_reject_trusted_ip_addresses(addrs)
+          return addrs.first if addrs.any?
         end
-        Geocoder.search(real_ip).first
       end
-      @location
+
+      @env['REMOTE_ADDR']
+    end
+
+    private
+
+    def geocoder_split_ip_addresses(ip_addresses)
+      ip_addresses ? ip_addresses.strip.split(/[,\s]+/) : []
+    end
+
+    # use Rack's trusted_proxy?() method to filter out IPs that have
+    #   been configured as trusted; includes private ranges by
+    #   default.  (we don't want every lookup to return the location
+    #   of our own proxy/load balancer)
+    def geocoder_reject_trusted_ip_addresses(ip_addresses)
+      ip_addresses.reject { |ip| trusted_proxy?(ip) }
     end
   end
 end

data/lib/geocoder/results/geoip2.rb

@@ -13,41 +13,35 @@ module Geocoder
       end
 
       def latitude
-        return 0.0 unless @data['location']
-        @data['location']['latitude'].to_f
+        @data.fetch('location',{}).fetch('latitude',0.0)
       end
 
       def longitude
-        return 0.0 unless @data['location']
-        @data['location']['longitude'].to_f
+        @data.fetch('location',{}).fetch('longitude',0.0)
       end
 
       def city
-        return '' unless @data['city']
-        @data['city']['names']['en']
+        @data.fetch('city', {}).fetch('names', {}).fetch('en', '')
       end
 
       def state
-        return '' unless @data['subdivisions']
-        @data['subdivisions'][0]['names']['en']
+        @data.fetch('subdivisions',[]).fetch(0,{}).fetch('names',{}).fetch('en','')
       end
 
       def state_code
-        return '' unless @data['subdivisions']
-        @data['subdivisions'][0]['iso_code']
+        @data.fetch('subdivisions',[]).fetch(0,{}).fetch('iso_code','')
       end
 
       def country
-        @data['country']['names']['en']
+        @data.fetch('country', {}).fetch('names',{}).fetch('en','')
       end
 
       def country_code
-        @data['country']['iso_code']
+        @data.fetch('country',{}).fetch('iso_code','')
       end
 
       def postal_code
-        return '' unless @data['postal']
-        @data['postal']['code']
+        @data.fetch('postal',{}).fetch('code','')
       end
 
       def self.response_attributes