handle_invalid_percent_encoding_requests 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: eb049a64fb48ed3fd17247b81b6c6de6335d8269
-  data.tar.gz: 6f7d893f18c24d6b1e593dfe465e3070d7ed518e
+  metadata.gz: d1c2fc0a8379091dd76dfe1081b449ae2863e185
+  data.tar.gz: bbb2b4b5a6e82bd2d633a3be54c10186b790469e
 SHA512:
-  metadata.gz: 0a73ac5e8a4d7c769d2573e1778922c4eaf0364f8dd47edd3a89fb98d00fc6d6e820d9b265ec4360d4472d5a97c8b611bf859b6f5382cb243a310fdcac164714
-  data.tar.gz: f07afec281ef61f5f95eeebdae40089378935a8e51663a49d02e3416c199ce738a89fd9324d2061e6a233b0908c50943ca5d79fb2948a7d72b27ec5676e33520
+  metadata.gz: 82e9afd76efb3e504c92351f99a6e1878c4434c9af3503dc0be5a6e464ffb3dc63d2fa02021501d6d2727ade561de082f82818a1c4fdf7dba1b2fe1f3802f6b5
+  data.tar.gz: 3eba4ad39247fb19c886062b7cb9a87395c566540548b82b1a8823967393e955803843f4ae89e8e81d43e40bcb4286c53690258dd0581809080e113cf097e562

data/README.md

@@ -1,20 +1,28 @@
 Handle Invalid Percent Encoding Requests
 =======================================
 
-Rails Engine that renders 400 error whenever a request's
-percent-encoding is malformed.
+Rails Engine that protects your app against malformed requests.
 
-This happens notably a lot for the chinese [EasouSpider](http://www.easou.com/search/spider.html).
+This middleware renders a 400 error instead of raising exceptions for the
+following errors:
 
-See http://stackoverflow.com/q/24648206/311657
+- `invalid byte sequence in UTF-8`
+- `string contains null byte`
 
-Install
--------
+Installation
+------------
 
-In your Rails app, add this line to your `Gemfile`:
+In your Rails app, add these lines to your `Gemfile`:
 
 ```rb
+# Helps against "invalid byte sequence" exceptions.
 gem "handle_invalid_percent_encoding_requests"
 ```
 
-Then type `bundle`.
+Then type `bundle install`.
+
+See also
+--------
+
+See also [Ruby on Rails “invalid byte sequence in UTF-8” due to
+bot](http://stackoverflow.com/q/24648206/311657) on StackOverflow.

data/lib/handle_invalid_percent_encoding_requests/engine.rb

@@ -2,6 +2,7 @@ require "rack/utf8_sanitizer"
 
 module HandleInvalidPercentEncodingRequests
 
+  # Rails Engine that inserts the Middleware at the top of the Rack queue
   class Engine < Rails::Engine
     initializer "handle_invalid_percent_encoding_requests.add_middleware" do |app|
       # Via http://stackoverflow.com/a/24727310/311657

data/lib/handle_invalid_percent_encoding_requests/middleware.rb

@@ -1,13 +1,35 @@
 # Via https://gist.github.com/bf4/d26259acfa29f3b9882b#file-exception_app-rb
-
 module HandleInvalidPercentEncodingRequests
+  module InvalidPercentEncodingErrorMatcher
+    def self.===(error)
+      error.is_a?(ArgumentError) &&
+        error.message =~ /invalid %-encoding/
+    end
+  end
+
+  module InvalidByteSequenceErrorMatcher
+    def self.===(error)
+      error.is_a?(ArgumentError) &&
+        error.message == "invalid byte sequence in UTF-8"
+    end
+  end
 
+  module NullByteErrorMatcher
+    def self.===(error)
+      error.is_a?(ArgumentError) &&
+        error.message == "string contains null byte"
+    end
+  end
+
+  # Rack Middleware inserted before the request that detects an encoding error
+  # and returns an appropriate response.
   class Middleware
-    def initialize(app, stdout=STDOUT)
+    def initialize(app, stdout = STDOUT)
       @app = app
       @logger = defined?(Rails.logger) ? Rails.logger : Logger.new(stdout)
     end
 
+    # Called by Rack when a request comes through
     def call(env)
       # calling env.dup here prevents bad things from happening
       request = Rack::Request.new(env.dup)
@@ -15,23 +37,26 @@ module HandleInvalidPercentEncodingRequests
       # calling request.params is sufficient to trigger the error see
       # https://github.com/rack/rack/issues/337#issuecomment-46453404
       request.params
+
       @app.call(env)
 
-    # Rescue from that specific ArgumentError
-    rescue ArgumentError => e
-      raise unless e.message =~ /invalid %-encoding/
+    rescue InvalidPercentEncodingErrorMatcher,
+           InvalidByteSequenceErrorMatcher,
+           NullByteErrorMatcher
 
-      @logger.info "Bad request. Returning 400 due to #{e.message} from request with env #{request.inspect}"
+      @logger.info "Bad request. Returning 400 due to #{e.class.name} " \
+                   "#{e.message.inspect} from request with env " \
+                   "#{request.inspect}"
       error_response
     end
 
+
     private
 
     def error_response
-      headers = { 'Content-Type' => "text/plain; charset=utf-8" }
+      headers = { "Content-Type" => "text/plain; charset=utf-8" }
       text = "Bad Request"
       [400, headers, [text]]
     end
   end
-
 end

data/lib/handle_invalid_percent_encoding_requests/version.rb

@@ -1,4 +1,4 @@
 # Uses Semantic Versionning
 module HandleInvalidPercentEncodingRequests
-  VERSION = "1.0.2"
+  VERSION = "1.1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: handle_invalid_percent_encoding_requests
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - Sunny Ripert
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-07-24 00:00:00.000000000 Z
+date: 2019-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -59,13 +59,13 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- MIT-LICENSE
+- README.md
+- Rakefile
+- lib/handle_invalid_percent_encoding_requests.rb
 - lib/handle_invalid_percent_encoding_requests/engine.rb
 - lib/handle_invalid_percent_encoding_requests/middleware.rb
 - lib/handle_invalid_percent_encoding_requests/version.rb
-- lib/handle_invalid_percent_encoding_requests.rb
-- MIT-LICENSE
-- Rakefile
-- README.md
 homepage: http://github.com/sunny/handle_invalid_percent_encoding_requests
 licenses:
 - MIT
@@ -86,7 +86,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.11
+rubygems_version: 2.5.2.3
 signing_key: 
 specification_version: 4
 summary: Handle invalid percent in encoding from requests in Rails