haveapi 0.28.3 → 0.28.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca76bb1c32eebc45f28bc5d4c76381715224685dd216fc896ff51d463c4ad810
-  data.tar.gz: 9db66d118d3cbb7d2869f752c5a88c80cc41db2b939403e36955efbee2ccf42f
+  metadata.gz: 12a166f4b2cfae2e1046011ec072c2d3cfe2bae2c6e22aa7ccbb8a3a772fc4cd
+  data.tar.gz: 919fcc67646a1c52b1410500a74e27b3628403e97f97c095523d78bef4046210
 SHA512:
-  metadata.gz: 752993a312ae16ed8522639eaf7e8a7f7cb1b621d113a8251cb1ab00b036ff4d2dbcbe90d484ecb047ca25ec001555b6dca13a8e03782d942cc2746127770580
-  data.tar.gz: 61843c1e9498fd7557d85a879d2f60f95f491184084f59da37f52a965ff94513bcaaaaee73b2745e887debe96041fd4d5c4826593c4c78c45da62383353608dd
+  metadata.gz: 8f818bba5c50921fa6dc188345aabed20988fa499af2de594ad3f44af0614bd0ffe94aec7a13558bc72492f46b2fb1ce6c92b24d7a53af5be964e056d0a1a2fa
+  data.tar.gz: 38095fce8f5b1abfa3d630f5188bbed4d1203ea5ce70ec2f8a2f59faab16c1edfb863441a77a87cd1a5155e623331e32a45e434f163d3ed03cb4c3ac3cb77a79

data/haveapi.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.required_ruby_version = ">= #{File.read('../../.ruby-version').strip}"
 
   s.add_dependency 'activesupport', '>= 7.1'
-  s.add_dependency 'haveapi-client', '~> 0.28.3'
+  s.add_dependency 'haveapi-client', '~> 0.28.4'
   s.add_dependency 'json'
   s.add_dependency 'mail'
   s.add_dependency 'nesty', '~> 1.0'

data/lib/haveapi/extensions/exception_mailer.rb

@@ -11,6 +11,21 @@ module HaveAPI::Extensions
   # is added. Some helper methods are taken either from Sinatra or Rack.
   class ExceptionMailer < Base
     Frame = Struct.new(:filename, :lineno, :function, :context_line)
+    FILTERED_VALUE = '[FILTERED]'.freeze
+    SENSITIVE_KEY_PATTERN = /
+      authorization|cookie|password|passwd|passphrase|secret|token|
+      api[_-]?key|credential|jwt|session|csrf|query_string|form_vars|
+      request_uri|original_fullpath|fullpath
+    /ix
+    SENSITIVE_STRING_PATTERN = /
+      (
+        (?:authorization|cookie|password|passwd|passphrase|secret|token|
+           api[_-]?key|credential|jwt|session|csrf)
+        [^=:\s&;<>]{0,64}
+        \s*(?:=|:|=>)\s*["']?
+      )
+      [^&;\s<"'}]+
+    /ix
 
     # @param opts [Hash] options
     # @option opts to [String] recipient address
@@ -24,21 +39,33 @@ module HaveAPI::Extensions
 
     def enabled(server)
       HaveAPI::Action.connect_hook(:exec_exception) do |ret, context, e|
-        log(context, e)
+        safe_log(context, e)
         ret
       end
 
       server.connect_hook(:description_exception) do |ret, context, e|
-        log(context, e)
+        safe_log(context, e)
         ret
       end
+
+      server.connect_hook(:request_exception) do |ret, context, e|
+        safe_log(context, e)
+        ret
+      end
+    end
+
+    def safe_log(context, exception)
+      log(context, exception)
+    rescue StandardError => e
+      warn "HaveAPI::Extensions::ExceptionMailer failed: #{e.class}: #{e.message}"
     end
 
     def log(context, exception)
-      req = context.request.request
-      path = (req.script_name + req.path_info).squeeze('/')
+      request_context = context&.request
+      req = request_context.respond_to?(:request) ? request_context.request : request_context
+      path = request_path(context, req)
 
-      frames = exception.backtrace.map do |line|
+      frames = Array(exception.backtrace).map do |line|
         frame = Frame.new
 
         next unless line =~ /(.*?):(\d+)(:in `(.*)')?/
@@ -57,14 +84,21 @@ module HaveAPI::Extensions
 
         frame
       end.compact
+      frames = [Frame.new('(unknown)', 0, nil, nil)] if frames.empty?
 
-      env = context.request.env
+      args = redact(context&.args)
+      path_params = redact(context&.path_params)
+      input = redact(context&.input)
+      get = request_params(req, :GET)
+      post = request_params(req, :POST)
+      cookies = request_cookies(req)
+      env = redact(request_env(request_context, req))
 
       user =
-        if context.current_user.respond_to?(:id)
+        if context&.current_user.respond_to?(:id)
           context.current_user.id
         else
-          context.current_user
+          context&.current_user
         end
 
       mail(context, exception, TEMPLATE.result(binding))
@@ -114,6 +148,91 @@ module HaveAPI::Extensions
       end
     end
 
+    def request_path(context, req)
+      if req.respond_to?(:script_name) && req.respond_to?(:path_info)
+        return filter_query_string((req.script_name + req.path_info).squeeze('/'))
+      end
+
+      filter_query_string(
+        if context.respond_to?(:resolved_path)
+          context.resolved_path
+        elsif context.respond_to?(:path)
+          context.path
+        else
+          '(unknown)'
+        end
+      )
+    end
+
+    def request_env(request_context, req)
+      if request_context.respond_to?(:env)
+        request_context.env
+      elsif req.respond_to?(:env)
+        req.env
+      else
+        {}
+      end
+    end
+
+    def request_params(req, method)
+      return {} unless req.respond_to?(method)
+
+      redact(req.public_send(method) || {})
+    rescue StandardError
+      {}
+    end
+
+    def request_cookies(req)
+      return {} unless req.respond_to?(:cookies)
+
+      cookies = req.cookies || {}
+
+      cookies.each_with_object({}) do |(key, _value), ret|
+        ret[key] = FILTERED_VALUE
+      end
+    rescue StandardError
+      {}
+    end
+
+    def filter_query_string(path)
+      return path unless path.respond_to?(:sub)
+
+      path.sub(/\?.*/, "?#{FILTERED_VALUE}")
+    end
+
+    def redact(value, key = nil, seen = nil)
+      return FILTERED_VALUE if sensitive_key?(key)
+
+      seen ||= {}.compare_by_identity
+
+      case value
+      when Hash
+        return value if seen.has_key?(value)
+
+        seen[value] = true
+        value.each_with_object({}) do |(inner_key, inner_value), ret|
+          ret[inner_key] = redact(inner_value, inner_key, seen)
+        end
+      when Array
+        return value if seen.has_key?(value)
+
+        seen[value] = true
+        value.map { |inner_value| redact(inner_value, nil, seen) }
+      when String
+        redact_string(value)
+      else
+        value
+      end
+    end
+
+    def sensitive_key?(key)
+      key && key.to_s.match?(SENSITIVE_KEY_PATTERN)
+    end
+
+    def redact_string(value)
+      value.gsub(SENSITIVE_STRING_PATTERN, "\\1#{FILTERED_VALUE}")
+    end
+
     TEMPLATE = ERB.new(<<~END
       <!DOCTYPE html>
       <html>
@@ -224,15 +343,15 @@ module HaveAPI::Extensions
                 </tr>
                 <tr>
                   <th>Arguments</th>
-                  <td><%=h context.args %></td>
+                  <td><%=h args %></td>
                 </tr>
                 <tr>
                   <th>Path parameters</th>
-                  <td><%=h context.path_params %></td>
+                  <td><%=h path_params %></td>
                 </tr>
                 <tr>
                   <th>Input</th>
-                  <td><%=h context.input %></td>
+                  <td><%=h input %></td>
                 </tr>
                 <tr>
                   <th>User</th>
@@ -269,13 +388,13 @@ module HaveAPI::Extensions
             </div> <!-- /BACKTRACE -->
             <div id="get">
               <h3 id="get-info">GET</h3>
-              <% if req.GET and not req.GET.empty? %>
+              <% if !get.empty? %>
                 <table class="req">
                   <tr>
                     <th>Variable</th>
                     <th>Value</th>
                   </tr>
-                  <% req.GET.sort_by { |k, v| k.to_s }.each { |key, val| %>
+                  <% get.sort_by { |k, v| k.to_s }.each { |key, val| %>
                   <tr>
                     <td><%=h key %></td>
                     <td class="code"><div><%=h val.inspect %></div></td>
@@ -289,13 +408,13 @@ module HaveAPI::Extensions
             </div> <!-- /GET -->
             <div id="post">
               <h3 id="post-info">POST</h3>
-              <% if req.POST and not req.POST.empty? %>
+              <% if !post.empty? %>
                 <table class="req">
                   <tr>
                     <th>Variable</th>
                     <th>Value</th>
                   </tr>
-                  <% req.POST.sort_by { |k, v| k.to_s }.each { |key, val| %>
+                  <% post.sort_by { |k, v| k.to_s }.each { |key, val| %>
                   <tr>
                     <td><%=h key %></td>
                     <td class="code"><div><%=h val.inspect %></div></td>
@@ -309,13 +428,13 @@ module HaveAPI::Extensions
             </div> <!-- /POST -->
             <div id="cookies">
               <h3 id="cookie-info">COOKIES</h3>
-              <% unless req.cookies.empty? %>
+              <% unless cookies.empty? %>
                 <table class="req">
                   <tr>
                     <th>Variable</th>
                     <th>Value</th>
                   </tr>
-                  <% req.cookies.each { |key, val| %>
+                  <% cookies.each { |key, val| %>
                     <tr>
                       <td><%=h key %></td>
                       <td class="code"><div><%=h val.inspect %></div></td>

data/lib/haveapi/server.rb

@@ -45,6 +45,17 @@ module HaveAPI
                message: 'error message sent to the client'
              }
 
+    has_hook :request_exception,
+             desc: 'Called when an exception occurs outside action execution',
+             args: {
+               context: 'HaveAPI::Context',
+               exception: 'exception instance'
+             },
+             ret: {
+               http_status: 'HTTP status code to send to client',
+               message: 'error message sent to the client'
+             }
+
     module ServerHelpers
       def setup_formatter
         return if @formatter
@@ -137,6 +148,32 @@ module HaveAPI
         halt code, headers, @formatter.format(false, nil, msg, version: false)
       end
 
+      def report_exception(exception, context = nil)
+        context ||= Context.new(
+          settings.api_server,
+          request: self,
+          params:,
+          endpoint: true
+        )
+
+        tmp =
+          begin
+            settings.api_server.call_hooks_for(
+              :request_exception,
+              args: [context, exception]
+            )
+          rescue StandardError => e
+            warn "HaveAPI request exception hook failed: #{e.class}: #{e.message}"
+            {}
+          end
+
+        report_error(
+          tmp[:http_status] || 500,
+          {},
+          tmp[:message] || 'Server error occurred'
+        )
+      end
+
       def root
         settings.api_server.root
       end
@@ -295,6 +332,10 @@ module HaveAPI
           report_error(404, {}, 'Action not found') unless @halted
         end
 
+        error do
+          report_exception(env['sinatra.error'])
+        end
+
         after do
           if Object.const_defined?(:ActiveRecord)
             ActiveRecord::Base.connection_handler.clear_active_connections!
@@ -528,113 +569,125 @@ module HaveAPI
 
     def mount_action(v, route)
       @sinatra.method(route.http_method).call(route.sinatra_path) do
-        setup_formatter
+        context = nil
 
-        if route.action.auth || settings.api_server.action_state_auth_required?(route)
-          authenticate!(v)
-        else
-          authenticated?(v)
-        end
+        begin
+          setup_formatter
 
-        raw_body = request.body.read
-        body_method = !%i[get head options].include?(route.http_method.to_sym)
+          if route.action.auth || settings.api_server.action_state_auth_required?(route)
+            authenticate!(v)
+          else
+            authenticated?(v)
+          end
 
-        if body_method && !raw_body.empty? && !settings.api_server.send(:json_content_type?, request)
-          report_error(415, {}, 'Unsupported Content-Type')
-        end
+          raw_body = request.body ? request.body.read : ''
+          body_method = !%i[get head options].include?(route.http_method.to_sym)
 
-        begin
-          body = raw_body.empty? ? nil : JSON.parse(raw_body)
-        rescue JSON::ParserError
-          report_error(400, {}, 'Bad JSON syntax')
-        end
+          if body_method && !raw_body.empty? && !settings.api_server.send(:json_content_type?, request)
+            report_error(415, {}, 'Unsupported Content-Type')
+          end
 
-        if !raw_body.empty? && !body.is_a?(Hash)
-          report_error(400, {}, 'JSON body must be an object')
-        end
+          begin
+            body = raw_body.empty? ? nil : JSON.parse(raw_body)
+          rescue JSON::ParserError
+            report_error(400, {}, 'Bad JSON syntax')
+          end
 
-        action_params = settings.api_server.send(:path_params, route, params)
-        action_input = body_method ? (body || {}) : request.GET
+          if !raw_body.empty? && !body.is_a?(Hash)
+            report_error(400, {}, 'JSON body must be an object')
+          end
 
-        context = Context.new(
-          settings.api_server,
-          version: v,
-          request: self,
-          action: route.action,
-          path: route.path,
-          path_params: action_params,
-          input: action_input,
-          user: current_user,
-          endpoint: true,
-          resource_path: route.resource_path
-        )
+          action_params = settings.api_server.send(:path_params, route, params)
+          action_input = body_method ? (body || {}) : request.GET
+
+          context = Context.new(
+            settings.api_server,
+            version: v,
+            request: self,
+            action: route.action,
+            path: route.path,
+            path_params: action_params,
+            input: action_input,
+            user: current_user,
+            endpoint: true,
+            resource_path: route.resource_path
+          )
 
-        action = route.action.new(request, v, action_params, action_input, context)
+          action = route.action.new(request, v, action_params, action_input, context)
 
-        unless action.authorized?(current_user)
-          report_error(403, {}, 'Access denied. Insufficient permissions.')
-        end
+          unless action.authorized?(current_user)
+            report_error(403, {}, 'Access denied. Insufficient permissions.')
+          end
 
-        status, reply, errors, http_status = action.safe_exec
-        @halted = true
+          status, reply, errors, http_status = action.safe_exec
+          @halted = true
 
-        [
-          http_status || 200,
-          @formatter.format(
-            status,
-            status ? reply : nil,
-            status ? nil : reply,
-            errors,
-            version: false
-          )
-        ]
+          [
+            http_status || 200,
+            @formatter.format(
+              status,
+              status ? reply : nil,
+              status ? nil : reply,
+              errors,
+              version: false
+            )
+          ]
+        rescue Exception => e # rubocop:disable Lint/RescueException
+          report_exception(e, context)
+        end
       end
 
       @sinatra.options route.sinatra_path do |*args|
-        setup_formatter
-        access_control
-        route_method = route.http_method.to_s.upcase
+        ctx = nil
 
-        pass if params[:method] && params[:method] != route_method
+        begin
+          setup_formatter
+          access_control
+          route_method = route.http_method.to_s.upcase
 
-        if route.action.auth || settings.api_server.action_state_auth_required?(route)
-          authenticate!(v)
-        else
-          authenticated?(v)
-        end
+          pass if params[:method] && params[:method] != route_method
 
-        ctx = Context.new(
-          settings.api_server,
-          version: v,
-          request: self,
-          action: route.action,
-          path: route.path,
-          args:,
-          params:,
-          user: current_user,
-          endpoint: true,
-          resource_path: route.resource_path,
-          doc: true
-        )
+          if route.action.auth || settings.api_server.action_state_auth_required?(route)
+            authenticate!(v)
+          else
+            authenticated?(v)
+          end
 
-        begin
-          desc = route.action.describe(ctx)
+          ctx = Context.new(
+            settings.api_server,
+            version: v,
+            request: self,
+            action: route.action,
+            path: route.path,
+            args:,
+            params:,
+            user: current_user,
+            endpoint: true,
+            resource_path: route.resource_path,
+            doc: true
+          )
 
-          unless desc
-            report_error(403, {}, 'Access denied. Insufficient permissions.')
+          begin
+            desc = route.action.describe(ctx)
+
+            unless desc
+              report_error(403, {}, 'Access denied. Insufficient permissions.')
+            end
+          rescue ValidationError => e
+            report_error(400, e.to_hash, e.message)
+          rescue StandardError => e
+            tmp = settings.api_server.call_hooks_for(:description_exception, args: [ctx, e])
+            report_error(
+              tmp[:http_status] || 500,
+              {},
+              tmp[:message] || 'Server error occured'
+            )
           end
-        rescue ValidationError => e
-          report_error(400, e.to_hash, e.message)
-        rescue StandardError => e
-          tmp = settings.api_server.call_hooks_for(:description_exception, args: [ctx, e])
-          report_error(
-            tmp[:http_status] || 500,
-            {},
-            tmp[:message] || 'Server error occured'
-          )
-        end
 
-        @formatter.format(true, desc)
+          @formatter.format(true, desc)
+        rescue Exception => e # rubocop:disable Lint/RescueException
+          report_exception(e, ctx)
+        end
       end
     end
 

data/lib/haveapi/version.rb

@@ -1,4 +1,4 @@
 module HaveAPI
   PROTOCOL_VERSION = '2.0'.freeze
-  VERSION = '0.28.3'.freeze
+  VERSION = '0.28.4'.freeze
 end