honey_pot_engine 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 9356e9d220987df822a501a622944843a02cb789d9cdd31fab8b884f9d730b75
+  data.tar.gz: f24de1cde9b7b725952383e6236dfc8784cc4343ba15948ae555112fadc2e1c3
+SHA512:
+  metadata.gz: 35d59ae3e20c3d1ee360ffd08b633312d37419f746c070dba184ee94b99711b0985b2d34c939326456d449e7ba3a05e089550c29cec4d015dd3726feb8af57fb
+  data.tar.gz: 2402792af2abd584bd822b5c8fb1f1f981dfba2660776ce6e100d45793ca272158f0cd48e5804d70b8ec51c5f829a7628f636f22d2e535a05dca532c5ca509cf

data/README.md

@@ -0,0 +1,28 @@
+# HoneyPotEngine
+An engine for deploying honeypots in Rails applications.
+
+## Usage
+How to use my plugin.
+
+## Installation
+Add this line to your application's Gemfile:
+
+```ruby
+gem "honey_pot_engine"
+```
+
+And then execute:
+```bash
+$ bundle
+```
+
+Or install it yourself as:
+```bash
+$ gem install honey_pot_engine
+```
+
+## Contributing
+Contribution directions go here.
+
+## License
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,8 @@
+require "bundler/setup"
+
+APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
+load "rails/tasks/engine.rake"
+
+load "rails/tasks/statistics.rake"
+
+require "bundler/gem_tasks"

data/app/views/errors/forbidden.html.erb

@@ -0,0 +1,2 @@
+<h1><%= t('honey_pot_engine.errors.forbidden.title', default: '403 Forbidden') %></h1>
+<p><%= t('honey_pot_engine.errors.forbidden.message', default: 'Suspicious submission detected.') %></p>

data/lib/honey_pot_engine/controller_guard.rb

@@ -0,0 +1,34 @@
+module HoneyPotEngine
+  module ControllerGuard
+    extend ActiveSupport::Concern
+
+    def self.prepended(base)
+      # prepend の時点でクラスに特異メソッドを定義
+      base.class_eval do
+        @skip_honeypot_check = false
+
+        def self.skip_honeypot!
+          @skip_honeypot_check = true
+        end
+
+        def self.honeypot_skipped?
+          @skip_honeypot_check == true
+        end
+      end
+
+      base.before_action :check_honeypot
+    end
+    
+    private
+
+    # ハニーポットフィールドに値が入っていたら bot と判断してブロック
+    def check_honeypot
+      return if self.class.honeypot_skipped?
+      if params[:honeypot].present?
+        Rails.logger.warn "[HONEYPOT] Blocked spam submission: #{request.remote_ip}"
+        # head :forbidden
+        render template: "errors/forbidden", status: :forbidden
+      end
+    end
+  end
+end

data/lib/honey_pot_engine/engine.rb

@@ -0,0 +1,18 @@
+module HoneyPotEngine
+  class Engine < ::Rails::Engine
+    isolate_namespace HoneyPotEngine
+    initializer "honey_pot_engine.auto_guard" do
+      ActiveSupport.on_load(:action_controller) do
+        require_relative "controller_guard"
+        ActionController::Base.prepend(HoneyPotEngine::ControllerGuard)
+      end
+    end
+
+    initializer "honey_pot_engine.inject_form_hook" do
+      ActiveSupport.on_load(:action_view) do
+        require_relative "form_injector"  # 相対パスでもOK
+        ActionView::Base.prepend(HoneyPotEngine::FormInjector)
+      end
+    end
+  end
+end

data/lib/honey_pot_engine/form_injector.rb

@@ -0,0 +1,38 @@
+module HoneyPotEngine
+  module FormInjector
+    # Railsのform_withをオーバーライドし、最初に隠しフィールドを挿入
+    def form_with(**options, &block)
+      super(**options) do |form|
+        concat hidden_honeypot_field
+        block.call(form)
+      end
+    end
+
+    # Railsのform_forにも同様の拡張を適用（レガシー対応用）
+    def form_for(record, options = {}, &block)
+      super(record, options) do |form|
+        concat hidden_honeypot_field
+        block.call(form)
+      end
+    end
+
+    # form_tag（非モデルベース）に対してもハニーポットを自動挿入
+    def form_tag(url_for_options = {}, options = {}, &block)
+      super(url_for_options, options) do
+        concat hidden_honeypot_field
+        block.call
+      end
+    end
+
+    private
+    def hidden_honeypot_field
+      # このコントローラが honeypot チェックをスキップする設定になっている場合は、入力フィールドも出力しない
+      # controller.class は現在のビューをレンダリングしているコントローラクラス
+      # respond_to? によってメソッド存在確認を行い、安全に動作させる
+      return "".html_safe if controller.class.respond_to?(:honeypot_skipped?) && controller.class.honeypot_skipped?
+
+      # ボットによる自動入力を検知するためのハニーポットフィールドを出力
+      tag.input type: "text", name: "honeypot", style: "display:none", autocomplete: "off"
+    end
+  end
+end

data/lib/honey_pot_engine/version.rb

@@ -0,0 +1,3 @@
+module HoneyPotEngine
+  VERSION = "0.1.0"
+end

data/lib/honey_pot_engine.rb

@@ -0,0 +1,6 @@
+require "honey_pot_engine/version"
+require "honey_pot_engine/engine"
+
+module HoneyPotEngine
+  # Your code goes here...
+end

metadata

@@ -0,0 +1,68 @@
+--- !ruby/object:Gem::Specification
+name: honey_pot_engine
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- teratai3
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2025-06-01 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 8.0.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 8.0.2
+description: A lightweight Rails engine that inserts honeypot fields into forms and
+  automatically blocks spammy submissions.
+email:
+- ''
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- Rakefile
+- app/views/errors/forbidden.html.erb
+- lib/honey_pot_engine.rb
+- lib/honey_pot_engine/controller_guard.rb
+- lib/honey_pot_engine/engine.rb
+- lib/honey_pot_engine/form_injector.rb
+- lib/honey_pot_engine/version.rb
+homepage: https://github.com/teratai3/honey_pot_engine
+licenses: []
+metadata:
+  homepage_uri: https://github.com/teratai3/honey_pot_engine
+  source_code_uri: https://github.com/teratai3/honey_pot_engine
+  changelog_uri: https://github.com/teratai3/honey_pot_engine
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.19
+signing_key:
+specification_version: 4
+summary: Honeypot anti-spam field for Rails forms
+test_files: []