immunio 1.1.19 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f0cf95fe27e81261056bdc9388cb78021e3f3e33
-  data.tar.gz: 91d07872cd32dbc236299020a62337c1296691ce
+  metadata.gz: c287a47d42c9475ecbae55e00ff6c4e14cd45e4f
+  data.tar.gz: 89925d6f6c506a1a42a3a64c9f6f290ab5e1fb46
 SHA512:
-  metadata.gz: c4d6a75b2a7d974ccd9cfc3e3e7c6744f72330ae6f4f23c926021ba002635a4bf807b32e8b15be17c39a70d3cba90a4f4da67c4ab003c70b466e7240b152e9e8
-  data.tar.gz: fd8e3009626ddbb2a97b1b72ce542f37f5df6d6b7f59f291738de125ec6c8ee312926791dbcf5eda634198a718ca6f107a0daf1f5e771322c23d054950f0d13a
+  metadata.gz: cac6affff43c65bccfcd448958b350a4690af6de096c6f43d5d240ad352bc62e4521d5f7c5a023ec68b9a5867be9d8a00ef3297d4460441be7a37dcc2f95f547
+  data.tar.gz: 59d721edc0ed0d570574aa9e328b57744b76d42d89a1ba96966460739359b2bcc96254a21302b9f6c4880565e4830277aa024e78374b2a902da66e5a21e9c7a4

data/lib/immunio/plugins/action_dispatch.rb

@@ -58,6 +58,7 @@ module Immunio
     #   hash: { foo: ['bar', 'baz'] }
     #     -> 'hash[foo]' => ['bar', 'baz']
     #
+    # A complex form like:
     #   user: {
     #     name: 'john',
     #     email: 'john@example.com',
@@ -75,38 +76,66 @@ module Immunio
     #   'user[address_attributes][city]' => ['Montreal'],
     #   'user[address_attributes][id]' => ['1']
     #
+    #
+    # A malicious payload like:
+    #
+    # "evil" =>
+    # {
+    #   "payload" =>
+    #   [
+    #     {
+    #       "lurks" =>
+    #       [
+    #         {
+    #           "here" =>
+    #           [
+    #             {"indeed" => "1" }
+    #           ]
+    #         }
+    #       ]
+    #     }
+    #   ]
+    # }
+    #
+    # becomes:
+    #
+    # "evil[payload]" => ["{\"lurks\"=>[{\"here\"=>[{\"indeed\"=>\"1\"}]}]}"]
+    #
     def convert_value(hash, key, value, nested_keys = nil)
       # Filter out UploadedFile.
       unless value.respond_to?(:open)
         if value.respond_to?(:keys)
-          nested = nested_keys ? nested_keys : "#{key}"
+          nested = nested_keys ? nested_keys : key
           value.each do |k, val|
             if val.respond_to?(:keys)
               convert_value(hash, k, val, nested + "[#{k}]")
             else
-              hash["#{nested}[#{k}]"] = [val].flatten
+              hash["#{nested}[#{k}]"] = [val].flatten.map(&:to_s)
             end
           end
         else
-          hash[key] = [value].flatten
+          hash[key] = [value].flatten.map(&:to_s)
         end
       end
     end
 
     def request_parameters_with_immunio
       params = request_parameters_without_immunio
-
       Request.time 'plugin', "#{Module.nesting[0]}::#{__method__}" do
         if params.any?
           filtered = {}.tap do |hash|
             params.each do |key, value|
-              convert_value(hash, key, value)
+              # Ensure top-level keys are strings
+              k = key.is_a?(String) ? key : key.to_s
+              convert_value(hash, k, value)
             end
           end
+
           Immunio.run_hook!(
             'action_dispatch',
             'framework_input_params',
-            params: filtered)
+            params: filtered
+          )
         end
       end
 

data/lib/immunio/plugins/active_record.rb

@@ -600,9 +600,24 @@ module Immunio
       @relation_data[relation_id][:ast_data] << "Arel AST visited node: #{ast_node_name}"
     end
 
+    # Adapter name / db_dialect
+    DIALECTS = {
+      sqlite: 'sqlite3',
+      postgres: 'postgres',
+      mysql: 'mysql',
+      mysql2: 'mysql',
+      ibm_db: 'db2',
+      oracle: 'oracle',
+      oracleenhanced: 'oracle',
+    }.freeze
+
+    def db_dialect(adapter_name)
+      DIALECTS.fetch(adapter_name.downcase.to_sym, 'unknown')
+    end
+
     # Evaluate a SQL call. This occurs after Arel AST conversion of a relation
     # to a statement.
-    def call(payload)
+    def call(payload, adapter_name)
       Request.time "plugin", "#{Module.nesting[0]}::#{__method__}" do
         # The #{payload} in the log string is causing lots of Rails 3.2
         # upstream test failures with Ruby 1.9.3.
@@ -659,6 +674,7 @@ module Immunio
                           "sql_execute",
                           sql: payload[:sql],
                           connection_uuid: connection_id.to_s,
+                          db_dialect: db_dialect(adapter_name),
                           params: params,
                           modifiers: modifiers,
                           context_key: strict_context,
@@ -703,9 +719,12 @@ module Immunio
     def log_with_immunio(sql, name = "SQL", binds = [], *args)
       # Some rails tests (in particular postresql) call :log with nil `sql`.
       QueryTracker.instance.call(
-        sql: sql,
-        connection_id: object_id,
-        binds: binds) if sql
+        {
+          sql: sql,
+          connection_id: object_id,
+          binds: binds
+        },
+        adapter_name) if sql
 
       # Log and execute the query
       log_without_immunio(sql, name, binds, *args) { yield }

data/lib/immunio/processor.rb

@@ -213,6 +213,7 @@ module Immunio
     # so to be on the safe side make sure we catch anything raised within the VM call --ol
     rescue StandardError => e
       # Log and discard VM errors
+      Immunio.logger.debug { request.inspect }
 
       log_and_send_error e, "Error running hook #{hook}",
                          request_id: request.id,

data/lib/immunio/version.rb

@@ -1,5 +1,5 @@
 module Immunio
   AGENT_TYPE = "agent-ruby"
-  VERSION = "1.1.19"
+  VERSION = "1.2.1"
   VM_VERSION = "2.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: immunio
 version: !ruby/object:Gem::Version
-  version: 1.1.19
+  version: 1.2.1
 platform: ruby
 authors:
 - Immunio
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-31 00:00:00.000000000 Z
+date: 2017-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -438,10 +438,6 @@ files:
 - lua-hooks/ext/sysutils/lua_utils.c
 - lua-hooks/ext/sysutils/module.mk
 - lua-hooks/lib/boot.lua
-- lua-hooks/lib/hooks/module.mk
-- lua-hooks/lib/hooks/xss/module.mk
-- lua-hooks/lib/lexers/module.mk
-- lua-hooks/lib/module.mk
 - lua-hooks/options.mk
 homepage: http://immun.io/
 licenses:

data/lua-hooks/lib/hooks/module.mk

@@ -1,36 +0,0 @@
-MODULES := lib/hooks/xss
-
-
-LUA_PROTECT_SRC += \
-	lib/hooks/file_io.lua \
-	lib/hooks/framework_redirect.lua \
-	lib/hooks/template_render_done.lua \
-	lib/hooks/sql_execute.lua \
-
-LUA_BASE_SRC += \
-	lib/hooks/authenticate.lua \
-	lib/hooks/bad_cookie.lua \
-	lib/hooks/custom_event.lua \
-	lib/hooks/custom_threat.lua \
-	lib/hooks/encode.lua \
-	lib/hooks/eval.lua \
-	lib/hooks/exception.lua \
-	lib/hooks/framework_csrf_check.lua \
-	lib/hooks/framework_login.lua \
-	lib/hooks/framework_password_reset.lua \
-	lib/hooks/framework_account_created.lua \
-	lib/hooks/framework_session.lua \
-	lib/hooks/framework_user.lua \
-	lib/hooks/framework_route.lua \
-	lib/hooks/framework_bad_response_header.lua \
-	lib/hooks/framework_input_params.lua \
-	lib/hooks/get_telemetry_config.lua \
-	lib/hooks/headers/header_validation.lua \
-	lib/hooks/headers/useragent.lua \
-	lib/hooks/http_request_finish.lua \
-	lib/hooks/http_request_start.lua \
-	lib/hooks/http_response_start.lua \
-	lib/hooks/mongodb_execute.lua \
-	lib/hooks/should_report.lua \
-
-include $(patsubst %, %/module.mk,$(MODULES))

data/lua-hooks/lib/hooks/xss/module.mk

@@ -1,4 +0,0 @@
-LUA_PROTECT_SRC += \
-	lib/hooks/xss/escape.lua \
-	lib/hooks/xss/escape_js.lua \
-	lib/hooks/xss/html_const.lua

data/lua-hooks/lib/lexers/module.mk

@@ -1,9 +0,0 @@
-LUA_BASE_SRC += \
-	lib/lexers/bash.lua \
-	lib/lexers/css_attr.lua \
-	lib/lexers/css.lua \
-	lib/lexers/html.lua \
-	lib/lexers/html_entities.lua \
-	lib/lexers/html_entities_ws.lua \
-	lib/lexers/javascript.lua \
-	lib/lexers/markers.lua

data/lua-hooks/lib/module.mk

@@ -1,42 +0,0 @@
-MODULES := lib/hooks lib/lexers
-
-LUA_BASE_SRC += \
-	lib/base64.lua \
-	lib/bit.lua \
-	lib/cookie.lua \
-	lib/counters.lua \
-	lib/DataDumper.lua \
-	lib/date.lua \
-	lib/defence.lua \
-	lib/diag.lua \
-	lib/dkjson.lua \
-	lib/extensions.lua \
-	lib/globtopattern.lua \
-	lib/hkdf.lua \
-	lib/hmac.lua \
-	lib/hooks.lua \
-	lib/idn.lua \
-	lib/immunio-schemas/immunio_schemas/schemas/request_schema.lua \
-	lib/immunio-schemas/immunio_schemas/schemas/validation.lua \
-	lib/ip.lua \
-	lib/learn.lua \
-	lib/lexgraph.lua \
-	lib/lexer.lua \
-	lib/lru.lua \
-	lib/neturl.lua \
-	lib/pathname.lua \
-	lib/perf.lua \
-	lib/permit.lua \
-	lib/profiler.lua \
-	lib/real_ip.lua \
-	lib/sanitize_sql.lua \
-	lib/sanitize_command.lua \
-	lib/semver.lua \
-	lib/sha1.lua \
-	lib/snap.lua \
-	lib/term.lua \
-	lib/tracking.lua \
-	lib/utils.lua \
-	lib/verb_tamper.lua
-
-include $(patsubst %, %/module.mk,$(MODULES))