immunio 1.0.7 → 1.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 80267dd0327d92f9af47b91f658a46a3e38cd000
-  data.tar.gz: be17e29bba57536a8d8cdb5a35134cfe64977510
+  metadata.gz: 99a30833d9388d3c2cf12a21d209c81983f69958
+  data.tar.gz: be529e5b823a1f0db90a4d058ba2af2f5327d2fb
 SHA512:
-  metadata.gz: 26355aaa28340307c3a6766ddda207e67484d6e9b0f33601d229660338d1e7becffc3e6140092fd0a10ed7d0bc2d0b3c5f494aaf29fd8e61f66759ac1eb62463
-  data.tar.gz: 218fbac35d91313ebf8dec8ca81cb1be22b05b8b388b79294db8e1750a1ce6f193da04a305b304dcf99544d27e4b503d28af074d98c05f3fed8ee4feafad0b35
+  metadata.gz: 581d82074c288618bec64dd899fde256d601d2703d3da32f86436cc92e1e53545cd209935bcc3989f2d895171b2401f5705795149c4680972daa91a0b353b660
+  data.tar.gz: 8b226690a97a6984025d96c57d3322d5c6790fe9fde2723ba690946be942dab9349ab3595f4c25ad0984df4790bc3c177b8a8681985c4ae149c67a6d43598d55

data/lib/immunio/plugins/action_view.rb

@@ -131,7 +131,7 @@ module Immunio
           return content.html_safe
         end
 
-        "{immunio-var:#{id}:#{nonce}}".html_safe + content.html_safe + "{/immunio-var:#{id}:#{nonce}}".html_safe
+        "{immunio-var:#{id}:#{nonce}}".html_safe + content.to_s.html_safe + "{/immunio-var:#{id}:#{nonce}}".html_safe
       end
 
       # If we got here, the interpolation has been wrapped in our markers and we
@@ -160,7 +160,7 @@ module Immunio
       # Don't handle templates with no source (inline text templates).
       unless has_source?
         rendered = yield
-        rendered.instance_variable_set("@__immunio_processed", true)
+        rendered.instance_variable_set("@__immunio_processed", true) unless rendered.frozen?
         return rendered
       end
 
@@ -172,14 +172,18 @@ module Immunio
         template_sha
         Immunio.logger.debug {"ActionView rendering template with sha #{@template_sha}, root: #{root}"}
         rendered = yield
-        rendered.instance_variable_set("@__immunio_processed", true)
+        rendered.instance_variable_set("@__immunio_processed", true) unless rendered.frozen?
 
         if root
           # This is the root template. Let ActionView render it, and then look
           # for XSS.
           rendered = rendered.to_str
-          # Rendering done!
-          result = run_hook! "template_render_done", rendered: rendered, vars: @vars
+
+          result = run_hook!("template_render_done", {
+            content_type: Mime::Type.lookup_by_extension(@template.formats.first).to_s,
+            rendered: rendered,
+            vars: @vars
+          })
 
           # We use the return value from the hook handler if present.
           rendered = result.fetch("rendered") { rendered.dup }

data/lib/immunio/plugins/warden.rb

@@ -6,72 +6,64 @@ rescue LoadError # rubocop:disable Lint/HandleExceptions
   # Ignore
 end
 
-if defined?(Warden)
-  Warden::Manager.after_authentication do |user|
-    Immunio::Request.time "plugin", "Warden::Manager.after_authentication" do
-      Immunio.logger.debug { "Warden instrumentation fired for after_authentication" }
-      Immunio.login user_record: user, plugin: "warden"
+if defined?(Warden::Manager)
+  class Warden::Manager
+    after_authentication do |user|
+      Immunio::Request.time "plugin", "Warden::Manager.after_authentication" do
+        Immunio.logger.debug { "Warden instrumentation fired for after_authentication" }
+        Immunio.login user_record: user, plugin: "warden"
+      end
     end
-  end
 
-  Warden::Manager.before_failure do |env|
-    Immunio::Request.time "plugin", "Warden::Manager.before_failure" do
-      info = {plugin: "warden"}
+    before_failure do |env|
+      Immunio::Request.time "plugin", "Warden::Manager.before_failure" do
+        info = {plugin: "warden"}
 
-      # Devise uses these specific form fields for authentication by default
-      user_found = false
-      [:username, :email].each do |attr|
-        value = env.fetch("rack.request.form_hash", {}).fetch("user", {})[attr.to_s]
-        if value
-          info[attr] = value
-          user_found = true
+        # Devise uses these specific form fields for authentication by default
+        user_found = false
+        [:username, :email].each do |attr|
+          value = env.fetch("rack.request.form_hash", {}).fetch("user", {})[attr.to_s]
+          if value
+            info[attr] = value
+            user_found = true
+          end
         end
-      end
 
-      # before_failure is called under many circumstances, but unfortunately
-      # there's no easy way to tell why. If we can't figure out who the
-      # attempted user was, don't report it as a failed login.
-      if user_found
-        Immunio.logger.debug { "Warden instrumentation fired for before_failure" }
-        Immunio.failed_login info
-      else
-        Immunio.logger.debug { "Failed to find user info for Warden failure, ignoring instead of reporting as failed login" }
+        # before_failure is called under many circumstances, but unfortunately
+        # there's no easy way to tell why. If we can't figure out who the
+        # attempted user was, don't report it as a failed login.
+        if user_found
+          Immunio.logger.debug { "Warden instrumentation fired for before_failure" }
+          Immunio.failed_login info
+        else
+          Immunio.logger.debug { "Failed to find user info for Warden failure, ignoring instead of reporting as failed login" }
+        end
       end
     end
-  end
-
-  Warden::Manager.after_set_user do |user|
-    Immunio::Request.time "plugin", "Warden::Manager.after_set_user" do
-      Immunio.logger.debug { "Warden instrumentation fired for after_set_user" }
-      Immunio.set_user user_record: user, plugin: "warden"
-    end
-  end
 
-  Warden::Manager.before_logout do |user|
-    Immunio::Request.time "plugin", "Warden::Manager.before_logout" do
-      Immunio.logger.debug { "Warden instrumentation fired for before_logout" }
-      Immunio.logout user_record: user, plugin: "warden"
+    after_set_user do |user|
+      Immunio::Request.time "plugin", "Warden::Manager.after_set_user" do
+        Immunio.logger.debug { "Warden instrumentation fired for after_set_user" }
+        Immunio.set_user user_record: user, plugin: "warden"
+      end
     end
-  end
 
-  # Force lookup of user info for all requests.
-  module Immunio
-    class WardenUserCaller
-      def initialize(app)
-        @app = app
+    before_logout do |user|
+      Immunio::Request.time "plugin", "Warden::Manager.before_logout" do
+        Immunio.logger.debug { "Warden instrumentation fired for before_logout" }
+        Immunio.logout user_record: user, plugin: "warden"
       end
+    end
 
-      def call(env)
-        Request.time "plugin", "#{Module.nesting[0]}::#{__method__}" do
-          # This will end up calling Warden::Manager.after_set_user above if
-          # a valid session associated with a user is seen.
-          env['warden'].user
-
-          Request.pause "plugin", "#{Module.nesting[0]}::#{__method__}" do
-            @app.call(env)
-          end
-        end
-      end
+    # Force lookup of user info for all requests.
+    def call_with_immunio(env)
+       call_without_immunio(env)
+     ensure
+       Immunio::Request.time "plugin", "#{Module.nesting[0]}::#{__method__}" do
+         env['warden'].user
+       end
     end
+    alias :call_without_immunio :call
+    alias :call :call_with_immunio
   end
 end

data/lib/immunio/rails.rb

@@ -10,7 +10,6 @@ module Immunio
     config.app_middleware.insert 0, HTTPFinisher
     config.app_middleware.insert_before ActionDispatch::ShowExceptions, HTTPTracker
     config.app_middleware.insert_after ActionDispatch::DebugExceptions, ExceptionHandler
-    config.app_middleware.insert_after Warden::Manager, WardenUserCaller if defined? Warden::Manager
     config.app_middleware.use EnvironmentReporter
 
     config.action_dispatch.rescue_responses.merge!('Immunio::RequestBlocked' => :forbidden)

data/lib/immunio/version.rb

@@ -1,5 +1,5 @@
 module Immunio
   AGENT_TYPE = "agent-ruby"
-  VERSION = "1.0.7"
+  VERSION = "1.0.8"
   VM_VERSION = "2.2.0"
 end

data/lua-hooks/Makefile

@@ -43,6 +43,7 @@ LUA_SRC = \
 	lib/hooks/authenticate.lua \
 	lib/hooks/bad_cookie.lua \
 	lib/hooks/custom_threat.lua \
+	lib/hooks/encode.lua \
 	lib/hooks/eval.lua \
 	lib/hooks/exception.lua \
 	lib/hooks/file_io.lua \

data/lua-hooks/lib/boot.lua

@@ -9,6 +9,7 @@ serverdata = serverdata or {}
 -- XXX Java agent has built in assumption that this function exists before VM
 -- initialisation.
 -- Encode a Lua object to be sent to the server.
+-- This can be removed when Java agent has moved to new VM API
 function encode(object)
   return cmsgpack.pack(object)
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: immunio
 version: !ruby/object:Gem::Version
-  version: 1.0.7
+  version: 1.0.8
 platform: ruby
 authors:
 - Immunio
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-12-14 00:00:00.000000000 Z
+date: 2015-12-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails