immunio 1.1.2 → 1.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 877a290ccd60b4a6e46fff24968cd223fae6ac56
-  data.tar.gz: 5e4c68c451a27e7de6590499dd427485d05ab577
+  metadata.gz: 1892a99bb27797888c8589ad7404d94c8bff8d92
+  data.tar.gz: b278c5b969f0431650d241b0a26499513a469b3a
 SHA512:
-  metadata.gz: 88c2d9d8c86bd24fa028e1c092524617f3bbc2e271f3fae53c50c8ae45f3ab6d5b1f5b8c1846be8fa7ede95441121426355b5960ed174269712a14f06883c9e6
-  data.tar.gz: 7a7bdc7a6cc3d85f5f226a8017061d22dda0bd9f9a6aeaae146f5f8df80b6f8d1e79b533bba2525e2ce8b245ebf52d9cb85e46d3221af0107b427114c1f421ea
+  metadata.gz: 177fe3c9024f2bc8ac4451eb8913c6c7c9c54a32592b2f33aa19d17eaf14c747786b1f180d22d56e8600f91186a840d6c2077e608336585b1d70538769ccbf15
+  data.tar.gz: 86adfa4ca69c87354f8d8d6bbc01d01d78c98958b3bd9e0ada2d406e95a70489c5e722c42a730ed65848ea0fda4a1882b1090b91e08c8733291f91f4b77ad878

data/lib/immunio/version.rb

@@ -1,5 +1,5 @@
 module Immunio
   AGENT_TYPE = "agent-ruby"
-  VERSION = "1.1.2"
+  VERSION = "1.1.5"
   VM_VERSION = "2.2.0"
 end

data/lua-hooks/Makefile

@@ -1,93 +1,44 @@
-CROSS =
-CC = $(CROSS)cc
-AR = $(CROSS)ar
+MODULES := lib ext
 
 # Source of extensions compiled w/ Lua's source.
 # Only include .c files that can't be directly included in ext/all.c.
-SRC = \
-	ext/all.c \
-	ext/libinjection/libinjection_html5.c \
-	ext/libinjection/libinjection_xss.c \
-	ext/libinjection/libinjection_sqli.c \
-	ext/lpeg/lpcap.c \
-	ext/lpeg/lpcode.c \
-	ext/lpeg/lpprint.c \
-	ext/lpeg/lpvm.c
-
-LUA_SRC = \
-	lib/cookie.lua \
-	lib/DataDumper.lua \
-	lib/date.lua \
-	lib/defence.lua \
-	lib/diag.lua \
-	lib/extensions.lua \
-	lib/hmac.lua \
-	lib/hooks.lua \
-	lib/idn.lua \
-	lib/lexgraph.lua \
-	lib/lru.lua \
-	lib/neturl.lua \
-	lib/paths.lua \
-	lib/perf.lua \
-	lib/permit.lua \
-	lib/real_ip.lua \
-	lib/sanitize_sql.lua \
-	lib/sanitize_command.lua \
-	lib/semver.lua \
-	lib/sha1.lua \
-	lib/snap.lua \
-	lib/term.lua \
-	lib/utils.lua \
-	lib/lexers/bash_dqstr.lua \
-	lib/lexers/bash.lua \
-	lib/lexers/css_attr.lua \
-	lib/lexers/css.lua \
-	lib/lexers/html.lua \
-	lib/lexers/javascript.lua \
-	lib/lexers/markers.lua \
-	lib/lexer.lua \
-	lib/hooks/authenticate.lua \
-	lib/hooks/bad_cookie.lua \
-	lib/hooks/custom_threat.lua \
-	lib/hooks/encode.lua \
-	lib/hooks/eval.lua \
-	lib/hooks/exception.lua \
-	lib/hooks/file_io.lua \
-	lib/hooks/framework_csrf_check.lua \
-	lib/hooks/framework_login.lua \
-	lib/hooks/framework_password_reset.lua \
-	lib/hooks/framework_account_created.lua \
-	lib/hooks/framework_redirect.lua \
-	lib/hooks/framework_session.lua \
-	lib/hooks/framework_user.lua \
-	lib/hooks/framework_route.lua \
-	lib/hooks/http_request_finish.lua \
-	lib/hooks/http_request_start.lua \
-	lib/hooks/http_response_start.lua \
-	lib/hooks/should_report.lua \
-	lib/hooks/sql_execute.lua \
-	lib/hooks/template_render_done.lua \
-	lib/hooks/xss/escape.lua \
-	lib/hooks/xss/escape_js.lua
-
-OBJ = ${SRC:.c=.o}
-
-SHA1OBJ = ext/sha1/sha1.o
-SHA2OBJ = ext/sha2/sha256.o
-OBJ = ${SRC:.c=.o} ${SHA1OBJ} ${SHA2OBJ}
 
-# Library archive. Used for compiling along agent bindings.
-SO_OUT = libimmunio.so
-A_OUT = libimmunio.a
+# All these source variables are filled in by the module.mk files
+SRC :=
+
+CXX_SRC :=
+
+SPECIAL_SRC :=
+
+LUA_SRC :=
+
+CLI_SRC := \
+	ext/luajit/src/luajit.c
+
+# Include module definitions
+include $(patsubst %,%/module.mk,$(MODULES))
+
+OBJ := \
+	$(patsubst %.c,%.o,$(filter %.c,$(SRC))) \
+
+SPECIAL_OBJ := \
+	$(patsubst %.c,%.o,$(filter %.c,$(SPECIAL_SRC))) \
+
+CXX_OBJ := \
+	$(patsubst %.cc,%.o,$(filter %.cc,$(CXX_SRC)))
+
+CLI_OBJ := \
+	$(patsubst %.c,%.o,$(filter %.c,$(CLI_SRC)))
+
 
 # CLI for running tests
 CLI = ./lua
-CLI_SRC = ext/luajit/src/luajit.c ${SRC}
 
-XCFLAGS =
-CFLAGS = -DLUA_USE_APICHECK -DLUAJIT -Dlua_assert=assert -O3 -fPIC ${XCFLAGS}
-INCS = -Iext -Iext/luajit/src
-LIBS = -lm -ldl
+# Library archive. Used for compiling along agent bindings.
+SO_OUT = libimmunio.so
+A_OUT = libimmunio.a
+
+include options.mk
 
 INIT_HOOK = hooks/__init__.lua
 HOOK_SRCS := $(wildcard hooks/*.lua) hooks/__init__.lua
@@ -95,47 +46,30 @@ MIN_SRCS = $(HOOK_SRCS:hooks/%.lua=build/%.lua)
 HOOKS_TARBALL = hooks.tgz
 HOOKS_SRCS_TARBALL = hooks_srcs.tgz
 
-LUAJIT_OBJ = ext/luajit/src/libluajit.a
 LUAJIT_OUT = libluajit.a
-LUAJIT_XCFLAGS = -fPIC
-
-SYS = $(shell uname -s)
-
-ifeq (${SYS}, Darwin)
-	# Disable the JIT on OS X
-	LUAJIT_XCFLAGS += -DLUAJIT_ENABLE_GC64
-endif
+LUAJIT_OBJ = ext/luajit/src/${LUAJIT_OUT}
 
 # Build lua, run tests, and create hooks archive
 all: ${CLI} ${INIT_HOOK} ${HOOKS_TARBALL} ${HOOKS_SRCS_TARBALL}
 
-%.o: %.c
-	MACOSX_DEPLOYMENT_TARGET="10.8" ${CC} ${CFLAGS} -c ${INCS} -o $@ $<
-
-# There is a huge performance advantage compiling sha1.o with just -O
-# -O2 or -O3 *reduce* the speed of the algorithm 30%
-${SHA1OBJ}:
-	${CC} -O -c ${INCS} -o ${SHA1OBJ} ${SHA1OBJ:.o=.c}
-
-${SHA2OBJ}:
-	${CC} -O -c ${INCS} -o ${SHA2OBJ} ${SHA2OBJ:.o=.c}
-
-${SO_OUT}: ${OBJ} ${LUAJIT_OBJ}
+${SO_OUT}: ${OBJ} ${SPECIAL_OBJ} ${LUAJIT_OBJ}
 	${CC} -shared ${CFLAGS} ${LIBS} -o $@ -lc $^
 
-${A_OUT}: ${OBJ}
+${A_OUT}: ${OBJ} ${SPECIAL_OBJ}
 	${AR} -rcus $@ $^
 
 ${LUAJIT_OUT}: ${LUAJIT_OBJ}
 	cp $^ $@
 
 ${LUAJIT_OBJ}:
-	cd ext/luajit && MACOSX_DEPLOYMENT_TARGET="10.8" make CROSS="${CROSS}" CC=cc HOST_CC=cc TARGET_SYS=${SYS} XCFLAGS="${LUAJIT_XCFLAGS}"
+	cd ext/luajit/src && MACOSX_DEPLOYMENT_TARGET="10.8" make CROSS="${CROSS}" CC=cc HOST_CC=cc XCFLAGS="${LUAJIT_XCFLAGS}" ${LUAJIT_OUT}
 
 # Build lua executable for testing and compilation
 # Seperate compilation as we need the LUA_UNSAFE_MODE flag set...
-${CLI}: ${CLI_SRC} ${LUAJIT_OBJ} ${SHA1OBJ} ${SHA2OBJ}
-	${CC} ${CFLAGS} -DLUA_UNSAFE_MODE ${INCS} -o $@ $^ ${LIBS}
+${CLI}: CFLAGS += ${UNSAFE_FLAG}
+${CLI}: CXXFLAGS += ${UNSAFE_FLAG}
+${CLI}: ${CLI_SRC} ${SRC} ${SPECIAL_OBJ} ${CXX_OBJ} ${LUAJIT_OBJ}
+	${CC} ${CFLAGS} ${LDFLAGS} -o $@ $^ ${LIBS}
 
 # Concatenate init hooks into one __init__.lua hook with two newlines in between
 ${INIT_HOOK}: ${LUA_SRC} ${CLI}
@@ -154,12 +88,22 @@ ${HOOKS_TARBALL}: ${MIN_SRCS}
 ${HOOKS_SRCS_TARBALL}: ${HOOK_SRCS}
 	tar -czf $@ -C hooks . --exclude="init"
 
+${SPECIAL_OBJ}: CFLAGS += ${OPTIMIZE_NONE}
+
+${CLI_OBJ} ${OBJ} ${CXX_OBJ} ${LUAJIT_OBJ}: CFLAGS += ${OPTIMIZE_FULL}
+
+%.o: %.c
+	${CC} ${CFLAGS} -c ${INCS} -o $@ $<
+
+%.o: %.cc
+	${CXX} ${CXXFLAGS} -c ${INCS} -o $@ $<
+
 cleanhooks:
 	rm -f ${INIT_HOOK}
 	rm -f build/*.lua
 
 clean: cleanhooks
-	rm -f ${CLI} ${OBJ} ${SO_OUT} ${A_OUT} ${LUAJIT_OUT} ${SHA1OBJ} ${SHA2OBJ}
+	rm -f ${CLI} ${CLI_OBJ} ${OBJ} ${CXX_OBJ} ${SPECIAL_OBJ} ${SO_OUT} ${A_OUT} ${LUAJIT_OUT}
 	cd ext/luajit && make clean
 	rm -f test_failed
 	rm -rf build
@@ -167,7 +111,10 @@ clean: cleanhooks
 
 test: ${CLI} ${INIT_HOOK} lint ${MIN_SRCS}
 	@rm -f test_failed
-	@for file in test/*_test.lua; do printf "\nRunning $$file\n"; TEST_BUILT_HOOKS=1 ./${CLI} $$file || touch test_failed; done
+	@for file in test/*_test.lua; do \
+		printf "\nRunning $$file\n"; \
+		TEST_BUILT_HOOKS=1 ${CLI} -e 'package.path="./LuaMinify/?.lua;" .. package.path' -l 'Strict' $$file || touch test_failed; \
+	done
 	@test ! -f test_failed
 
 enable-console: cleanhooks

data/lua-hooks/ext/all.c

@@ -8,19 +8,7 @@
 #include "lauxlib.h"
 #include "lualib.h"
 
-
-// Include our custom modules
-#include "libinjection/lualib.c"
-#include "luautf8/lutf8lib.c"
-#include "lpeg/lptree.c"
-#include "lua-cmsgpack/lua_cmsgpack.c"
-#include "lua-snapshot/snapshot.c"
-#include "sha1/luasha1.c"
-#include "sha2/luasha256.c"
-#include "perf/luacpu.c"
-#include "perf/lualoadavg.c"
-#include "perf/luameminfo.c"
-#include "perf/luaoslib.c"
+#include "modules.h"
 
 
 static const luaL_Reg lj_lib_load[] = {
@@ -47,7 +35,7 @@ static const luaL_Reg lj_lib_load[] = {
   {"libinjection", luaopen_libinjection},
   {"utf8", luaopen_utf8},
   {"lpeg", luaopen_lpeg},
-  {LUACMSGPACK_NAME, luaopen_cmsgpack},
+  {"cmsgpack", luaopen_cmsgpack},
   {"snapshot", luaopen_snapshot},
   {"sha1", luaopen_sha1},
   {"sha2", luaopen_sha256},
@@ -55,6 +43,7 @@ static const luaL_Reg lj_lib_load[] = {
   {"perf", luaopen_loadavg},
   {"perf", luaopen_meminfo},
   {"perf", luaopen_luaos},
+  {"sysutils", luaopen_sysutils},
 
   { NULL,   NULL }
 };

data/lua-hooks/ext/libinjection/module.mk

@@ -0,0 +1,5 @@
+SRC += \
+	ext/libinjection/libinjection_html5.c \
+	ext/libinjection/libinjection_xss.c \
+	ext/libinjection/libinjection_sqli.c\
+	ext/libinjection/lualib.c

data/lua-hooks/ext/lpeg/module.mk

@@ -0,0 +1,6 @@
+SRC += \
+	ext/lpeg/lpcap.c \
+	ext/lpeg/lpcode.c \
+	ext/lpeg/lpprint.c \
+	ext/lpeg/lptree.c \
+	ext/lpeg/lpvm.c

data/lua-hooks/ext/lua-cmsgpack/module.mk

@@ -0,0 +1,2 @@
+SRC += \
+	ext/lua-cmsgpack/lua_cmsgpack.c

data/lua-hooks/ext/lua-snapshot/module.mk

@@ -0,0 +1,2 @@
+SRC += \
+	ext/lua-snapshot/snapshot.c

data/lua-hooks/ext/luajit/COPYRIGHT

@@ -1,7 +1,7 @@
 ===============================================================================
 LuaJIT -- a Just-In-Time Compiler for Lua. http://luajit.org/
 
-Copyright (C) 2005-2015 Mike Pall. All rights reserved.
+Copyright (C) 2005-2016 Mike Pall. All rights reserved.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/lua-hooks/ext/luajit/Makefile

@@ -10,13 +10,13 @@
 # For MSVC, please follow the instructions given in src/msvcbuild.bat.
 # For MinGW and Cygwin, cd to src and run make with the Makefile there.
 #
-# Copyright (C) 2005-2015 Mike Pall. See Copyright Notice in luajit.h
+# Copyright (C) 2005-2016 Mike Pall. See Copyright Notice in luajit.h
 ##############################################################################
 
 MAJVER=  2
 MINVER=  1
 RELVER=  0
-PREREL=  -beta1
+PREREL=  -beta2
 VERSION= $(MAJVER).$(MINVER).$(RELVER)$(PREREL)
 ABIVER=  5.1
 

data/lua-hooks/ext/luajit/README

@@ -1,11 +1,11 @@
-README for LuaJIT 2.1.0-beta1
+README for LuaJIT 2.1.0-beta2
 -----------------------------
 
 LuaJIT is a Just-In-Time (JIT) compiler for the Lua programming language.
 
 Project Homepage: http://luajit.org/
 
-LuaJIT is Copyright (C) 2005-2015 Mike Pall.
+LuaJIT is Copyright (C) 2005-2016 Mike Pall.
 LuaJIT is free software, released under the MIT license.
 See full Copyright Notice in the COPYRIGHT file or in luajit.h.
 

data/lua-hooks/ext/luajit/doc/bluequad-print.css

@@ -1,4 +1,4 @@
-/* Copyright (C) 2004-2015 Mike Pall.
+/* Copyright (C) 2004-2016 Mike Pall.
  *
  * You are welcome to use the general ideas of this design for your own sites.
  * But please do not steal the stylesheet, the layout or the color scheme.

data/lua-hooks/ext/luajit/doc/bluequad.css

@@ -1,4 +1,4 @@
-/* Copyright (C) 2004-2015 Mike Pall.
+/* Copyright (C) 2004-2016 Mike Pall.
  *
  * You are welcome to use the general ideas of this design for your own sites.
  * But please do not steal the stylesheet, the layout or the color scheme.

data/lua-hooks/ext/luajit/doc/changes.html

@@ -4,7 +4,7 @@
 <title>LuaJIT Change History</title>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <meta name="Author" content="Mike Pall">
-<meta name="Copyright" content="Copyright (C) 2005-2015, Mike Pall">
+<meta name="Copyright" content="Copyright (C) 2005-2016, Mike Pall">
 <meta name="Language" content="en">
 <link rel="stylesheet" type="text/css" href="bluequad.css" media="screen">
 <link rel="stylesheet" type="text/css" href="bluequad-print.css" media="print">
@@ -74,6 +74,19 @@ to see whether newer versions are available.
 </p>
 
 <div class="major" style="background: #d0d0ff;">
+<h2 id="LuaJIT-2.1.0-beta2">LuaJIT 2.1.0-beta2 &mdash; 2016-03-03</h2>
+<ul>
+<li>Enable trace stitching.</li>
+<li>Use internal implementation for converting FP numbers to strings.</li>
+<li>Parse Unicode escape <tt>'\u{XX...}'</tt> in string literals.</li>
+<li>Add MIPS soft-float support.</li>
+<li>Switch MIPS port to dual-number mode.</li>
+<li>x86/x64: Add support for AES-NI, AVX and AVX2 to DynASM.</li>
+<li>FFI: Add <tt>ssize_t</tt> declaration.</li>
+<li>FFI: Parse <tt>#line NN</tt> and <tt>#NN</tt>.</li>
+<li>Various minor fixes.</li>
+</ul>
+
 <h2 id="LuaJIT-2.1.0-beta1">LuaJIT 2.1.0-beta1 &mdash; 2015-08-25</h2>
 <p>
 This is a brief summary of the major changes in LuaJIT 2.1 compared to 2.0.
@@ -794,7 +807,7 @@ no point in listing differences over earlier versions.</li>
 </div>
 <div id="foot">
 <hr class="hide">
-Copyright &copy; 2005-2015 Mike Pall
+Copyright &copy; 2005-2016 Mike Pall
 <span class="noprint">
 &middot;
 <a href="contact.html">Contact</a>

data/lua-hooks/ext/luajit/doc/contact.html

@@ -4,7 +4,7 @@
 <title>Contact</title>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <meta name="Author" content="Mike Pall">
-<meta name="Copyright" content="Copyright (C) 2005-2015, Mike Pall">
+<meta name="Copyright" content="Copyright (C) 2005-2016, Mike Pall">
 <meta name="Language" content="en">
 <link rel="stylesheet" type="text/css" href="bluequad.css" media="screen">
 <link rel="stylesheet" type="text/css" href="bluequad-print.css" media="print">
@@ -86,7 +86,7 @@ xD("fyZKB8xv\"FJytmz8.KAB0u52D")
 <h2>Copyright</h2>
 <p>
 All documentation is
-Copyright &copy; 2005-2015 Mike Pall.
+Copyright &copy; 2005-2016 Mike Pall.
 </p>
 
 
@@ -94,7 +94,7 @@ Copyright &copy; 2005-2015 Mike Pall.
 </div>
 <div id="foot">
 <hr class="hide">
-Copyright &copy; 2005-2015 Mike Pall
+Copyright &copy; 2005-2016 Mike Pall
 <span class="noprint">
 &middot;
 <a href="contact.html">Contact</a>

data/lua-hooks/ext/luajit/doc/ext_c_api.html

@@ -4,7 +4,7 @@
 <title>Lua/C API Extensions</title>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <meta name="Author" content="Mike Pall">
-<meta name="Copyright" content="Copyright (C) 2005-2015, Mike Pall">
+<meta name="Copyright" content="Copyright (C) 2005-2016, Mike Pall">
 <meta name="Language" content="en">
 <link rel="stylesheet" type="text/css" href="bluequad.css" media="screen">
 <link rel="stylesheet" type="text/css" href="bluequad-print.css" media="print">
@@ -179,7 +179,7 @@ Also note that this mechanism is not without overhead.
 </div>
 <div id="foot">
 <hr class="hide">
-Copyright &copy; 2005-2015 Mike Pall
+Copyright &copy; 2005-2016 Mike Pall
 <span class="noprint">
 &middot;
 <a href="contact.html">Contact</a>

data/lua-hooks/ext/luajit/doc/ext_ffi.html

@@ -4,7 +4,7 @@
 <title>FFI Library</title>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <meta name="Author" content="Mike Pall">
-<meta name="Copyright" content="Copyright (C) 2005-2015, Mike Pall">
+<meta name="Copyright" content="Copyright (C) 2005-2016, Mike Pall">
 <meta name="Language" content="en">
 <link rel="stylesheet" type="text/css" href="bluequad.css" media="screen">
 <link rel="stylesheet" type="text/css" href="bluequad-print.css" media="print">
@@ -322,7 +322,7 @@ without undue conversion penalties.
 </div>
 <div id="foot">
 <hr class="hide">
-Copyright &copy; 2005-2015 Mike Pall
+Copyright &copy; 2005-2016 Mike Pall
 <span class="noprint">
 &middot;
 <a href="contact.html">Contact</a>