logster 2.3.1 → 2.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d19b6d2558ca3ac27df16998d9bab79aabc9e98f15d28894490e61b4d0f7987
-  data.tar.gz: 5bb3053384ea1203e96ddbd26c11cccb88ba66e5fa3a7f342f4ae00049d2a1a8
+  metadata.gz: f2f37eb7a03d711e0162719afed21c5d2b085f641764a9cec168eba16761d0ff
+  data.tar.gz: 1398a1d9baea28cdb3015b863075d0d242ab423f11b78db3b7fd074df9de9d03
 SHA512:
-  metadata.gz: 65f024a72e62ab478c7e77ad02193e9d8d8d88ab90f7b544b4c6751683600e52d776bc0bf56dd7a6f65c85e47bed7be7a28c7967db1011ee0f8b3ec9ef142863
-  data.tar.gz: b0e4b102c3de5523ec8057fdc26234d60d70958a5fdd683783f1d59e0dc054a145869605f8c76e4dacfc1c8b49ba74b890abe681c66003194d55033cfcebcaea
+  metadata.gz: 893b198161a8c729c8e8290de1e82568f1b0caa2facb06e149216b456cdf8ce9ed76ea489296f632e431985ce769cbd3bb4c9fe90acb8c1641a2a48522d01c91
+  data.tar.gz: b7a1460c5d42d07bffe1df6fab527fd4ee6a733e10364f212fd8ee19e4180893b03e2b3b669ba9e7ef2efb01cbb91857ce4162e37f17b5a3efa18428a9595d48

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+- 2019-08-20: 2.3.2
+
+  - FEATURE: automatic 1 minute rate limiting for js error reporting per IP
+
 - 2019-08-15: 2.3.1
 
   - DEV: upgrade Ember to 3.8 and jQuery to 3.4.1 (#84)

data/README.md

@@ -35,6 +35,15 @@ To run logster in other environments, in `config/application.rb`
 Logster.set_environments([:development, :staging, :production])
 ```
 
+### Configuration
+
+Logster can be configured using `Logster.config`:
+
+- `Logster.config.application_version`: set to a unique identifier denoting version of your app. The "solve" function takes this version into account when suppressing errors.
+- `Logster.config.enable_js_error_reporting` : enable js error reporting from clients
+- `Logster.config.rate_limit_error_reporting` : controls automatic 1 minute rate limiting for JS error reporting.
+- `Logster.config.web_title` : `<title>` tag for logster error page.
+
 ### Tracking Error Rate
 Logster allows you to register a callback when the rate of errors has exceeded
 a given limit.

data/lib/logster.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'logster/logger'
 require 'logster/message'
 require 'logster/configuration'

data/lib/logster/base_store.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Logster
   class BaseStore
 
@@ -115,6 +117,10 @@ module Logster
       {}
     end
 
+    def rate_limited?(ip_address, perform: false, limit: 60)
+      not_implemented
+    end
+
     def report(severity, progname, msg, opts = {})
       return if (!msg || (String === msg && msg.empty?)) && skip_empty
       return if level && severity < level

data/lib/logster/configuration.rb

@@ -1,7 +1,18 @@
+# frozen_string_literal: true
+
 module Logster
   class Configuration
-    attr_accessor :current_context, :allow_grouping, :environments,
-      :application_version, :web_title, :env_expandable_keys, :enable_custom_patterns_via_ui
+    attr_accessor(
+      :allow_grouping,
+      :application_version,
+      :current_context,
+      :env_expandable_keys,
+      :enable_custom_patterns_via_ui,
+      :enable_js_error_reporting,
+      :environments,
+      :rate_limit_error_reporting,
+      :web_title
+    )
 
     attr_writer :subdirectory
 
@@ -12,6 +23,8 @@ module Logster
       @subdirectory = nil
       @env_expandable_keys = []
       @enable_custom_patterns_via_ui = false
+      @rate_limit_error_reporting = true
+      @enable_js_error_reporting = true
 
       @allow_grouping = false
 

data/lib/logster/middleware/debug_exceptions.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Logster::Middleware::DebugExceptions < ActionDispatch::DebugExceptions
   private
 
@@ -13,13 +15,14 @@ class Logster::Middleware::DebugExceptions < ActionDispatch::DebugExceptions
 
     Logster.config.current_context.call(env) do
       location = exception.backtrace[0]
-      exception_string = exception.to_s
 
-      Logster.logger.add_with_opts(::Logger::Severity::FATAL,
-                        exception.class.to_s << " (" << exception_string << ")\n#{location}",
-                        "web-exception",
-                        backtrace: exception.backtrace.join("\n"),
-                        env: env)
+      Logster.logger.add_with_opts(
+        ::Logger::Severity::FATAL,
+        "#{exception.class} (#{exception})\n#{location}",
+        "web-exception",
+        backtrace: exception.backtrace.join("\n"),
+        env: env
+      )
     end
 
   end

data/lib/logster/middleware/reporter.rb

@@ -1,9 +1,11 @@
+# frozen_string_literal: true
+
 module Logster
   module Middleware
     class Reporter
 
-      PATH_INFO = "PATH_INFO".freeze
-      SCRIPT_NAME = "SCRIPT_NAME".freeze
+      PATH_INFO = "PATH_INFO"
+      SCRIPT_NAME = "SCRIPT_NAME"
 
       def initialize(app, config = {})
         @app = app
@@ -21,7 +23,18 @@ module Logster
         end
 
         if path == @error_path
+
+          if !Logster.config.enable_js_error_reporting
+            return [403, {}, "Access Denied"]
+          end
+
           Logster.config.current_context.call(env) do
+            if Logster.config.rate_limit_error_reporting
+              req = Rack::Request.new(env)
+              if Logster.store.rate_limited?(req.ip, perform: true)
+                return [429, {}, "Rate Limited"]
+              end
+            end
             report_js_error(env)
           end
           return [200, {}, ["OK"]]
@@ -34,9 +47,10 @@ module Logster
 
       def report_js_error(env)
         req = Rack::Request.new(env)
+
         params = req.params
 
-        message = params["message"] || ""
+        message = (params["message"] || "").dup
         message << "\nUrl: " << params["url"] if params["url"]
         message << "\nLine: " << params["line"] if params["line"]
         message << "\nColumn: " << params["column"] if params["column"]
@@ -48,6 +62,8 @@ module Logster
                             message,
                             backtrace: backtrace,
                             env: env)
+
+        true
       end
 
     end

data/lib/logster/rails/railtie.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Logster::Rails
 
   # this magically registers logster.js in the asset pipeline
@@ -30,7 +32,9 @@ module Logster::Rails
     return unless Logster.config.environments.include?(Rails.env.to_sym)
 
     if Logster::Logger === Rails.logger
-      app.middleware.insert_before ActionDispatch::ShowExceptions, Logster::Middleware::Reporter
+      if Logster.config.enable_js_error_reporting
+        app.middleware.insert_before ActionDispatch::ShowExceptions, Logster::Middleware::Reporter
+      end
 
       if Rails::VERSION::MAJOR == 3
         app.middleware.insert_before ActionDispatch::DebugExceptions, Logster::Middleware::DebugExceptions

data/lib/logster/redis_rate_limiter.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+module Logster
+  class RedisRateLimiter
+    BUCKETS = 6
+    PREFIX = "__LOGSTER__RATE_LIMIT".freeze
+
+    attr_reader :duration, :callback
+
+    def self.clear_all(redis, redis_prefix = nil)
+      prefix = key_prefix(redis_prefix)
+
+      redis.eval "
+      local keys = redis.call('keys', '*#{prefix}*')
+      if (table.getn(keys) > 0) then
+        redis.call('del', unpack(keys))
+      end
+      "
+    end
+
+    def initialize(redis, severities, limit, duration, redis_prefix = nil, callback = nil)
+      @severities = severities
+      @limit = limit
+      @duration = duration
+      @callback = callback
+      @redis_prefix = redis_prefix
+      @redis = redis
+      @bucket_range = @duration / BUCKETS
+      @mget_keys = (0..(BUCKETS - 1)).map { |i| "#{key}:#{i}" }
+    end
+
+    def retrieve_rate
+      @redis.mget(@mget_keys).reduce(0) { |sum, value| sum + value.to_i }
+    end
+
+    def check(severity)
+      return unless @severities.include?(severity)
+      time = Time.now.to_i
+      num = bucket_number(time)
+      redis_key = "#{key}:#{num}"
+
+      current_rate = @redis.eval <<-LUA
+        local bucket_number = #{num}
+        local bucket_count = redis.call("INCR", "#{redis_key}")
+
+        if bucket_count == 1 then
+          redis.call("EXPIRE", "#{redis_key}", "#{bucket_expiry(time)}")
+          redis.call("DEL", "#{callback_key}")
+        end
+
+        local function retrieve_rate ()
+          local sum = 0
+          local values = redis.call("MGET", #{mget_keys(num)})
+          for index, value in ipairs(values) do
+            if value ~= false then sum = sum + value end
+          end
+          return sum
+        end
+
+        return (retrieve_rate() + bucket_count)
+      LUA
+
+      if !@redis.get(callback_key) && (current_rate >= @limit)
+        @callback.call(current_rate) if @callback
+        @redis.set(callback_key, 1)
+      end
+
+      current_rate
+    end
+
+    def key
+      # "_LOGSTER_RATE_LIMIT:012:20:30"
+      # Triggers callback when log levels of :debug, :info and :warn occurs 20 times within 30 secs
+      "#{key_prefix}:#{@severities.join("")}:#{@limit}:#{@duration}"
+    end
+
+    def callback_key
+      "#{key}:callback_triggered"
+    end
+
+    private
+
+    def self.key_prefix(redis_prefix)
+      if redis_prefix
+        "#{redis_prefix.call}:#{PREFIX}"
+      else
+        PREFIX
+      end
+
+    end
+
+    def key_prefix
+      self.class.key_prefix(@redis_prefix)
+    end
+
+    def mget_keys(bucket_num)
+      keys = @mget_keys.dup
+      keys.delete_at(bucket_num)
+      keys.map { |key| "'#{key}'" }.join(', ')
+    end
+
+    def bucket_number(time)
+      (time % @duration) / @bucket_range
+    end
+
+    def bucket_expiry(time)
+      @duration - ((time % @duration) % @bucket_range)
+    end
+  end
+end

data/lib/logster/redis_store.rb

@@ -1,114 +1,10 @@
+# frozen_string_literal: true
+
 require 'json'
 require 'logster/base_store'
+require 'logster/redis_rate_limiter'
 
 module Logster
-  class RedisRateLimiter
-    BUCKETS = 6
-    PREFIX = "__LOGSTER__RATE_LIMIT".freeze
-
-    attr_reader :duration, :callback
-
-    def self.clear_all(redis, redis_prefix = nil)
-      prefix = key_prefix(redis_prefix)
-
-      redis.eval "
-      local keys = redis.call('keys', '*#{prefix}*')
-      if (table.getn(keys) > 0) then
-        redis.call('del', unpack(keys))
-      end
-      "
-    end
-
-    def initialize(redis, severities, limit, duration, redis_prefix = nil, callback = nil)
-      @severities = severities
-      @limit = limit
-      @duration = duration
-      @callback = callback
-      @redis_prefix = redis_prefix
-      @redis = redis
-      @bucket_range = @duration / BUCKETS
-      @mget_keys = (0..(BUCKETS - 1)).map { |i| "#{key}:#{i}" }
-    end
-
-    def retrieve_rate
-      @redis.mget(@mget_keys).reduce(0) { |sum, value| sum + value.to_i }
-    end
-
-    def check(severity)
-      return unless @severities.include?(severity)
-      time = Time.now.to_i
-      num = bucket_number(time)
-      redis_key = "#{key}:#{num}"
-
-      current_rate = @redis.eval <<-LUA
-        local bucket_number = #{num}
-        local bucket_count = redis.call("INCR", "#{redis_key}")
-
-        if bucket_count == 1 then
-          redis.call("EXPIRE", "#{redis_key}", "#{bucket_expiry(time)}")
-          redis.call("DEL", "#{callback_key}")
-        end
-
-        local function retrieve_rate ()
-          local sum = 0
-          local values = redis.call("MGET", #{mget_keys(num)})
-          for index, value in ipairs(values) do
-            if value ~= false then sum = sum + value end
-          end
-          return sum
-        end
-
-        return (retrieve_rate() + bucket_count)
-      LUA
-
-      if !@redis.get(callback_key) && (current_rate >= @limit)
-        @callback.call(current_rate) if @callback
-        @redis.set(callback_key, 1)
-      end
-
-      current_rate
-    end
-
-    def key
-      # "_LOGSTER_RATE_LIMIT:012:20:30"
-      # Triggers callback when log levels of :debug, :info and :warn occurs 20 times within 30 secs
-      "#{key_prefix}:#{@severities.join("")}:#{@limit}:#{@duration}"
-    end
-
-    def callback_key
-      "#{key}:callback_triggered"
-    end
-
-    private
-
-    def self.key_prefix(redis_prefix)
-      if redis_prefix
-        "#{redis_prefix.call}:#{PREFIX}"
-      else
-        PREFIX
-      end
-
-    end
-
-    def key_prefix
-      self.class.key_prefix(@redis_prefix)
-    end
-
-    def mget_keys(bucket_num)
-      keys = @mget_keys.dup
-      keys.delete_at(bucket_num)
-      keys.map { |key| "'#{key}'" }.join(', ')
-    end
-
-    def bucket_number(time)
-      (time % @duration) / @bucket_range
-    end
-
-    def bucket_expiry(time)
-      @duration - ((time % @duration) % @bucket_range)
-    end
-  end
-
   class RedisStore < BaseStore
 
     attr_accessor :redis, :max_backlog, :redis_raw_connection
@@ -278,6 +174,7 @@ module Logster
       end
       @redis.keys.each do |key|
         @redis.del(key) if key.include?(Logster::RedisRateLimiter::PREFIX)
+        @redis.del(key) if key.start_with?(ip_rate_limit_key(""))
       end
     end
 
@@ -373,6 +270,18 @@ module Logster
       @redis.hgetall(ignored_logs_count_key)
     end
 
+    def rate_limited?(ip_address, perform: false, limit: 60)
+      key = ip_rate_limit_key(ip_address)
+
+      limited = @redis.exists(key)
+
+      if perform && !limited
+        @redis.setex key, limit, ""
+      end
+
+      limited
+    end
+
     protected
 
     def clear_solved(count = nil)
@@ -583,6 +492,10 @@ module Logster
       @ignored_logs_count_key ||= "__LOGSTER__IGNORED_LOGS_COUNT_KEY__MAP"
     end
 
+    def ip_rate_limit_key(ip_address)
+      "__LOGSTER__IP_RATE_LIMIT_#{ip_address}"
+    end
+
     private
 
     def register_rate_limit(severities, limit, duration, callback)

data/lib/logster/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Logster
-  VERSION = "2.3.1"
+  VERSION = "2.3.2"
 end

data/test/logster/middleware/test_reporter.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../test_helper'
 require 'rack'
 require 'logster/redis_store'
@@ -5,15 +7,53 @@ require 'logster/middleware/reporter'
 
 class TestReporter < Minitest::Test
 
+  def setup
+    Logster.store = Logster::RedisStore.new
+    Logster.store.clear_all
+    Logster.config.enable_js_error_reporting = true
+  end
+
   def test_logs_errors
-    Logster.store = Logster::TestStore.new
+    reporter = Logster::Middleware::Reporter.new(nil)
+    env = Rack::MockRequest.env_for("/logs/report_js_error?message=hello")
+    status, = reporter.call(env)
+
+    assert_equal(200, status)
+    assert_equal(1, Logster.store.count)
+  end
+
+  def test_respects_ban_on_errors
+    Logster.config.enable_js_error_reporting = false
 
     reporter = Logster::Middleware::Reporter.new(nil)
     env = Rack::MockRequest.env_for("/logs/report_js_error?message=hello")
     status, = reporter.call(env)
 
+    assert_equal(403, status)
+    assert_equal(0, Logster.store.count)
+  end
+
+  def test_rate_limiting
+    reporter = Logster::Middleware::Reporter.new(nil)
+    env = Rack::MockRequest.env_for("/logs/report_js_error?message=hello")
+    status, = reporter.call(env)
+
     assert_equal(200, status)
     assert_equal(1, Logster.store.count)
+
+    reporter = Logster::Middleware::Reporter.new(nil)
+    env = Rack::MockRequest.env_for("/logs/report_js_error?message=hello2")
+    status, = reporter.call(env)
+
+    assert_equal(429, status)
+    assert_equal(1, Logster.store.count)
+
+    reporter = Logster::Middleware::Reporter.new(nil)
+    env = Rack::MockRequest.env_for("/logs/report_js_error?message=hello2", "REMOTE_ADDR" => "100.1.1.2")
+    status, = reporter.call(env)
+
+    assert_equal(200, status)
+    assert_equal(2, Logster.store.count)
   end
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logster
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.3.2
 platform: ruby
 authors:
 - UI for viewing logs in Rack
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-08-15 00:00:00.000000000 Z
+date: 2019-08-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -248,6 +248,7 @@ files:
 - lib/logster/middleware/viewer.rb
 - lib/logster/pattern.rb
 - lib/logster/rails/railtie.rb
+- lib/logster/redis_rate_limiter.rb
 - lib/logster/redis_store.rb
 - lib/logster/scheduler.rb
 - lib/logster/suppression_pattern.rb