nemesis-shield 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/nemesis_shield.rb +14 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 85883516f944f9a9d9ad3022e7687c3018a78b1d019417baa28ff4c75fa8164f
|
|
4
|
+
data.tar.gz: 94dda8b752f38047a60cc3dc8a78e6c2a464dafb9d85de82c52d9f007241acd8
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: fccc3324a906b8518acc6ae1bc1dc2be46c34fd9f73b0507b3f6d099b1fc7b8a97e3825e127bff6e1c727ceeb8834a810361291d49e3088fb781a56dd49030bf
|
|
7
|
+
data.tar.gz: fe2c53142a11201c6ce83dbb61618df7917d0935bd44acb5e4727a19ff00a4194d689edef1497840a51a6a542ae19812a52ef273f77410a1e0866fcf758e95f7
|
data/nemesis_shield.rb
CHANGED
|
@@ -74,9 +74,22 @@ module NemesisShield
|
|
|
74
74
|
end
|
|
75
75
|
|
|
76
76
|
# Request signature (method + route + query param kinds + auth). Excludes status by design.
|
|
77
|
+
# Analytics / click-tracking query params carry no application logic and are the main cause of shape
|
|
78
|
+
# explosion (every ad/campaign link adds different ones). Stripped from the signature so a UTM'd
|
|
79
|
+
# request matches the bare route, while real params (and any attack in them) stay modeled. Shared,
|
|
80
|
+
# identical across every Nemesis Shield SDK so the shape hash matches everywhere.
|
|
81
|
+
TRACKING_PREFIXES = %w[utm_ mtm_ pk_ hsa_ matomo_ piwik_ ga_].freeze
|
|
82
|
+
TRACKING_EXACT = %w[gclid gbraid wbraid dclid gclsrc fbclid msclkid twclid ttclid yclid igshid scid wickedid _ga _gl _hsenc _hsmi mc_cid mc_eid vero_id vero_conv oly_anon_id oly_enc_id _openstat rb_clickid s_cid epik sccid].freeze
|
|
83
|
+
|
|
84
|
+
def tracking_param?(name)
|
|
85
|
+
n = name.to_s.downcase
|
|
86
|
+
TRACKING_PREFIXES.any? { |p| n.start_with?(p) } || TRACKING_EXACT.include?(n)
|
|
87
|
+
end
|
|
88
|
+
module_function :tracking_param?
|
|
89
|
+
|
|
77
90
|
def build_sketch(method:, path:, query: {}, authed: false, status: 0)
|
|
78
91
|
route = normalize_path(path)
|
|
79
|
-
params = (query || {}).keys.sort.map { |k| v = query[k]; { name: k.to_s, kind: kind_of(v.is_a?(Array) ? v.first : v), nested: v.is_a?(Array) } }
|
|
92
|
+
params = (query || {}).keys.reject { |k| tracking_param?(k) }.sort.map { |k| v = query[k]; { name: k.to_s, kind: kind_of(v.is_a?(Array) ? v.first : v), nested: v.is_a?(Array) } }
|
|
80
93
|
# canonical shape input: keys sorted (auth, method, params, route); params are [name, kind, nested];
|
|
81
94
|
# status is intentionally excluded so enforcement can decide BEFORE the response exists.
|
|
82
95
|
canon = JSON.generate({ auth: authed ? 1 : 0, method: method.to_s.upcase, params: params.map { |p| [p[:name], p[:kind], p[:nested] ? 1 : 0] }, route: route })
|