otto 1.6.0 → 2.0.0.pre1

data/lib/otto/security/rate_limiting.rb

@@ -1,111 +1,16 @@
-require 'json'
+# frozen_string_literal: true
 
-begin
-  require 'rack/attack'
-rescue LoadError
-  # rack-attack is optional - graceful fallback
-end
+# lib/otto/security/rate_limiting.rb
+#
+# Index file for rate limiting components
+# Provides backward compatibility for existing rate limiting usage
+
+require_relative 'rate_limiter'
+require_relative 'middleware/rate_limit_middleware'
 
 class Otto
   module Security
-    class RateLimiting
-      def self.configure_rack_attack!(config = {})
-        return unless defined?(Rack::Attack)
-
-        # Use provided cache store or default
-        if config[:cache_store]
-          Rack::Attack.cache.store = config[:cache_store]
-        end
-
-        # Default rules
-        default_requests_per_minute = config.fetch(:requests_per_minute, 100)
-
-        # General request throttling
-        Rack::Attack.throttle('requests', limit: default_requests_per_minute, period: 60) do |request|
-          request.ip unless request.path.start_with?('/_') # Skip internal paths by default
-        end
-
-        # Apply custom rules if provided
-        if config[:custom_rules]
-          config[:custom_rules].each do |name, rule_config|
-            limit = rule_config[:limit]
-            period = rule_config[:period] || 60
-            condition = rule_config[:condition]
-
-            Rack::Attack.throttle(name.to_s, limit: limit, period: period) do |request|
-              if condition
-                request.ip if condition.call(request)
-              else
-                request.ip
-              end
-            end
-          end
-        end
-
-        # Custom response for rate limited requests
-        Rack::Attack.throttled_responder = lambda do |request|
-          match_data = request.env['rack.attack.match_data']
-          now = match_data[:epoch_time]
-
-          headers = {
-            'content-type' => 'application/json',
-            'retry-after' => (match_data[:period] - (now % match_data[:period])).to_s,
-          }
-
-          # Check if request expects JSON
-          accept_header = request.env['HTTP_ACCEPT'].to_s
-          if accept_header.include?('application/json')
-            error_response = {
-              error: 'Rate limit exceeded',
-              message: 'Too many requests',
-              retry_after: headers['retry-after'].to_i,
-              limit: match_data[:limit],
-              period: match_data[:period],
-            }
-            [429, headers, [JSON.generate(error_response)]]
-          else
-            body = "Rate limit exceeded. Retry after #{headers['retry-after']} seconds."
-            headers['content-type'] = 'text/plain'
-            [429, headers, [body]]
-          end
-        end
-
-        # Log blocked requests if ActiveSupport is available
-        return unless defined?(ActiveSupport::Notifications)
-
-        ActiveSupport::Notifications.subscribe('rack.attack') do |_name, _start, _finish, _request_id, payload|
-          req = payload[:request]
-          Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{req.ip}: #{payload[:matched]}"
-        end
-      end
-    end
-
-    class RateLimitMiddleware
-      def initialize(app, security_config = nil)
-        @app = app
-        @security_config = security_config
-        @rate_limiter_available = defined?(Rack::Attack)
-
-        if @rate_limiter_available
-          configure_rate_limiting
-        else
-          Otto.logger.warn '[Otto] rack-attack not available - rate limiting disabled'
-        end
-      end
-
-      def call(env)
-        return @app.call(env) unless @rate_limiter_available
-
-        # Let rack-attack handle the rate limiting
-        @app.call(env)
-      end
-
-      private
-
-      def configure_rate_limiting
-        config = @security_config&.rate_limiting_config || {}
-        RateLimiting.configure_rack_attack!(config)
-      end
-    end
+    # Backward compatibility alias
+    RateLimitMiddleware = Middleware::RateLimitMiddleware
   end
 end

data/lib/otto/security/validator.rb

@@ -1,260 +1,15 @@
-# lib/otto/security/validator.rb
+# frozen_string_literal: true
 
-require 'json'
-require 'cgi'
-require 'loofah'
-require 'facets/file'
+# lib/otto/security/validator.rb
+#
+# Index file for validation middleware
+# Provides backward compatibility for existing validation usage
 
-require_relative '../helpers/validation'
+require_relative 'middleware/validation_middleware'
 
 class Otto
   module Security
-    # ValidationMiddleware provides input validation and sanitization for web requests
-    # Uses Loofah for HTML/XSS sanitization and Facets for filename sanitization
-    class ValidationMiddleware
-      # Character validation patterns
-      INVALID_CHARACTERS = /[\x00-\x1f\x7f-\xff]/n
-      NULL_BYTE          = /\0/
-
-      # HTML/XSS sanitization is handled by Loofah library for better security coverage
-
-      SQL_INJECTION_PATTERNS = [
-        /('|(\\')|(;)|(\\)|(--)|(%27)|(%3B)|(%3D))/i,
-        /(union|select|insert|update|delete|drop|create|alter|exec|execute)/i,
-        /(or|and)\s+\w+\s*=\s*\w+/i,
-        /\d+\s*(=|>|<|>=|<=|<>|!=)\s*\d+/i,
-      ].freeze
-
-      def initialize(app, config = nil)
-        @app    = app
-        @config = config || Otto::Security::Config.new
-      end
-
-      def call(env)
-        return @app.call(env) unless @config.input_validation
-
-        request = Rack::Request.new(env)
-
-        begin
-          # Validate request size
-          validate_request_size(request)
-
-          # Validate content type
-          validate_content_type(request)
-
-          # Validate and sanitize parameters
-          begin
-            validate_parameters(request) if request.params
-          rescue Rack::QueryParser::QueryLimitError => ex
-            # Handle Rack's built-in query parsing limits
-            raise Otto::Security::ValidationError, "Parameter structure too complex: #{ex.message}"
-          end
-
-          # Validate headers
-          validate_headers(request)
-
-          @app.call(env)
-        rescue Otto::Security::ValidationError => ex
-          validation_error_response(ex.message)
-        rescue Otto::Security::RequestTooLargeError => ex
-          request_too_large_response(ex.message)
-        end
-      end
-
-      private
-
-      def validate_request_size(request)
-        content_length = request.env['CONTENT_LENGTH']
-        @config.validate_request_size(content_length)
-      end
-
-      def validate_content_type(request)
-        content_type = request.env['CONTENT_TYPE']
-        return unless content_type
-
-        # Block dangerous content types
-        dangerous_types = [
-          'application/x-shockwave-flash',
-          'application/x-silverlight-app',
-          'text/vbscript',
-          'application/vbscript',
-        ]
-
-        if dangerous_types.any? { |type| content_type.downcase.include?(type) }
-          raise Otto::Security::ValidationError, "Dangerous content type: #{content_type}"
-        end
-      end
-
-      def validate_parameters(request)
-        validate_param_structure(request.params, 0)
-        sanitize_params(request.params)
-      end
-
-      def validate_param_structure(params, depth = 0)
-        if depth >= @config.max_param_depth
-          raise Otto::Security::ValidationError, "Parameter depth exceeds maximum (#{@config.max_param_depth})"
-        end
-
-        case params
-        when Hash
-          if params.keys.length > @config.max_param_keys
-            raise Otto::Security::ValidationError, "Too many parameters (#{params.keys.length} > #{@config.max_param_keys})"
-          end
-
-          params.each do |key, value|
-            validate_param_key(key)
-            validate_param_structure(value, depth + 1) if value.is_a?(Hash) || value.is_a?(Array)
-          end
-        when Array
-          if params.length > @config.max_param_keys
-            raise Otto::Security::ValidationError, "Too many array elements (#{params.length} > #{@config.max_param_keys})"
-          end
-
-          params.each do |value|
-            validate_param_structure(value, depth + 1) if value.is_a?(Hash) || value.is_a?(Array)
-          end
-        end
-      end
-
-      def validate_param_key(key)
-        key_str = key.to_s
-
-        # Check for dangerous characters in parameter names using shared patterns
-        if key_str.match?(NULL_BYTE) || key_str.match?(INVALID_CHARACTERS)
-          raise Otto::Security::ValidationError, "Invalid characters in parameter name: #{key_str}"
-        end
-
-        # Check for suspiciously long parameter names
-        if key_str.length > 256
-          raise Otto::Security::ValidationError, "Parameter name too long: #{key_str[0..50]}..."
-        end
-      end
-
-      def sanitize_params(params)
-        case params
-        when Hash
-          params.each do |key, value|
-            params[key] = sanitize_value(value)
-          end
-        when Array
-          params.map! { |value| sanitize_value(value) }
-        else
-          sanitize_value(params)
-        end
-      end
-
-      def sanitize_value(value)
-        return value unless value.is_a?(String)
-
-        # Check for extremely long values first
-        if value.length > 10_000
-          raise Otto::Security::ValidationError, "Parameter value too long (#{value.length} characters)"
-        end
-
-        # Start with the original value
-        original = value.dup
-
-        # Check for null bytes first (these should be rejected, not sanitized)
-        if original.match?(NULL_BYTE)
-          raise Otto::Security::ValidationError, 'Dangerous content detected in parameter'
-        end
-
-        # Check for script injection first (these should always be rejected)
-        if looks_like_script_injection?(original)
-          raise Otto::Security::ValidationError, 'Dangerous content detected in parameter'
-        end
-
-        # Use Loofah to sanitize HTML/XSS content for less dangerous HTML
-        # Loofah.fragment removes dangerous HTML but preserves safe content
-        sanitized = Loofah.fragment(original).scrub!(:whitewash).to_s
-
-        # Remove control characters (sanitize, don't block)
-        sanitized = sanitized.gsub(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, '')
-
-        # Check for SQL injection patterns
-        SQL_INJECTION_PATTERNS.each do |pattern|
-          if sanitized.match?(pattern)
-            raise Otto::Security::ValidationError, 'Potential SQL injection detected'
-          end
-        end
-
-        sanitized
-      end
-
-      include ValidationHelpers
-
-      private
-
-      def validate_headers(request)
-        # Check for dangerous headers
-        dangerous_headers = %w[
-          HTTP_X_FORWARDED_HOST
-          HTTP_X_ORIGINAL_URL
-          HTTP_X_REWRITE_URL
-          HTTP_DESTINATION
-          HTTP_UPGRADE_INSECURE_REQUESTS
-        ]
-
-        dangerous_headers.each do |header|
-          value = request.env[header]
-          next unless value
-
-          # Basic validation - no null bytes or control characters
-          if value.match?(NULL_BYTE) || value.match?(INVALID_CHARACTERS)
-            raise Otto::Security::ValidationError, "Invalid characters in header: #{header}"
-          end
-        end
-
-        # Validate User-Agent length
-        user_agent = request.env['HTTP_USER_AGENT']
-        if user_agent && user_agent.length > 1000
-          raise Otto::Security::ValidationError, 'User-Agent header too long'
-        end
-
-        # Validate Referer header
-        referer = request.env['HTTP_REFERER']
-        if referer && referer.length > 2000
-          raise Otto::Security::ValidationError, 'Referer header too long'
-        end
-      end
-
-      def validation_error_response(message)
-        [
-          400,
-          {
-            'content-type' => 'application/json',
-            'content-length' => validation_error_body(message).bytesize.to_s,
-          },
-          [validation_error_body(message)],
-        ]
-      end
-
-      def request_too_large_response(message)
-        [
-          413,
-          {
-            'content-type' => 'application/json',
-            'content-length' => request_too_large_body(message).bytesize.to_s,
-          },
-          [request_too_large_body(message)],
-        ]
-      end
-
-      def validation_error_body(message)
-        require 'json'
-        {
-          error: 'Validation failed',
-          message: message,
-        }.to_json
-      end
-
-      def request_too_large_body(message)
-        require 'json'
-        {
-          error: 'Request too large',
-          message: message,
-        }.to_json
-      end
-    end
+    # Backward compatibility alias
+    ValidationMiddleware = Middleware::ValidationMiddleware
   end
 end

data/lib/otto/static.rb

@@ -1,6 +1,9 @@
+# frozen_string_literal: true
+
 # lib/otto/static.rb
 
 class Otto
+  # Static response utilities for common HTTP responses
   module Static
     extend self
 

data/lib/otto/utils.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# lib/otto/utils.rb
+
+class Otto
+  # Utility methods for common operations and helpers
+  module Utils
+    extend self
+
+    def yes?(value)
+      !value.to_s.empty? && %w[true yes 1].include?(value.to_s.downcase)
+    end
+  end
+end

data/lib/otto/version.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 # lib/otto/version.rb
 
 class Otto
-  VERSION = '1.6.0'.freeze
+  VERSION = '2.0.0.pre1'
 end