paraxial 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea5f2156685b5204495019d6a72ad0f433326438abfef4e70e26b39ab62bf58b
-  data.tar.gz: 4dd855ada83c429df5422b42177af07863041ef94feb14912375df5f8d18e807
+  metadata.gz: fa19e78278421371d0e25cd1e387383676df44a7d09ec936520e6e2e9a4fa70f
+  data.tar.gz: 807b6b4401164502c8b38ea4b6ff861c667b0aee5fcd124d68a5f98c19ed5e38
 SHA512:
-  metadata.gz: 5f458988de37e4a6c9c0a8f8e1489b613925faf48d11dc59c1addbcca49acc740292cddae12bd675c25c8c640a2f45133e5ed6d9232c8319f74fe868c2e2396e
-  data.tar.gz: 81504558ae7231a7f5f5397f6ca640faf63532c15686d61942d54a306c0d28b865f3e11e8c17973729a1b200c74ad3246f149ca46a53635e91dfa229fe57a998
+  metadata.gz: f99fc3adc1dab0e302e45b26b2a245055b2b03eac517e5640b7f18828de1a78d64362a37811be9221b4f5c560feff727324b171d1c9493609b513de43579780a
+  data.tar.gz: fbe25d2549601ab95b67934deda8dd1e070d7ced5cb0abf570f85b8650acc9700d35c4274f3460a25d434a6f09c67ad80b85927564da3ba78a1b1dfa9b9ed2d0

data/lib/paraxial/checker.rb

@@ -0,0 +1,138 @@
+require 'rpatricia'
+module Paraxial
+  module Checker
+    @allows = { 'v4' => Patricia.new, 'v6' => Patricia.new(:AF_INET6) }
+    @bans = { 'v4' => Patricia.new, 'v6' => Patricia.new(:AF_INET6) }
+
+
+    if Paraxial::Helpers.get_api_key
+      @thread = Thread.new do
+        loop do
+          get_abr
+          sleep(10)
+        end
+      end
+    end
+
+    def self.get_abr
+      uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/abr')
+      headers = { 'Content-Type': 'application/json' }
+
+      body = { api_key: Paraxial::Helpers.get_api_key }
+      begin
+        r = Net::HTTP.post(uri, body.to_json, headers)
+        if r.code == '200'
+          put_abr(JSON.parse(r.body))
+        else
+          'ab_failed'
+        end
+      rescue StandardError => e
+        puts '[Paraxial] HTTP connection to backend failed, check configuration'
+        'ab_failed'
+      end
+    end
+
+    def self.put_abr(abr)
+      # Expected input: a hash
+      # {"allows"=>[{"address"=>[96, 56, 162, 210], "netmask"=>32}],
+      # "bans"=>
+      # [{"address"=>[8193, 3512, 34211, 0, 0, 35374, 880, 29492], "netmask"=>128},
+      # {"address"=>[111, 56, 162, 210], "netmask"=>32}],
+      # "rules"=>[]}
+      ipv4_a = []
+      ipv4_b = []
+      ipv6_a = []
+      ipv6_b = []
+      abr.each do |key, value|
+        next if key == 'rules' # skip rules for now
+
+        value.each do |ip|
+          address = ip['address']
+          if address.length == 4
+            if key == 'allows'
+              ipv4_a << address.join('.')
+            elsif key == 'bans'
+              ipv4_b << address.join('.')
+            end
+          elsif key == 'allows'
+            ipv6_a << address.map { |n| n.to_s(16).rjust(4, '0') }.join(':')
+          elsif key == 'bans'
+            ipv6_b << address.map { |n| n.to_s(16).rjust(4, '0') }.join(':')
+          end
+        end
+      end
+
+      ab = { 'allows' => { 'v4' => ipv4_a, 'v6' => ipv6_a }, 'bans' => { 'v4' => ipv4_b, 'v6' => ipv6_b } }
+      Paraxial::Checker.put(ab)
+    end
+
+    def self.put(allow_ban)
+      allows = allow_ban['allows']
+      bans = allow_ban['bans']
+      @allows = { 'v4' => create_patricia(allows['v4'], 'v4'), 'v6' => create_patricia(allows['v6'], 'v6') }
+      @bans = { 'v4' => create_patricia(bans['v4'], 'v4'), 'v6' => create_patricia(bans['v6'], 'v6') }
+      :ok
+    end
+
+    def self.create_patricia(list, type)
+      if type == 'v4'
+        p = Patricia.new
+        list.each do |ip|
+          p.add(ip)
+        end
+        p
+      elsif type == 'v6'
+        p = Patricia.new(:AF_INET6)
+        list.each do |ip|
+          p.add(ip)
+        end
+        p
+      else
+        raise 'Wrong type in Paraxial::Checker.create_patricia'
+      end
+    end
+
+    def self.ban_ip(ip)
+      if ip.include?('.')
+        # IPv4
+        current_t = @bans['v4']
+        current_t.add(ip)
+        @bans['v4'] = current_t
+      else
+        # IPv6
+        current_t = @bans['v6']
+        current_t.add(ip)
+        @bans['v6'] = current_t
+      end
+
+      uri = URI.parse(Paraxial::Helpers.get_ban_url)
+      headers = { 'Content-Type': 'application/json' }
+
+      body = { api_key: Paraxial::Helpers.get_api_key, ip_address: ip }
+      r = Net::HTTP.post(uri, body.to_json, headers)
+      if r.code == '200'
+        :ok
+      else
+        :error
+      end
+    end
+
+    def self.allow_ip?(ip)
+      if ip.include?('.')
+        if !@allows['v4'].search_best(ip).nil? # v4 on allow list
+          true
+        elsif !@bans['v4'].search_best(ip).nil? # v4 on ban list
+          false
+        else # v4 on no list
+          true
+        end
+      elsif !@allows['v6'].search_best(ip).nil? # v6 on allow list
+        true
+      elsif !@bans['v6'].search_best(ip).nil? # v6 on ban list
+        false
+      else # v6 on no list
+        true
+      end
+    end
+  end
+end

data/lib/paraxial/cli.rb

@@ -18,15 +18,8 @@ module Paraxial
 
     def scan
       puts '[Paraxial] Scan starting...'
-      if check_rubocop_configuration
-        puts '[Paraxial] .rubocop.yml contains the required paraxial configuration.'
-      else
-        puts '[Paraxial] .rubocop.yml does not contain the required paraxial configuration.'
-        puts '[Paraxial] How to configure: TODO_URL'
-        exit
-      end
 
-      if ENV['PARAXIAL_API_KEY'].nil?
+      if Paraxial::Helpers.get_api_key.nil?
         puts '[Paraxial] Environment variable PARAXIAL_API_KEY not found'
       else
         github_app = options[:github_app]
@@ -36,24 +29,35 @@ module Paraxial
         pr_number = options[:pr_number]
 
         cops = 'Paraxial,Security/Eval,Security/IoMethods,Security/JSONLoad,Security/MarshalLoad,Security/Open,Security/YAMLLoad'
-        rubocop = `rubocop --only #{cops} --format json`
+        rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json`
         lockfile = File.read('./Gemfile.lock')
         api_key = ENV['PARAXIAL_API_KEY']
         uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_scan')
         headers = { 'Content-Type': 'application/json' }
 
-        body = { rubocop:, lockfile:, api_key:, timestamp: Paraxial.get_timestamp }
+        body = { rubocop: rubocop, lockfile: lockfile, api_key: api_key, timestamp: Paraxial.get_timestamp }
         response = Net::HTTP.post(uri, body.to_json, headers)
-        puts "[Paraxial] scan result: #{response.body}"
+        m = JSON.parse(response.body)
+        findings = m['ok']['findings']
+        puts
+        puts "[Paraxial] Scan count #{findings.length}"
+        puts
+        findings.each do |finding|
+          puts finding
+          puts
+        end
+        puts "[Paraxial] Scan UUID #{m['ok']['scan_uuid']}"
+        puts "[Paraxial] Scan URL #{m['ok']['scan_url']}"
         github_valid = (!!github_app and !!install_id and !!repo_owner and !!repo_name and !!pr_number)
 
         if github_app and github_valid == false
           puts '[Paraxial] --github_app missing arguments'
           puts '[Paraxial] Required: --github_app, --install_id, --repo_owner, --repo_name, --pr_number'
         elsif github_app and github_valid
-          uuid_regex = /UUID\s+(\S+)/
-          match = response.body.match(uuid_regex)
-          uuid = match[1] if match
+          # uuid_regex = /UUID\s+(\S+)/
+          # match = response.body.match(uuid_regex)
+          # uuid = match[1] if match
+          uuid = m['ok']['scan_uuid']
           if uuid
             final_uuid = uuid.chomp('.')
             censored_backend_map = {
@@ -85,21 +89,5 @@ module Paraxial
       end
     end
 
-    private
-
-    def check_rubocop_configuration
-      rubocop_file = File.join(Dir.pwd, '.rubocop.yml')
-
-      return false unless File.exist?(rubocop_file)
-
-      config = YAML.load_file(rubocop_file)
-      required_key = 'require'
-
-      if config.is_a?(Hash) && config[required_key].is_a?(Array)
-        config[required_key].include?('paraxial')
-      else
-        false
-      end
-    end
   end
 end

data/lib/paraxial/helpers.rb

@@ -3,5 +3,17 @@ module Paraxial
     def self.get_paraxial_url
       @paraxial_url ||= ENV['PARAXIAL_URL'] || 'https://app.paraxial.io/'
     end
+
+    def self.get_ban_url
+      get_paraxial_url + '/api/ban_ip'
+    end
+
+    def self.get_exploit_url
+      get_paraxial_url + '/api/exploit'
+    end
+
+    def self.get_api_key
+      @paraxial_api_key ||= ENV['PARAXIAL_API_KEY']
+    end
   end
 end

data/lib/paraxial/initializers/marshal_patch.rb

@@ -0,0 +1,37 @@
+unless Rails.env.test? || File.basename($0) == 'rake' || defined?(Rails::Generators)
+  module Marshal
+    class << self
+      alias_method :original_load, :load
+
+      def load(source, proc = nil)
+        exg = Paraxial.configuration.exploit_guard
+        if [:monitor, :block].include?(exg)
+          if source.is_a?(String) && source.match?(/ActionView|Net::BufferedIO|ERB|ActiveSupport/)
+            puts "[Paraxial] Exploit Guard triggered, malicious input to Marshal.load"
+            puts source
+
+            m = {
+              "api_key" => Paraxial::Helpers.get_api_key,
+              "mode" => exg,
+              "message" =>  "Marshal.load exploit behavior detected: #{Base64.encode64(source)}"
+            }
+            headers = { 'Content-Type': 'application/json' }
+            uri = URI.parse(Paraxial::Helpers.get_exploit_url)
+            Thread.new do
+              Net::HTTP.post(uri, m.to_json, headers)
+            end
+            if exg == :monitor
+              original_load(source, proc)
+            else
+              :block
+            end
+          else
+            original_load(source, proc)
+          end
+        else
+          original_load(source, proc)
+        end
+      end
+    end
+  end
+end

data/lib/paraxial/initializers/startup.rb

@@ -2,65 +2,75 @@ require 'bundler'
 require 'paraxial'
 require 'rpatricia'
 require_relative '../helpers'
+require_relative '../checker'
 
 Bundler.setup
 
-Rails.application.config.to_prepare do
-  puts '[Paraxial] Init start'
-  api_key = ENV['PARAXIAL_API_KEY']
+unless Rails.env.test? || File.basename($0) == 'rake' || defined?(Rails::Generators)
+  Rails.application.config.to_prepare do
+    puts '[Paraxial] Agent starting...'
+    api_key = Paraxial::Helpers.get_api_key
 
-  if api_key.nil?
-    puts '[Paraxial] Init PARAXIAL_API_KEY key not set, agent not started'
-  elsif Rails.env.test?
-    puts '[Paraxial] Init Test environment detected, agent not started'
-  else
-    begin
-      puts '[Paraxial] Init config valid, agent starting'
-      deps_and_licenses = []
-      Bundler.load.specs.each do |spec|
-        # Print the gem name and license
-        h = { name: spec.name, version: spec.version.to_s, description: Paraxial.trim_dep(spec.description),
-              license: spec.license || 'None' }
-        deps_and_licenses << h
-      end
-      deps_and_licenses << { name: 'ruby', version: RUBY_VERSION, description: 'The Ruby Programming Language',
-                             license: 'Ruby' }
-      uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_app_lic')
-      headers = { 'Content-Type': 'application/json' }
+    if api_key.nil?
+      puts '[Paraxial] PARAXIAL_API_KEY key not set, agent not started'
+    elsif Rails.env.test?
+      puts '[Paraxial] Test environment detected, agent not started'
+    else
+      begin
+        puts '[Paraxial] API key detected, agent starting'
 
-      body = { app_lic: deps_and_licenses, api_key:, timestamp: Paraxial.get_timestamp }
-      cloud_uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/cloud_ip_list')
-      response = Net::HTTP.get(cloud_uri)
+        Paraxial.check_exploit_guard
 
-      Thread.new do
-        Net::HTTP.post(uri, body.to_json, headers)
-      end
+        deps_and_licenses = []
+        Bundler.load.specs.each do |spec|
+          # Print the gem name and license
+          h = { name: spec.name, version: spec.version.to_s, description: Paraxial.trim_dep(spec.description),
+                license: spec.license || 'None' }
+          deps_and_licenses << h
+        end
+        deps_and_licenses << { name: 'ruby', version: RUBY_VERSION, description: 'The Ruby Programming Language',
+                               license: 'Ruby' }
+        uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_app_lic')
+        headers = { 'Content-Type': 'application/json' }
+
+        body = { app_lic: deps_and_licenses, api_key: api_key, timestamp: Paraxial.get_timestamp }
+        cloud_uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/cloud_ip_list')
+        response = Net::HTTP.get(cloud_uri)
+
+        Thread.new do
+          Net::HTTP.post(uri, body.to_json, headers)
+        end
 
-      # https://github.com/jkitching/rpatricia
-      pt_v4 = Patricia.new
-      pt_v6 = Patricia.new(:AF_INET6)
-      cloud_list = JSON.parse(response)
-      cloud_list.each do |k, v|
-        if k.include?('::')
-          pt_v6.add(k, v)
-        else
-          pt_v4.add(k, v)
+        # https://github.com/jkitching/rpatricia
+        pt_v4 = Patricia.new
+        pt_v6 = Patricia.new(:AF_INET6)
+        cloud_list = JSON.parse(response)
+        cloud_list.each do |k, v|
+          if k.include?('::')
+            pt_v6.add(k, v)
+          else
+            pt_v4.add(k, v)
+          end
         end
+        puts '[Paraxial] Cloud IPs set'
+        # puts '[Paraxial] pt_v4.num_nodes'
+        # puts pt_v4.num_nodes
+        # puts 'pt_v6.num_nodes'
+        # puts pt_v6.num_nodes
+        PARAXIAL_IPV4 = pt_v4
+        PARAXIAL_IPV6 = pt_v6
+        # ab = Paraxial.get_abr
+        # puts "[Paraxial] Allows/Bans set: #{ab}"
+      rescue Errno::ECONNREFUSED => _e
+        puts '[Paraxial] Init HTTP request failed, check configuration'
+        PARAXIAL_IPV4 = Patricia.new unless defined?(PARAXIAL_IPV4)
+        PARAXIAL_IPV6 = Patricia.new(:AF_INET6) unless defined?(PARAXIAL_IPV4)
+      rescue StandardError => e
+        puts e
+        puts '[Paraxial] Init error, check configuration'
+        PARAXIAL_IPV4 = Patricia.new unless defined?(PARAXIAL_IPV4)
+        PARAXIAL_IPV6 = Patricia.new(:AF_INET6) unless defined?(PARAXIAL_IPV4)
       end
-      # puts '[Paraxial] pt_v4.num_nodes'
-      # puts pt_v4.num_nodes
-      # puts 'pt_v6.num_nodes'
-      # puts pt_v6.num_nodes
-      PARAXIAL_IPV4 = pt_v4
-      PARAXIAL_IPV6 = pt_v6
-    rescue Errno::ECONNREFUSED => _e
-      puts '[Paraxial] Init HTTP request failed, check configuration'
-      PARAXIAL_IPV4 = Patricia.new
-      PARAXIAL_IPV6 = Patricia.new(:AF_INET6)
-    rescue StandardError => _e
-      puts '[Paraxial] Init error, check configuration'
-      PARAXIAL_IPV4 = Patricia.new
-      PARAXIAL_IPV6 = Patricia.new(:AF_INET6)
     end
   end
 end

data/lib/paraxial/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paraxial
-  VERSION = '0.3.0'
+  VERSION = '0.5.0'
 end

data/lib/paraxial.rb

@@ -9,11 +9,14 @@ require_relative 'rubocop/cop/paraxial/send'
 require_relative 'rubocop/cop/paraxial/constantize'
 require_relative 'rubocop/cop/paraxial/html_safe'
 require_relative 'rubocop/cop/paraxial/sql'
-require_relative "paraxial/version"
+require_relative 'paraxial/version'
 require_relative 'paraxial/cli'
 
-
 module Paraxial
+  class << self
+    attr_accessor :configuration
+  end
+
   class Error < StandardError; end
   # Your code goes here...
 
@@ -27,7 +30,7 @@ module Paraxial
 
       if request_path.end_with?('.php')
         # Return a 404 response if the request path ends with '.php'
-        [404, { 'Content-Type' => 'text/plain' }, ["Not Found from Paraxial.io"]]
+        [404, { 'Content-Type' => 'text/plain' }, ['Not Found from Paraxial.io']]
       else
         # Pass the request to the next middleware or the application
         @app.call(env)
@@ -37,15 +40,27 @@ module Paraxial
 
   def self.get_timestamp
     utc_time = Time.now.utc
-    utc_time.strftime("%Y-%m-%d %H:%M:%S.%6N") + "Z"
+    utc_time.strftime('%Y-%m-%d %H:%M:%S.%6N') + 'Z'
   end
 
   def self.cloud_ip?(ip)
-    !!(PARAXIAL_IPV4.search_best(ip) or PARAXIAL_IPV6.search_best(ip))
+    if ip.include?('.')
+      !!PARAXIAL_IPV4.search_best(ip)
+    else
+      !!PARAXIAL_IPV6.search_best(ip)
+    end
+  end
+
+  def self.ban_ip(ip)
+    Paraxial::Checker.ban_ip(ip)
+  end
+
+  def self.allow_ip?(ip)
+    Paraxial::Checker.allow_ip?(ip)
   end
 
   def self.trim_dep(input)
-    if input == nil
+    if input.nil?
       nil
     else
       cleaned_string = input.gsub(/\n/, '')
@@ -54,11 +69,40 @@ module Paraxial
       period_index = cleaned_string.index('.')
 
       # If there's a period, truncate the string up to that point
-      if period_index
-        cleaned_string = cleaned_string[0..period_index]
-      end
+      cleaned_string = cleaned_string[0..period_index] if period_index
 
       cleaned_string
     end
   end
+
+  def self.configure
+    self.configuration ||= Configuration.new
+    yield(configuration) if block_given?
+  end
+
+  def self.check_exploit_guard
+    if configuration.nil?
+      puts "[Paraxial] Exploit Guard, no config exists, will not run"
+      return
+    end
+
+    case configuration.exploit_guard
+    when :monitor
+      puts "[Paraxial] Exploit Guard, running in monitor mode"
+    when :block
+      puts "[Paraxial] Exploit Guard, running in block mode"
+    when nil
+      puts "[Paraxial] Exploit Guard, not configured, will not run"
+    else
+      puts "[Paraxial] Exploit Guard, bad value"
+    end
+  end
+
+  class Configuration
+    attr_accessor :exploit_guard
+
+    def initialize
+      @exploit_guard = nil
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paraxial
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Michael Lubas
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-08-13 00:00:00.000000000 Z
+date: 2024-08-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -80,9 +80,11 @@ files:
 - Rakefile
 - exe/paraxial
 - lib/paraxial.rb
+- lib/paraxial/checker.rb
 - lib/paraxial/cli.rb
 - lib/paraxial/engine.rb
 - lib/paraxial/helpers.rb
+- lib/paraxial/initializers/marshal_patch.rb
 - lib/paraxial/initializers/startup.rb
 - lib/paraxial/version.rb
 - lib/rubocop/cop/paraxial/constantize.rb