paraxial 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce7c75f780f9b356d4a15b4fb834bb6f064a8f5a39ead6e629a4f42ff2768010
-  data.tar.gz: 929b701d0e47c7a12b1654c3426e515b37824f591b7a65b2c9a22630c72bc8cc
+  metadata.gz: fa19e78278421371d0e25cd1e387383676df44a7d09ec936520e6e2e9a4fa70f
+  data.tar.gz: 807b6b4401164502c8b38ea4b6ff861c667b0aee5fcd124d68a5f98c19ed5e38
 SHA512:
-  metadata.gz: b1d9decea112098e9c71cf36d071fe1fbe86028ac23b34d4b9a704771d7a007a42f56abbaea51dc65825067e0ac5d029781b7c344c82a3cd339716908f6d8451
-  data.tar.gz: 54bff15c7c351b7f3e74eae787d2858f12e4ded57be06cb3f5872147cdccae90819396837fa60e5ddeda6fff758eddeef0868fed4d02748c3873282c6c59306e
+  metadata.gz: f99fc3adc1dab0e302e45b26b2a245055b2b03eac517e5640b7f18828de1a78d64362a37811be9221b4f5c560feff727324b171d1c9493609b513de43579780a
+  data.tar.gz: fbe25d2549601ab95b67934deda8dd1e070d7ced5cb0abf570f85b8650acc9700d35c4274f3460a25d434a6f09c67ad80b85927564da3ba78a1b1dfa9b9ed2d0

data/lib/paraxial/checker.rb

@@ -4,10 +4,13 @@ module Paraxial
     @allows = { 'v4' => Patricia.new, 'v6' => Patricia.new(:AF_INET6) }
     @bans = { 'v4' => Patricia.new, 'v6' => Patricia.new(:AF_INET6) }
 
-    @thread = Thread.new do
-      loop do
-        get_abr
-        sleep(10)
+
+    if Paraxial::Helpers.get_api_key
+      @thread = Thread.new do
+        loop do
+          get_abr
+          sleep(10)
+        end
       end
     end
 
@@ -15,11 +18,16 @@ module Paraxial
       uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/abr')
       headers = { 'Content-Type': 'application/json' }
 
-      body = { api_key: ENV['PARAXIAL_API_KEY'] }
-      r = Net::HTTP.post(uri, body.to_json, headers)
-      if r.code == '200'
-        put_abr(JSON.parse(r.body))
-      else
+      body = { api_key: Paraxial::Helpers.get_api_key }
+      begin
+        r = Net::HTTP.post(uri, body.to_json, headers)
+        if r.code == '200'
+          put_abr(JSON.parse(r.body))
+        else
+          'ab_failed'
+        end
+      rescue StandardError => e
+        puts '[Paraxial] HTTP connection to backend failed, check configuration'
         'ab_failed'
       end
     end
@@ -100,7 +108,7 @@ module Paraxial
       uri = URI.parse(Paraxial::Helpers.get_ban_url)
       headers = { 'Content-Type': 'application/json' }
 
-      body = { api_key: ENV['PARAXIAL_API_KEY'], ip_address: ip }
+      body = { api_key: Paraxial::Helpers.get_api_key, ip_address: ip }
       r = Net::HTTP.post(uri, body.to_json, headers)
       if r.code == '200'
         :ok

data/lib/paraxial/cli.rb

@@ -18,15 +18,8 @@ module Paraxial
 
     def scan
       puts '[Paraxial] Scan starting...'
-      if check_rubocop_configuration
-        puts '[Paraxial] .rubocop.yml contains the required paraxial configuration.'
-      else
-        puts '[Paraxial] .rubocop.yml does not contain the required paraxial configuration.'
-        puts '[Paraxial] How to configure: TODO_URL'
-        exit
-      end
 
-      if ENV['PARAXIAL_API_KEY'].nil?
+      if Paraxial::Helpers.get_api_key.nil?
         puts '[Paraxial] Environment variable PARAXIAL_API_KEY not found'
       else
         github_app = options[:github_app]
@@ -36,7 +29,7 @@ module Paraxial
         pr_number = options[:pr_number]
 
         cops = 'Paraxial,Security/Eval,Security/IoMethods,Security/JSONLoad,Security/MarshalLoad,Security/Open,Security/YAMLLoad'
-        rubocop = `rubocop --only #{cops} --format json`
+        rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json`
         lockfile = File.read('./Gemfile.lock')
         api_key = ENV['PARAXIAL_API_KEY']
         uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_scan')
@@ -96,21 +89,5 @@ module Paraxial
       end
     end
 
-    private
-
-    def check_rubocop_configuration
-      rubocop_file = File.join(Dir.pwd, '.rubocop.yml')
-
-      return false unless File.exist?(rubocop_file)
-
-      config = YAML.load_file(rubocop_file)
-      required_key = 'require'
-
-      if config.is_a?(Hash) && config[required_key].is_a?(Array)
-        config[required_key].include?('paraxial')
-      else
-        false
-      end
-    end
   end
 end

data/lib/paraxial/helpers.rb

@@ -7,5 +7,13 @@ module Paraxial
     def self.get_ban_url
       get_paraxial_url + '/api/ban_ip'
     end
+
+    def self.get_exploit_url
+      get_paraxial_url + '/api/exploit'
+    end
+
+    def self.get_api_key
+      @paraxial_api_key ||= ENV['PARAXIAL_API_KEY']
+    end
   end
 end

data/lib/paraxial/initializers/marshal_patch.rb

@@ -0,0 +1,37 @@
+unless Rails.env.test? || File.basename($0) == 'rake' || defined?(Rails::Generators)
+  module Marshal
+    class << self
+      alias_method :original_load, :load
+
+      def load(source, proc = nil)
+        exg = Paraxial.configuration.exploit_guard
+        if [:monitor, :block].include?(exg)
+          if source.is_a?(String) && source.match?(/ActionView|Net::BufferedIO|ERB|ActiveSupport/)
+            puts "[Paraxial] Exploit Guard triggered, malicious input to Marshal.load"
+            puts source
+
+            m = {
+              "api_key" => Paraxial::Helpers.get_api_key,
+              "mode" => exg,
+              "message" =>  "Marshal.load exploit behavior detected: #{Base64.encode64(source)}"
+            }
+            headers = { 'Content-Type': 'application/json' }
+            uri = URI.parse(Paraxial::Helpers.get_exploit_url)
+            Thread.new do
+              Net::HTTP.post(uri, m.to_json, headers)
+            end
+            if exg == :monitor
+              original_load(source, proc)
+            else
+              :block
+            end
+          else
+            original_load(source, proc)
+          end
+        else
+          original_load(source, proc)
+        end
+      end
+    end
+  end
+end

data/lib/paraxial/initializers/startup.rb

@@ -8,16 +8,19 @@ Bundler.setup
 
 unless Rails.env.test? || File.basename($0) == 'rake' || defined?(Rails::Generators)
   Rails.application.config.to_prepare do
-    puts '[Paraxial] Init start'
-    api_key = ENV['PARAXIAL_API_KEY']
+    puts '[Paraxial] Agent starting...'
+    api_key = Paraxial::Helpers.get_api_key
 
     if api_key.nil?
-      puts '[Paraxial] Init PARAXIAL_API_KEY key not set, agent not started'
+      puts '[Paraxial] PARAXIAL_API_KEY key not set, agent not started'
     elsif Rails.env.test?
-      puts '[Paraxial] Init Test environment detected, agent not started'
+      puts '[Paraxial] Test environment detected, agent not started'
     else
       begin
-        puts '[Paraxial] Init config valid, agent starting'
+        puts '[Paraxial] API key detected, agent starting'
+
+        Paraxial.check_exploit_guard
+
         deps_and_licenses = []
         Bundler.load.specs.each do |spec|
           # Print the gem name and license
@@ -30,7 +33,7 @@ unless Rails.env.test? || File.basename($0) == 'rake' || defined?(Rails::Generat
         uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_app_lic')
         headers = { 'Content-Type': 'application/json' }
 
-        body = { app_lic: deps_and_licenses, api_key:, timestamp: Paraxial.get_timestamp }
+        body = { app_lic: deps_and_licenses, api_key: api_key, timestamp: Paraxial.get_timestamp }
         cloud_uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/cloud_ip_list')
         response = Net::HTTP.get(cloud_uri)
 

data/lib/paraxial/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paraxial
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

data/lib/paraxial.rb

@@ -13,6 +13,10 @@ require_relative 'paraxial/version'
 require_relative 'paraxial/cli'
 
 module Paraxial
+  class << self
+    attr_accessor :configuration
+  end
+
   class Error < StandardError; end
   # Your code goes here...
 
@@ -40,7 +44,11 @@ module Paraxial
   end
 
   def self.cloud_ip?(ip)
-    !!(PARAXIAL_IPV4.search_best(ip) or PARAXIAL_IPV6.search_best(ip))
+    if ip.include?('.')
+      !!PARAXIAL_IPV4.search_best(ip)
+    else
+      !!PARAXIAL_IPV6.search_best(ip)
+    end
   end
 
   def self.ban_ip(ip)
@@ -66,4 +74,35 @@ module Paraxial
       cleaned_string
     end
   end
+
+  def self.configure
+    self.configuration ||= Configuration.new
+    yield(configuration) if block_given?
+  end
+
+  def self.check_exploit_guard
+    if configuration.nil?
+      puts "[Paraxial] Exploit Guard, no config exists, will not run"
+      return
+    end
+
+    case configuration.exploit_guard
+    when :monitor
+      puts "[Paraxial] Exploit Guard, running in monitor mode"
+    when :block
+      puts "[Paraxial] Exploit Guard, running in block mode"
+    when nil
+      puts "[Paraxial] Exploit Guard, not configured, will not run"
+    else
+      puts "[Paraxial] Exploit Guard, bad value"
+    end
+  end
+
+  class Configuration
+    attr_accessor :exploit_guard
+
+    def initialize
+      @exploit_guard = nil
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paraxial
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Michael Lubas
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-08-22 00:00:00.000000000 Z
+date: 2024-08-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -84,6 +84,7 @@ files:
 - lib/paraxial/cli.rb
 - lib/paraxial/engine.rb
 - lib/paraxial/helpers.rb
+- lib/paraxial/initializers/marshal_patch.rb
 - lib/paraxial/initializers/startup.rb
 - lib/paraxial/version.rb
 - lib/rubocop/cop/paraxial/constantize.rb