perimeter_x 1.1.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 8821c69fed2516694f5cfc66c4fd86cb8350e1c6
-  data.tar.gz: cb26bfa40459f6e0745c9d1d1bdb94a07ade258b
+SHA256:
+  metadata.gz: d65b91dbf3bdf1829dbfe7b1d44677d86ecde223bc0bd614618d1a9b1a188e84
+  data.tar.gz: 473dc3f4a54232d59c2f89dcc6a1bddbb6a95de0268fddf53cfa28b47e8653d6
 SHA512:
-  metadata.gz: 79d0af263099a0b1cc363546e26a2c7c3c42b80e71a7eb1b39c9f07a784ad5ad925598aa42be2036cc79620528762398c4ac58d1ee448ca792b55aa422bf2784
-  data.tar.gz: a13e5dab8ce2a5a9380996921799a5e90bb3b141f10b08b13821b07ff36efaa6cb12c1b853f7071e7ebcc3d2ffa84e21233d8442f07a01aa3607a80f287edf77
+  metadata.gz: a89194401d9a60cd41fdb524724329bee547285742c218ffd157337203090ab66f4992fed517389868c639fea175a9c3561663b81b2463a9b1f3fb0011391e7b
+  data.tar.gz: 428757d1a7dafc96543a125db63a8a2c7639ba27673f96bd5222b1628bafcd117f26d1fefb8041179f30e89f5ea286454ebbfb897b0d81d54e5be2be24d6fb8e

data/.gitignore

@@ -1,4 +1,5 @@
 *.rbc
+*.iml
 capybara-*.html
 .rspec
 /log

data/.travis.yml

@@ -0,0 +1,3 @@
+language: ruby
+rvm:
+    - 2.7.1

data/Dockerfile

@@ -1,50 +1,26 @@
 # Based on manual compile instructions at http://wiki.nginx.org/HttpLuaModule#Installation
-FROM ubuntu:14.04
-RUN apt-get update && apt-get --force-yes -qq -y install \
-    build-essential \
-    ca-certificates \
-    curl \
-    git \
-    libpcre3 \
-    libpcre3-dev \
-    libssl-dev \
-    libreadline-dev \
-    libyaml-dev \
-    libgdbm-dev \
-    libtool \
-    automake \
-    bison \
-    lua-cjson \
-    libncurses5-dev \
-    m4 \
-    libsqlite3-dev \
-    rsyslog \
-    sqlite3 \
-    libxml2-dev \
-    libxslt1-dev \
-    libcurl4-openssl-dev \
-    python-software-properties \
-    libffi-dev \
-    nodejs \
-    wget \
-    zlib1g-dev
+FROM ruby:2.7.1
 
-RUN gpg --keyserver hkp://keys.gnupg.net --recv-keys D39DC0E3
-RUN /bin/bash -l -c "curl -L get.rvm.io | bash -s stable --rails"
-RUN /bin/bash -l -c "rvm install 2.3.0"
-RUN /bin/bash -l -c "rvm use 2.3.0"
-RUN /bin/bash -l -c "gem install bundler"
-RUN /bin/bash -l -c "gem install rails -v 4.2.0"
+RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg -o /root/yarn-pubkey.gpg && apt-key add /root/yarn-pubkey.gpg
+RUN echo "deb https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list
+RUN apt-get update && apt-get install -y --no-install-recommends nodejs yarn vim
+
+ENV RAILS_VERSION 6.0.3.2
+RUN gem install rails --version "$RAILS_VERSION"
+RUN gem install bundler
 RUN mkdir -p /tmp/ruby_sandbox
 WORKDIR /tmp/ruby_sandbox
-RUN git clone https://github.com/PerimeterX/perimeterx-ruby-sdk.git
-RUN /bin/bash -l -c "rails new webapp"
+COPY lib /tmp/ruby_sandbox/lib
+COPY Gemfile /tmp/ruby_sandbox/
+COPY perimeter_x.gemspec /tmp/ruby_sandbox/
+COPY Rakefile /tmp/ruby_sandbox/
+RUN rails new webapp
 WORKDIR /tmp/ruby_sandbox/webapp
-RUN /bin/bash -l -c "rails generate controller home index"
+
+RUN rails generate controller home index
 WORKDIR /tmp/ruby_sandbox/webapp
 EXPOSE 3000
-# TODO: make it take the files from git
-RUN sed -i '2i gem "perimeter_x", :path => "/tmp/ruby_sandbox/perimeterx-ruby-sdk"' /tmp/ruby_sandbox/webapp/Gemfile
-RUN /bin/bash -l -c "bundler update"
-COPY ./examples/ /tmp/ruby_sandbox/webapp
-CMD ["/bin/bash", "-l", "-c", "rails server -b 0.0.0.0;"]
+RUN sed -i '2i gem "perimeter_x", :path => "/tmp/ruby_sandbox"' /tmp/ruby_sandbox/webapp/Gemfile
+RUN bundler update
+COPY ./dev/site/ /tmp/ruby_sandbox/webapp
+CMD ["rails","server","-b","0.0.0.0"]

data/Gemfile.lock

@@ -1,55 +1,61 @@
 PATH
   remote: .
   specs:
-    perimeter_x (1.0.5)
-      activesupport (>= 4.2.0)
-      httpclient (= 2.8.2.4)
+    perimeter_x (2.0.0)
+      activesupport (>= 5.2.4.3)
+      concurrent-ruby (~> 1.0, >= 1.0.5)
       mustache (~> 1.0, >= 1.0.3)
+      typhoeus (~> 1.1, >= 1.1.2)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (5.0.2)
+    activesupport (6.0.3.2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (~> 0.7)
+      i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    concurrent-ruby (1.0.5)
-    diff-lcs (1.3)
-    httpclient (2.8.2.4)
-    i18n (0.8.1)
-    metaclass (0.0.4)
-    minitest (5.10.1)
-    mocha (1.2.1)
-      metaclass (~> 0.0.1)
-    mustache (1.0.4)
-    rake (10.4.2)
-    rspec (3.5.0)
-      rspec-core (~> 3.5.0)
-      rspec-expectations (~> 3.5.0)
-      rspec-mocks (~> 3.5.0)
-    rspec-core (3.5.4)
-      rspec-support (~> 3.5.0)
-    rspec-expectations (3.5.0)
+      zeitwerk (~> 2.2, >= 2.2.2)
+    concurrent-ruby (1.1.6)
+    diff-lcs (1.4.4)
+    ethon (0.12.0)
+      ffi (>= 1.3.0)
+    ffi (1.13.1)
+    i18n (1.8.3)
+      concurrent-ruby (~> 1.0)
+    minitest (5.14.1)
+    mocha (1.11.2)
+    mustache (1.1.1)
+    rake (13.0.1)
+    rspec (3.9.0)
+      rspec-core (~> 3.9.0)
+      rspec-expectations (~> 3.9.0)
+      rspec-mocks (~> 3.9.0)
+    rspec-core (3.9.2)
+      rspec-support (~> 3.9.3)
+    rspec-expectations (3.9.2)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.5.0)
-    rspec-mocks (3.5.0)
+      rspec-support (~> 3.9.0)
+    rspec-mocks (3.9.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.5.0)
-    rspec-support (3.5.0)
+      rspec-support (~> 3.9.0)
+    rspec-support (3.9.3)
     thread_safe (0.3.6)
-    tzinfo (1.2.3)
+    typhoeus (1.4.0)
+      ethon (>= 0.9.0)
+    tzinfo (1.2.7)
       thread_safe (~> 0.1)
+    zeitwerk (2.3.1)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  bundler (~> 1.14)
+  bundler (>= 2.1)
   mocha (~> 1.2, >= 1.2.1)
   perimeter_x!
-  rake (~> 10.0)
+  rake (>= 12.3)
   rspec (~> 3.0)
 
 BUNDLED WITH
-   1.14.6
+   2.1.4

data/Rakefile

@@ -3,6 +3,7 @@ begin
 
   RSpec::Core::RakeTask.new(:spec)
 
+  task :default => :spec
   task :test => :spec
 rescue LoadError
   # no rspec available

data/changelog.md

@@ -5,6 +5,68 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [2.1.0] - 2020-09-01
+### Added
+ - Added option to set a different px configuration on each request
+ - Added types validation on configuration fields
+
+### Fixed
+ - New cookie logic for mobile requests
+ - Renamed api_connect_timeout to api_timeout_conncection on default configuration
+ - Removed unsapported configuration fields: max_buffer_len and local_proxy
+ - Send cookie_origin only if there is a cookie
+
+## [2.0.0] - 2020-07-24
+### Added
+ - Added fields to Block Activity: simulated_block, http_version, http_method, risk_rtt, px_orig_cookie
+ - Added fields to page_requested activity: pass_reason, risk_rtt, px_orig_cookie
+ - Added px_orig_cookie field to risk_api in case of cookie_decryption_failed
+ - Added support for captcha v2
+ - Added support for Advanced Blocking Response
+ - Added support for whitelise routes
+ - Added support for bypass monitor header
+ - Added support for extracting vid from _pxvid cookie
+ - Added support for rate limit
+ - Added risk_cookie_max_iterations configuration
+
+### Fixed
+ - Updated dependencies
+ - Updated sample site dockerfile
+ - Fixed monitor mode
+ - Fixed send_page_activities and send_block_activities configurations
+ - Updated risk to v3
+ - Refactored ip header extraction
+ - Renamed block_uuid field to client_uuid
+ - Renamed perimeterx_server_host configuration to backend_url
+ - Updated risk_response handling: pass the request if risk_response.status is -1
+ - Forcing http header values to be utf8
+
+## [1.4.0] - 2018-03-18
+### Fixed
+ - Incorrect assigment for s2s_call_reason
+ - Fixed empty token result correct s2s reason
+
+### Added
+ - Added support to captcha api v2
+ - Mobile sdk support for special tokens 1/2/3
+
+
+## [1.3.0] - 2017-07-27
+### Added
+ - Sending client_uuid on page_requested activities
+ - Supporting mobile sdk
+### Fixed
+ - Using `request.env` instead of `env`
+
+## [1.2.0] - 2017-06-04
+### Fixed 
+    - Default timeouts for post api requests
+    - Fixed Dockerfile
+### Changed
+    - Removed httpclient and instead using typheous
+### Added
+    - Using concurrent-ruby for async post requests
+    
 ## [1.1.0] - 2017-06-04
 ### Added 
     - Added support for sensitive routes
@@ -18,3 +80,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
  - Constants on px_constants
  - Cookie Validation flow when cookie score was over the configured threshold
  - Using symbols instead of strings for requests body
+

data/examples/app/controllers/home_controller.rb

@@ -1,7 +1,7 @@
 class HomeController < ApplicationController
   include PxModule
 
-  before_filter :px_verify_request
+  before_action :px_verify_request
 
   def index
   end

data/lib/perimeter_x.rb

@@ -1,3 +1,7 @@
+require 'concurrent'
+require 'json'
+require 'base64'
+require 'uri'
 require 'perimeterx/configuration'
 require 'perimeterx/utils/px_logger'
 require 'perimeterx/utils/px_constants'
@@ -7,102 +11,167 @@ require 'perimeterx/internal/perimeter_x_context'
 require 'perimeterx/internal/clients/perimeter_x_activity_client'
 require 'perimeterx/internal/validators/perimeter_x_s2s_validator'
 require 'perimeterx/internal/validators/perimeter_x_cookie_validator'
-require 'perimeterx/internal/validators/perimeter_x_captcha_validator'
+require 'perimeterx/internal/exceptions/px_config_exception'
 
 module PxModule
-
   # Module expose API
-  def px_verify_request
-    verified, px_ctx = PerimeterX.instance.verify(env)
-
-    # Invalidate _pxCaptcha, can be done only on the controller level
-    cookies[:_pxCaptcha] = { value: "", expires: -1.minutes.from_now }
-
-    if (!verified)
-      # In case custon block handler exists
-      if (PerimeterX.instance.px_config.key?(:custom_block_handler))
-        PerimeterX.instance.px_config[:logger].debug("PxModule[px_verify_request]: custom_block_handler triggered")
-        return instance_exec(px_ctx, &PerimeterX.instance.px_config[:custom_block_handler])
-      else
-        # Generate template
-        PerimeterX.instance.px_config[:logger].debug("PxModule[px_verify_request]: sending default block page")
-        html = PxTemplateFactory.get_template(px_ctx, PerimeterX.instance.px_config)
-        response.headers["Content-Type"] = "text/html"
-        response.status = 403
-        render :html => html
+  def px_verify_request(request_config={})    
+    begin
+      px_instance = PerimeterX.new(request_config)
+      px_ctx = px_instance.verify(request.env)
+      px_config = px_instance.px_config
+
+      msg_title = 'PxModule[px_verify_request]'
+
+      # In case custom verification handler is in use
+      if px_config.key?(:custom_verification_handler)
+        px_config[:logger].debug("#{msg_title}: custom_verification_handler triggered")
+        return instance_exec(px_ctx, &px_config[:custom_verification_handler])
       end
-    end
 
-    return verified
+      unless px_ctx.nil? || px_ctx.context[:verified] || (px_config[:module_mode] == PxModule::MONITOR_MODE && !px_ctx.context[:should_bypass_monitor])
+        # In case custom block handler exists (soon to be deprecated)
+        if px_config.key?(:custom_block_handler)
+          px_config[:logger].debug("#{msg_title}: custom_block_handler triggered")
+          px_config[:logger].debug(
+              "#{msg_title}: Please note that custom_block_handler is deprecated. Use custom_verification_handler instead.")
+          return instance_exec(px_ctx, &px_config[:custom_block_handler])
+        else
+          if px_ctx.context[:block_action]== 'rate_limit'
+            px_config[:logger].debug("#{msg_title}: sending rate limit page")
+            response.status = 429
+          else
+            px_config[:logger].debug("#{msg_title}: sending default block page")
+            response.status = 403
+          end
+
+          is_mobile = px_ctx.context[:cookie_origin] == 'header' ? '1' : '0'
+          action = px_ctx.context[:block_action][0,1]
+
+          px_template_object = {
+            block_script: "//#{PxModule::CAPTCHA_HOST}/#{px_config[:app_id]}/captcha.js?a=#{action}&u=#{px_ctx.context[:uuid]}&v=#{px_ctx.context[:vid]}&m=#{is_mobile}",
+            js_client_src: "//#{PxModule::CLIENT_HOST}/#{px_config[:app_id]}/main.min.js"
+          }
+
+          html = PxTemplateFactory.get_template(px_ctx, px_config, px_template_object)
+
+          # Web handler
+          if px_ctx.context[:cookie_origin] == 'cookie'
+
+            accept_header_value = request.headers['accept'] || request.headers['content-type'];
+            is_json_response = px_ctx.context[:block_action] != 'rate_limit' && accept_header_value && accept_header_value.split(',').select {|e| e.downcase.include? 'application/json'}.length > 0;
+
+            if (is_json_response)
+              px_config[:logger].debug("#{msg_title}: advanced blocking response response")
+              response.headers['Content-Type'] = 'application/json'
+
+              hash_json = {
+                  :appId => px_config[:app_id],
+                  :jsClientSrc => px_template_object[:js_client_src],
+                  :firstPartyEnabled => false,
+                  :uuid => px_ctx.context[:uuid],
+                  :vid => px_ctx.context[:vid],
+                  :hostUrl => "https://collector-#{px_config[:app_id]}.perimeterx.net",
+                  :blockScript => px_template_object[:block_script],
+              }
+
+              render :json => hash_json
+            else
+              px_config[:logger].debug('#{msg_title}: web block')
+              response.headers['Content-Type'] = 'text/html'
+              render :html => html
+            end
+          else # Mobile SDK
+            px_config[:logger].debug("#{msg_title}: mobile sdk block")
+            response.headers['Content-Type'] = 'application/json'
+            hash_json = {
+                :action => px_ctx.context[:block_action],
+                :uuid => px_ctx.context[:uuid],
+                :vid => px_ctx.context[:vid],
+                :appId => px_config[:app_id],
+                :page => Base64.strict_encode64(html),
+                :collectorUrl => "https://collector-#{px_config[:app_id]}.perimeterx.net"
+            }
+            render :json => hash_json
+          end
+        end
+      end
+
+      # Request was verified
+      return px_ctx.nil? ? true : px_ctx.context[:verified]
+      
+    rescue PxConfigurationException
+      raise
+    rescue Exception => e
+      error_logger = PxLogger.new(true)
+      error_logger.error("#{e.backtrace.first}: #{e.message} (#{e.class})")
+      e.backtrace.drop(1).map {|s| error_logger.error("\t#{s}")}
+      return nil
+    end
   end
 
-  def self.configure(params)
-    @px_instance = PerimeterX.configure(params)
+  def self.configure(basic_config)
+    PerimeterX.set_basic_config(basic_config)
   end
 
 
-  # PerimtereX Module
+  # PerimeterX Module
   class PerimeterX
-    @@__instance = nil
-    @@mutex = Mutex.new
 
     attr_reader :px_config
     attr_accessor :px_http_client
     attr_accessor :px_activity_client
 
     #Static methods
-    def self.configure(params)
-      return true if @@__instance
-      @@mutex.synchronize {
-        return @@__instance if @@__instance
-        @@__instance = new(params)
-      }
-      return true
+    def self.set_basic_config(basic_config)
+      Configuration.set_basic_config(basic_config)
     end
 
-    def self.instance
-      return @@__instance if !@@__instance.nil?
-      raise Exception.new("Please initialize perimeter x first")
-    end
-
-
     #Instance Methods
     def verify(env)
       begin
-        @logger.debug("PerimeterX[pxVerify]")
-        req = ActionDispatch::Request.new(env)
-        if (!@px_config[:module_enabled])
-          @logger.warn("Module is disabled")
-          return true
+
+        # check module_enabled 
+        @logger.debug('PerimeterX[pxVerify]')
+        if !@px_config[:module_enabled]
+          @logger.warn('Module is disabled')
+          return nil
         end
-        px_ctx = PerimeterXContext.new(@px_config, req)
 
-        # Captcha phase
-        captcha_verified, px_ctx = @px_captcha_validator.verify(px_ctx)
-        if (captcha_verified)
-          return handle_verification(px_ctx)
+        req = ActionDispatch::Request.new(env)
+        
+        # filter whitelist routes
+        url_path = URI.parse(req.original_url).path
+        if url_path && !url_path.empty?
+          if check_whitelist_routes(px_config[:whitelist_routes], url_path)
+            @logger.debug("PerimeterX[pxVerify]: whitelist route: #{url_path}")
+            return nil
+          end
         end
+        
+        # create context
+        px_ctx = PerimeterXContext.new(@px_config, req)
 
         # Cookie phase
         cookie_verified, px_ctx = @px_cookie_validator.verify(px_ctx)
-        if (!cookie_verified)
+        if !cookie_verified
+          if !px_ctx.context[:mobile_error].nil?
+            px_ctx.context[:s2s_call_reason] = "mobile_error_#{px_ctx.context[:mobile_error]}"
+          end
           @px_s2s_validator.verify(px_ctx)
         end
 
-        if (@px_config.key?(:custom_verification_handler))
-          return @px_config[:custom_verification_handler].call(px_ctx.context)
-        else
-          return handle_verification(px_ctx)
-        end
+        return handle_verification(px_ctx)
       rescue Exception => e
         @logger.error("#{e.backtrace.first}: #{e.message} (#{e.class})")
-        e.backtrace.drop(1).map { |s| @logger.error("\t#{s}") }
-        return true
+        e.backtrace.drop(1).map {|s| @logger.error("\t#{s}")}
+        return nil
       end
     end
 
-    private def initialize(params)
-      @px_config = Configuration.new(params).configuration
+    def initialize(request_config)
+
+      @px_config = Configuration.new(request_config).configuration
       @logger = @px_config[:logger]
       @px_http_client = PxHttpClient.new(@px_config)
 
@@ -110,36 +179,49 @@ module PxModule
 
       @px_cookie_validator = PerimeterxCookieValidator.new(@px_config)
       @px_s2s_validator = PerimeterxS2SValidator.new(@px_config, @px_http_client)
-      @px_captcha_validator = PerimeterxCaptchaValidator.new(@px_config, @px_http_client)
-      @logger.debug("PerimeterX[initialize]")
+      @logger.debug('PerimeterX[initialize]')
     end
 
     private def handle_verification(px_ctx)
-      @logger.debug("PerimeterX[handle_verification]")
+      @logger.debug('PerimeterX[handle_verification]')
       @logger.debug("PerimeterX[handle_verification]: processing ended - score:#{px_ctx.context[:score]}, uuid:#{px_ctx.context[:uuid]}")
 
       score = px_ctx.context[:score]
+      px_ctx.context[:should_bypass_monitor] = @px_config[:bypass_monitor_header] && px_ctx.context[:headers][@px_config[:bypass_monitor_header].to_sym] == '1';
+
+      px_ctx.context[:verified] = score < @px_config[:blocking_score]
       # Case PASS request
-      if (score < @px_config[:blocking_score])
+      if px_ctx.context[:verified]
         @logger.debug("PerimeterX[handle_verification]: score:#{score} < blocking score, passing request")
         @px_activity_client.send_page_requested_activity(px_ctx)
-        return true
+        return px_ctx
       end
 
       # Case blocking activity
       @px_activity_client.send_block_activity(px_ctx)
 
       # In case were in monitor mode, end here
-      if(@px_config[:module_mode] == PxModule::MONITOR_MODE)
+      if @px_config[:module_mode] == PxModule::MONITOR_MODE && !px_ctx.context[:should_bypass_monitor]
         @logger.debug("PerimeterX[handle_verification]: monitor mode is on, passing request")
-        return true
+        return px_ctx
       end
 
-      @logger.debug("PerimeterX[handle_verification]: verification ended, the request should be blocked")
+      @logger.debug('PerimeterX[handle_verification]: verification ended, the request should be blocked')
 
-      return false, px_ctx
+      return px_ctx
+    end
+
+    private def check_whitelist_routes(whitelist_routes, path)
+      whitelist_routes.each do |whitelist_route|
+        if whitelist_route.is_a?(Regexp) && path.match(whitelist_route)
+          return true
+        end
+        if whitelist_route.is_a?(String) && path.start_with?(whitelist_route)
+          return true
+        end
+      end
+      false
     end
 
-    private_class_method :new
   end
 end