rack-attack 4.1.1 → 4.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5fcafc0f62e4bc044a43ebff9f20d2059db798be
-  data.tar.gz: 19ef91c505bac94a8e9e7cb0e9e672ce2c3f6aa7
+  metadata.gz: e99e6a7757d11626b6b7d078abe43e9fe123cc36
+  data.tar.gz: 77b5a17a9de1acd9692805e2e634d165d66f1506
 SHA512:
-  metadata.gz: 51e6cbf5836d2edef0186e310eadc05ab859db5ba03bc3243250e9c0e739961d4a58c96021db8a0966afaa9b94cbf23e43cffb6689e4e6902b04170a575af6ab
-  data.tar.gz: afd3639047fe6ac3c6e749d1efc1ceccd0d6100a9ae43d4947d48f09e4af2df48b94d66e879551d8ff6ccd1260467d5d5ad90604f0d942f0d9b61a5ce78cd71b
+  metadata.gz: 75e2f1b7c760cc33323618edf03dd6fb3f661b73d2ed2d2ce67e80f632942c369d4e4336c479ae68e99805c2c2910a51b54dc4fab545b54d295536c28811ca20
+  data.tar.gz: 5da774caa95cfe83eaeb1c42d759ac0761fc76c5c6137681101f658680b3bba9edde35862f9a84cd0a1f530ae294142663a619c3940fedc761345b0be5cd3542

data/README.md

@@ -73,9 +73,9 @@ def call(env)
   if whitelisted?(req)
     @app.call(env)
   elsif blacklisted?(req)
-    blacklisted_response[env]
+    self.class.blacklisted_response.call(env)
   elsif throttled?(req)
-    throttled_response[env]
+    self.class.throttled_response.call(env)
   else
     tracked?(req)
     @app.call(env)
@@ -181,10 +181,11 @@ Rack::Attack.throttle('logins/email', :limit => 6, :period => 60.seconds) do |re
   req.params['email'] if req.path == '/login' && req.post?
 end
 
-# You can also set a limit using a proc instead of a number. For
-# instance, after Rack::Auth::Basic has authenticated the user:
-limit_based_on_proc = proc {|req| req.env["REMOTE_USER"] == "admin" ? 100 : 1}
-Rack::Attack.throttle('req/ip', :limit => limit_based_on_proc, :period => 1.second) do |req|
+# You can also set a limit and period using a proc. For instance, after
+# Rack::Auth::Basic has authenticated the user:
+limit_proc = proc {|req| req.env["REMOTE_USER"] == "admin" ? 100 : 1}
+period_proc = proc {|req| req.env["REMOTE_USER"] == "admin" ? 1.second : 1.minute}
+Rack::Attack.throttle('req/ip', :limit => limit_proc, :period => period_proc) do |req|
   req.ip
 end
 ```

data/lib/rack/attack.rb

@@ -82,7 +82,7 @@ class Rack::Attack
   @notifier             = ActiveSupport::Notifications if defined?(ActiveSupport::Notifications)
   @blacklisted_response = lambda {|env| [403, {'Content-Type' => 'text/plain'}, ["Forbidden\n"]] }
   @throttled_response   = lambda {|env|
-    retry_after = env['rack.attack.match_data'][:period] rescue nil
+    retry_after = (env['rack.attack.match_data'] || {})[:period]
     [429, {'Content-Type' => 'text/plain', 'Retry-After' => retry_after.to_s}, ["Retry later\n"]]
   }
 
@@ -96,9 +96,9 @@ class Rack::Attack
     if whitelisted?(req)
       @app.call(env)
     elsif blacklisted?(req)
-      self.class.blacklisted_response[env]
+      self.class.blacklisted_response.call(env)
     elsif throttled?(req)
-      self.class.throttled_response[env]
+      self.class.throttled_response.call(env)
     else
       tracked?(req)
       @app.call(env)

data/lib/rack/attack/throttle.rb

@@ -9,7 +9,7 @@ module Rack
           raise ArgumentError.new("Must pass #{opt.inspect} option") unless options[opt]
         end
         @limit  = options[:limit]
-        @period = options[:period].to_i
+        @period = options[:period].respond_to?(:call) ? options[:period] : options[:period].to_i
         @type   = options.fetch(:type, :throttle)
       end
 
@@ -21,12 +21,14 @@ module Rack
         discriminator = block[req]
         return false unless discriminator
 
-        key = "#{name}:#{discriminator}"
-        count = cache.count(key, period)
-        current_limit = limit.respond_to?(:call) ? limit.call(req) : limit
+        current_period = period.respond_to?(:call) ? period.call(req) : period
+        current_limit  = limit.respond_to?(:call) ? limit.call(req) : limit
+        key            = "#{name}:#{discriminator}"
+        count          = cache.count(key, current_period)
+
         data = {
           :count => count,
-          :period => period,
+          :period => current_period,
           :limit => current_limit
         }
         (req.env['rack.attack.throttle_data'] ||= {})[name] = data

data/lib/rack/attack/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Attack
-    VERSION = '4.1.1'
+    VERSION = '4.2.0'
   end
 end

data/spec/rack_attack_throttle_spec.rb

@@ -44,7 +44,30 @@ describe 'Rack::Attack.throttle with limit as proc' do
   before do
     @period = 60 # Use a long period; failures due to cache key rotation less likely
     Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
-    Rack::Attack.throttle('ip/sec', :limit => lambda {|req| 1}, :period => @period) { |req| req.ip }
+    Rack::Attack.throttle('ip/sec', :limit => lambda { |req| 1 }, :period => @period) { |req| req.ip }
+  end
+
+  allow_ok_requests
+
+  describe 'a single request' do
+    before { get '/', {}, 'REMOTE_ADDR' => '1.2.3.4' }
+    it 'should set the counter for one request' do
+      key = "rack::attack:#{Time.now.to_i/@period}:ip/sec:1.2.3.4"
+      Rack::Attack.cache.store.read(key).must_equal 1
+    end
+
+    it 'should populate throttle data' do
+      data = { :count => 1, :limit => 1, :period => @period }
+      last_request.env['rack.attack.throttle_data']['ip/sec'].must_equal data
+    end
+  end
+end
+
+describe 'Rack::Attack.throttle with period as proc' do
+  before do
+    @period = 60 # Use a long period; failures due to cache key rotation less likely
+    Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
+    Rack::Attack.throttle('ip/sec', :limit => lambda { |req| 1 }, :period => lambda { |req| @period }) { |req| req.ip }
   end
 
   allow_ok_requests

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-attack
 version: !ruby/object:Gem::Version
-  version: 4.1.1
+  version: 4.2.0
 platform: ruby
 authors:
 - Aaron Suggs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-11 00:00:00.000000000 Z
+date: 2014-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -204,3 +204,4 @@ test_files:
 - spec/rack_attack_throttle_spec.rb
 - spec/rack_attack_track_spec.rb
 - spec/spec_helper.rb
+has_rdoc: