rack-attack 4.3.1 → 5.4.2

data/spec/spec_helper.rb

@@ -1,4 +1,3 @@
-require "rubygems"
 require "bundler/setup"
 
 require "minitest/autorun"
@@ -7,31 +6,53 @@ require "rack/test"
 require 'active_support'
 require 'action_dispatch'
 
-# Load Journey for Rails 3.2
-require 'journey' if ActionPack::VERSION::MAJOR == 3
-
 require "rack/attack"
 
-begin
-  require 'pry'
-rescue LoadError
-  #nothing to do here
+if RUBY_ENGINE == "ruby"
+  require "byebug"
 end
 
-class MiniTest::Spec
+def safe_require(name)
+  begin
+    require name
+  rescue LoadError
+  end
+end
+
+safe_require "connection_pool"
+safe_require "dalli"
+safe_require "redis"
+safe_require "redis-activesupport"
+safe_require "redis-store"
 
+class MiniTest::Spec
   include Rack::Test::Methods
 
-  after { Rack::Attack.clear! }
+  before do
+    @_original_throttled_response = Rack::Attack.throttled_response
+    @_original_blocklisted_response = Rack::Attack.blocklisted_response
+  end
+
+  after do
+    Rack::Attack.clear_configuration
+    Rack::Attack.instance_variable_set(:@cache, nil)
+
+    Rack::Attack.throttled_response = @_original_throttled_response
+    Rack::Attack.blocklisted_response = @_original_blocklisted_response
+  end
 
   def app
-    Rack::Builder.new {
+    Rack::Builder.new do
+      # Use Rack::Lint to test that rack-attack is complying with the rack spec
+      use Rack::Lint
       use Rack::Attack
-      run lambda {|env| [200, {}, ['Hello World']]}
-    }.to_app
+      use Rack::Lint
+
+      run lambda { |_env| [200, {}, ['Hello World']] }
+    end.to_app
   end
 
-  def self.allow_ok_requests
+  def self.it_allows_ok_requests
     it "must allow ok requests" do
       get '/', {}, 'REMOTE_ADDR' => '127.0.0.1'
       last_response.status.must_equal 200

data/spec/support/cache_store_helper.rb

@@ -0,0 +1,82 @@
+class Minitest::Spec
+  def self.it_works_for_cache_backed_features(options)
+    fetch_from_store = options.fetch(:fetch_from_store)
+
+    it "works for throttle" do
+      Rack::Attack.throttle("by ip", limit: 1, period: 60) do |request|
+        request.ip
+      end
+
+      get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+      assert_equal 200, last_response.status
+
+      get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+      assert_equal 429, last_response.status
+    end
+
+    it "works for fail2ban" do
+      Rack::Attack.blocklist("fail2ban pentesters") do |request|
+        Rack::Attack::Fail2Ban.filter(request.ip, maxretry: 2, findtime: 30, bantime: 60) do
+          request.path.include?("private-place")
+        end
+      end
+
+      get "/"
+      assert_equal 200, last_response.status
+
+      get "/private-place"
+      assert_equal 403, last_response.status
+
+      get "/private-place"
+      assert_equal 403, last_response.status
+
+      get "/"
+      assert_equal 403, last_response.status
+    end
+
+    it "works for allow2ban" do
+      Rack::Attack.blocklist("allow2ban pentesters") do |request|
+        Rack::Attack::Allow2Ban.filter(request.ip, maxretry: 2, findtime: 30, bantime: 60) do
+          request.path.include?("scarce-resource")
+        end
+      end
+
+      get "/"
+      assert_equal 200, last_response.status
+
+      get "/scarce-resource"
+      assert_equal 200, last_response.status
+
+      get "/scarce-resource"
+      assert_equal 200, last_response.status
+
+      get "/scarce-resource"
+      assert_equal 403, last_response.status
+
+      get "/"
+      assert_equal 403, last_response.status
+    end
+
+    it "doesn't leak keys" do
+      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
+        request.ip
+      end
+
+      key = nil
+
+      # Freeze time during these statement to be sure that the key used by rack attack is the same
+      # we pre-calculate in local variable `key`
+      Timecop.freeze do
+        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
+
+        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+      end
+
+      assert fetch_from_store.call(key)
+
+      sleep 2.1
+
+      assert_nil fetch_from_store.call(key)
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-attack
 version: !ruby/object:Gem::Version
-  version: 4.3.1
+  version: 5.4.2
 platform: ruby
 authors:
 - Aaron Suggs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-12-18 00:00:00.000000000 Z
+date: 2018-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -16,140 +16,174 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: appraisal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.16'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.16'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.11'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.11'
 - !ruby/object:Gem::Dependency
-  name: rack-test
+  name: minitest-stub-const
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.6'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.6'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: rack-test
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: appraisal
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '12.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '12.3'
 - !ruby/object:Gem::Dependency
-  name: activesupport
+  name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 0.58.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 0.58.2
 - !ruby/object:Gem::Dependency
-  name: actionpack
+  name: timecop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 0.9.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 0.9.1
 - !ruby/object:Gem::Dependency
-  name: redis-activesupport
+  name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '10.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '10.0'
 - !ruby/object:Gem::Dependency
-  name: dalli
+  name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.2'
 - !ruby/object:Gem::Dependency
-  name: connection_pool
+  name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.2'
 description: A rack middleware for throttling and blocking abusive requests
 email: aaron@ktheory.com
 executables: []
@@ -158,25 +192,58 @@ extra_rdoc_files: []
 files:
 - README.md
 - Rakefile
+- bin/setup
 - lib/rack/attack.rb
 - lib/rack/attack/allow2ban.rb
-- lib/rack/attack/blacklist.rb
+- lib/rack/attack/blocklist.rb
 - lib/rack/attack/cache.rb
 - lib/rack/attack/check.rb
 - lib/rack/attack/fail2ban.rb
 - lib/rack/attack/path_normalizer.rb
 - lib/rack/attack/request.rb
+- lib/rack/attack/safelist.rb
 - lib/rack/attack/store_proxy.rb
 - lib/rack/attack/store_proxy/dalli_proxy.rb
+- lib/rack/attack/store_proxy/mem_cache_proxy.rb
+- lib/rack/attack/store_proxy/mem_cache_store_proxy.rb
+- lib/rack/attack/store_proxy/redis_cache_store_proxy.rb
+- lib/rack/attack/store_proxy/redis_proxy.rb
 - lib/rack/attack/store_proxy/redis_store_proxy.rb
 - lib/rack/attack/throttle.rb
 - lib/rack/attack/track.rb
 - lib/rack/attack/version.rb
-- lib/rack/attack/whitelist.rb
+- spec/acceptance/allow2ban_spec.rb
+- spec/acceptance/blocking_ip_spec.rb
+- spec/acceptance/blocking_spec.rb
+- spec/acceptance/blocking_subnet_spec.rb
+- spec/acceptance/cache_store_config_for_allow2ban_spec.rb
+- spec/acceptance/cache_store_config_for_fail2ban_spec.rb
+- spec/acceptance/cache_store_config_for_throttle_spec.rb
+- spec/acceptance/cache_store_config_with_rails_spec.rb
+- spec/acceptance/customizing_blocked_response_spec.rb
+- spec/acceptance/customizing_throttled_response_spec.rb
+- spec/acceptance/extending_request_object_spec.rb
+- spec/acceptance/fail2ban_spec.rb
+- spec/acceptance/safelisting_ip_spec.rb
+- spec/acceptance/safelisting_spec.rb
+- spec/acceptance/safelisting_subnet_spec.rb
+- spec/acceptance/stores/active_support_dalli_store_spec.rb
+- spec/acceptance/stores/active_support_mem_cache_store_pooled_spec.rb
+- spec/acceptance/stores/active_support_mem_cache_store_spec.rb
+- spec/acceptance/stores/active_support_memory_store_spec.rb
+- spec/acceptance/stores/active_support_redis_cache_store_pooled_spec.rb
+- spec/acceptance/stores/active_support_redis_cache_store_spec.rb
+- spec/acceptance/stores/active_support_redis_store_spec.rb
+- spec/acceptance/stores/connection_pool_dalli_client_spec.rb
+- spec/acceptance/stores/dalli_client_spec.rb
+- spec/acceptance/stores/redis_spec.rb
+- spec/acceptance/stores/redis_store_spec.rb
+- spec/acceptance/throttling_spec.rb
+- spec/acceptance/track_spec.rb
+- spec/acceptance/track_throttle_spec.rb
 - spec/allow2ban_spec.rb
 - spec/fail2ban_spec.rb
 - spec/integration/offline_spec.rb
-- spec/integration/rack_attack_cache_spec.rb
 - spec/rack_attack_dalli_proxy_spec.rb
 - spec/rack_attack_path_normalizer_spec.rb
 - spec/rack_attack_request_spec.rb
@@ -184,10 +251,14 @@ files:
 - spec/rack_attack_throttle_spec.rb
 - spec/rack_attack_track_spec.rb
 - spec/spec_helper.rb
-homepage: http://github.com/kickstarter/rack-attack
+- spec/support/cache_store_helper.rb
+homepage: https://github.com/kickstarter/rack-attack
 licenses:
 - MIT
-metadata: {}
+metadata:
+  bug_tracker_uri: https://github.com/kickstarter/rack-attack/issues
+  changelog_uri: https://github.com/kickstarter/rack-attack/blob/master/CHANGELOG.md
+  source_code_uri: https://github.com/kickstarter/rack-attack
 post_install_message: 
 rdoc_options:
 - "--charset=UTF-8"
@@ -197,7 +268,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.0.0
+      version: '2.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -205,19 +276,48 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Block & throttle abusive requests
 test_files:
-- spec/allow2ban_spec.rb
-- spec/fail2ban_spec.rb
 - spec/integration/offline_spec.rb
-- spec/integration/rack_attack_cache_spec.rb
-- spec/rack_attack_dalli_proxy_spec.rb
 - spec/rack_attack_path_normalizer_spec.rb
-- spec/rack_attack_request_spec.rb
+- spec/acceptance/safelisting_subnet_spec.rb
+- spec/acceptance/track_throttle_spec.rb
+- spec/acceptance/cache_store_config_for_fail2ban_spec.rb
+- spec/acceptance/cache_store_config_with_rails_spec.rb
+- spec/acceptance/cache_store_config_for_allow2ban_spec.rb
+- spec/acceptance/safelisting_ip_spec.rb
+- spec/acceptance/track_spec.rb
+- spec/acceptance/blocking_subnet_spec.rb
+- spec/acceptance/blocking_ip_spec.rb
+- spec/acceptance/allow2ban_spec.rb
+- spec/acceptance/throttling_spec.rb
+- spec/acceptance/blocking_spec.rb
+- spec/acceptance/customizing_throttled_response_spec.rb
+- spec/acceptance/extending_request_object_spec.rb
+- spec/acceptance/safelisting_spec.rb
+- spec/acceptance/cache_store_config_for_throttle_spec.rb
+- spec/acceptance/fail2ban_spec.rb
+- spec/acceptance/stores/active_support_mem_cache_store_pooled_spec.rb
+- spec/acceptance/stores/active_support_redis_cache_store_spec.rb
+- spec/acceptance/stores/active_support_memory_store_spec.rb
+- spec/acceptance/stores/active_support_redis_store_spec.rb
+- spec/acceptance/stores/active_support_mem_cache_store_spec.rb
+- spec/acceptance/stores/active_support_redis_cache_store_pooled_spec.rb
+- spec/acceptance/stores/connection_pool_dalli_client_spec.rb
+- spec/acceptance/stores/active_support_dalli_store_spec.rb
+- spec/acceptance/stores/redis_store_spec.rb
+- spec/acceptance/stores/dalli_client_spec.rb
+- spec/acceptance/stores/redis_spec.rb
+- spec/acceptance/customizing_blocked_response_spec.rb
+- spec/spec_helper.rb
+- spec/allow2ban_spec.rb
+- spec/rack_attack_dalli_proxy_spec.rb
 - spec/rack_attack_spec.rb
 - spec/rack_attack_throttle_spec.rb
+- spec/rack_attack_request_spec.rb
+- spec/fail2ban_spec.rb
 - spec/rack_attack_track_spec.rb
-- spec/spec_helper.rb
+- spec/support/cache_store_helper.rb