rack-attack 5.4.0 → 5.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 123608043cbaa1604ab2d7b06c056010decd274dd4a5b1fe8f2175cec766fa4d
-  data.tar.gz: 2bd3ca91293545b76221608f144c1a43a458fbd9e6f2e8ea2647bf561d8ea9a9
+  metadata.gz: 21f1ecf9854b74958cacdb31211735c29b9a2f98f1ee848e0f60a3f409651cc6
+  data.tar.gz: 934f2ac2af420277f6d31052b56af24d2cbe93412a272aa753c25ce26228d7b1
 SHA512:
-  metadata.gz: '06388ad68edc65019740c9ee77347f817b0769e782d0f8564ac5ac6b9c7fa819fe2157a10d89b570c78c14ef5a86fe080fac30aba8ebdfed281f2073785f5685'
-  data.tar.gz: a15cc2cef9eebda52d662fe3eeee3f187d5b575c089a1fa2cf5e0179012499f6440889349a47108c4017f8b73dd18985655dc933baf8c031e08d73ea23d1dbba
+  metadata.gz: 32f63613544602a11c8af12a5ac764adf44ba22beda1dc8840bfc5431a32edd8ea1075eab6933f423405e71959ed0c5b5f8668d72262c5fb4787f89105259f5a
+  data.tar.gz: aad3b2d1ace4369f2605d863df03c86d0e008c934c5f9c6741b71d2a3e363bcf37c93685e436ff48c917a512d39b8fd059fb3db09f38250c609f5fa22244cda4

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/lib/rack/attack.rb

@@ -17,6 +17,7 @@ class Rack::Attack
   autoload :StoreProxy,           'rack/attack/store_proxy'
   autoload :DalliProxy,           'rack/attack/store_proxy/dalli_proxy'
   autoload :MemCacheProxy,        'rack/attack/store_proxy/mem_cache_proxy'
+  autoload :MemCacheStoreProxy,   'rack/attack/store_proxy/mem_cache_store_proxy'
   autoload :RedisProxy,           'rack/attack/store_proxy/redis_proxy'
   autoload :RedisStoreProxy,      'rack/attack/store_proxy/redis_store_proxy'
   autoload :RedisCacheStoreProxy, 'rack/attack/store_proxy/redis_cache_store_proxy'

data/lib/rack/attack/store_proxy.rb

@@ -1,10 +1,7 @@
 module Rack
   class Attack
     module StoreProxy
-      PROXIES = [DalliProxy, MemCacheProxy, RedisStoreProxy, RedisProxy, RedisCacheStoreProxy].freeze
-
-      ACTIVE_SUPPORT_WRAPPER_CLASSES = Set.new(['ActiveSupport::Cache::MemCacheStore', 'ActiveSupport::Cache::RedisStore', 'ActiveSupport::Cache::RedisCacheStore']).freeze
-      ACTIVE_SUPPORT_CLIENTS = Set.new(['Redis::Store', 'Dalli::Client', 'MemCache']).freeze
+      PROXIES = [DalliProxy, MemCacheStoreProxy, MemCacheProxy, RedisStoreProxy, RedisProxy, RedisCacheStoreProxy].freeze
 
       def self.build(store)
         client = unwrap_active_support_stores(store)
@@ -15,15 +12,8 @@ module Rack
       def self.unwrap_active_support_stores(store)
         # ActiveSupport::Cache::RedisStore doesn't expose any way to set an expiry,
         # so use the raw Redis::Store instead.
-        # We also want to use the underlying Dalli client instead of ::ActiveSupport::Cache::MemCacheStore,
-        # and the MemCache client if using Rails 3.x
-
-        if store.instance_variable_defined?(:@data)
-          client = store.instance_variable_get(:@data)
-        end
-
-        if ACTIVE_SUPPORT_WRAPPER_CLASSES.include?(store.class.to_s) && ACTIVE_SUPPORT_CLIENTS.include?(client.class.to_s)
-          client
+        if store.class.name == 'ActiveSupport::Cache::RedisStore'
+          store.instance_variable_get(:@data)
         else
           store
         end

data/lib/rack/attack/store_proxy/mem_cache_store_proxy.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'delegate'
+
+module Rack
+  class Attack
+    module StoreProxy
+      class MemCacheStoreProxy < SimpleDelegator
+        def self.handle?(store)
+          defined?(::Dalli) && defined?(::ActiveSupport::Cache::MemCacheStore) && store.is_a?(::ActiveSupport::Cache::MemCacheStore)
+        end
+
+        def write(name, value, options = {})
+          super(name, value, options.merge!(raw: true))
+        end
+      end
+    end
+  end
+end

data/lib/rack/attack/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Attack
-    VERSION = '5.4.0'
+    VERSION = '5.4.1'
   end
 end

data/spec/acceptance/stores/active_support_dalli_store_spec.rb

@@ -14,28 +14,6 @@ if defined?(::Dalli)
       Rack::Attack.cache.store.clear
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.fetch(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.fetch(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.fetch(key) })
   end
 end

data/spec/acceptance/stores/active_support_mem_cache_store_pooled_spec.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require_relative "../../spec_helper"
+
+if defined?(::ConnectionPool) && defined?(::Dalli)
+  require_relative "../../support/cache_store_helper"
+  require "timecop"
+
+  describe "ActiveSupport::Cache::MemCacheStore (pooled) as a cache backend" do
+    before do
+      Rack::Attack.cache.store = ActiveSupport::Cache::MemCacheStore.new(pool_size: 2)
+    end
+
+    after do
+      Rack::Attack.cache.store.clear
+    end
+
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) {
+      Rack::Attack.cache.store.read(key)
+    })
+  end
+end

data/spec/acceptance/stores/active_support_mem_cache_store_spec.rb

@@ -10,31 +10,9 @@ if defined?(::Dalli)
     end
 
     after do
-      Rack::Attack.cache.store.flush_all
+      Rack::Attack.cache.store.clear
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.get(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.get(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.read(key) })
   end
 end

data/spec/acceptance/stores/active_support_memory_store_spec.rb

@@ -12,27 +12,5 @@ describe "ActiveSupport::Cache::MemoryStore as a cache backend" do
     Rack::Attack.cache.store.clear
   end
 
-  it_works_for_cache_backed_features
-
-  it "doesn't leak keys" do
-    Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-      request.ip
-    end
-
-    key = nil
-
-    # Freeze time during these statement to be sure that the key used by rack attack is the same
-    # we pre-calculate in local variable `key`
-    Timecop.freeze do
-      key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-      get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-    end
-
-    assert Rack::Attack.cache.store.fetch(key)
-
-    sleep 2.1
-
-    assert_nil Rack::Attack.cache.store.fetch(key)
-  end
+  it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.fetch(key) })
 end

data/spec/acceptance/stores/active_support_redis_cache_store_pooled_spec.rb

@@ -13,28 +13,6 @@ if defined?(::ConnectionPool) && defined?(::Redis) && defined?(::ActiveSupport::
       Rack::Attack.cache.store.clear
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.fetch(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.fetch(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.fetch(key) })
   end
 end

data/spec/acceptance/stores/active_support_redis_cache_store_spec.rb

@@ -13,29 +13,6 @@ if defined?(::Redis) && defined?(::ActiveSupport::Cache::RedisCacheStore)
       Rack::Attack.cache.store.clear
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        # puts key
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.fetch(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.fetch(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.fetch(key) })
   end
 end

data/spec/acceptance/stores/active_support_redis_store_spec.rb

@@ -13,28 +13,6 @@ if defined?(::ActiveSupport::Cache::RedisStore)
       Rack::Attack.cache.store.flushdb
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.read(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.read(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.read(key) })
   end
 end

data/spec/acceptance/stores/connection_pool_dalli_client_spec.rb

@@ -15,28 +15,8 @@ if defined?(::Dalli) && defined?(::ConnectionPool)
       Rack::Attack.cache.store.with { |client| client.flush_all }
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert(Rack::Attack.cache.store.with { |client| client.fetch(key) })
-
-      sleep 2.1
-
-      assert_nil(Rack::Attack.cache.store.with { |client| client.fetch(key) })
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) {
+      Rack::Attack.cache.store.with { |client| client.fetch(key) }
+    })
   end
 end

data/spec/acceptance/stores/dalli_client_spec.rb

@@ -14,28 +14,6 @@ if defined?(::Dalli)
       Rack::Attack.cache.store.flush_all
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.fetch(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.fetch(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.fetch(key) })
   end
 end

data/spec/acceptance/stores/redis_spec.rb

@@ -15,28 +15,6 @@ if defined?(::Redis)
       Rack::Attack.cache.store.flushdb
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.get(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.get(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.get(key) })
   end
 end

data/spec/acceptance/stores/redis_store_spec.rb

@@ -13,28 +13,6 @@ if defined?(::Redis::Store)
       Rack::Attack.cache.store.flushdb
     end
 
-    it_works_for_cache_backed_features
-
-    it "doesn't leak keys" do
-      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
-        request.ip
-      end
-
-      key = nil
-
-      # Freeze time during these statement to be sure that the key used by rack attack is the same
-      # we pre-calculate in local variable `key`
-      Timecop.freeze do
-        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
-
-        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
-      end
-
-      assert Rack::Attack.cache.store.read(key)
-
-      sleep 2.1
-
-      assert_nil Rack::Attack.cache.store.read(key)
-    end
+    it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.read(key) })
   end
 end

data/spec/support/cache_store_helper.rb

@@ -1,5 +1,7 @@
 class Minitest::Spec
-  def self.it_works_for_cache_backed_features
+  def self.it_works_for_cache_backed_features(options)
+    fetch_from_store = options.fetch(:fetch_from_store)
+
     it "works for throttle" do
       Rack::Attack.throttle("by ip", limit: 1, period: 60) do |request|
         request.ip
@@ -54,5 +56,27 @@ class Minitest::Spec
       get "/"
       assert_equal 403, last_response.status
     end
+
+    it "doesn't leak keys" do
+      Rack::Attack.throttle("by ip", limit: 1, period: 1) do |request|
+        request.ip
+      end
+
+      key = nil
+
+      # Freeze time during these statement to be sure that the key used by rack attack is the same
+      # we pre-calculate in local variable `key`
+      Timecop.freeze do
+        key = "rack::attack:#{Time.now.to_i}:by ip:1.2.3.4"
+
+        get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+      end
+
+      assert fetch_from_store.call(key)
+
+      sleep 2.1
+
+      assert_nil fetch_from_store.call(key)
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-attack
 version: !ruby/object:Gem::Version
-  version: 5.4.0
+  version: 5.4.1
 platform: ruby
 authors:
 - Aaron Suggs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-02 00:00:00.000000000 Z
+date: 2018-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -120,14 +120,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.57.2
+        version: 0.58.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.57.2
+        version: 0.58.2
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
@@ -192,6 +192,7 @@ extra_rdoc_files: []
 files:
 - README.md
 - Rakefile
+- bin/setup
 - lib/rack/attack.rb
 - lib/rack/attack/allow2ban.rb
 - lib/rack/attack/blocklist.rb
@@ -204,6 +205,7 @@ files:
 - lib/rack/attack/store_proxy.rb
 - lib/rack/attack/store_proxy/dalli_proxy.rb
 - lib/rack/attack/store_proxy/mem_cache_proxy.rb
+- lib/rack/attack/store_proxy/mem_cache_store_proxy.rb
 - lib/rack/attack/store_proxy/redis_cache_store_proxy.rb
 - lib/rack/attack/store_proxy/redis_proxy.rb
 - lib/rack/attack/store_proxy/redis_store_proxy.rb
@@ -226,6 +228,7 @@ files:
 - spec/acceptance/safelisting_spec.rb
 - spec/acceptance/safelisting_subnet_spec.rb
 - spec/acceptance/stores/active_support_dalli_store_spec.rb
+- spec/acceptance/stores/active_support_mem_cache_store_pooled_spec.rb
 - spec/acceptance/stores/active_support_mem_cache_store_spec.rb
 - spec/acceptance/stores/active_support_memory_store_spec.rb
 - spec/acceptance/stores/active_support_redis_cache_store_pooled_spec.rb
@@ -297,6 +300,7 @@ test_files:
 - spec/acceptance/safelisting_spec.rb
 - spec/acceptance/cache_store_config_for_throttle_spec.rb
 - spec/acceptance/fail2ban_spec.rb
+- spec/acceptance/stores/active_support_mem_cache_store_pooled_spec.rb
 - spec/acceptance/stores/active_support_redis_cache_store_spec.rb
 - spec/acceptance/stores/active_support_memory_store_spec.rb
 - spec/acceptance/stores/active_support_redis_store_spec.rb