rack-attack 5.4.2 → 6.0.0

data/spec/acceptance/cache_store_config_for_fail2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "minitest/stub_const"
 
@@ -20,11 +22,9 @@ describe "Cache store config when using fail2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def write(key, value)
-      end
+      def write(key, value); end
 
-      def increment(key, count, options = {})
-      end
+      def increment(key, count, options = {}); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do
@@ -42,11 +42,9 @@ describe "Cache store config when using fail2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def read(key)
-      end
+      def read(key); end
 
-      def increment(key, count, options = {})
-      end
+      def increment(key, count, options = {}); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do
@@ -64,11 +62,9 @@ describe "Cache store config when using fail2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def read(key)
-      end
+      def read(key); end
 
-      def write(key, value)
-      end
+      def write(key, value); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do

data/spec/acceptance/cache_store_config_for_throttle_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Cache store config when throttling without Rails" do

data/spec/acceptance/cache_store_config_with_rails_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "minitest/stub_const"
 require "ostruct"

data/spec/acceptance/customizing_blocked_response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Customizing block responses" do

data/spec/acceptance/customizing_throttled_response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Customizing throttled response" do

data/spec/acceptance/extending_request_object_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Extending the request object" do

data/spec/acceptance/fail2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "timecop"
 

data/spec/acceptance/safelisting_ip_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Safelist an IP" do
@@ -36,8 +38,8 @@ describe "Safelist an IP" do
   it "notifies when the request is safe" do
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("safelist.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/admin", {}, "REMOTE_ADDR" => "5.6.7.8"

data/spec/acceptance/safelisting_spec.rb

@@ -1,6 +1,60 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "#safelist" do
+  before do
+    Rack::Attack.blocklist do |request|
+      request.ip == "1.2.3.4"
+    end
+
+    Rack::Attack.safelist do |request|
+      request.path == "/safe_space"
+    end
+  end
+
+  it "forbids request if blocklist condition is true and safelist is false" do
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 403, last_response.status
+  end
+
+  it "succeeds if blocklist condition is false and safelist is false" do
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "succeeds request if blocklist condition is false and safelist is true" do
+    get "/safe_space", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "succeeds request if both blocklist and safelist conditions are true" do
+    get "/safe_space", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "notifies when the request is safe" do
+    notification_matched = nil
+    notification_type = nil
+
+    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
+    end
+
+    get "/safe_space", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 200, last_response.status
+    assert_nil notification_matched
+    assert_equal :safelist, notification_type
+  end
+end
+
+describe "#safelist with name" do
   before do
     Rack::Attack.blocklist("block 1.2.3.4") do |request|
       request.ip == "1.2.3.4"
@@ -39,9 +93,9 @@ describe "#safelist" do
     notification_matched = nil
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_matched = request.env["rack.attack.matched"]
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("safelist.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/safe_space", {}, "REMOTE_ADDR" => "1.2.3.4"

data/spec/acceptance/safelisting_subnet_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Safelisting an IP subnet" do
@@ -36,8 +38,8 @@ describe "Safelisting an IP subnet" do
   it "notifies when the request is safe" do
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("safelist.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/admin", {}, "REMOTE_ADDR" => "5.6.0.0"

data/spec/acceptance/stores/active_support_dalli_store_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 
 if defined?(::Dalli)

data/spec/acceptance/stores/active_support_mem_cache_store_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 
 if defined?(::Dalli)

data/spec/acceptance/stores/active_support_memory_store_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 require_relative "../../support/cache_store_helper"
 

data/spec/acceptance/stores/active_support_redis_cache_store_pooled_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 
 if defined?(::ConnectionPool) && defined?(::Redis) && Gem::Version.new(::Redis::VERSION) >= Gem::Version.new("4") && defined?(::ActiveSupport::Cache::RedisCacheStore)

data/spec/acceptance/stores/active_support_redis_cache_store_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 
 if defined?(::Redis) && Gem::Version.new(::Redis::VERSION) >= Gem::Version.new("4") && defined?(::ActiveSupport::Cache::RedisCacheStore)

data/spec/acceptance/stores/active_support_redis_store_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 
 if defined?(::ActiveSupport::Cache::RedisStore)
@@ -10,7 +12,7 @@ if defined?(::ActiveSupport::Cache::RedisStore)
     end
 
     after do
-      Rack::Attack.cache.store.flushdb
+      Rack::Attack.cache.store.clear
     end
 
     it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.read(key) })

data/spec/acceptance/stores/connection_pool_dalli_client_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 
 if defined?(::Dalli) && defined?(::ConnectionPool)

data/spec/acceptance/stores/dalli_client_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 
 if defined?(::Dalli)

data/spec/acceptance/stores/redis_store_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../../spec_helper"
 require_relative "../../support/cache_store_helper"
 

data/spec/acceptance/throttling_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "timecop"
 
@@ -123,11 +125,11 @@ describe "#throttle" do
     notification_data = nil
     notification_discriminator = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_matched = request.env["rack.attack.matched"]
-      notification_type = request.env["rack.attack.match_type"]
-      notification_data = request.env['rack.attack.match_data']
-      notification_discriminator = request.env['rack.attack.match_discriminator']
+    ActiveSupport::Notifications.subscribe("throttle.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
+      notification_data = payload[:request].env['rack.attack.match_data']
+      notification_discriminator = payload[:request].env['rack.attack.match_discriminator']
     end
 
     get "/", {}, "REMOTE_ADDR" => "5.6.7.8"

data/spec/acceptance/track_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "#track" do
@@ -9,9 +11,9 @@ describe "#track" do
     notification_matched = nil
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_matched = request.env["rack.attack.matched"]
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("track.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/", {}, "REMOTE_ADDR" => "5.6.7.8"

data/spec/acceptance/track_throttle_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "timecop"
 
@@ -12,9 +14,9 @@ describe "#track with throttle-ish options" do
     notification_matched = nil
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_matched = request.env["rack.attack.matched"]
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("track.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/", {}, "REMOTE_ADDR" => "1.2.3.4"

data/spec/allow2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'spec_helper'
 
 describe 'Rack::Attack.Allow2Ban' do
@@ -7,7 +9,7 @@ describe 'Rack::Attack.Allow2Ban' do
     @findtime = 60
     @bantime  = 60
     Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
-    @f2b_options = { :bantime => @bantime, :findtime => @findtime, :maxretry => 2 }
+    @f2b_options = { bantime: @bantime, findtime: @findtime, maxretry: 2 }
 
     Rack::Attack.blocklist('pentest') do |req|
       Rack::Attack::Allow2Ban.filter(req.ip, @f2b_options) { req.query_string =~ /OMGHAX/ }

data/spec/fail2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'spec_helper'
 
 describe 'Rack::Attack.Fail2Ban' do
@@ -7,7 +9,7 @@ describe 'Rack::Attack.Fail2Ban' do
     @findtime = 60
     @bantime  = 60
     Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
-    @f2b_options = { :bantime => @bantime, :findtime => @findtime, :maxretry => 2 }
+    @f2b_options = { bantime: @bantime, findtime: @findtime, maxretry: 2 }
 
     Rack::Attack.blocklist('pentest') do |req|
       Rack::Attack::Fail2Ban.filter(req.ip, @f2b_options) { req.query_string =~ /OMGHAX/ }

data/spec/integration/offline_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'active_support/cache'
 require_relative '../spec_helper'
 
@@ -22,7 +24,7 @@ if defined?(::ActiveSupport::Cache::RedisStore)
     before do
       @cache = Rack::Attack::Cache.new
       # Use presumably unused port for Redis client
-      @cache.store = ActiveSupport::Cache::RedisStore.new(:host => '127.0.0.1', :port => 3333)
+      @cache.store = ActiveSupport::Cache::RedisStore.new(host: '127.0.0.1', port: 3333)
     end
   end
 end

data/spec/rack_attack_dalli_proxy_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'spec_helper'
 
 describe Rack::Attack::StoreProxy::DalliProxy do

data/spec/rack_attack_instrumentation_spec.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require_relative "spec_helper"
+
+# ActiveSupport::Subscribers added in ~> 4.0.2.0
+if ActiveSupport::VERSION::MAJOR > 3
+  require_relative 'spec_helper'
+  require 'active_support/subscriber'
+  class CustomSubscriber < ActiveSupport::Subscriber
+    @notification_count = 0
+
+    class << self
+      attr_accessor :notification_count
+    end
+
+    def throttle(_event)
+      self.class.notification_count += 1
+    end
+  end
+
+  describe 'Rack::Attack.instrument' do
+    before do
+      @period = 60 # Use a long period; failures due to cache key rotation less likely
+      Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
+      Rack::Attack.throttle('ip/sec', limit: 1, period: @period) { |req| req.ip }
+    end
+
+    describe "with throttling" do
+      before do
+        ActiveSupport::Notifications.stub(:notifier, ActiveSupport::Notifications::Fanout.new) do
+          CustomSubscriber.attach_to("rack_attack")
+          2.times { get '/', {}, 'REMOTE_ADDR' => '1.2.3.4' }
+        end
+      end
+
+      it 'should instrument without error' do
+        last_response.status.must_equal 429
+        assert_equal 1, CustomSubscriber.notification_count
+      end
+    end
+  end
+end

data/spec/rack_attack_path_normalizer_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'spec_helper'
 
 describe Rack::Attack::PathNormalizer do

data/spec/rack_attack_request_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'spec_helper'
 
 describe 'Rack::Attack' do

data/spec/rack_attack_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative 'spec_helper'
 
 describe 'Rack::Attack' do
@@ -24,13 +26,6 @@ describe 'Rack::Attack' do
       Rack::Attack.blocklists.key?("ip #{@bad_ip}").must_equal true
     }
 
-    it('has a blacklist with a deprication warning') {
-      _, stderror = capture_io do
-        Rack::Attack.blacklists.key?("ip #{@bad_ip}").must_equal true
-      end
-      assert_match "[DEPRECATION] 'Rack::Attack.blacklists' is deprecated.  Please use 'blocklists' instead.", stderror
-    }
-
     describe "a bad request" do
       before { get '/', {}, 'REMOTE_ADDR' => @bad_ip }
 
@@ -55,13 +50,6 @@ describe 'Rack::Attack' do
 
       it('has a safelist') { Rack::Attack.safelists.key?("good ua") }
 
-      it('has a whitelist with a deprication warning') {
-        _, stderror = capture_io do
-          Rack::Attack.whitelists.key?("good ua")
-        end
-        assert_match "[DEPRECATION] 'Rack::Attack.whitelists' is deprecated.  Please use 'safelists' instead.", stderror
-      }
-
       describe "with a request match both safelist & blocklist" do
         before { get '/', {}, 'REMOTE_ADDR' => @bad_ip, 'HTTP_USER_AGENT' => @good_ua }
 
@@ -80,13 +68,6 @@ describe 'Rack::Attack' do
       it 'should exist' do
         Rack::Attack.blocklisted_response.must_respond_to :call
       end
-
-      it 'should give a deprication warning for blacklisted_response' do
-        _, stderror = capture_io do
-          Rack::Attack.blacklisted_response
-        end
-        assert_match "[DEPRECATION] 'Rack::Attack.blacklisted_response' is deprecated.  Please use 'blocklisted_response' instead.", stderror
-      end
     end
 
     describe '#throttled_response' do