rack-attack 5.4.2 → 6.2.2

data/lib/rack/attack/throttle.rb

@@ -1,15 +1,18 @@
+# frozen_string_literal: true
+
 module Rack
   class Attack
     class Throttle
       MANDATORY_OPTIONS = [:limit, :period].freeze
 
       attr_reader :name, :limit, :period, :block, :type
-      def initialize(name, options, block)
-        @name, @block = name, block
+      def initialize(name, options, &block)
+        @name = name
+        @block = block
         MANDATORY_OPTIONS.each do |opt|
-          raise ArgumentError.new("Must pass #{opt.inspect} option") unless options[opt]
+          raise ArgumentError, "Must pass #{opt.inspect} option" unless options[opt]
         end
-        @limit  = options[:limit]
+        @limit = options[:limit]
         @period = options[:period].respond_to?(:call) ? options[:period] : options[:period].to_i
         @type   = options.fetch(:type, :throttle)
       end
@@ -29,10 +32,11 @@ module Rack
         epoch_time     = cache.last_epoch_time
 
         data = {
-          :count => count,
-          :period => current_period,
-          :limit => current_limit,
-          :epoch_time => epoch_time
+          discriminator: discriminator,
+          count: count,
+          period: current_period,
+          limit: current_limit,
+          epoch_time: epoch_time
         }
 
         (request.env['rack.attack.throttle_data'] ||= {})[name] = data

data/lib/rack/attack/track.rb

@@ -1,16 +1,19 @@
+# frozen_string_literal: true
+
 module Rack
   class Attack
     class Track
       attr_reader :filter
 
-      def initialize(name, options = {}, block)
+      def initialize(name, options = {}, &block)
         options[:type] = :track
 
-        if options[:limit] && options[:period]
-          @filter = Throttle.new(name, options, block)
-        else
-          @filter = Check.new(name, options, block)
-        end
+        @filter =
+          if options[:limit] && options[:period]
+            Throttle.new(name, options, &block)
+          else
+            Check.new(name, options, &block)
+          end
       end
 
       def matched_by?(request)

data/lib/rack/attack/version.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 module Rack
   class Attack
-    VERSION = '5.4.2'
+    VERSION = '6.2.2'
   end
 end

data/spec/acceptance/allow2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "timecop"
 

data/spec/acceptance/blocking_ip_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Blocking an IP" do
@@ -21,9 +23,9 @@ describe "Blocking an IP" do
     notified = false
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
+    ActiveSupport::Notifications.subscribe("blocklist.rack_attack") do |_name, _start, _finish, _id, payload|
       notified = true
-      notification_type = request.env["rack.attack.match_type"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/", {}, "REMOTE_ADDR" => "5.6.7.8"

data/spec/acceptance/blocking_spec.rb

@@ -1,6 +1,48 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "#blocklist" do
+  before do
+    Rack::Attack.blocklist do |request|
+      request.ip == "1.2.3.4"
+    end
+  end
+
+  it "forbids request if blocklist condition is true" do
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 403, last_response.status
+  end
+
+  it "succeeds if blocklist condition is false" do
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "notifies when the request is blocked" do
+    notification_matched = nil
+    notification_type = nil
+
+    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
+    end
+
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_nil notification_matched
+    assert_nil notification_type
+
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_nil notification_matched
+    assert_equal :blocklist, notification_type
+  end
+end
+
+describe "#blocklist with name" do
   before do
     Rack::Attack.blocklist("block 1.2.3.4") do |request|
       request.ip == "1.2.3.4"
@@ -23,9 +65,9 @@ describe "#blocklist" do
     notification_matched = nil
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_matched = request.env["rack.attack.matched"]
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("blocklist.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/", {}, "REMOTE_ADDR" => "5.6.7.8"

data/spec/acceptance/blocking_subnet_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Blocking an IP subnet" do
@@ -27,9 +29,9 @@ describe "Blocking an IP subnet" do
     notified = false
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
+    ActiveSupport::Notifications.subscribe("blocklist.rack_attack") do |_name, _start, _finish, _id, payload|
       notified = true
-      notification_type = request.env["rack.attack.match_type"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/", {}, "REMOTE_ADDR" => "5.6.7.8"

data/spec/acceptance/cache_store_config_for_allow2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "minitest/stub_const"
 
@@ -20,11 +22,9 @@ describe "Cache store config when using allow2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def write(key, value)
-      end
+      def write(key, value); end
 
-      def increment(key, count, options = {})
-      end
+      def increment(key, count, options = {}); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do
@@ -42,11 +42,9 @@ describe "Cache store config when using allow2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def read(key)
-      end
+      def read(key); end
 
-      def increment(key, count, options = {})
-      end
+      def increment(key, count, options = {}); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do
@@ -64,11 +62,9 @@ describe "Cache store config when using allow2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def read(key)
-      end
+      def read(key); end
 
-      def write(key, value)
-      end
+      def write(key, value); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do

data/spec/acceptance/cache_store_config_for_fail2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "minitest/stub_const"
 
@@ -20,11 +22,9 @@ describe "Cache store config when using fail2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def write(key, value)
-      end
+      def write(key, value); end
 
-      def increment(key, count, options = {})
-      end
+      def increment(key, count, options = {}); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do
@@ -42,11 +42,9 @@ describe "Cache store config when using fail2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def read(key)
-      end
+      def read(key); end
 
-      def increment(key, count, options = {})
-      end
+      def increment(key, count, options = {}); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do
@@ -64,11 +62,9 @@ describe "Cache store config when using fail2ban" do
     raised_exception = nil
 
     fake_store_class = Class.new do
-      def read(key)
-      end
+      def read(key); end
 
-      def write(key, value)
-      end
+      def write(key, value); end
     end
 
     Object.stub_const(:FakeStore, fake_store_class) do

data/spec/acceptance/cache_store_config_for_throttle_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Cache store config when throttling without Rails" do

data/spec/acceptance/cache_store_config_with_rails_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "minitest/stub_const"
 require "ostruct"

data/spec/acceptance/customizing_blocked_response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Customizing block responses" do

data/spec/acceptance/customizing_throttled_response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Customizing throttled response" do

data/spec/acceptance/extending_request_object_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Extending the request object" do

data/spec/acceptance/fail2ban_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 require "timecop"
 

data/spec/acceptance/rails_middleware_spec.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "../spec_helper"
+
+if defined?(Rails)
+  describe "Middleware for Rails" do
+    before do
+      @app = Class.new(Rails::Application) do
+        config.eager_load = false
+        config.logger = Logger.new(nil) # avoid creating the log/ directory automatically
+        config.cache_store = :null_store # avoid creating tmp/ directory for cache
+      end
+    end
+
+    if Gem::Version.new(Rails::VERSION::STRING) >= Gem::Version.new("5.1")
+      it "is used by default" do
+        @app.initialize!
+        assert_equal 1, @app.middleware.count(Rack::Attack)
+      end
+
+      it "is not added when it was explicitly deleted" do
+        @app.config.middleware.delete(Rack::Attack)
+        @app.initialize!
+        refute @app.middleware.include?(Rack::Attack)
+      end
+    end
+
+    if Gem::Version.new(Rails::VERSION::STRING) < Gem::Version.new("5.1")
+      it "is not used by default" do
+        @app.initialize!
+        assert_equal 0, @app.middleware.count(Rack::Attack)
+      end
+    end
+  end
+end

data/spec/acceptance/safelisting_ip_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Safelist an IP" do
@@ -36,8 +38,8 @@ describe "Safelist an IP" do
   it "notifies when the request is safe" do
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("safelist.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/admin", {}, "REMOTE_ADDR" => "5.6.7.8"

data/spec/acceptance/safelisting_spec.rb

@@ -1,6 +1,60 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "#safelist" do
+  before do
+    Rack::Attack.blocklist do |request|
+      request.ip == "1.2.3.4"
+    end
+
+    Rack::Attack.safelist do |request|
+      request.path == "/safe_space"
+    end
+  end
+
+  it "forbids request if blocklist condition is true and safelist is false" do
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 403, last_response.status
+  end
+
+  it "succeeds if blocklist condition is false and safelist is false" do
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "succeeds request if blocklist condition is false and safelist is true" do
+    get "/safe_space", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "succeeds request if both blocklist and safelist conditions are true" do
+    get "/safe_space", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "notifies when the request is safe" do
+    notification_matched = nil
+    notification_type = nil
+
+    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
+    end
+
+    get "/safe_space", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 200, last_response.status
+    assert_nil notification_matched
+    assert_equal :safelist, notification_type
+  end
+end
+
+describe "#safelist with name" do
   before do
     Rack::Attack.blocklist("block 1.2.3.4") do |request|
       request.ip == "1.2.3.4"
@@ -39,9 +93,9 @@ describe "#safelist" do
     notification_matched = nil
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_matched = request.env["rack.attack.matched"]
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("safelist.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_matched = payload[:request].env["rack.attack.matched"]
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/safe_space", {}, "REMOTE_ADDR" => "1.2.3.4"

data/spec/acceptance/safelisting_subnet_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "../spec_helper"
 
 describe "Safelisting an IP subnet" do
@@ -36,8 +38,8 @@ describe "Safelisting an IP subnet" do
   it "notifies when the request is safe" do
     notification_type = nil
 
-    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
-      notification_type = request.env["rack.attack.match_type"]
+    ActiveSupport::Notifications.subscribe("safelist.rack_attack") do |_name, _start, _finish, _id, payload|
+      notification_type = payload[:request].env["rack.attack.match_type"]
     end
 
     get "/admin", {}, "REMOTE_ADDR" => "5.6.0.0"