rack-attack 6.1.0 → 6.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 273111fdf125be1d54c6c956dd4a4e3abe96184a0c5608304839280e06d655a3
-  data.tar.gz: 7e9039aaca427b1f9312ce4739d9d1713282f7b29647988577a37b32c6cfb393
+  metadata.gz: ac5af22059fcc24c45b9732a806b13ef8a39b3ab425e713d22b7d0b1c9fbae11
+  data.tar.gz: fdd20e74080d4254d7910be3d1f0343580a2cedd79b18f2448fa753acd9259e2
 SHA512:
-  metadata.gz: deab3999e7a7f72e6e3d240f8312a38590deb1fd88aba2261c115573ac3081a5dc2e17667d184b68db8e06faf1f28dac27e44fc07867dc149c01ce3635069c42
-  data.tar.gz: bcfc056fd31c5f05c5fa4b517c420df227211186713dab5eeabea74917aa5236ffcac0f00455ac1b4ceb840c1f32929a4c73c84bedf3c34d00f2f04b5e93025a
+  metadata.gz: 1f2a7bd75ab8423dde30e482085b19cb5cfbf7347aed13c94da63d31784939075278cc0f891af450bd33e5ef3de4ea092441b26f2519e28ecb5cbe5c6a16d007
+  data.tar.gz: fbe8d0cc86c52be9a028a4fcb2f8f2399af143b6ccd77c7377cbe5f762bb344bdb80833c5e53221ffefad57d04ee132650b38cd5e9d44c5073e475ba894a1a3f

data/README.md

@@ -1,3 +1,6 @@
+__Note__: You are viewing the development version README.
+For the README consistent with the latest released version see https://github.com/kickstarter/rack-attack/blob/6-stable/README.md.
+
 # Rack::Attack
 
 *Rack middleware for blocking & throttling abusive requests*
@@ -9,6 +12,7 @@ See the [Backing & Hacking blog post](https://www.kickstarter.com/backing-and-ha
 [![Gem Version](https://badge.fury.io/rb/rack-attack.svg)](https://badge.fury.io/rb/rack-attack)
 [![Build Status](https://travis-ci.org/kickstarter/rack-attack.svg?branch=master)](https://travis-ci.org/kickstarter/rack-attack)
 [![Code Climate](https://codeclimate.com/github/kickstarter/rack-attack.svg)](https://codeclimate.com/github/kickstarter/rack-attack)
+[![Join the chat at https://gitter.im/rack-attack/rack-attack](https://badges.gitter.im/rack-attack/rack-attack.svg)](https://gitter.im/rack-attack/rack-attack)
 
 ## Table of contents
 
@@ -67,14 +71,19 @@ Or install it yourself as:
 
 Then tell your ruby web application to use rack-attack as a middleware.
 
-a) For __rails__ applications:
-
+a) For __rails__ applications with versions >= 5.1 it is used by default. For older rails versions you should enable it explicitly:
 ```ruby
 # In config/application.rb
 
 config.middleware.use Rack::Attack
 ```
 
+You can disable it permanently (like for specific environment) or temporarily (can be useful for specific test cases) by writing:
+
+```ruby
+Rack::Attack.enabled = false
+```
+
 b) For __rack__ applications:
 
 ```ruby

data/lib/rack/attack.rb

@@ -6,159 +6,171 @@ require 'rack/attack/path_normalizer'
 require 'rack/attack/request'
 require "ipaddr"
 
-class Rack::Attack
-  class MisconfiguredStoreError < StandardError; end
-  class MissingStoreError < StandardError; end
-
-  autoload :Cache,                'rack/attack/cache'
-  autoload :Check,                'rack/attack/check'
-  autoload :Throttle,             'rack/attack/throttle'
-  autoload :Safelist,             'rack/attack/safelist'
-  autoload :Blocklist,            'rack/attack/blocklist'
-  autoload :Track,                'rack/attack/track'
-  autoload :StoreProxy,           'rack/attack/store_proxy'
-  autoload :DalliProxy,           'rack/attack/store_proxy/dalli_proxy'
-  autoload :MemCacheStoreProxy,   'rack/attack/store_proxy/mem_cache_store_proxy'
-  autoload :RedisProxy,           'rack/attack/store_proxy/redis_proxy'
-  autoload :RedisStoreProxy,      'rack/attack/store_proxy/redis_store_proxy'
-  autoload :RedisCacheStoreProxy, 'rack/attack/store_proxy/redis_cache_store_proxy'
-  autoload :ActiveSupportRedisStoreProxy, 'rack/attack/store_proxy/active_support_redis_store_proxy'
-  autoload :Fail2Ban,             'rack/attack/fail2ban'
-  autoload :Allow2Ban,            'rack/attack/allow2ban'
-
-  class << self
-    attr_accessor :notifier, :blocklisted_response, :throttled_response, :anonymous_blocklists, :anonymous_safelists
-
-    def safelist(name = nil, &block)
-      safelist = Safelist.new(name, &block)
-
-      if name
-        safelists[name] = safelist
-      else
-        anonymous_safelists << safelist
+require 'rack/attack/railtie' if defined?(::Rails)
+
+module Rack
+  class Attack
+    class Error < StandardError; end
+    class MisconfiguredStoreError < Error; end
+    class MissingStoreError < Error; end
+
+    autoload :Cache,                'rack/attack/cache'
+    autoload :Check,                'rack/attack/check'
+    autoload :Throttle,             'rack/attack/throttle'
+    autoload :Safelist,             'rack/attack/safelist'
+    autoload :Blocklist,            'rack/attack/blocklist'
+    autoload :Track,                'rack/attack/track'
+    autoload :StoreProxy,           'rack/attack/store_proxy'
+    autoload :DalliProxy,           'rack/attack/store_proxy/dalli_proxy'
+    autoload :MemCacheStoreProxy,   'rack/attack/store_proxy/mem_cache_store_proxy'
+    autoload :RedisProxy,           'rack/attack/store_proxy/redis_proxy'
+    autoload :RedisStoreProxy,      'rack/attack/store_proxy/redis_store_proxy'
+    autoload :RedisCacheStoreProxy, 'rack/attack/store_proxy/redis_cache_store_proxy'
+    autoload :ActiveSupportRedisStoreProxy, 'rack/attack/store_proxy/active_support_redis_store_proxy'
+    autoload :Fail2Ban,             'rack/attack/fail2ban'
+    autoload :Allow2Ban,            'rack/attack/allow2ban'
+
+    class << self
+      attr_accessor :enabled, :notifier, :blocklisted_response, :throttled_response,
+                    :anonymous_blocklists, :anonymous_safelists
+
+      def safelist(name = nil, &block)
+        safelist = Safelist.new(name, &block)
+
+        if name
+          safelists[name] = safelist
+        else
+          anonymous_safelists << safelist
+        end
       end
-    end
 
-    def blocklist(name = nil, &block)
-      blocklist = Blocklist.new(name, &block)
+      def blocklist(name = nil, &block)
+        blocklist = Blocklist.new(name, &block)
 
-      if name
-        blocklists[name] = blocklist
-      else
-        anonymous_blocklists << blocklist
+        if name
+          blocklists[name] = blocklist
+        else
+          anonymous_blocklists << blocklist
+        end
       end
-    end
 
-    def blocklist_ip(ip_address)
-      anonymous_blocklists << Blocklist.new { |request| IPAddr.new(ip_address).include?(IPAddr.new(request.ip)) }
-    end
+      def blocklist_ip(ip_address)
+        anonymous_blocklists << Blocklist.new { |request| IPAddr.new(ip_address).include?(IPAddr.new(request.ip)) }
+      end
 
-    def safelist_ip(ip_address)
-      anonymous_safelists << Safelist.new { |request| IPAddr.new(ip_address).include?(IPAddr.new(request.ip)) }
-    end
+      def safelist_ip(ip_address)
+        anonymous_safelists << Safelist.new { |request| IPAddr.new(ip_address).include?(IPAddr.new(request.ip)) }
+      end
 
-    def throttle(name, options, &block)
-      throttles[name] = Throttle.new(name, options, &block)
-    end
+      def throttle(name, options, &block)
+        throttles[name] = Throttle.new(name, options, &block)
+      end
 
-    def track(name, options = {}, &block)
-      tracks[name] = Track.new(name, options, &block)
-    end
+      def track(name, options = {}, &block)
+        tracks[name] = Track.new(name, options, &block)
+      end
 
-    def safelists
-      @safelists  ||= {}
-    end
+      def safelists
+        @safelists ||= {}
+      end
 
-    def blocklists
-      @blocklists ||= {}
-    end
+      def blocklists
+        @blocklists ||= {}
+      end
 
-    def throttles
-      @throttles  ||= {}
-    end
+      def throttles
+        @throttles ||= {}
+      end
 
-    def tracks
-      @tracks     ||= {}
-    end
+      def tracks
+        @tracks ||= {}
+      end
 
-    def safelisted?(request)
-      anonymous_safelists.any? { |safelist| safelist.matched_by?(request) } ||
-        safelists.any? { |_name, safelist| safelist.matched_by?(request) }
-    end
+      def safelisted?(request)
+        anonymous_safelists.any? { |safelist| safelist.matched_by?(request) } ||
+          safelists.any? { |_name, safelist| safelist.matched_by?(request) }
+      end
 
-    def blocklisted?(request)
-      anonymous_blocklists.any? { |blocklist| blocklist.matched_by?(request) } ||
-        blocklists.any? { |_name, blocklist| blocklist.matched_by?(request) }
-    end
+      def blocklisted?(request)
+        anonymous_blocklists.any? { |blocklist| blocklist.matched_by?(request) } ||
+          blocklists.any? { |_name, blocklist| blocklist.matched_by?(request) }
+      end
 
-    def throttled?(request)
-      throttles.any? do |_name, throttle|
-        throttle.matched_by?(request)
+      def throttled?(request)
+        throttles.any? do |_name, throttle|
+          throttle.matched_by?(request)
+        end
       end
-    end
 
-    def tracked?(request)
-      tracks.each_value do |track|
-        track.matched_by?(request)
+      def tracked?(request)
+        tracks.each_value do |track|
+          track.matched_by?(request)
+        end
       end
-    end
 
-    def instrument(request)
-      if notifier
-        event_type = request.env["rack.attack.match_type"]
-        notifier.instrument("#{event_type}.rack_attack", request: request)
+      def instrument(request)
+        if notifier
+          event_type = request.env["rack.attack.match_type"]
+          notifier.instrument("#{event_type}.rack_attack", request: request)
 
-        # Deprecated: Keeping just for backwards compatibility
-        notifier.instrument("rack.attack", request: request)
+          # Deprecated: Keeping just for backwards compatibility
+          notifier.instrument("rack.attack", request: request)
+        end
       end
-    end
 
-    def cache
-      @cache ||= Cache.new
+      def cache
+        @cache ||= Cache.new
+      end
+
+      def clear_configuration
+        @safelists = {}
+        @blocklists = {}
+        @throttles = {}
+        @tracks = {}
+        self.anonymous_blocklists = []
+        self.anonymous_safelists = []
+      end
+
+      def clear!
+        warn "[DEPRECATION] Rack::Attack.clear! is deprecated. Please use Rack::Attack.clear_configuration instead"
+        clear_configuration
+      end
     end
 
-    def clear_configuration
-      @safelists, @blocklists, @throttles, @tracks = {}, {}, {}, {}
-      self.anonymous_blocklists = []
-      self.anonymous_safelists = []
+    # Set defaults
+    @enabled = true
+    @anonymous_blocklists = []
+    @anonymous_safelists = []
+    @notifier = ActiveSupport::Notifications if defined?(ActiveSupport::Notifications)
+    @blocklisted_response = lambda { |_env| [403, { 'Content-Type' => 'text/plain' }, ["Forbidden\n"]] }
+    @throttled_response   = lambda do |env|
+      retry_after = (env['rack.attack.match_data'] || {})[:period]
+      [429, { 'Content-Type' => 'text/plain', 'Retry-After' => retry_after.to_s }, ["Retry later\n"]]
     end
 
-    def clear!
-      warn "[DEPRECATION] Rack::Attack.clear! is deprecated. Please use Rack::Attack.clear_configuration instead"
-      clear_configuration
+    def initialize(app)
+      @app = app
     end
-  end
 
-  # Set defaults
-  @anonymous_blocklists = []
-  @anonymous_safelists = []
-  @notifier             = ActiveSupport::Notifications if defined?(ActiveSupport::Notifications)
-  @blocklisted_response = lambda { |_env| [403, { 'Content-Type' => 'text/plain' }, ["Forbidden\n"]] }
-  @throttled_response   = lambda { |env|
-    retry_after = (env['rack.attack.match_data'] || {})[:period]
-    [429, { 'Content-Type' => 'text/plain', 'Retry-After' => retry_after.to_s }, ["Retry later\n"]]
-  }
-
-  def initialize(app)
-    @app = app
-  end
+    def call(env)
+      return @app.call(env) unless self.class.enabled
+
+      env['PATH_INFO'] = PathNormalizer.normalize_path(env['PATH_INFO'])
+      request = Rack::Attack::Request.new(env)
 
-  def call(env)
-    env['PATH_INFO'] = PathNormalizer.normalize_path(env['PATH_INFO'])
-    request = Rack::Attack::Request.new(env)
-
-    if safelisted?(request)
-      @app.call(env)
-    elsif blocklisted?(request)
-      self.class.blocklisted_response.call(env)
-    elsif throttled?(request)
-      self.class.throttled_response.call(env)
-    else
-      tracked?(request)
-      @app.call(env)
+      if safelisted?(request)
+        @app.call(env)
+      elsif blocklisted?(request)
+        self.class.blocklisted_response.call(env)
+      elsif throttled?(request)
+        self.class.throttled_response.call(env)
+      else
+        tracked?(request)
+        @app.call(env)
+      end
     end
-  end
 
-  extend Forwardable
-  def_delegators self, :safelisted?, :blocklisted?, :throttled?, :tracked?
+    extend Forwardable
+    def_delegators self, :safelisted?, :blocklisted?, :throttled?, :tracked?
+  end
 end

data/lib/rack/attack/cache.rb

@@ -73,7 +73,10 @@ module Rack
 
       def enforce_store_method_presence!(method_name)
         if !store.respond_to?(method_name)
-          raise Rack::Attack::MisconfiguredStoreError, "Configured store #{store.class.name} doesn't respond to ##{method_name} method"
+          raise(
+            Rack::Attack::MisconfiguredStoreError,
+            "Configured store #{store.class.name} doesn't respond to ##{method_name} method"
+          )
         end
       end
     end

data/lib/rack/attack/check.rb

@@ -5,7 +5,8 @@ module Rack
     class Check
       attr_reader :name, :block, :type
       def initialize(name, options = {}, &block)
-        @name, @block = name, block
+        @name = name
+        @block = block
         @type = options.fetch(:type, nil)
       end
 

data/lib/rack/attack/path_normalizer.rb

@@ -1,24 +1,26 @@
 # frozen_string_literal: true
 
-class Rack::Attack
-  # When using Rack::Attack with a Rails app, developers expect the request path
-  # to be normalized. In particular, trailing slashes are stripped.
-  # (See https://git.io/v0rrR for implementation.)
-  #
-  # Look for an ActionDispatch utility class that Rails folks would expect
-  # to normalize request paths. If unavailable, use a fallback class that
-  # doesn't normalize the path (as a non-Rails rack app developer expects).
+module Rack
+  class Attack
+    # When using Rack::Attack with a Rails app, developers expect the request path
+    # to be normalized. In particular, trailing slashes are stripped.
+    # (See https://git.io/v0rrR for implementation.)
+    #
+    # Look for an ActionDispatch utility class that Rails folks would expect
+    # to normalize request paths. If unavailable, use a fallback class that
+    # doesn't normalize the path (as a non-Rails rack app developer expects).
 
-  module FallbackPathNormalizer
-    def self.normalize_path(path)
-      path
+    module FallbackPathNormalizer
+      def self.normalize_path(path)
+        path
+      end
     end
-  end
 
-  PathNormalizer = if defined?(::ActionDispatch::Journey::Router::Utils)
-                     # For Rails apps
-                     ::ActionDispatch::Journey::Router::Utils
-                   else
-                     FallbackPathNormalizer
-                   end
+    PathNormalizer = if defined?(::ActionDispatch::Journey::Router::Utils)
+                       # For Rails apps
+                       ::ActionDispatch::Journey::Router::Utils
+                     else
+                       FallbackPathNormalizer
+                     end
+  end
 end

data/lib/rack/attack/railtie.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Rack
+  class Attack
+    class Railtie < ::Rails::Railtie
+      initializer 'rack.attack.middleware', after: :load_config_initializers, before: :build_middleware_stack do |app|
+        if Gem::Version.new(::Rails::VERSION::STRING) >= Gem::Version.new("5.1")
+          middlewares = app.config.middleware
+          operations = middlewares.send(:operations) + middlewares.send(:delete_operations)
+
+          use_middleware = operations.none? do |operation|
+            middleware = operation[1]
+            middleware.include?(Rack::Attack)
+          end
+
+          middlewares.use(Rack::Attack) if use_middleware
+        end
+      end
+    end
+  end
+end

data/lib/rack/attack/store_proxy/active_support_redis_store_proxy.rb

@@ -7,7 +7,9 @@ module Rack
     module StoreProxy
       class ActiveSupportRedisStoreProxy < SimpleDelegator
         def self.handle?(store)
-          defined?(::Redis) && defined?(::ActiveSupport::Cache::RedisStore) && store.is_a?(::ActiveSupport::Cache::RedisStore)
+          defined?(::Redis) &&
+            defined?(::ActiveSupport::Cache::RedisStore) &&
+            store.is_a?(::ActiveSupport::Cache::RedisStore)
         end
 
         def increment(name, amount = 1, options = {})

data/lib/rack/attack/store_proxy/mem_cache_store_proxy.rb

@@ -7,7 +7,9 @@ module Rack
     module StoreProxy
       class MemCacheStoreProxy < SimpleDelegator
         def self.handle?(store)
-          defined?(::Dalli) && defined?(::ActiveSupport::Cache::MemCacheStore) && store.is_a?(::ActiveSupport::Cache::MemCacheStore)
+          defined?(::Dalli) &&
+            defined?(::ActiveSupport::Cache::MemCacheStore) &&
+            store.is_a?(::ActiveSupport::Cache::MemCacheStore)
         end
 
         def write(name, value, options = {})