rack-dedos 0.4.0 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 499458581f04fa158a8cd0bfb41068b72c41e0d33c0a4321aeaa123a66af7c53
-  data.tar.gz: 22777d21fa4db1beb2571792683835780a561dd466c366803212b88a5e828711
+  metadata.gz: 13b363d6e2ef672affc0c451da8b7209cba8dcf99922ecf4ee852df9f72f2427
+  data.tar.gz: ccd78d96fd078ecb549778809abc85cc8063d0ec0018fa111484e4571158751b
 SHA512:
-  metadata.gz: 889de2da536b7376f39e901caa59e78fb3a59faffd3dddb833051dafe8fae40199d31125ea1c5595480df4cb85cfb61edeb0e3a224335e0a512a503c5275121f
-  data.tar.gz: 22c1060501f2c686b8ad0f499e9ffd366d99640aedcc40f84ac94208ed6e5a917c03e3ad82ae0583705306bb6d9ca09a350e82c838466dbc34316bc24560ff34
+  metadata.gz: 21cc53bde60003177c38cf0db3ea19b83a6cd47ca4b23cc0d3b40fac43e13b141b8d4186eef7fc6feecde39a9733fa5af621ba4cad1521d381c25166d2dc251d
+  data.tar.gz: 1976ab0c669f8e222759251a45e502b2e7e62419bdfef21e7f184bb58dd7d23088a03e9ea3ab4fde20b70b1d651161923e448d9ed98ae14f1edb702098ebd5aa

data/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 Nothing so far
 
+## 0.4.2
+
+### Changes
+* Use [BreakVer](https://www.taoensso.com/break-versioning) from this point forward
+
+### Additions
+* Include the requested URL in warnings
+* Add `only_paths` and `except_paths` options
+
+## 0.4.1
+
+### Fixes
+* Correctly include details in warnings (i.e. country code)
+
 ## 0.4.0
 
 ### Changes

data/README.md

@@ -31,14 +31,56 @@ And then install the bundle:
 bundle install
 ```
 
-## Configuration
+⚠️ This gem initially followed [SemVer](https://semver.org) loosely but transitioned to [BreakVer](https://www.taoensso.com/break-versioning) starting from version 0.4.2 onwards.
 
-Given the drastic nature of the filters, you should use this middleware for production environments only and/or if an environment variable like `UNDER_ATTACK` is set to true.
+## Usage
+
+You should use an environment variable such as `UNDER_ATTACK` to enable Rack::Dedos only when your app is actually under attack.
+
+### Rackup
+
+```ruby
+#!/usr/bin/env rackup
+require 'rack/dedos'
+
+if %w(true t on 1).include? ENV['UNDER_ATTACK']
+  use Rack::Dedos
+end
+
+run lambda { |env| [200, {'Content-Type' => 'text/plain'}, "Hello, world!\n"] }
+```
+
+### Hanami
+
+```ruby
+# config/settings.rb
+
+module MyApp
+  class Settings < Hanami::Settings
+    setting :under_attack, default: false, constructor: Types::Params::Bool
+  end
+end
+```
+
+```ruby
+# config/app.rb
+
+module MyApp
+  class App < Hanami::App
+    environment(:production) do
+      if setting.under_attack
+        middleware.use Rack::Dedos
+      end
+    end
+  end
+end
+```
 
 ### Rails
 
 ```ruby
 # config/application.rb
+
 class Application < Rails::Application
   if Rails.env.production? && ActiveModel::Type::Boolean.new.cast(ENV['UNDER_ATTACK'])
     config.middleware.use Rack::Dedos
@@ -46,19 +88,26 @@ class Application < Rails::Application
 end
 ```
 
-### Rackup
+## Configuration
 
-```ruby
-#!/usr/bin/env rackup
-require 'rack/dedos'
+Given the drastic nature of the filters, you should use this middleware for production environments only and/or if an environment variable like `UNDER_ATTACK` is set to true.
 
-if %w(true t on 1).include? ENV['UNDER_ATTACK']
-  use Rack::Dedos
-end
+### Request
 
-run lambda { |env| [200, {'Content-Type' => 'text/plain'}, "Hello, world!\n"] }
+By default, filters are applied to all request paths. You can norrow this to only certain request paths:
+
+```ruby
+use Rack::Dedos,
+  only_paths: [%r(^/search), %r(%r(\.xml)$)]
+
+use Rack::Dedos,
+  except_paths: [%r(^/$)]
 ```
 
+If you set both `only_paths` and `except_paths`, the latter take precedence.
+
+⚠️ The request path does not include GET parameters.
+
 ### Response
 
 If a request is classified as malicious by at least one filter, the middleware responds with:

data/lib/rack/dedos/filters/base.rb

@@ -6,27 +6,32 @@ module Rack
       class Base
 
         DEFAULT_OPTIONS = {
+          only_paths: [],
+          except_paths: [],
           status: 403,
           text: 'Forbidden (Temporarily Blocked by Rules)'
-        }
+        }.freeze
 
         attr_reader :app
         attr_reader :options
+        attr_reader :details
 
         # @param app [#call]
         # @param options [Hash{Symbol => Object}]
         def initialize(app, options = {})
           @app = app
           @options = DEFAULT_OPTIONS.merge(options)
+          @details = nil
         end
 
         def call(env)
           request = Rack::Request.new(env)
           ip = real_ip(request)
-          if allowed?(request, ip)
+          if !apply?(request) || allowed?(request, ip)
             app.call(env)
           else
-            warn("rack-dedos: request from #{ip} blocked by #{self.class} `#{@country_code.inspect}'")
+            message = "rack-dedos: request #{request.path} from #{ip} blocked by #{self.class}"
+            warn([message, details].compact.join(": "))
             [options[:status], { 'Content-Type' => 'text/plain' }, [options[:text]]]
           end
         end
@@ -37,6 +42,12 @@ module Rack
           Rack::Dedos.config
         end
 
+        def apply?(request)
+          return false if @options[:except_paths].any? { request.path.match? _1 }
+          return true if @options[:only_paths].none?
+          @options[:only_paths].any? { request.path.match? _1 }
+        end
+
         # Get the real IP of the client
         #
         # If containers and/or proxies such as Cloudflare are in the mix, the

data/lib/rack/dedos/filters/country.rb

@@ -23,7 +23,7 @@ module Rack
 
         def allowed?(request, ip)
           if country = maxmind_db&.get(ip)
-            country_code = country.dig('country', 'iso_code').to_sym
+            country_code = @details = country.dig('country', 'iso_code').to_sym
             @countries.include?(country_code) ? @allowed : !@allowed
           else   # not found in database
             true

data/lib/rack/dedos/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   module Dedos
-    VERSION = "0.4.0"
+    VERSION = "0.4.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-dedos
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.2
 platform: ruby
 authors:
 - Sven Schwyn