RubyGems - rack-honeypot - Versions diffs - 0.1.0 - Mend

rack-honeypot 0.1.0

Files changed (8) hide show

data/Gemfile ADDED Viewed

@@ -0,0 +1,7 @@
+source 'http://rubygems.org/'
+gem 'rake'
+gem 'unindentable', '0.0.4'
+gem 'rack'
+gem 'mocha'
+gem 'rack-test'

data/LICENSE.md ADDED Viewed

@@ -0,0 +1,10 @@
+Copyright (c) 2009, Sunlight Foundation
+All rights reserved.
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+  * Neither the name of Sunlight Foundation nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

data/README.md ADDED Viewed

@@ -0,0 +1,70 @@
+# Honeypot, a Rack Middleware for trapping spambots
+Written by Luigi Montanez of the Sunlight Labs, with contributions from Luc Castera. Copyright 2009.
+This middleware acts as a spam trap. It inserts, into every outputted `<form>`, a text field that a spambot will really want to fill in, but is actually not used by the app. The field is hidden to humans via CSS, and includes a warning label for screenreading software.
+In the `<body>`:
+    <form>
+      <div class='phonetoy'>
+        <label for='email'>Don't fill in this field</label>
+        <input type='text' name='email' value=''/>
+      </div>
+    [...]
+In the `<head>`:
+    <style type='text/css' media='all'>
+      div.phonetoy {
+        display:none;
+      }
+    </style>
+Then, for incoming requests, the middleware will check if the text field has been set to an unexpected value. If it has, that means a spambot has altered the field, and the spambot is booted to a dead end blank page.
+## Dependencies
+You will need to install these RubyGems:
+* unindentable: http://github.com/sunlightlabs/ruby-unindentable/tree/master
+* rack-test: http://github.com/brynary/rack-test/tree/master
+## Configuration
+To use in your Rails app, place `honeypot.rb` in `lib/rack`.
+Then in `environment.rb`:
+    config.middleware.use "Rack::Honeypot"
+That's all there is to it. Fire up your app, View Source on a page with a form, and see the magic.
+There are a few options you can pass in:
+  * `:class_name` is the class assigned to the parent div of the honeypot. Defaults to "phonetoy", an anagram of honeypot.
+  * `:label` is the warning label displayed to those with CSS disabled. Defaults to "Don't fill in this field".
+  * `:input_name` is the name of the form field. Ensure that this is tempting to a spambot if you modify it. Defaults to "email".
+  * `:input_value` is the value of the form field that would only be modified by a spambot. Defaults to blank.
+If you want to modify the options used, simply do:
+    config.middleware.use "Rack::Honeypot", :input_name => "firstname"
+## Tests
+To run the tests:
+    sudo gem install rack-test
+    cd test
+    ruby test_honeypot.rb
+## Props
+Based on [django-honeypot](http://github.com/sunlightlabs/django-honeypot) by James Turk.
+Credit to Geoff Buesing for a first stab at this [idea in Rack](http://mad.ly/2009/05/01/honeypot-filter-as-a-rack-middleware/).
+See LICENSE.md for proper reuse guidelines.

data/Rakefile ADDED Viewed

@@ -0,0 +1,6 @@
+require 'rake/testtask'
+Rake::TestTask.new do |task|
+  task.test_files = FileList['test/test_*.rb']
+end

data/VERSION ADDED Viewed

	@@ -0,0 +1 @@
1	+ 0.1.0

data/lib/rack/honeypot.rb ADDED Viewed

@@ -0,0 +1,68 @@
+require 'unindentable'
+module Rack
+  class Honeypot
+    include Unindentable
+    def initialize(app, options={})
+      @app = app
+      @class_name   = options[:class_name] || "phonetoy"
+      @label        = options[:label] || "Don't fill in this field"
+      @input_name   = options[:input_name] || "email"
+      @input_value  = options[:input_value] || ""
+      @logger       = options[:logger]
+    end
+    def call(env)
+      if spambot_submission?(Rack::Request.new(env).params)
+        @logger.warn("[Rack::Honeypot] Spam bot detected; responded with null") unless @logger.nil?
+        send_to_dead_end
+      else
+        status, headers, response = @app.call(env)
+        new_body = insert_honeypot(build_response_body(response))
+        new_headers = recalculate_body_length(headers, new_body)
+        [status, new_headers, new_body]
+      end
+    end
+    def spambot_submission?(form_hash)
+      form_hash && form_hash[@input_name] && form_hash[@input_name] != @input_value
+    end
+    def send_to_dead_end
+      [200, {'Content-Type' => 'text/html', "Content-Length" => "0"}, []]
+    end
+    def build_response_body(response)
+      response_body = ""
+      response.each { |part| response_body += part }
+      response_body
+    end
+    def recalculate_body_length(headers, body)
+      new_headers = headers
+      new_headers["Content-Length"] = body.length.to_s
+      new_headers
+    end
+    def insert_honeypot(body)
+      css = unindent <<-BLOCK
+        <style type='text/css' media='all'>
+          div.#{@class_name} {
+            display:none;
+          }
+        </style>
+      BLOCK
+      div = unindent <<-BLOCK
+        <div class='#{@class_name}'>
+          <label for='#{@input_name}'>#{@label}</label>
+          <input type='text' name='#{@input_name}' value='#{@input_value}'/>
+        </div>
+      BLOCK
+      body.gsub!(/<\/head>/, css + "\n</head>")
+      body.gsub!(/<form(.*)>/, '<form\1>' + "\n" + div)
+      body
+    end
+  end
+end

data/test/test_honeypot.rb ADDED Viewed

@@ -0,0 +1,87 @@
+require 'rack/test'
+require 'test/unit'
+require 'mocha'
+require 'unindentable'
+require File.expand_path(File.dirname(__FILE__) + '/../lib/rack/honeypot')
+# To run this test, you need to have rack-test gem installed: sudo gem install rack-test
+class HoneypotTest < Test::Unit::TestCase
+  include Rack::Test::Methods
+  include Unindentable
+  def setup
+    @logger = stub("logger", :warn => nil)
+  end
+  def app
+    content = unindent <<-BLOCK
+      <html>
+        <head>
+        </head>
+        <body>
+          <form></form>
+          Hello World!
+        </body>
+      </html>
+    BLOCK
+    hello_world_app = lambda do |env|
+      [
+        200,
+        {
+          'Content-Type'   => 'text/plain',
+          'Content-Length' => content.length.to_s
+        },
+        [content]
+      ]
+    end
+    Rack::Honeypot.new(hello_world_app, :input_name => 'honeypot_email', :logger => @logger)
+  end
+  def test_normal_request_should_go_through
+    get '/'
+    assert_equal 200, last_response.status
+    assert_not_equal '', last_response.body
+  end
+  def test_request_with_form_should_add_honeypot_css
+    get '/'
+    assert_equal 200, last_response.status
+    css = unindent <<-BLOCK
+      <style type='text/css' media='all'>
+        div.phonetoy {
+          display:none;
+        }
+      </style>
+    BLOCK
+    assert last_response.body.index(css)
+  end
+  def test_request_with_form_should_add_honeypot_div
+    get '/'
+    assert_equal 200, last_response.status
+    div = unindent <<-BLOCK
+      <div class='phonetoy'>
+        <label for='honeypot_email'>Don't fill in this field</label>
+        <input type='text' name='honeypot_email' value=''/>
+      </div>
+    BLOCK
+    assert last_response.body.index(div)
+  end
+  def test_spam_request_should_be_sent_to_dead_end
+    post '/', :honeypot_email => 'joe@example.com'
+    assert_equal 200, last_response.status
+    assert_equal '', last_response.body
+  end
+  def test_spam_request_should_be_logged
+    @logger.expects(:warn).with("[Rack::Honeypot] Spam bot detected; responded with null")
+    post '/', :honeypot_email => 'joe@example.com'
+  end
+end

metadata ADDED Viewed

@@ -0,0 +1,131 @@
+--- !ruby/object:Gem::Specification
+name: rack-honeypot
+version: !ruby/object:Gem::Version
+  hash: 27
+  prerelease:
+  segments:
+  - 0
+  - 1
+  - 0
+  version: 0.1.0
+platform: ruby
+authors:
+- Luigi Montanez
+- Luc Castera
+- Daniel Schierbeck
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2011-10-05 00:00:00 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        hash: 3
+        segments:
+        - 0
+        version: "0"
+  type: :runtime
+  version_requirements: *id001
+- !ruby/object:Gem::Dependency
+  name: unindentable
+  prerelease: false
+  requirement: &id002 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - "="
+      - !ruby/object:Gem::Version
+        hash: 23
+        segments:
+        - 0
+        - 0
+        - 4
+        version: 0.0.4
+  type: :runtime
+  version_requirements: *id002
+- !ruby/object:Gem::Dependency
+  name: rack
+  prerelease: false
+  requirement: &id003 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        hash: 3
+        segments:
+        - 0
+        version: "0"
+  type: :runtime
+  version_requirements: *id003
+- !ruby/object:Gem::Dependency
+  name: rack-test
+  prerelease: false
+  requirement: &id004 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        hash: 3
+        segments:
+        - 0
+        version: "0"
+  type: :runtime
+  version_requirements: *id004
+description: This middleware acts as a spam trap. It inserts, into every outputted <form>, a text field that a spambot will really want to fill in, but is actually not used by the app. The field is hidden to humans via CSS, and includes a warning label for screenreading software.
+email: luigi.montanez@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- LICENSE.md
+- README.md
+files:
+- Gemfile
+- LICENSE.md
+- README.md
+- Rakefile
+- VERSION
+- lib/rack/honeypot.rb
+- test/test_honeypot.rb
+homepage: http://github.com/sunlightlabs/rack-honeypot
+licenses: []
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      hash: 3
+      segments:
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      hash: 3
+      segments:
+      - 0
+      version: "0"
+requirements: []
+rubyforge_project:
+rubygems_version: 1.8.6
+signing_key:
+specification_version: 3
+summary: Middleware that functions as a spambot trap.
+test_files: []