rack-padlock 0.0.1 → 0.0.2

data/README.md

@@ -1,36 +1,61 @@
-rack-padlock
-=======
+# rack-padlock
 
-A toolkit for writing tests against rack applications that ensure all traffic on a page is secure.
+A toolkit for rack applications that ensures _ALL_ content on a page is secure.  The browser padlock is pretty important for commercial web applications. Modern sites rely on so many third party services: analytics, video players, social media widgets.  With all these moving parts it's easy to end up with a broken padlock. Rack-Padlock will increase the visibility of padlock problems to your development team, and it's dead easy to use.
 
-###Prerequisites
+## Prerequisites
 
-1. You need to have a rack based application
-2. The application must have a browser based integration test suite.  I recommend capybara.
-3. Your integration tests must use HTTPS
+All you need to have a rack based application! (Rails, Sinatra, Camping, etc...)
 
 ## Setup
 
 Add rack-padlock gem to your test group
 
-```bash
+```ruby
 group :test do
   gem 'rack-padlock'
 end
 ```
 
-Add rack-padlock middleware to your app
+Add rack-padlock rake tasks to your app
 
-```bash
-group :test do
-  gem 'rack-padlock'
+```ruby
+require 'rack/padlock'
+load 'tasks/rack-padlock.rake'
+```
+
+Specify what url's you want to test somewhere in your Rakefile
+
+```ruby
+Rack::Padlock.padlock_uris = ["/secure", "/insecure"]
+```
+
+If your application isn't a Rails app, then you need to add an environment rake task to your Rakefile like this
+```ruby
+desc "setup application environment"
+task :environment do
+  require 'your rack application'
+  Rack::Padlock.application = YourRackApplication
+  Rack::Padlock.padlock_uris = ["/secure", "/insecure"]
 end
 ```
+## Running Tests
+
+Once you've set things up simply run
+
+```bash
+rake padlock
+```
+
+This will run the padlock tests.  If any of your integration tests mix secure and insecure content, the padlock test will fail.
+
+## Example rack application
+
+Have a look at a simple sinatra application that demonstrates rack-padlock at https://github.com/joshuacronemeyer/rack-padlock-example-app
 
-Please see the example application at https://github.com/joshuacronemeyer/rack-padlock-example-app
+## How it works
 
-how it works
-=======
+Rack-Padlock starts your Rack app up with an SSL enabled webrick server.  It puts a custom middleware in front of your application that implements a CSP policy.  That policy requires the browser to notify us of any non SSL activity.  The custom middleware intercepts these notifications and logs them.  At the end of the run the rack-padlock test will either succeed or fail based on the presence of any policy violations.
 
+## References
 
-Please see https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
+1. http://www.w3.org/TR/CSP/

data/lib/rack/padlock/padlock.js

@@ -0,0 +1,42 @@
+var startTime = Date.now();
+var timeOut = 10000;
+console.log('Padlock: JS client starting!');
+var page = require('webpage').create(),
+    system = require('system'),
+    t, address;
+
+if (system.args.length === 1) {
+    console.log('ERROR: You need to pass phantomjs some URLs to visit!');
+    phantom.exit();
+}
+
+var pagesToVisit = system.args.slice(1);
+var numberOfPagesToVisit = pagesToVisit.length;
+var numberOfPagesVisited = 0;
+
+var visitPages = function(pages){
+  if(pages.length == 0){return;}
+  var thePage = pages.pop();
+  console.log("Opening " + thePage);
+  page.open(thePage, function (status) {
+      if (status !== 'success') {
+          console.log('FAIL to load the address: ' + thePage);
+      } else {
+          console.log('visited: ' + thePage );
+      }
+      numberOfPagesVisited++;
+      visitPages(pages);
+  });
+};
+
+var exitWhenDone = function(){
+  var executionTime = Date.now() - startTime;
+  if (numberOfPagesVisited == numberOfPagesToVisit || executionTime > timeOut) {
+    phantom.exit();
+  } else{
+    setTimeout(exitWhenDone,500); 
+  }
+};
+
+visitPages(pagesToVisit);
+exitWhenDone();

data/lib/rack/padlock/phantomjs.rb

@@ -0,0 +1,24 @@
+module Rack
+  class Padlock
+    class Phantomjs
+      KILL_TIMEOUT = 20 # seconds
+      attr_reader :pid, :binary
+      
+      def initialize(addresses, binary=nil)
+        @binary = binary || 'phantomjs'
+        @addresses = addresses
+        @pid = nil
+      end
+      
+      def command
+        js_path = ::File.expand_path('../padlock.js', __FILE__)
+        "#{@binary} --ignore-ssl-errors=yes #{js_path} #{@addresses.join(' ')}"
+      end
+        
+      def start
+        puts "Starting up phantomjs\n"
+        Timeout.timeout(KILL_TIMEOUT) { system(command) }
+      end
+    end
+  end
+end

data/lib/rack/padlock/selenium.rb

@@ -0,0 +1,18 @@
+require "selenium-webdriver"
+module Rack
+  class Padlock
+    class Selenium
+      def initialize(addresses)
+        @addresses = addresses
+      end
+      
+      def start
+        puts "Starting up selenium webdriver\n"
+        @driver = ::Selenium::WebDriver.for :firefox
+        @driver.manage.timeouts.implicit_wait = 30
+        @addresses.each{|address| @driver.get(address)}
+        @driver.quit
+      end
+    end
+  end
+end

data/lib/rack/padlock/server.rb

@@ -0,0 +1,104 @@
+require 'timeout'
+require 'rack'
+module Rack
+  class Padlock
+    
+    class Server
+      PORT = 9988
+      attr_reader :app
+
+      def initialize(app)
+        @app = app
+        @middleware = Rack::Padlock.new(@app)
+        @server_thread = nil
+      end
+
+      def boot
+        @server_thread = Thread.new do
+          webserver = Rack::Padlock::Webrick.run(@middleware, PORT)
+        end
+
+        Timeout.timeout(60) { @server_thread.join(0.1) until responsive? }
+      rescue Timeout::Error
+        raise "Rack application timed out during boot"
+      else
+        self
+      end
+      
+      def responsive?
+        return false if @server_thread && @server_thread.join(0)
+
+        require "net/https"
+        require 'uri'
+        uri = URI.parse("#{base_uri}/padlock_middleware/poke")
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        request = Net::HTTP::Get.new(uri.request_uri)
+        response = http.request(request)
+
+        return response.is_a?(Net::HTTPSuccess) || response.is_a?(Net::HTTPRedirection)
+      rescue Errno::ECONNREFUSED, Errno::EBADF
+        return false
+      end
+
+      def base_uri
+        "https://localhost:#{PORT}"
+      end
+    end
+    
+    class Webrick
+      def self.run(app, port)
+        puts "Starting up SSL webrick\n"
+        require 'rack/handler/webrick'
+        require 'webrick/https'
+        require 'openssl'
+        webrick_options = {
+          :Port => (port), 
+            :AccessLog => [],
+            :Logger => WEBrick::Log::new(nil, 0),
+            :SSLEnable => true,
+            :SSLVerifyClient => OpenSSL::SSL::VERIFY_NONE,
+            :SSLPrivateKey => OpenSSL::PKey::RSA.new(KEY),
+            :SSLCertificate => OpenSSL::X509::Certificate.new(CRT),
+            :SSLCertName => [["CN", WEBrick::Utils::getservername]]
+        }
+        webrick_options.merge({:Logger => WEBrick::Log::new($stdout, WEBrick::Log::DEBUG)}) if Rack::Padlock.debug?
+        Rack::Handler::WEBrick.run(app, webrick_options)
+      end
+      
+      KEY=<<EOF
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDayqjBWENExonuc2RPbegDb7O2r5vw+iVl0MBF9sQAmuu3vuoN
+UCeNgF2CFvMpFQFsQ8hm+qnnDQFU66+lEXfR5bfRd8whOIS7ysD5nDzr8wKhqX9s
+964zhVInvfEinmggyxz6BdkWTXsMblS1Z0JjsomFrhQkIkw82r5t7Hc4iQIDAQAB
+AoGBALAo4i0iQq86Z84s7IQjit5RbtJVnGovDjNnG5h5ciDGm6nLNqnXcrE0vJVE
+oy3dstKX1OBNTMUyrHLSfQ6b/OrvKw6dg7ndyFK+XO4zLFB5B0sCE5Bp05Ycjlj1
+8IAuu9k2e3ozDjf1tNpD80OTa8S3y4+4yxeN5QYbAd2eh+7tAkEA8WbVz8Cjaf9w
+y53k5L9Rv7GP54CI2f7LAsla6TUqQsgjvKTOqalGm4O/7N62nj/JAyWWQl72d4GQ
+xL2ZZyhCxwJBAOgFy5b0yNP/QywzEtpwP3JBrOIdYqV/oXxE0rCzJkWC94xm2J1p
+0198fNjgueAy4YnuMjR6nTGjBVCdU82fWi8CQB93t0ForCSiHrL8Nx02b1Kcs9SK
+pcw88XvAgbBKtOKVskrh9Oqa3VBiYT9gXM/OIsbdPHQUau5zHkr3KCsRTXsCQQCT
+bStBjeQVoDpkWUd/eJc32DcrrZRCqGhJd8mP8SU+QctdcPPugZGHOKhzfcddh7b7
+V1ibM9Wx9m2oHW9kVf6NAkA1q90FzKwrpFmyzwKCe7wWhPd3GlN4qXvwdEW4kk1b
+KTjyjrIXRt5UObL+ywhdkES8h2+rUFw5hXfyzIpafjyZ
+-----END RSA PRIVATE KEY-----
+EOF
+      CRT=<<EOF
+-----BEGIN CERTIFICATE-----
+MIIB8TCCAVoCCQCD/Pvld7jzMDANBgkqhkiG9w0BAQUFADA8MQswCQYDVQQGEwJV
+UzELMAkGA1UECAwCQ0ExCzAJBgNVBAcMAlNGMRMwEQYDVQQKDApDb2xsZWdlc2V0
+MCAXDTEzMDIwNzE5MzM1M1oYDzMwMTIwNjEwMTkzMzUzWjA8MQswCQYDVQQGEwJV
+UzELMAkGA1UECAwCQ0ExCzAJBgNVBAcMAlNGMRMwEQYDVQQKDApDb2xsZWdlc2V0
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDayqjBWENExonuc2RPbegDb7O2
+r5vw+iVl0MBF9sQAmuu3vuoNUCeNgF2CFvMpFQFsQ8hm+qnnDQFU66+lEXfR5bfR
+d8whOIS7ysD5nDzr8wKhqX9s964zhVInvfEinmggyxz6BdkWTXsMblS1Z0JjsomF
+rhQkIkw82r5t7Hc4iQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACbe+qTXarpzRtRx
++v3AQhN/nMMKHvDwIhfiDlJva0DcRvWi9FDyyQVO8NA5YgcfMPI0iN1opEfOSrfG
+mtyWupIL5lpn4EzW9r/0jOhjwA2NDN/BVYiFe4ovsPvJCOWti1bs7xMz7bSaFiNr
+fi5nkNjLgLQmZHUj9/soMSfRGbP1
+-----END CERTIFICATE-----
+EOF
+    end
+  end
+end

data/lib/rack/padlock/string_util.rb

@@ -0,0 +1,16 @@
+module Rack
+  class Padlock
+    class StringUtil
+      def elide(string, max)
+        length = string.length
+        return string unless length > max
+        return string if max <= 0
+        amount_to_preserve_on_the_left = (max/2.0).ceil
+        amount_to_preserve_on_the_right = max - amount_to_preserve_on_the_left
+        left = string[0..(amount_to_preserve_on_the_left-1)]
+        right = string[-amount_to_preserve_on_the_right..-1]
+        "#{left}...#{right}"
+      end
+    end
+  end
+end

data/lib/rack/padlock/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Padlock
-    VERSION = "0.0.1"
+    VERSION = "0.0.2"
   end
 end

data/lib/rack/padlock.rb

@@ -1,40 +1,81 @@
 module Rack
   class Padlock
+    @@application = nil
+    @@padlock_uris = nil
+    @@debug = false
+    @@logfile = "tmp/padlock.log"
+    
     POST_BODY  = 'rack.input'.freeze
     
-    def initialize(app, options={})
-      default_options = {
-        :log_file => "tmp/padlock.log"
-      }
+    def initialize(app)
       @app = app
-      @options = default_options.merge(options)
     end
 
     def call(env)
+      return poke_response if poke?(env)
       return capture_violation(env) if csp_policy_violation?(env)
       status, headers, body = @app.call(env)
       headers.merge!(csp_headers(env))
       [status, headers, body]
     end
-  
+    
+    def self.application=(app)
+      @@application = app
+    end
+    
+    def self.application
+      @@application
+    end
+    
+    def self.padlock_uris=(uri_list)
+      @@padlock_uris = uri_list
+    end
+    
+    def self.padlock_uris(base_uri)
+      @@padlock_uris.map {|path| "#{base_uri}#{path}" } if @@padlock_uris
+    end
+    
+    def self.debug=(flag)
+      @@debug = flag
+    end
+    
+    def self.debug?
+      @@debug
+    end
+    
+    def self.logfile=(log)
+      @@logfile = log
+    end
+    
+    def self.logfile
+      @@logfile
+    end
     private
   
     def capture_violation(env)
       violation = env[POST_BODY].read
-      PadlockFile.write(@options[:log_file], violation)
-      [200, {}, []]
+      PadlockFile.write(Padlock.logfile, violation)
+      [200, {"Content-Length"=>"0"}, []]
     end
   
+    def poke_response
+      [200, {}, []]
+    end
+    
     def csp_policy_violation?(env)
       env['PATH_INFO'] =~ /padlock_middleware\/report$/
     end
   
+    def poke?(env)
+      env['PATH_INFO'] =~ /padlock_middleware\/poke$/
+    end
+    
     def csp_headers(env)
       host = env["HTTP_HOST"]
       report_uri = "#{host}/padlock_middleware/report"
       csp_header_names = %w(Content-Security-Policy-Report-Only X-Content-Security-Policy-Report-Only X-WebKit-CSP-Report-Only)
       csp_headers = {}
-      csp_header_names.each{|name| csp_headers[name] = "default-src https: 'unsafe-inline' 'unsafe-eval'; report-uri http://#{report_uri}"}
+      csp_header_names.each{|name| csp_headers[name] = "default-src https: 'unsafe-inline' 'unsafe-eval'; report-uri https://#{report_uri}"}
       csp_headers
     end
     

data/lib/tasks/rack-padlock.rake

@@ -1,15 +1,37 @@
 require 'rainbow'
-PADLOCK_LOG = 'tmp/padlock.log'
+require 'rack/padlock'
+require 'rack/padlock/server'
+require 'rack/padlock/selenium'
+require 'rack/padlock/string_util'
 
 desc "Test for padlock"
-task :padlock_test => [:padlock_clean, :test] do
-  contents = File.open(PADLOCK_LOG, 'r') { |f| f.readlines }
-  if File.size? PADLOCK_LOG
+task :padlock_test => [:environment] do
+  rails_app = Rails.application if defined?(Rails)
+  app = Rack::Padlock.application || rails_app
+  puts "Padlock Test: checking #{app} for insecure content.".foreground(:green)
+  server = Rack::Padlock::Server.new(app)
+  server.boot
+  uris = Rack::Padlock.padlock_uris(server.base_uri) || [server.base_uri]
+  client = Rack::Padlock::Selenium.new(uris)
+  client.start
+end
+
+desc "Test for padlock"
+task :padlock => [:padlock_clean, :padlock_test, :padlock_check]
+
+desc "Clean padlock logs"
+task :padlock_check do
+  contents = File.open(Rack::Padlock.logfile, 'r') { |f| f.readlines }
+  if File.size? Rack::Padlock.logfile
     puts "Padlock test failure: Insecure content is being loaded on the page.".foreground(:red)
     contents.each do |line|
-      blocked_uri = line.match(/blocked-uri":"([^"]+)/)[1].foreground(:yellow)
-      violated_directive = line.match(/violated-directive":"([^"]+)/)[1].foreground(:magenta)
-      puts "Request for #{blocked_uri} has violated directive #{violated_directive}"
+      what_match = line.match(/blocked-uri":"([^"]+)/)
+      why_match = line.match(/violated-directive":"([^"]+)/)
+      next unless what_match && why_match
+      blocked_uri = what_match[1].foreground(:yellow)
+      violated_directive = why_match[1].foreground(:magenta)
+      util = Rack::Padlock::StringUtil.new
+      puts "Request for #{util.elide(blocked_uri, 200)} has violated directive #{util.elide(violated_directive, 200)}"
     end
     exit 1
   else
@@ -19,5 +41,5 @@ end
 
 desc "Clean padlock logs"
 task :padlock_clean do
-  File.truncate('tmp/padlock.log', 0) if File.exist?(PADLOCK_LOG)
+  File.truncate('tmp/padlock.log', 0) if File.exist?(Rack::Padlock.logfile)
 end

data/test/rack_padlock_test.rb

@@ -49,7 +49,7 @@ class RackPadlockTest < MiniTest::Unit::TestCase
   
   class Rack::Padlock::PadlockFile
     @@last_output = ""
-    def self.write(data)
+    def self.write(file, data)
       @@last_output = data
     end
     

data/test/string_util_test.rb

@@ -0,0 +1,18 @@
+require File.join(File.dirname(__FILE__), 'test_helper')
+
+class StringUtilTest < MiniTest::Unit::TestCase
+  
+  describe "elide" do
+    before do
+      @util = Rack::Padlock::StringUtil.new
+    end
+    
+    it "should add ellipsis and shorten words" do
+      @util.elide("hootinanny", 4).must_equal "ho...ny"
+      @util.elide("hootinanny", 10).must_equal "hootinanny"
+      @util.elide("hootinanny", 11).must_equal "hootinanny"
+      @util.elide("hootinanny", 9).must_equal "hooti...anny"
+      @util.elide("hootinanny", 0).must_equal "hootinanny"
+    end
+  end  
+end

data/test/test_helper.rb

@@ -2,13 +2,13 @@ require 'minitest/autorun'
 require 'rack/mock'
 require 'rack/test'
 require 'rack/padlock'
-
+require 'rack/padlock/string_util'
 class MiniTest::Unit::TestCase
   include Rack::Test::Methods
 
   def app; Rack::Lint.new(@app); end
 
-  def mock_app(options = {})
+  def mock_app
     main_app = lambda { |env|
       request = Rack::Request.new(env)
       headers = {'Content-Type' => "text/html"}
@@ -16,7 +16,7 @@ class MiniTest::Unit::TestCase
     }
 
     builder = Rack::Builder.new
-    builder.use Rack::Padlock, options
+    builder.use Rack::Padlock
     builder.run main_app
     @app = builder.to_app
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-padlock
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-07 00:00:00.000000000 Z
+date: 2013-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: &70300117186540 !ruby/object:Gem::Requirement
+  requirement: &70095896651180 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70300117186540
+  version_requirements: *70095896651180
 - !ruby/object:Gem::Dependency
   name: rainbow
-  requirement: &70300117186000 !ruby/object:Gem::Requirement
+  requirement: &70095900907220 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,21 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70300117186000
+  version_requirements: *70095900907220
+- !ruby/object:Gem::Dependency
+  name: selenium-webdriver
+  requirement: &70095900905920 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: *70095900905920
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70300117185120 !ruby/object:Gem::Requirement
+  requirement: &70095900904820 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,10 +54,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70300117185120
+  version_requirements: *70095900904820
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &70300117183780 !ruby/object:Gem::Requirement
+  requirement: &70095900903940 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,10 +65,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70300117183780
+  version_requirements: *70095900903940
 - !ruby/object:Gem::Dependency
   name: minitest
-  requirement: &70300117183120 !ruby/object:Gem::Requirement
+  requirement: &70095900903060 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +76,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70300117183120
+  version_requirements: *70095900903060
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: &70300117182600 !ruby/object:Gem::Requirement
+  requirement: &70095900902260 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,7 +87,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70300117182600
+  version_requirements: *70095900902260
 description: A Gem for testing web applications don't generate mixed secure/insecure
   traffic. Keep that browser padlock locked!
 email: joshuacronemeyer@gmail.com
@@ -84,12 +95,18 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- lib/rack/padlock/padlock.js
+- lib/rack/padlock/phantomjs.rb
+- lib/rack/padlock/selenium.rb
+- lib/rack/padlock/server.rb
+- lib/rack/padlock/string_util.rb
 - lib/rack/padlock/version.rb
 - lib/rack/padlock.rb
 - lib/rack-padlock.rb
 - lib/tasks/rack-padlock.rake
 - README.md
 - test/rack_padlock_test.rb
+- test/string_util_test.rb
 - test/test_helper.rb
 homepage: https://github.com/joshuacronemeyer/rack-padlock
 licenses: []
@@ -117,4 +134,5 @@ specification_version: 3
 summary: A Toolkit for writing tests that ensure all traffic on a page is secure.
 test_files:
 - test/rack_padlock_test.rb
+- test/string_util_test.rb
 - test/test_helper.rb