rack-protection 1.1.4 → 1.2.0

data/lib/rack/protection.rb

@@ -20,14 +20,13 @@ module Rack
       # does not include: RemoteReferrer, AuthenticityToken and FormToken
       except = Array options[:except]
       Rack::Builder.new do
-        use EscapedParams,    options unless except.include? :escaped_params
-        use FrameOptions,     options unless except.include? :frame_options
-        use IPSpoofing,       options unless except.include? :ip_spoofing
-        use JsonCsrf,         options unless except.include? :json_csrf
-        use PathTraversal,    options unless except.include? :path_traversal
-        use RemoteToken,      options unless except.include? :remote_token
-        use SessionHijacking, options unless except.include? :session_hijacking
-        use XSSHeader,        options unless except.include? :xss_header
+        use ::Rack::Protection::FrameOptions,     options unless except.include? :frame_options
+        use ::Rack::Protection::IPSpoofing,       options unless except.include? :ip_spoofing
+        use ::Rack::Protection::JsonCsrf,         options unless except.include? :json_csrf
+        use ::Rack::Protection::PathTraversal,    options unless except.include? :path_traversal
+        use ::Rack::Protection::RemoteToken,      options unless except.include? :remote_token
+        use ::Rack::Protection::SessionHijacking, options unless except.include? :session_hijacking
+        use ::Rack::Protection::XSSHeader,        options unless except.include? :xss_header
         run app
       end.to_app
     end

data/lib/rack/protection/base.rb

@@ -83,7 +83,7 @@ module Rack
 
       def random_string(secure = defined? SecureRandom)
         secure ? SecureRandom.hex(32) : "%032x" % rand(2**128-1)
-      rescue NotImpelentedError
+      rescue NotImplementedError
         random_string false
       end
 

data/lib/rack/protection/json_csrf.rb

@@ -16,7 +16,10 @@ module Rack
       def call(env)
         status, headers, body = app.call(env)
         if headers['Content-Type'].to_s.split(';', 2).first =~ /^\s*application\/json\s*$/
-          result = react(env) if referrer(env) != Request.new(env).host
+          if referrer(env) != Request.new(env).host
+            result = react(env)
+            warn env, "attack prevented by #{self.class}"
+          end
         end
         result or [status, headers, body]
       end

data/lib/rack/protection/version.rb

@@ -4,7 +4,7 @@ module Rack
       VERSION
     end
 
-    SIGNATURE = [1, 1, 4]
+    SIGNATURE = [1, 2, 0]
     VERSION   = SIGNATURE.join('.')
 
     VERSION.extend Comparable

data/rack-protection.gemspec

@@ -2,7 +2,7 @@
 Gem::Specification.new do |s|
   # general infos
   s.name        = "rack-protection"
-  s.version     = "1.1.4"
+  s.version     = "1.2.0"
   s.description = "You should use protection!"
   s.homepage    = "http://github.com/rkh/rack-protection"
   s.summary     = s.description
@@ -10,17 +10,21 @@ Gem::Specification.new do |s|
   # generated from git shortlog -sn
   s.authors = [
     "Konstantin Haase",
+    "Akzhan Abdulin",
     "Corey Ward",
     "David Kellum",
-    "Fojas"
+    "Fojas",
+    "Martin Mauch"
   ]
 
   # generated from git shortlog -sne
   s.email = [
     "konstantin.mailinglists@googlemail.com",
+    "akzhan.abdulin@gmail.com",
     "coreyward@me.com",
     "dek-oss@gravitext.com",
-    "developer@fojasaur.us"
+    "developer@fojasaur.us",
+    "martin.mauch@gmail.com"
   ]
 
   # generated from git ls-files

data/spec/protection_spec.rb

@@ -2,4 +2,19 @@ require File.expand_path('../spec_helper.rb', __FILE__)
 
 describe Rack::Protection do
   it_behaves_like "any rack application"
+
+  it 'passes on options' do
+    mock_app do
+      use Rack::Protection, :track => ['HTTP_FOO']
+      run proc { |e| [200, {'Content-Type' => 'text/plain'}, ['hi']] }
+    end
+
+    session = {:foo => :bar}
+    get '/', {}, 'rack.session' => session, 'HTTP_ACCEPT_ENCODING' => 'a'
+    get '/', {}, 'rack.session' => session, 'HTTP_ACCEPT_ENCODING' => 'b'
+    session[:foo].should be == :bar
+
+    get '/', {}, 'rack.session' => session, 'HTTP_FOO' => 'BAR'
+    session.should be_empty
+  end
 end

metadata

@@ -1,22 +1,24 @@
 --- !ruby/object:Gem::Specification
 name: rack-protection
 version: !ruby/object:Gem::Version
-  version: 1.1.4
+  version: 1.2.0
   prerelease: 
 platform: ruby
 authors:
 - Konstantin Haase
+- Akzhan Abdulin
 - Corey Ward
 - David Kellum
 - Fojas
+- Martin Mauch
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-10-04 00:00:00.000000000Z
+date: 2011-12-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: &2152664140 !ruby/object:Gem::Requirement
+  requirement: &2153091280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -24,10 +26,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2152664140
+  version_requirements: *2153091280
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: &2152663420 !ruby/object:Gem::Requirement
+  requirement: &2153090800 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -35,10 +37,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152663420
+  version_requirements: *2153090800
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &2152662520 !ruby/object:Gem::Requirement
+  requirement: &2153090140 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -46,13 +48,15 @@ dependencies:
         version: '2.0'
   type: :development
   prerelease: false
-  version_requirements: *2152662520
+  version_requirements: *2153090140
 description: You should use protection!
 email:
 - konstantin.mailinglists@googlemail.com
+- akzhan.abdulin@gmail.com
 - coreyward@me.com
 - dek-oss@gravitext.com
 - developer@fojasaur.us
+- martin.mauch@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []