rack-security-middleware 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 74db62ac80f57ad5d8d5579123623ca30b367f66bd9c411b587b4f833f84183d
+  data.tar.gz: 763041d7915a503b45c0de7f1a7c02e7fb8641a53e9a6244a66a0b3770a4e78c
+SHA512:
+  metadata.gz: ae576b3b616e23c59494f3476241bfbb5dd6dca20ec5a4f92ac409e7b8609616447d5876a877ec32aeec7f441bcdf2ff59c150add05a2631a30691a3f135e7dc
+  data.tar.gz: 1226727bd35eda1eb0ac35f65c0ef685467bc4066eb634569f781b3d8384822d62aa0f4e1d4ec6f9bfb6b19577a04785229a6300161c0e4baabaaef90fb240d2

data/lib/rack-security-middleware/block_path_traversal.rb

@@ -0,0 +1,28 @@
+# Inspired by https://github.com/sinatra/sinatra/blob/master/rack-protection/lib/rack/protection/path_traversal.rb
+# but we want to completely block any abnormal url
+
+module RackSecurityMiddleware
+  class BlockPathTraversal
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      if has_path_traversal?(env['PATH_INFO'])
+        [403, { 'Content-Type' => 'text/html' }, ['Forbidden']]
+      else
+        @app.call env
+      end
+    end
+
+    private
+
+    def has_path_traversal?(path)
+      encoding = path.encoding
+      dot = '.'.encode(encoding)
+      unescaped = path.gsub(/%2e/i, dot)
+
+      unescaped.include?("#{dot}#{dot}")
+    end
+  end
+end

data/lib/rack-security-middleware/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module RackSecurityMiddleware
+  VERSION = '0.0.1'
+end

data/spec/block_path_traversal_spec.rb

@@ -0,0 +1,42 @@
+require 'spec_helper'
+require 'rack-security-middleware/block_path_traversal'
+
+RSpec.describe RackSecurityMiddleware::BlockPathTraversal do
+  let(:app) do
+    Class.new do
+      attr_reader :request
+
+      def call(env)
+        @request = ActionDispatch::Request.new(env)
+        [200, { 'Content-Type' => 'text/plain' }, ['OK']]
+      end
+    end
+  end
+
+  let(:stack) { described_class.new(app.new) }
+  let(:request) { Rack::MockRequest.new(stack) }
+
+  describe '.call' do
+    it 'does not affect normal calls' do
+      response = request.get('/')
+
+      expect(response.status).to eq(200)
+    end
+
+    it 'blocks calls trying path traversal' do
+      response = request.get('/../root/passwords')
+
+      expect(response.status).to eq(403)
+    end
+
+    # this could catch things that are not path traversals
+    # but there are all kinds of variations like %c1%9c.. or %252f.. or x5Cx5Cx5C.. etc
+    # and a legit use case for .. in the middle of a section of the path is arguable
+    # so we chose to be more aggressive and safer here
+    it 'blocks calls with .. but not /' do
+      response = request.get('/ohno..root/passwords')
+
+      expect(response.status).to eq(403)
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+require 'action_dispatch'
+require 'rack/test'

metadata

@@ -0,0 +1,131 @@
+--- !ruby/object:Gem::Specification
+name: rack-security-middleware
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Gusto Open Source
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2021-01-06 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.2'
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.2'
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rack-test
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+description: Middleware collection to secure a Rack application
+email: open-source@gusto.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/rack-security-middleware/block_path_traversal.rb
+- lib/rack-security-middleware/version.rb
+- spec/block_path_traversal_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/Gusto/rack-security-middleware
+licenses: []
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.6
+signing_key:
+specification_version: 4
+summary: Middleware collection to secure a Rack application
+test_files:
+- spec/spec_helper.rb
+- spec/block_path_traversal_spec.rb