rack-shield 1.1.1 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fea3d5844980d07e59e42929d6d0679bd4cd636fb5eb9444d02d4a3729710bf1
-  data.tar.gz: ea7b2700a32bcdd687aed84b4cf815302bff6f4570b9aed2b9a84a42bf7698e3
+  metadata.gz: 8853aad4ab5646f5a5477f712fe297f005660958e15358144fc175d4f1497215
+  data.tar.gz: 23cf1ec7e0b8d547ccbaf66a63bcb8f8914677a70b1377b8ca4c4ba3894f8d56
 SHA512:
-  metadata.gz: e76a82a335a7eaddd9d0cb5f9724f1c0bd722a2f11cf6b3d08f382d16c2cf704753455e9ffb0d9bd199bc6963ba28d59dda2c7878b608a7171e97349c647498c
-  data.tar.gz: 1f72b350d9c692f8f8f3909d15321848ee21d6f57ddfcc65e2314df8a12f0cf96d1d0b139a3dcada02a5b1f6847c380743f5ef8e7cfa5fae98c4e9c62b8c5f69
+  metadata.gz: ddcbe97f5e6f3ba3ba3d50be2b60c248ac1c2e5c730744e498e7b7f6093d4f5adbc7b3c87bdae15569184387c6ef6afaf098752482d869b6842aaaf32eba8360
+  data.tar.gz: e558e60a3711893170dc994a9ec6d7c31b871f4237ba8ba7779cec44cc65ed8dd198579f2729e8e438948cbe5c953adba3c521adb70ecea999d22a4ec010567f

data/README.md

@@ -37,10 +37,10 @@ Adding to path matchers:
 
 ```ruby
 # Regexp will be matched
-Rack::Shield.evil_paths << /\.sql\z/
+Rack::Shield.paths << /\.sql\z/
 
 # String will be checked for inclusion
-Rack::Shield.evil_paths << '/wp-admin'
+Rack::Shield.paths << '/wp-admin'
 ```
 Defaults are defined in `Rack::Shield::DEFAULT_EVIL_PATHS`.
 

data/lib/rack/shield/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module Shield
-    VERSION = '1.1.1'
+    VERSION = '1.2.0'
   end
 end

data/lib/rack/shield.rb

@@ -8,7 +8,7 @@ require_relative 'shield/request_ext'
 module Rack
   module Shield
     DEFAULT_PATHS = [/\/wp-(includes|content|admin|json|config)/,
-                     /\.(php|cgi|asp|aspx|shtml|log|(my)?sql(\.tar)?(\.t?(gz|zip))?|cfm|py|lasso|e?rb|pl|jsp|do|action|sh)\z/i,
+                     /\.(php|cgi|asp|aspx|shtml|log|(my)?sql(\.tar)?(\.t?(gz|zip))?|cfm|py|lasso|e?rb|pl|jsp|do|action|sh|dll)\z/i,
                     'cgi-bin',
                     'phpmyadmin',
                     '/pma/',
@@ -42,12 +42,18 @@ module Rack
                     'deployment-config.json',
                     'ftpsync.settings',
                     '/_profiler/latest',
-                    '/_ignition/execute-solution',
+                    '/_ignition/',
                     '/_wpeprivate/',
                     '/Config/SaveUploadedHotspotLogoFile',
                     'ALFA_DATA',
                     'cgialfa',
                     'alfacgiapi',
+                    '/+CSCOT+/',
+                    '/api/v2/cmdb/system',
+                    'com.vmware.vsan.client.services',
+                    '/aspnet-ajax/',
+                    '/Portal.mwsl',
+                    '/adminer',
                     /\A\/"/,
                     /\/\.(hg|git|svn|bzr|htaccess|ftpconfig|vscode|remote-sync|aws|env|DS_Store)/,
                     /\/old\/?\z/,
@@ -70,17 +76,16 @@ module Rack
                        '<php>',
                        'onload=confirm',
                        'HelloThinkCMF',
-                       'XDEBUG_SESSION_START',
-                     ]
-
+                       'XDEBUG_SESSION_START']
+    
+    DEFAULT_BODIES = []
+    
     class << self
 
-      attr_accessor :paths, :queries, :checks, :responder
+      attr_accessor :paths, :queries, :bodies, :checks, :responder
   
       def evil?(req)
-        (req.path && paths.any? { |matcher| match?(req.path, matcher) }) ||
-        (req.query_string && queries.any? { |matcher| match?(req.query_string, matcher) }) ||
-        (checks.any? { |matcher| match?(req, matcher) })
+        evil_paths?(req) || evil_queries?(req) || evil_checks?(req) || evil_bodies?(req)
       end
       
       def template
@@ -96,10 +101,30 @@ module Rack
         when Proc   then matcher.call(obj)
         end
       end
+      
+      def evil_paths?(req)
+        req.path && paths.any? { |matcher| match?(req.path, matcher) }
+      end
+      
+      def evil_queries?(req)
+        req.query_string && queries.any? { |matcher| match?(req.query_string, matcher) }
+      end
+      
+      def evil_checks?(req)
+        checks.any? { |matcher| match?(req, matcher) }
+      end
+      
+      def evil_bodies?(req)
+        return false unless req.post? || req.put? || req.patch?
+        return false unless body = req.raw_post_data
+        return false if body.empty?
+        bodies.any? { |matcher| match?(body, matcher) }
+      end
     end
 
     self.paths     = DEFAULT_PATHS.dup
     self.queries   = DEFAULT_QUERIES.dup
+    self.bodies    = DEFAULT_BODIES.dup
     self.checks    = []
     self.responder = Responder
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-shield
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.2.0
 platform: ruby
 authors:
 - Matthias Grosser
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-08-19 00:00:00.000000000 Z
+date: 2023-03-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack-attack
@@ -44,7 +44,7 @@ homepage: https://github.com/mtgrosser/rack-shield
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -60,7 +60,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.4
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Block and unblock evil requests
 test_files: []