rack-shield 1.1.2 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c750d4385a2c39170a389f8b5a2aca1e4b967abb97cbdcd2fb142fd470d8df8c
-  data.tar.gz: ea2b3f0519e5e38f742e1aa093366451082852ae6b57e29209d5c327c1298a84
+  metadata.gz: a08b10397030d6fb099720d6d2012adee70498c920e3cd058390dfab5ddfa4b0
+  data.tar.gz: 3270af671fe6fc922884ac0b54fe13432e25db90d1dfee511b48add36cef4e5e
 SHA512:
-  metadata.gz: 28d31dba76eda79a987bc8139ce7f1fa22cc0347ea5bd2dda52e79064e040bd0569e14c7c642d37421e25dd390410198ddb51ca2ce26d54e3e0842c828c9f2cb
-  data.tar.gz: 7b1d80c74cbbe6d07e2127f967fc7373dccc7f1258b9c4050311442b378ba9a47aedc7fafdf0342554c3d72d1353fd381d20277b93d17d99e640fc70d9d63daa
+  metadata.gz: bf63b373e4028d497234fd10a78b57084225ac43893794a92ee9e7f81e0ae224afda214ec39b13ac723c9cad82bd092ba8081430c070d6eef6565e552d70309f
+  data.tar.gz: 35593332faa7b985a5f227d014ae280344041eb0d69f783ce4e4ca7b855da6888dc464031bd2ae8f796e203e0d8546ddbdb5f8ac04e95176fab59f0ba992d7ec

data/README.md

@@ -1,3 +1,5 @@
+[![Gem Version](https://badge.fury.io/rb/rack-shield.svg)](http://badge.fury.io/rb/rack-shield) [![build](https://github.com/mtgrosser/rack-shield/actions/workflows/build.yml/badge.svg)](https://github.com/mtgrosser/rack-shield/actions/workflows/build.yml)
+
 ![Shield](https://raw.githubusercontent.com/mtgrosser/rack-shield/master/doc/shield.svg)
 
 # Rack::Shield
@@ -37,10 +39,10 @@ Adding to path matchers:
 
 ```ruby
 # Regexp will be matched
-Rack::Shield.evil_paths << /\.sql\z/
+Rack::Shield.paths << /\.sql\z/
 
 # String will be checked for inclusion
-Rack::Shield.evil_paths << '/wp-admin'
+Rack::Shield.paths << '/wp-admin'
 ```
 Defaults are defined in `Rack::Shield::DEFAULT_EVIL_PATHS`.
 

data/lib/rack/shield/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module Shield
-    VERSION = '1.1.2'
+    VERSION = '1.2.1'
   end
 end

data/lib/rack/shield.rb

@@ -8,7 +8,7 @@ require_relative 'shield/request_ext'
 module Rack
   module Shield
     DEFAULT_PATHS = [/\/wp-(includes|content|admin|json|config)/,
-                     /\.(php|cgi|asp|aspx|shtml|log|(my)?sql(\.tar)?(\.t?(gz|zip))?|cfm|py|lasso|e?rb|pl|jsp|do|action|sh|dll)\z/i,
+                     /\.(php\d?|cgi|asp|aspx|shtml|log|(my)?sql(\.tar)?(\.t?(gz|zip))?|cfm|cmd|py|lasso|e?rb|pl|jsp|do|action|sh|dll|lsp)\z/i,
                     'cgi-bin',
                     'phpmyadmin',
                     '/pma/',
@@ -54,12 +54,22 @@ module Rack
                     '/aspnet-ajax/',
                     '/Portal.mwsl',
                     '/adminer',
+                    '/appsuite/signin',
+                    '/io.ox/',
+                    '/tkset/',
+                    '/bakula-web',
+                    '/snort/',
+                    '/officescan/',
+                    '/servlet/',
+                    '/ox6/',
+                    '/ws_utc/',
                     /\A\/"/,
                     /\/\.(hg|git|svn|bzr|htaccess|ftpconfig|vscode|remote-sync|aws|env|DS_Store)/,
                     /\/old\/?\z/,
                     /\/\.env\z/,
                     /\A\/old-wp/,
-                    /\A\/(wordpress|wp)(\/|\z)/]
+                    /\A\/(wordpress|wp)(\/|\z)/,
+                    /Open-Xchange/i]
     
     DEFAULT_QUERIES = [/SELECT.+FROM.+/i,
                        /SELECT.+COUNT/i,
@@ -76,17 +86,16 @@ module Rack
                        '<php>',
                        'onload=confirm',
                        'HelloThinkCMF',
-                       'XDEBUG_SESSION_START',
-                     ]
-
+                       'XDEBUG_SESSION_START']
+    
+    DEFAULT_BODIES = []
+    
     class << self
 
-      attr_accessor :paths, :queries, :checks, :responder
+      attr_accessor :paths, :queries, :bodies, :checks, :responder
   
       def evil?(req)
-        (req.path && paths.any? { |matcher| match?(req.path, matcher) }) ||
-        (req.query_string && queries.any? { |matcher| match?(req.query_string, matcher) }) ||
-        (checks.any? { |matcher| match?(req, matcher) })
+        evil_paths?(req) || evil_queries?(req) || evil_checks?(req) || evil_bodies?(req)
       end
       
       def template
@@ -102,10 +111,30 @@ module Rack
         when Proc   then matcher.call(obj)
         end
       end
+      
+      def evil_paths?(req)
+        req.path && paths.any? { |matcher| match?(req.path, matcher) }
+      end
+      
+      def evil_queries?(req)
+        req.query_string && queries.any? { |matcher| match?(req.query_string, matcher) }
+      end
+      
+      def evil_checks?(req)
+        checks.any? { |matcher| match?(req, matcher) }
+      end
+      
+      def evil_bodies?(req)
+        return false unless req.post? || req.put? || req.patch?
+        return false unless body = req.raw_post_data
+        return false if body.empty?
+        bodies.any? { |matcher| match?(body, matcher) }
+      end
     end
 
     self.paths     = DEFAULT_PATHS.dup
     self.queries   = DEFAULT_QUERIES.dup
+    self.bodies    = DEFAULT_BODIES.dup
     self.checks    = []
     self.responder = Responder
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-shield
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.2.1
 platform: ruby
 authors:
 - Matthias Grosser
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-05 00:00:00.000000000 Z
+date: 2023-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack-attack
@@ -44,7 +44,7 @@ homepage: https://github.com/mtgrosser/rack-shield
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -60,7 +60,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.4
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Block and unblock evil requests
 test_files: []