rack-shield 1.1.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c750d4385a2c39170a389f8b5a2aca1e4b967abb97cbdcd2fb142fd470d8df8c
-  data.tar.gz: ea2b3f0519e5e38f742e1aa093366451082852ae6b57e29209d5c327c1298a84
+  metadata.gz: 8853aad4ab5646f5a5477f712fe297f005660958e15358144fc175d4f1497215
+  data.tar.gz: 23cf1ec7e0b8d547ccbaf66a63bcb8f8914677a70b1377b8ca4c4ba3894f8d56
 SHA512:
-  metadata.gz: 28d31dba76eda79a987bc8139ce7f1fa22cc0347ea5bd2dda52e79064e040bd0569e14c7c642d37421e25dd390410198ddb51ca2ce26d54e3e0842c828c9f2cb
-  data.tar.gz: 7b1d80c74cbbe6d07e2127f967fc7373dccc7f1258b9c4050311442b378ba9a47aedc7fafdf0342554c3d72d1353fd381d20277b93d17d99e640fc70d9d63daa
+  metadata.gz: ddcbe97f5e6f3ba3ba3d50be2b60c248ac1c2e5c730744e498e7b7f6093d4f5adbc7b3c87bdae15569184387c6ef6afaf098752482d869b6842aaaf32eba8360
+  data.tar.gz: e558e60a3711893170dc994a9ec6d7c31b871f4237ba8ba7779cec44cc65ed8dd198579f2729e8e438948cbe5c953adba3c521adb70ecea999d22a4ec010567f

data/README.md

@@ -37,10 +37,10 @@ Adding to path matchers:
 
 ```ruby
 # Regexp will be matched
-Rack::Shield.evil_paths << /\.sql\z/
+Rack::Shield.paths << /\.sql\z/
 
 # String will be checked for inclusion
-Rack::Shield.evil_paths << '/wp-admin'
+Rack::Shield.paths << '/wp-admin'
 ```
 Defaults are defined in `Rack::Shield::DEFAULT_EVIL_PATHS`.
 

data/lib/rack/shield/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module Shield
-    VERSION = '1.1.2'
+    VERSION = '1.2.0'
   end
 end

data/lib/rack/shield.rb

@@ -76,17 +76,16 @@ module Rack
                        '<php>',
                        'onload=confirm',
                        'HelloThinkCMF',
-                       'XDEBUG_SESSION_START',
-                     ]
-
+                       'XDEBUG_SESSION_START']
+    
+    DEFAULT_BODIES = []
+    
     class << self
 
-      attr_accessor :paths, :queries, :checks, :responder
+      attr_accessor :paths, :queries, :bodies, :checks, :responder
   
       def evil?(req)
-        (req.path && paths.any? { |matcher| match?(req.path, matcher) }) ||
-        (req.query_string && queries.any? { |matcher| match?(req.query_string, matcher) }) ||
-        (checks.any? { |matcher| match?(req, matcher) })
+        evil_paths?(req) || evil_queries?(req) || evil_checks?(req) || evil_bodies?(req)
       end
       
       def template
@@ -102,10 +101,30 @@ module Rack
         when Proc   then matcher.call(obj)
         end
       end
+      
+      def evil_paths?(req)
+        req.path && paths.any? { |matcher| match?(req.path, matcher) }
+      end
+      
+      def evil_queries?(req)
+        req.query_string && queries.any? { |matcher| match?(req.query_string, matcher) }
+      end
+      
+      def evil_checks?(req)
+        checks.any? { |matcher| match?(req, matcher) }
+      end
+      
+      def evil_bodies?(req)
+        return false unless req.post? || req.put? || req.patch?
+        return false unless body = req.raw_post_data
+        return false if body.empty?
+        bodies.any? { |matcher| match?(body, matcher) }
+      end
     end
 
     self.paths     = DEFAULT_PATHS.dup
     self.queries   = DEFAULT_QUERIES.dup
+    self.bodies    = DEFAULT_BODIES.dup
     self.checks    = []
     self.responder = Responder
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-shield
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.2.0
 platform: ruby
 authors:
 - Matthias Grosser
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-05 00:00:00.000000000 Z
+date: 2023-03-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack-attack
@@ -44,7 +44,7 @@ homepage: https://github.com/mtgrosser/rack-shield
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -60,7 +60,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.4
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Block and unblock evil requests
 test_files: []