rack_csrf 1.0.1 → 1.1.0

data/Manifest

@@ -5,6 +5,7 @@ example/config.ru
 example/views/form.erb
 example/views/form_not_working.erb
 example/views/response.erb
+features/browser_only.feature
 features/empty_responses.feature
 features/raising_exception.feature
 features/setup.feature

data/README.rdoc

@@ -27,17 +27,32 @@ The following options allow you to tweak Rack::Csrf.
   an empty response, Rack::Csrf will raise an exception of class
   Rack::Csrf::InvalidCsrfToken.
 
+  Default value: false.
+
 [<tt>:skip</tt>]
   By default, Rack::Csrf checks every POST, PUT and DELETE request; passing an
-  array of HTTP method/URL to this option you can choose what to let pass
-  unchecked:
+  array of HTTP method/URL (regular expressions allowed) to this option you
+  can choose what to let pass unchecked:
+
+    use Rack::Csrf, :skip => ['POST:/not_checking', 'PUT:/me_too',
+      'DELETE:/cars/.*\.xml']
+
+  Please, note that the regular expressions are not escaped and it is your
+  duty to write them correctly.
 
-    use Rack::Csrf, :skip => ['POST:/not_checking', 'PUT:/me_too']
+  Default value: empty.
 
 [<tt>:field</tt>]
   Default field name (see below) is <tt>_csrf</tt>; you can adapt it to
   specific needs.
 
+[<tt>:browser_only</tt>]
+  Set it to true to inspect only requests with Content-Type typically produced
+  only by web browser. This means that curl, Active Resource, etc. can send
+  any request without worring about the token.
+
+  Default value: false.
+
 == Helpers
 
 The following class methods try to ease the insertion of the anti-forging

data/Rakefile

@@ -11,7 +11,7 @@ Spec::Rake::SpecTask.new do |t|
   t.spec_opts = %w(-O spec/spec.opts)
 end
 
-Echoe.new('rack_csrf', '1.0.1') do |s|
+Echoe.new('rack_csrf', '1.1.0') do |s|
   s.author = 'Emanuele Vicentini'
   s.email = 'emanuele.vicentini@gmail.com'
   s.summary = 'Anti-CSRF Rack middleware'

data/cucumber.yml

@@ -1 +1 @@
-default: --format pretty -n features
+default: --format pretty --no-source features

data/example/config-with-raise.ru

@@ -1,6 +1,9 @@
 require 'sinatra'
 require File.dirname(__FILE__) + '/../lib/rack/csrf'
 
+require 'erb'
+require 'app'
+
 use Rack::ShowExceptions
 use Rack::Session::Cookie
 use Rack::Csrf, :raise => true

data/example/config.ru

@@ -1,6 +1,9 @@
 require 'sinatra'
 require File.dirname(__FILE__) + '/../lib/rack/csrf'
 
+require 'erb'
+require 'app'
+
 use Rack::Session::Cookie
 use Rack::Csrf
 

data/features/browser_only.feature

@@ -0,0 +1,24 @@
+Feature: Filtering only browser generated requests
+
+  Scenario Outline: Handling request without CSRF token
+    Given a rack with the anti-CSRF middleware and the :browser_only option
+    When it receives a <method> request without the CSRF token
+    Then it lets it pass untouched
+
+    Examples:
+      | method |
+      | POST   |
+      | PUT    |
+      | DELETE |
+
+  Scenario Outline: Handling request without CSRF token
+    Given a rack with the anti-CSRF middleware and the :browser_only option
+    When it receives a <method> request without the CSRF token from a browser
+    Then it responds with 417
+    And the response body is empty
+
+    Examples:
+      | method |
+      | POST   |
+      | PUT    |
+      | DELETE |

data/features/empty_responses.feature

@@ -1,17 +1,17 @@
 Feature: Handling of the HTTP requests returning an empty response
 
   Scenario: GET request with CSRF token
-    Given a Rack setup with the anti-CSRF middleware
+    Given a rack with the anti-CSRF middleware
     When it receives a GET request with the CSRF token
     Then it lets it pass untouched
 
   Scenario: GET request without CSRF token
-    Given a Rack setup with the anti-CSRF middleware
+    Given a rack with the anti-CSRF middleware
     When it receives a GET request without the CSRF token
     Then it lets it pass untouched
 
   Scenario Outline: Handling request without CSRF token
-    Given a Rack setup with the anti-CSRF middleware
+    Given a rack with the anti-CSRF middleware
     When it receives a <method> request without the CSRF token
     Then it responds with 417
     And the response body is empty
@@ -23,7 +23,7 @@ Feature: Handling of the HTTP requests returning an empty response
       | DELETE |
 
   Scenario Outline: Handling request with the right CSRF token
-    Given a Rack setup with the anti-CSRF middleware
+    Given a rack with the anti-CSRF middleware
     When it receives a <method> request with the right CSRF token
     Then it lets it pass untouched
 
@@ -34,7 +34,7 @@ Feature: Handling of the HTTP requests returning an empty response
       | DELETE |
 
   Scenario Outline: Handling request with the wrong CSRF token
-    Given a Rack setup with the anti-CSRF middleware
+    Given a rack with the anti-CSRF middleware
     When it receives a <method> request with the wrong CSRF token
     Then it responds with 417
     And the response body is empty

data/features/raising_exception.feature

@@ -1,12 +1,12 @@
 Feature: Handling of the HTTP requests raising an exception
 
   Scenario: GET request without CSRF token
-    Given a Rack setup with the anti-CSRF middleware and the :raise option
+    Given a rack with the anti-CSRF middleware and the :raise option
     When it receives a GET request without the CSRF token
     Then it lets it pass untouched
 
   Scenario Outline: Handling request without CSRF token
-    Given a Rack setup with the anti-CSRF middleware and the :raise option
+    Given a rack with the anti-CSRF middleware and the :raise option
     When it receives a <method> request without the CSRF token
     Then there is no response
     And an exception is climbing up the stack
@@ -18,7 +18,7 @@ Feature: Handling of the HTTP requests raising an exception
       | DELETE |
 
   Scenario Outline: Handling request with the right CSRF token
-    Given a Rack setup with the anti-CSRF middleware and the :raise option
+    Given a rack with the anti-CSRF middleware and the :raise option
     When it receives a <method> request with the right CSRF token
     Then it lets it pass untouched
 
@@ -29,7 +29,7 @@ Feature: Handling of the HTTP requests raising an exception
       | DELETE |
 
   Scenario Outline: Handling request with the wrong CSRF token
-    Given a Rack setup with the anti-CSRF middleware and the :raise option
+    Given a rack with the anti-CSRF middleware and the :raise option
     When it receives a <method> request with the wrong CSRF token
     Then there is no response
     And an exception is climbing up the stack

data/features/setup.feature

@@ -1,22 +1,22 @@
 Feature: Setup of the middleware
 
   Scenario: Simple setup with session support
-    Given a Rack setup with the session middleware
+    Given a rack with the session middleware
     When I insert the anti-CSRF middleware
     Then I get a fully functional rack
 
   Scenario: Simple setup without session support
-    Given a Rack setup without the session middleware
+    Given a rack without the session middleware
     When I insert the anti-CSRF middleware
     Then I get an error message
 
   Scenario: Setup with :raise option
-    Given a Rack setup with the session middleware
+    Given a rack with the session middleware
     When I insert the anti-CSRF middleware with the :raise option
     Then I get a fully functional rack
 
   Scenario: Setup with the :skip option
-    Given a Rack setup with the session middleware
+    Given a rack with the session middleware
     When I insert the anti-CSRF middleware with the :skip option
       | route              |
       | POST:/not_checking |
@@ -24,6 +24,11 @@ Feature: Setup of the middleware
     Then I get a fully functional rack
 
   Scenario: Setup with the :field option
-    Given a Rack setup with the session middleware
+    Given a rack with the session middleware
     When I insert the anti-CSRF middleware with the :field option
     Then I get a fully functional rack
+
+  Scenario: Setup with the :browser_only option
+    Given a rack with the session middleware
+    When I insert the anti-CSRF middleware with the :browser_only option
+    Then I get a fully functional rack

data/features/skip_some_routes.feature

@@ -1,33 +1,46 @@
 Feature: Skipping the check for some specific routes
 
   Scenario Outline: Skipping the check for some requests
-    Given a Rack setup with the anti-CSRF middleware and the :skip option
-      | pair               |
-      | POST:/not_checking |
-      | PUT:/is_wrong      |
+    Given a rack with the anti-CSRF middleware and the :skip option
+      | pair                 |
+      | POST:/not_checking   |
+      | PUT:/is_wrong        |
+      | POST:/not_.*\.json   |
+      | DELETE:/cars/.*\.xml |
     When it receives a <method> request for <path> without the CSRF token
     Then it lets it pass untouched
 
     Examples:
-      | method | path          |
-      | POST   | /not_checking |
-      | PUT    | /is_wrong     |
+      | method | path                            |
+      | POST   | /not_checking                   |
+      | PUT    | /is_wrong                       |
+      | POST   | /not_checking.json              |
+      | POST   | /not_again/params/whatever.json |
+      | DELETE | /cars/abc123.xml                |
 
   Scenario Outline: Keep checking the requests for other method/path pairs
-    Given a Rack setup with the anti-CSRF middleware and the :skip option
-      | pair               |
-      | POST:/not_checking |
-      | PUT:/is_wrong      |
+    Given a rack with the anti-CSRF middleware and the :skip option
+      | pair                 |
+      | POST:/not_checking   |
+      | PUT:/is_wrong        |
+      | POST:/not_.*\.json   |
+      | DELETE:/cars/.*\.xml |
     When it receives a <method> request for <path> without the CSRF token
     Then it responds with 417
     And the response body is empty
 
     Examples:
-      | method | path          |
-      | PUT    | /not_checking |
-      | DELETE | /not_checking |
-      | POST   | /is_wrong     |
-      | DELETE | /is_wrong     |
-      | POST   | /             |
-      | PUT    | /not          |
-      | POST   | /is           |
+      | method | path                            |
+      | PUT    | /not_checking                   |
+      | DELETE | /not_checking                   |
+      | POST   | /is_wrong                       |
+      | DELETE | /is_wrong                       |
+      | POST   | /                               |
+      | PUT    | /not                            |
+      | POST   | /is                             |
+      | PUT    | /not_checking.json              |
+      | DELETE | /not_checking.json              |
+      | PUT    | /not_again/params/whatever.json |
+      | DELETE | /not_again/params/whatever.json |
+      | POST   | /cars/abc123.xml                |
+      | PUT    | /cars/abc123.xml                |

data/features/step_definitions/request_steps.rb

@@ -28,6 +28,16 @@ When /^it receives a (POST|PUT|DELETE) request for (.+) without the CSRF token$/
   end
 end
 
+When /^it receives a (POST|PUT|DELETE) request without the CSRF token from a browser$/ do |http_method|
+  http_method.downcase!
+  begin
+    @response = Rack::MockRequest.new(@app).send http_method.to_sym, '/',
+      'CONTENT_TYPE' => 'text/html'
+  rescue Exception => e
+    @exception = e
+  end
+end
+
 When /^it receives a (POST|PUT|DELETE) request with the right CSRF token$/ do |http_method|
   http_method.downcase!
   @response = Rack::MockRequest.new(@app).send http_method.to_sym, '/',

data/features/step_definitions/response_steps.rb

@@ -3,8 +3,8 @@ Then /^it lets it pass untouched$/ do
   @response.should =~ /Hello world!/
 end
 
-Then /^it responds with 417$/ do
-  @response.status.should == 417
+Then /^it responds with (\d\d\d)$/ do |code|
+  @response.status.should == code.to_i
 end
 
 Then /^the response body is empty$/ do

data/features/step_definitions/setup_steps.rb

@@ -1,4 +1,4 @@
-Given /^a Rack setup (with|without) the session middleware$/ do |prep|
+Given /^a rack (with|without) the session middleware$/ do |prep|
   @rack_builder = Rack::Builder.new
   @rack_builder.use FakeSession if prep == 'with'
 end
@@ -6,26 +6,31 @@ end
 # Yes, they're not as DRY as possible, but I think they're more readable than
 # a single step definition with a few captures and more complex checkings.
 
-Given /^a Rack setup with the anti\-CSRF middleware$/ do
-  Given 'a Rack setup with the session middleware'
+Given /^a rack with the anti\-CSRF middleware$/ do
+  Given 'a rack with the session middleware'
   When 'I insert the anti-CSRF middleware'
 end
 
-Given /^a Rack setup with the anti\-CSRF middleware and the :raise option$/ do
-  Given 'a Rack setup with the session middleware'
+Given /^a rack with the anti\-CSRF middleware and the :raise option$/ do
+  Given 'a rack with the session middleware'
   When 'I insert the anti-CSRF middleware with the :raise option'
 end
 
-Given /^a Rack setup with the anti\-CSRF middleware and the :skip option$/ do |table|
-  Given 'a Rack setup with the session middleware'
+Given /^a rack with the anti\-CSRF middleware and the :skip option$/ do |table|
+  Given 'a rack with the session middleware'
   When 'I insert the anti-CSRF middleware with the :skip option', table
 end
 
-Given /^a Rack setup with the anti\-CSRF middleware and the :field option$/ do
-  Given 'a Rack setup with the session middleware'
+Given /^a rack with the anti\-CSRF middleware and the :field option$/ do
+  Given 'a rack with the session middleware'
   When 'I insert the anti-CSRF middleware with the :field option'
 end
 
+Given /^a rack with the anti\-CSRF middleware and the :browser_only option$/ do
+  Given 'a rack with the session middleware'
+  When 'I insert the anti-CSRF middleware with the :browser_only option'
+end
+
 # Yes, they're not as DRY as possible, but I think they're more readable than
 # a single step definition with a few captures and more complex checkings.
 
@@ -58,6 +63,13 @@ When /^I insert the anti\-CSRF middleware with the :field option$/ do
   @app = @rack_builder.to_app
 end
 
+When /^I insert the anti\-CSRF middleware with the :browser_only option$/ do
+  @rack_builder.use Rack::Lint
+  @rack_builder.use Rack::Csrf, :browser_only => true
+  @rack_builder.run(lambda {|env| Rack::Response.new('Hello world!').finish})
+  @app = @rack_builder.to_app
+end
+
 Then /^I get a fully functional rack$/ do
   lambda {Rack::MockRequest.new(@app).get('/')}.should_not raise_error
 end

data/features/variation_on_field_name.feature

@@ -1,12 +1,12 @@
 Feature: Customization of the field name
 
   Scenario: GET request with CSRF token in custom field
-    Given a Rack setup with the anti-CSRF middleware and the :field option
+    Given a rack with the anti-CSRF middleware and the :field option
     When it receives a GET request with the CSRF token
     Then it lets it pass untouched
 
   Scenario Outline: Handling request with the right CSRF token in custom field
-    Given a Rack setup with the anti-CSRF middleware and the :field option
+    Given a rack with the anti-CSRF middleware and the :field option
     When it receives a <method> request with the right CSRF token
     Then it lets it pass untouched
 
@@ -17,7 +17,7 @@ Feature: Customization of the field name
       | DELETE |
 
   Scenario Outline: Handling request with the wrong CSRF token in custom field
-    Given a Rack setup with the anti-CSRF middleware and the :field option
+    Given a rack with the anti-CSRF middleware and the :field option
     When it receives a <method> request with the wrong CSRF token
     Then it responds with 417
     And the response body is empty

data/lib/rack/csrf.rb

@@ -14,10 +14,17 @@ module Rack
 
     def initialize(app, opts = {})
       @app = app
+
       @raisable = opts[:raise] || false
-      @skippable = opts[:skip] || []
-      @skippable.map {|s| s.downcase!}
+      @skippable = (opts[:skip] || []).map {|r| /\A#{r}\Z/i}
       @@field = opts[:field] if opts[:field]
+      @browser_only = opts[:browser_only] || false
+
+      @http_verbs = %w(POST PUT DELETE)
+      @browser_content_types = ['text/html', 'application/xhtml+xml', 'xhtml',
+        'application/x-www-form-urlencoded',
+        'multipart/form-data',
+        'text/plain', 'txt']
     end
 
     def call(env)
@@ -26,9 +33,9 @@ module Rack
       end
       self.class.csrf_token(env)
       req = Rack::Request.new(env)
-      untouchable = !%w(POST PUT DELETE).include?(req.request_method) ||
+      untouchable = !@http_verbs.include?(req.request_method) ||
         req.POST[self.class.csrf_field] == env['rack.session']['csrf.token'] ||
-        skip_checking(req)
+        skip_checking(req) || (@browser_only && !from_a_browser(req))
       if untouchable
         @app.call(env)
       else
@@ -52,7 +59,13 @@ module Rack
     protected
 
     def skip_checking request
-      @skippable.include?(request.request_method.downcase + ':' + request.path_info)
+      @skippable.any? do |route|
+        route =~ (request.request_method + ':' + request.path_info)
+      end
+    end
+
+    def from_a_browser request
+      @browser_content_types.include?(request.media_type)
     end
   end
 end

data/rack_csrf.gemspec

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification 
 name: rack_csrf
 version: !ruby/object:Gem::Version 
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors: 
 - Emanuele Vicentini
 autorequire: 
 bindir: bin
 
-date: 2009-05-02 00:00:00 +02:00
+date: 2009-05-22 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -78,6 +78,7 @@ files:
 - example/views/form.erb
 - example/views/form_not_working.erb
 - example/views/response.erb
+- features/browser_only.feature
 - features/empty_responses.feature
 - features/raising_exception.feature
 - features/setup.feature
@@ -126,7 +127,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: rackcsrf
-rubygems_version: 1.3.2
+rubygems_version: 1.3.3
 specification_version: 3
 summary: Anti-CSRF Rack middleware
 test_files: []

data/spec/csrf_spec.rb

@@ -40,6 +40,8 @@ describe Rack::Csrf do
   describe '#csrf_tag' do
     before do
       @env = {'rack.session' => {}}
+      fakeapp = [200, {}, []]
+      Rack::Csrf.new fakeapp, :field => 'whatever'
       @tag = Rack::Csrf.csrf_tag(@env)
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: rack_csrf
 version: !ruby/object:Gem::Version 
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors: 
 - Emanuele Vicentini
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-05-02 00:00:00 +02:00
+date: 2009-05-22 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -79,6 +79,7 @@ files:
 - example/views/form.erb
 - example/views/form_not_working.erb
 - example/views/response.erb
+- features/browser_only.feature
 - features/empty_responses.feature
 - features/raising_exception.feature
 - features/setup.feature
@@ -127,7 +128,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: rackcsrf
-rubygems_version: 1.3.2
+rubygems_version: 1.3.3
 signing_key: 
 specification_version: 3
 summary: Anti-CSRF Rack middleware