referer_tracking 4.5.0 → 5.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7bbc9b6a0e64428a3ec0b7ba23bcc245c8837164ad465d1f18d5f9a4ba34d66
-  data.tar.gz: edd8a010186ee088bb847cf3ab1158254e04ba74d9c04924ab78650abf9def4e
+  metadata.gz: b1d31bdfc71fe8f3693ee62bb07b24175dbd1d3ff73df06241d7081ba689ed23
+  data.tar.gz: 6c49d4106a856d379501d0e7257357effbd4580c7b79a592e30e4b2fe0d25660
 SHA512:
-  metadata.gz: 647fa7e8f6fe007144782727a5a0e0ca438a88f38e1d1a7015ac4d34a59c16c59d168c1981c0c2d34ff5513f2da01baf00b04531fe28912d23ebe90c8e3847b3
-  data.tar.gz: 9099f20f9c02d7ad3915db429203e669583bd1403fee6e996fe54edf17e47b7306a3d65ac6286e37f65cd2df8f1e997b266c199cbd801fc3626151e9eb9c071f
+  metadata.gz: 29d8ba7c6144d187b7f4c2c1601c89a95d41e1dd577d308391100774870dc519df4e839f3352348f44daa1bd8d1657ef81ede748a31486d1c92ad756270e7fae
+  data.tar.gz: fc5b9e4b06b3c54eac91c0579e354c6d7b5011e84c595ff785e695fda7b1cbc02bdf8d0ad39fc85c5edf35fe513f57468a470e2c158eae20071807ab4a2f0dbc

data/README.md

@@ -6,8 +6,6 @@ It does it by saving referrer url to session and saving information about the re
 
 Also includes tools to add log lines to models to get better information about the flow of the users or which A/B testing variation was used for which model. Aim is to make data collection for model creation, A/B-testing and growth hacking easier.
 
-[<img src="https://secure.travis-ci.org/holli/referer_tracking.png" />](http://travis-ci.org/holli/referer_tracking)
-
 ## Example use cases
 
 ```

data/app/models/referer_tracking/tracking.rb

@@ -2,8 +2,11 @@ module RefererTracking
   class Tracking < ActiveRecord::Base
     self.table_name = "referer_trackings"
     belongs_to :trackable, polymorphic: true, optional: true
-    serialize :infos_session, Hash
-    serialize :infos_request, Hash
+    # coder is explicit because Rails 7.1 defaults set active_record.default_column_serializer
+    # to nil; without it `serialize` raises ArgumentError in any app on load_defaults 7.1+.
+    # YAML keeps the on-disk format of existing rows unchanged.
+    serialize :infos_session, type: Hash, coder: YAML
+    serialize :infos_request, type: Hash, coder: YAML
 
     def first_url_combined
       cookie_first_url || session_first_url
@@ -31,7 +34,7 @@ module RefererTracking
       Rails.logger.info("RefererTracking add_log_line to #{trackable_type}.#{trackable_id}: #{log_line}")
 
       log_line = log_line.to_s.gsub("\n", ' ')
-      str = "#{Time.now.utc.to_s(:db)}: #{log_line}\n"
+      str = "#{Time.now.utc.to_fs(:db)}: #{log_line}\n"
       self.log = log.to_s + str
 
       save if save_model && !self.new_record?

data/lib/referer_tracking/controller_addons.rb

@@ -6,26 +6,35 @@ module RefererTracking::ControllerAddons
     unless request_is_from_a_known_bot?
       if session[:referer_tracking].nil?
         @referer_tracking_first_request = true
-        session[:referer_tracking] = hash = Hash.new
 
-        request_ref = "unknown"
-        request_ref = request.headers["HTTP_REFERER"] if !request.headers["HTTP_REFERER"].blank?
+        request_ref = referer_tracking_utf8(request.headers["HTTP_REFERER"])
+        request_ref = "unknown" if request_ref.blank?
 
-        request_ref = request_ref.to_s.gsub(/pass(word)?=[^&]+/, 'pass=xxxx')
-        first_url = request.url.to_s.gsub(/pass(word)?=[^&]+/, 'pass=xxxx')
+        request_ref = request_ref.gsub(/pass(word)?=[^&]+/, 'pass=xxxx')
+        first_url = referer_tracking_utf8(request.url).gsub(/pass(word)?=[^&]+/, 'pass=xxxx')
 
-        hash[:session_referer_url] = request_ref
-        hash[:session_first_url] = first_url
+        # String keys throughout the session hash. Rails 7.0 made :json the default
+        # cookies_serializer, and JSON has no symbols — a symbol key written here comes
+        # back as a string on the next request, so any symbol lookup silently returns nil.
+        hash = {"session_referer_url" => request_ref, "session_first_url" => first_url}
 
         if RefererTracking.set_referer_cookies && cookies[RefererTracking.set_referer_cookies_name].nil?
           cookie_info = "v01|||#{Time.now.utc.to_i}|||#{first_url.first(RefererTracking.set_referer_cookies_first_url_max_length)}|||#{request_ref.first(RefererTracking.set_referer_cookies_ref_url_max_length)}"
           cookies[RefererTracking.set_referer_cookies_name] = { :value => cookie_info, :expires => 5.years.from_now, :domain => :all }
         end
 
-        logger.info( "REFERER_TRACKING_FIRST: ver04 (ref|first) ||| #{hash[:session_referer_url]} ||| #{hash[:session_first_url]}" )
+        logger.info( "REFERER_TRACKING_FIRST: ver04 (ref|first) ||| #{hash["session_referer_url"]} ||| #{hash["session_first_url"]}" )
+
+        # Assigned once the hash is complete. A half-built one reaching the session cookie
+        # would leave session[:referer_tracking] non-nil, and this block would never run
+        # again for that visitor.
+        session[:referer_tracking] = hash
       end
 
     end
+
+  rescue => e
+    Rails.logger.info "RefererTracking::ControllerAddons.save_to_session problem with the first request: #{e}"
   end
 
   def referer_tracking_after_create(record)
@@ -42,7 +51,7 @@ module RefererTracking::ControllerAddons
 
       ses.each_pair do |key, value|
         ref_mod[key] = value if ref_mod.has_attribute?(key)
-        ref_mod.infos_session[key] = value unless [:session_referer_url, :session_first_url].include?(key)
+        ref_mod.infos_session[key] = value unless ["session_referer_url", "session_first_url"].include?(key.to_s)
       end
 
       if defined?(@referer_tracking_request_add_infos)
@@ -55,13 +64,17 @@ module RefererTracking::ControllerAddons
       end
 
       ref_mod[:ip] = request.ip
-      ref_mod[:user_agent] = request.env['HTTP_USER_AGENT'].to_s.first(200)
-      ref_mod[:current_request_url] = request.url
-      ref_mod[:current_request_referer_url] = request.env["HTTP_REFERER"] # or request.headers["HTTP_REFERER"]
+      ref_mod[:user_agent] = referer_tracking_utf8(request.env['HTTP_USER_AGENT']).to_s.first(200)
+      ref_mod[:current_request_url] = referer_tracking_utf8(request.url)
+      ref_mod[:current_request_referer_url] = referer_tracking_utf8(request.env["HTTP_REFERER"]) # or request.headers["HTTP_REFERER"]
       ref_mod[:session_id] = request.session["session_id"]
 
-      unless cookies[RefererTracking.set_referer_cookies_name].blank?
-        _cookie_ver, cookie_time_org, cookie_first_url, cookie_referer_url = cookies[RefererTracking.set_referer_cookies_name].to_s.split("|||")
+      # Sanitized before blank? and split, which match a regexp against the value and raise on
+      # invalid bytes instead of answering. Rack unescapes an incoming cookie into UTF-8 without
+      # checking the result, so whatever the client sent arrives here as it is.
+      ref_cookie = referer_tracking_utf8(cookies[RefererTracking.set_referer_cookies_name])
+      unless ref_cookie.blank?
+        _cookie_ver, cookie_time_org, cookie_first_url, cookie_referer_url = ref_cookie.split("|||")
         ref_mod[:cookie_first_url] = cookie_first_url
         ref_mod[:cookie_referer_url] = cookie_referer_url
         ref_mod[:cookie_time] = Time.at(cookie_time_org.to_i)
@@ -70,7 +83,7 @@ module RefererTracking::ControllerAddons
       if RefererTracking.save_cookies
         begin
           ref_mod[:cookies_yaml] = cookies.instance_variable_get('@cookies').to_yaml
-        rescue
+        rescue => e
           str = "referer_tracking after create problem encoding cookie yml, probably non utf8 chars #{e}"
           logger.error(str)
           ref_mod[:cookies_yaml] = "error: #{str}"
@@ -84,25 +97,37 @@ module RefererTracking::ControllerAddons
     Rails.logger.info "RefererTracking::ControllerAddons.after_create problem with creating record: #{e}"
   end
 
+  # Everything the request hands us — headers tagged ASCII-8BIT by Rack, cookies unescaped into
+  # UTF-8 without a validity check — is scrubbed here before anything downstream looks at it.
+  #
+  # scrub rather than encode(invalid: :replace, undef: :replace): converting *from* ASCII-8BIT
+  # treats every byte above 0x7F as undefined, so encode turns a valid "hä" into "h??", and
+  # since Rack tags valid multibyte referers binary too that is the common case, not the edge
+  # case. scrub drops only the genuinely invalid bytes.
+  def referer_tracking_utf8(str)
+    str.nil? ? nil : str.to_s.dup.force_encoding(Encoding::UTF_8).scrub("")
+  end
+  private :referer_tracking_utf8
+
   ###############################################
   # Session add methods
 
   # Add only if referer_tracking already in session and key has not been added/changed before
   # So this is only performed on the first time of the session
   def referer_tracking_add_info(key, value)
-    if !session[:referer_tracking].nil? && session[:referer_tracking][key.to_sym].nil?
+    if !session[:referer_tracking].nil? && session[:referer_tracking][key.to_s].nil?
       referer_tracking_set_info(key, value)
     end
   end
 
   def referer_tracking_set_info(key, value)
     if !session[:referer_tracking].nil?
-      session[:referer_tracking][key.to_sym] = value
+      session[:referer_tracking][key.to_s] = value
     end
   end
 
   def referer_tracking_get_info(key)
-    session[:referer_tracking].nil? ? nil : session[:referer_tracking][key.to_sym]
+    session[:referer_tracking].nil? ? nil : session[:referer_tracking][key.to_s]
   end
 
   ###############################################

data/lib/referer_tracking/version.rb

@@ -1,3 +1,3 @@
 module RefererTracking
-  VERSION = "4.5.0"
+  VERSION = "5.0.1"
 end