rq4 0.9.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 215a35a2ada0834699c4c8fe892b012af67cdf2156913c165e24ab196d3db4b3
+  data.tar.gz: 8fd6357e10dc97e10ebab775b04001a6fecae63bf7207101f207afe1de3ba278
+SHA512:
+  metadata.gz: '02867ce8325521e5cd87f4333e287c8c388ad735fd7e92a68923ab75e41ec96cd689739da9e9dba81a03359be10dd2957bf06438abbd1664975f9477234c15df'
+  data.tar.gz: cc031500a1308f7cf92c6965fd7fcd058a760de6ef37c95c47d1a17cfbd949c6a19cc3ee68faffa7feb1e2cc2f58fad0dee342dc934f808aca26773e958312c2

data/LICENCE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 J.J. Green
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,61 @@
+RQ4-Ruby
+--------
+
+Rack middleware adding [RQ4](https://rq4.dev) (request context)
+headers to requests.
+
+This code is beta, use with caution.
+
+### Rails install
+
+Add
+
+```ruby
+gem 'rq4'
+```
+
+to your `Gemfile` and run `bundle install rq4`.
+
+### Usage
+
+In any controller, one can access the value of the header with
+
+```ruby
+request.env['rq4']
+```
+
+In case of error this can be the string `error`, that would be
+a bug -- please report!
+
+### Configuration
+
+Optionally, add a new file
+```ruby
+# config/initializers/rq4.rb
+Rails.application.config.tap do |config|
+  config.rq4 = ActiveSupport::OrderedOptions.new
+  config.rq4.prefetch_skip = true
+  config.rq4.prefetch_key = 'x-sec-purpose'
+  config.rq4.prefetch_value = 'prefetch'
+end
+```
+The options are to handle the prefetching of links typically
+used by Turbo: those are mistaken for bot requests (typically
+with a `vv-x`) by the default configuration. But one can skip
+the relevant test entirely with `prefetch_skip` set `true`.
+Alternatively, since Turbo adds the header
+```
+x-turbo-request-id: f90cf13d-0...
+```
+one can use
+```ruby
+config.rq4.prefetch_key = 'x-turbo-request-id'
+```
+to skip if that key is present, or
+```ruby
+config.rq4.prefetch_key = 'x-sec-purpose'
+config.rq4.prefetch_value = 'prefetch'
+```
+to skip if the key _and_ specified value are present.  The
+former is more reliable since the `x-sec-purpose` is only
+added to `GET` requests.

data/lib/rq4/railtie.rb

@@ -0,0 +1,8 @@
+module RQ4
+  class Railtie < Rails::Railtie
+    initializer 'rq4.insert_middleware' do |app|
+      config = Rails.application.config
+      app.middleware.use RQ4::Middleware, config
+    end
+  end
+end

data/lib/rq4/version.rb

@@ -0,0 +1,3 @@
+module RQ4
+  VERSION = '0.9.0'
+end

data/lib/rq4.rb

@@ -0,0 +1,429 @@
+require 'rq4/railtie' if defined?(Rails::Railtie)
+require 'yaml'
+require 'set'
+
+module RQ4 ; end
+
+class RQ4::Middleware
+  private attr_reader :request, :config
+
+  def initialize(app, config = nil)
+    @app = app
+    @config = config
+  end
+
+  def call(env)
+    @request = Rack::Request.new(env)
+    @request.set_header('rq4', rq4)
+    @app.call(env)
+  end
+
+  private
+
+  def options
+    if config.respond_to? :rq4 then
+      config.rq4
+    end
+  end
+
+  def rq4
+    [Mode, Upgrade, Identity, Transfer]
+      .map { |cls| cls.new(request, options:).code }
+      .join
+  rescue StandardError => e
+    request.set_header('rack.errors', e.message)
+    'error'
+  end
+
+  class Base
+    CODE = {
+      valid: 'v',
+      invalid: 'x',
+      indeterminate: '-'
+    }.freeze
+
+    private attr_reader :request, :options
+
+    def initialize(request, options:)
+      @request = request
+      @options = options
+    end
+
+    def status
+      raise PureVirtualError
+    end
+
+    def code
+      CODE.fetch(status)
+    end
+
+    private
+
+    # Rails can be configured with link prefetching (with Turbo
+    # for example), and those will trigger the accept_on_cors test
+    # so giving a false positive.
+
+    def prefetch_skip?
+      options&.prefetch_skip || false
+    end
+
+    def prefetch_key
+      options&.prefetch_key
+    end
+
+    def prefetch_value
+      options&.prefetch_value
+    end
+
+    def prefetch_rack_key
+      ['HTTP', *prefetch_key.split('-')].join('_').upcase
+    end
+
+    def prefetch_header?
+      if prefetch_key then
+        value = request.get_header(prefetch_rack_key)
+        if prefetch_value then
+          value == prefetch_value
+        else
+          ! value.nil?
+        end
+      else
+        false
+      end
+    end
+
+    # standard headers
+
+    def content_type
+      request.get_header('CONTENT_TYPE')
+    end
+
+    def content_length
+      request.get_header('CONTENT_LENGTH')
+    end
+
+    def mode
+      request.get_header('HTTP_SEC_FETCH_MODE')
+    end
+
+    def dest
+      request.get_header('HTTP_SEC_FETCH_DEST')
+    end
+
+    def site
+      request.get_header('HTTP_SEC_FETCH_SITE')
+    end
+
+    def user
+      request.get_header('HTTP_SEC_FETCH_USER')
+    end
+
+    def uir
+      request.get_header('HTTP_UPGRADE_INSECURE_REQUESTS')
+    end
+
+    def ua
+      request.get_header('HTTP_USER_AGENT')
+    end
+
+    def sec_ch_ua
+      request.get_header('HTTP_SEC_CH_UA')
+    end
+
+    def sec_ch_ua_platform
+      request.get_header('HTTP_SEC_CH_UA_PLATFORM')
+    end
+
+    def sec_ch_ua_mobile
+      request.get_header('HTTP_SEC_CH_UA_MOBILE')
+    end
+
+    def accept
+      request.get_header('HTTP_ACCEPT')
+    end
+
+    def accept_language
+      request.get_header('HTTP_ACCEPT_LANGUAGE')
+    end
+  end
+
+  class Mode < Base
+    VALID = YAML.load(
+      File.read(__FILE__).split("__END__\n", 2).last
+    ).map { |k, v| [k, Set.new(v)] }.to_h.freeze
+
+    def status
+      @status ||= status_eval
+    end
+
+    private
+
+    def status_eval
+      if mode then
+        if dest then
+          if (mode == 'navigate') && (dest == 'empty') then
+            :invalid
+          elsif VALID.fetch(mode, []).include? dest then
+            :valid
+          else
+            :invalid
+          end
+        else
+          :invalid
+        end
+      else
+        :indeterminate
+      end
+    end
+  end
+
+  class Upgrade < Base
+
+    def status
+      @status ||= status_eval
+    end
+
+    private
+
+    def status_eval
+      if mode then
+        if uir.nil? && user.nil? then
+          :valid
+        elsif mode == 'navigate' then
+          :valid
+        elsif (uir == '1') || (user == '?1') then
+          :invalid
+        else
+          :valid
+        end
+      else
+        :indeterminate
+      end
+    end
+  end
+
+  class Identity < Base
+
+    def status
+      @status ||= status_eval
+    end
+
+    private
+
+    def status_eval
+      if sec_ch_ua || sec_ch_ua_platform || sec_ch_ua_mobile then
+        if ua_consistent? &&
+           platform_consistent? &&
+           mobile_consistent? then
+          :valid
+        else
+          :invalid
+        end
+      else
+        :indeterminate
+      end
+    end
+
+    def ua_lc
+      @ua_lc ||= ua.downcase
+    end
+
+    def ua_firefox?
+      ua_lc.include?('firefox/')
+    end
+
+    def ua_safari?
+      ua_lc.include?('safari/')
+    end
+
+    def ua_chrome?
+      ua_lc.include?('chrome/')
+    end
+
+    def ua_chromium?
+      ua_lc.include?('chromium/')
+    end
+
+    def ua_consistent?
+      if sec_ch_ua then
+        if ua_firefox? && !ua_chrome? then
+          false
+        elsif ua_safari? && !ua_chrome? && !ua_chromium? then
+          false
+        else
+          true
+        end
+      else
+        true
+      end
+    end
+
+    def platform
+      @platform ||= sec_ch_ua_platform.delete('"').downcase
+    end
+
+    def platform_windows?
+      platform == 'windows'
+    end
+
+    def platform_macos?
+      platform == 'macos'
+    end
+
+    def platform_linux?
+      platform == 'linux'
+    end
+
+    def ua_macintosh?
+      ua_lc.include? 'macintosh'
+    end
+
+    def ua_windows_nt?
+      ua_lc.include? 'windows nt'
+    end
+
+    def platform_consistent?
+      if sec_ch_ua_platform && ua then
+        if platform_windows? && ua_macintosh? then
+          false
+        elsif platform_macos? && ua_windows_nt? then
+          false
+        elsif platform_linux? && (ua_macintosh? || ua_windows_nt?) then
+          false
+        else
+          true
+        end
+      else
+        true
+      end
+    end
+
+    def mobile?
+      sec_ch_ua_mobile == '?1'
+    end
+
+    def ua_mobile?
+      ['mobile', 'android'].any? { |name| ua_lc.include?(name) }
+    end
+
+    def ua_desktop?
+      (ua_macintosh? || ua_windows_nt?) && !ua_mobile?
+    end
+
+    def all_ua_hints?
+      sec_ch_ua && sec_ch_ua_platform && sec_ch_ua_mobile
+    end
+
+    def no_accept_language?
+      ! accept_language
+    end
+
+    def mobile_consistent?
+      if sec_ch_ua_mobile && ua then
+        if mobile? && ua_desktop? then
+          false
+        elsif all_ua_hints? && no_accept_language? then
+          false
+        else
+          true
+        end
+      else
+        true
+      end
+    end
+  end
+
+  class Transfer < Base
+
+    def status
+      @status ||= status_eval
+    end
+
+    private
+
+    def status_eval
+      if mode || content_type then
+        if empty_form_urlencoded_site_none? then
+          :invalid
+        elsif accept_on_cors? then
+          :invalid
+        else
+          :valid
+        end
+      else
+        :indeterminate
+      end
+    end
+
+    def empty_form_urlencoded_site_none?
+      content_type &&
+        content_type.include?('application/x-www-form-urlencoded') &&
+        content_length == '0' &&
+        site == 'none'
+    end
+
+    def accept_on_cors?
+      if prefetch_skip? || prefetch_header? then
+        false
+      else
+        accept &&
+          accept.include?('text/html') &&
+          mode == 'cors'
+      end
+    end
+  end
+end
+
+__END__
+# -*- yaml -*-
+# valid Sec-Fetch-Dest values
+---
+navigate:
+  - document
+  - embed
+  - frame
+  - iframe
+  - object
+same-origin:
+  - audio
+  - empty
+  - font
+  - image
+  - json
+  - manifest
+  - report
+  - script
+  - sharedworker
+  - style
+  - track
+  - video
+  - worker
+  - xslt
+cors:
+  - audio
+  - empty
+  - font
+  - image
+  - json
+  - manifest
+  - report
+  - script
+  - sharedworker
+  - style
+  - track
+  - video
+  - xslt
+no-cors:
+  - audio
+  - embed
+  - empty
+  - image
+  - object
+  - report
+  - script
+  - style
+  - track
+  - video
+websocket:
+  - empty
+  - websocket

metadata

@@ -0,0 +1,172 @@
+--- !ruby/object:Gem::Specification
+name: rq4
+version: !ruby/object:Gem::Version
+  version: 0.9.0
+platform: ruby
+authors:
+- J.J. Green
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: simplecov-cobertura
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubygems-tasks
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rbs
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: 'Rack middleware implementing the RQ4 fingerprint
+
+  '
+email: j.j.green@gmx.co.uk
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENCE
+- README.md
+- lib/rq4.rb
+- lib/rq4/railtie.rb
+- lib/rq4/version.rb
+homepage: https://gitlab.com/jjg/rq4-ruby
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: RQ4 request fingerprint
+test_files: []