rservicebus2 0.2.19 → 0.2.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 40740ce5d75540b3c751035c3b36e9829c14cae0decfaafeaca9ea02d59c775d
-  data.tar.gz: 52ad2edd143b3b5248a44510412265d86fd64c16cd1777a69d970203ba5be239
+  metadata.gz: bda60d28cc7f2488863f583c78cd7d93f5f10e9b1108e555ace21bc4c9a1e5c0
+  data.tar.gz: 0a6909f90328adb8dd96f3dc7f2aee10ba7e930d7a55a9de7db3dc9c7a3d8bd8
 SHA512:
-  metadata.gz: af23a4c627e06a151acee10fc4a1be2582195d0df9f7d38bd127c446802a79dbdbb0e82cf9a22a9d2df2ffd572b6e1654bb42706eb5a2bf4a6c1f4b66d336b26
-  data.tar.gz: 27003eec5f598361137ee0d187a4432fd91e1f1a2c19aebd724ae727adb47cc8018ec25ecd2e0d339d5acefe52fd4035646c52992374a7bf15cd3ffa1cf8643c
+  metadata.gz: d52251deafca3c285f9f263f2ef94b38c702855f12dcd5d1425dd1c118d92774db86cecbe0a6ba87ee1e5e5e9fd9c6971a9f75a057c389618c0e6f38c0590d98
+  data.tar.gz: 1959b69ce7b511dd8f09b4a19dbbda9967671f369ff714aeb129c88054fafe1542cf220ba5757cfdf6030800327ec1e6ee07739ac4b4d0d56f9d42d4cf9c5e59

data/bin/return_messages_to_source_queue

@@ -13,7 +13,8 @@ def return_msg(beanstalk, job, request_nbr)
 
   msg_name = payload.match('(\w*)', start_index)[1]
 
-  msg = YAML.load(payload)
+  msg = RServiceBus2.safe_load(payload)
+
   if msg.last_error_string.nil?
     puts "*** Requested msg, #{request_nbr}, does not have a sourceQueue to
           which it can be returned"

data/lib/rservicebus2.rb

@@ -23,6 +23,7 @@ require 'rservicebus2/config'
 require 'rservicebus2/endpointmapping'
 require 'rservicebus2/statistic_manager'
 require 'rservicebus2/audit'
+require 'rservicebus2/yaml_safe_loader'
 
 require 'rservicebus2/message'
 require 'rservicebus2/message/subscription'

data/lib/rservicebus2/agent.rb

@@ -50,7 +50,7 @@ module RServiceBus2
     def check_for_reply(queue_name)
       @mq.subscribe(queue_name)
       body = @mq.pop
-      @msg = YAML.load(body)
+      @msg = RServiceBus2.safe_load(body)
       @mq.ack
       @msg.msg
     end

data/lib/rservicebus2/handler_loader.rb

@@ -140,14 +140,17 @@ module RServiceBus2
         next if file_path.end_with?('.')
 
         msg_name = get_msg_name(file_path)
+        YamlSafeLoader.instance.add_permitted_class(msg_name
+                       .gsub(/(?<=_|^)(\w)/) { Regexp.last_match(1).upcase }.gsub(/(?:_)(\w)/, '\1'))
         if File.directory?(file_path)
           load_handlers_from_second_level_path(msg_name, file_path)
-        else
-          # Classify
-          handler_name = "message_handler_#{msg_name}"
-                         .gsub(/(?<=_|^)(\w)/) { Regexp.last_match(1).upcase }.gsub(/(?:_)(\w)/, '\1')
-          load_handler(msg_name, file_path, handler_name)
+          next
         end
+
+        # Classify
+        handler_name = "message_handler_#{msg_name}"
+                       .gsub(/(?<=_|^)(\w)/) { Regexp.last_match(1).upcase }.gsub(/(?:_)(\w)/, '\1')
+        load_handler(msg_name, file_path, handler_name)
       end
 
       self

data/lib/rservicebus2/helper_functions.rb

@@ -1,7 +1,14 @@
 # frozen_string_literal: true
 
+require 'csv'
+
 # Helper functions
 module RServiceBus2
+  def self.safe_load(body)
+    # YAML.safe_load(body, permitted_classes: Module.constants)
+    YamlSafeLoader.instance.load(body)
+  end
+
   def self.convert_dto_to_hash(obj)
     hash = {}
     obj.instance_variables.each do |var|
@@ -32,6 +39,7 @@ module RServiceBus2
   end
 
   def self.create_anonymous_class(name_for_class)
+    # TODO do some reflection thing to create a class
     new_anonymous_class = Class.new(Object)
     Object.const_set(name_for_class, new_anonymous_class)
     Object.const_get(name_for_class).new

data/lib/rservicebus2/host.rb

@@ -99,6 +99,7 @@ module RServiceBus2
 
     def initialize
       RServiceBus2.rlog "Current directory: #{Dir.pwd}"
+      YamlSafeLoader.instance
       @config = ConfigFromEnv.new
                              .load_host_section
                              .load_contracts
@@ -162,7 +163,7 @@ module RServiceBus2
           body = @mq.pop
           begin
             @stats.inc_total_processed
-            @msg = YAML.load(body)
+            @msg = RServiceBus2.safe_load(body)
             case @msg.msg.class.name
             when 'RServiceBus2::MessageSubscription'
               @subscription_manager.add(@msg.msg.event_name,

data/lib/rservicebus2/message.rb

@@ -55,9 +55,9 @@ module RServiceBus2
 
     # @return [Object] The msg to be sent
     def msg
-      return YAML.load(Zlib::Inflate.inflate(@_msg)) if @compressed == true
+      return RServiceBus2.safe_load(Zlib::Inflate.inflate(@_msg)) if @compressed == true
 
-      YAML.load(@_msg)
+      RServiceBus2.safe_load(@_msg)
     rescue ArgumentError => e
       raise e if e.message.index('undefined class/module ').nil?
 

data/lib/rservicebus2/monitor/dir.rb

@@ -146,7 +146,8 @@ module RServiceBus2
         process_path(file_path)
 
         file_processed += 1
-        RServiceBus2.log "Processed #{file_processed} of #{file_list.length}.\nAllow system tick #{self.class.name}"
+        RServiceBus2.log "Processed #{file_processed} of #{file_list.length}."
+        RServiceBus2.log "Allow system tick #{self.class.name}"
 
         break if file_processed >= max_files_processed
       end

data/lib/rservicebus2/monitor/dirnotifier.rb

@@ -9,30 +9,46 @@ module RServiceBus2
   class MonitorDirNotifier < Monitor
     attr_reader :path, :processing_folder, :filter
 
+    def directory_not_writable(path, param_name)
+      "***** #{param_name} is not writable, #{path}.\n" \
+      "***** Make the directory, #{path}, writable and try again."
+    end
+
+    def directory_does_not_exist(path, param_name)
+      "***** #{param_name} does not exist, #{path}.\n" \
+      "***** Create the directory, #{path}, and try again.\n" \
+      "***** eg, mkdir #{path}"
+    end
+
+    def path_is_not_a_directory(path)
+      "***** The specified path does not point to a directory, #{path}.\n" \
+      "***** Either repoint path to a directory, or remove, #{path}, and create it as a directory.\n" \
+      "***** eg, rm #{path} && mkdir #{path}"
+    end
+
+    def processing_directory_not_specified(path)
+      '***** Processing Directory is not specified.' \
+      '***** Specify the Processing Directory as a query string in the Path URI' \
+      "***** eg, '/#{path}?processing=*ProcessingDir*'"
+    end
+
     def validate_directory(path, param_name)
       open_folder path
       return if File.writable?(path)
 
-      puts "***** #{param_name} is not writable, #{path}.\n
-           ***** Make the directory, #{path}, writable and try again."
+      puts directory_not_writable(path, param_name)
       abort
     rescue Errno::ENOENT
-      puts "***** #{param_name} does not exist, #{path}.\n" \
-           "***** Create the directory, #{path}, and try again.\n" \
-           "***** eg, mkdir #{path}"
+      puts directory_does_not_exist(path, param_name)
       abort
     rescue Errno::ENOTDIR
-      puts "***** The specified path does not point to a directory, #{path}.
-           ***** Either repoint path to a directory, or remove, #{path}, and create it as a directory.
-           ***** eg, rm #{path} && mkdir #{path}"
+      puts path_is_not_a_directory(path)
       abort
     end
 
     def validate_processing_directory(uri)
       if uri.query.nil?
-        puts '***** Processing Directory is not specified.' \
-             '***** Specify the Processing Directory as a query string in the Path URI' \
-             "***** eg, '/#{uri.path}?processing=*ProcessingDir*'"
+        puts processing_directory_not_specified(uri.path)
         abort
       end
 

data/lib/rservicebus2/saga_storage/dir.rb

@@ -81,7 +81,7 @@ module RServiceBus2
 
       return {} if content == ''
 
-      YAML.load(content)
+      RServiceBus2.safe_load(content)
     end
   end
 end

data/lib/rservicebus2/sendat_storage/file.rb

@@ -16,7 +16,7 @@ module RServiceBus2
 
       return [] if content == ''
 
-      YAML.load(content)
+      RServiceBus2.safe_load(content)
     end
 
     def add(msg)

data/lib/rservicebus2/state_storage/dir.rb

@@ -61,7 +61,7 @@ module RServiceBus2
 
       return {} if content == ''
 
-      YAML.load(content)
+      RServiceBus2.safe_load(content)
     end
   end
 end

data/lib/rservicebus2/subscription_storage/file.rb

@@ -7,11 +7,11 @@ module RServiceBus2
       RServiceBus2.log 'Load subscriptions'
       return {} unless File.exist?(@uri.path)
 
-      YAML.load(File.open(@uri.path))
+      RServiceBus2.safe_load(File.open(@uri.path))
     end
 
     def add(event_name, queue_name)
-      s = File.exist?(@uri.path) ? YAML.load(File.open(@uri.path)) : {}
+      s = File.exist?(@uri.path) ? RServiceBus2.safe_load(File.open(@uri.path)) : {}
       s[event_name] = [] if s[event_name].nil?
 
       s[event_name] << queue_name

data/lib/rservicebus2/transporter.rb

@@ -114,7 +114,7 @@ module RServiceBus2
     def process
       # Get the next job from the source queue
       job = @source.reserve @timeout
-      msg = YAML.load(job.body)
+      msg = RServiceBus2.safe_load(job.body)
 
       connect(msg.remote_host_name)
 

data/lib/rservicebus2/yaml_safe_loader.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'csv'
+require 'singleton'
+
+# YamlSafeLoader
+class YamlSafeLoader
+  include Singleton
+
+  DEFAULT_PERMITTED_CLASSES = 'RServiceBus2::Message,RServiceBus2::ErrorMessage,Time,UUIDTools::UUID,YamlSafeLoader,' \
+                              'URI::Generic,URI::RFC3986_Parser,Symbol,Regexp'
+
+  def initialize
+    string = "#{RServiceBus2.get_value('PERMITTED_CLASSES_BASE', DEFAULT_PERMITTED_CLASSES)}," \
+             "#{RServiceBus2.get_value('PERMITTED_CLASSES', '')}"
+    @permitted_classes = CSV.parse(string)[0].reject { |c| c.to_s.rstrip.empty? }
+  end
+
+  def add_permitted_class(string)
+    @permitted_classes << string
+    @permitted_classes.uniq!
+  end
+
+  def load(body)
+    YAML.safe_load(body, permitted_classes: @permitted_classes)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rservicebus2
 version: !ruby/object:Gem::Version
-  version: 0.2.19
+  version: 0.2.24
 platform: ruby
 authors:
 - Guy Irvine
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-05-28 00:00:00.000000000 Z
+date: 2021-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: beanstalk-client
@@ -165,6 +165,7 @@ files:
 - lib/rservicebus2/test/bus.rb
 - lib/rservicebus2/transporter.rb
 - lib/rservicebus2/usermessage/withpayload.rb
+- lib/rservicebus2/yaml_safe_loader.rb
 homepage: http://rubygems.org/gems/rservicebus2
 licenses:
 - LGPL-3.0