ruby-zoom 4.5.4 → 4.5.5

Sign up to get free protection for your applications and to get access to all the features.
Files changed (8) hide show
  1. checksums.yaml +4 -4
  2. data/lib/zoom/profile/unsafe_c.rb +1 -0
  3. data/lib/zoom/profile/unsafe_java.rb +10 -2
  4. data/lib/zoom/profile/unsafe_js.rb +9 -1
  5. data/lib/zoom/profile/unsafe_php.rb +11 -4
  6. data/lib/zoom/profile/unsafe_python.rb +3 -1
  7. data/lib/zoom/profile/unsafe_ruby.rb +11 -4
  8. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 329434cae677eeac8fd10517aa29c429bf75a67f
4
- data.tar.gz: b785b487f1a4d6ca7c6665d2b92793829b105a34
3
+ metadata.gz: 141e398dfd381970365f9a7ac9d006d12fbb5e78
4
+ data.tar.gz: 6cfe24ba6b90cb368bd24eed6a58805be9ee5c1f
5
5
  SHA512:
6
- metadata.gz: 284c3e9edf33bc66af8402665613eab5d9984d3b4982ced5f72f157c1f3c2ac90e359820bdf9f0fc083ca7047671820f9088f60942551aeee1351f1b052bd83b
7
- data.tar.gz: 1a999fe2c8290b85429f9f7fd7fc9b900a5ddaf6be69d12ce6c3e23ee3fcccd0a24fbd07bb0bada16249c2b7fa2a715373db18e76159e05ebcf45b34de204b09
6
+ metadata.gz: '099bd9cdefabd22a413ec96781aafd202b21e498a7c9cc8cac0024398a02590ce55cf0b2ea6425ed3e9a80ee5aa4cc53e4e8b16b46bd067f884cf8f56961d83e'
7
+ data.tar.gz: ad060d42f0f9d2e64010460cd17ce9b9cb938958e9227a6b8b21822d0f3cc9525daf6a4f0e362847853f42297dba9800c881a620e85ddfcf6b02478b19280b05
data/lib/zoom/profile/unsafe_c.rb CHANGED
@@ -11,6 +11,7 @@ class Zoom::SecurityProfile::UnsafeC < Zoom::SecurityProfile
11
11
 
12
12
  super(n, nil, f, b, a)
13
13
  @pattern = [
14
+ "(^|[^\\nA-Za-z_])",
14
15
  "(",
15
16
  [
16
17
  "_splitpath",
data/lib/zoom/profile/unsafe_java.rb CHANGED
@@ -16,8 +16,16 @@ class Zoom::SecurityProfile::UnsafeJava < Zoom::SecurityProfile
16
16
  super(n, nil, f, b, a)
17
17
  @pattern = [
18
18
  "(sun\\.misc\\.)?Unsafe",
19
- "(\\.getRuntime|readObject|Runtime)\\("
20
- ].join("|")
19
+ "|",
20
+ "(",
21
+ [
22
+ "\\.getRuntime",
23
+ "readObject",
24
+ "Runtime"
25
+ ].join("|"),
26
+ ")",
27
+ "\\("
28
+ ].join
21
29
  @taggable = true
22
30
  end
23
31
  end
data/lib/zoom/profile/unsafe_js.rb CHANGED
@@ -10,7 +10,15 @@ class Zoom::SecurityProfile::UnsafeJs < Zoom::SecurityProfile
10
10
  end
11
11
 
12
12
  super(n, nil, f, b, a)
13
- @pattern = "\\.((append|eval|html)\\(|innerHTML)"
13
+ @pattern = [
14
+ "\\.",
15
+ "(",
16
+ [
17
+ "(append|eval|html)\\(",
18
+ "innerHTML"
19
+ ].join("|"),
20
+ ")"
21
+ ].join
14
22
  @taggable = true
15
23
  end
16
24
  end
data/lib/zoom/profile/unsafe_php.rb CHANGED
@@ -18,9 +18,14 @@ class Zoom::SecurityProfile::UnsafePhp < Zoom::SecurityProfile
18
18
  # From here: https://www.eukhost.com/blog/webhosting/dangerous-php-functions-must-be-disabled/
19
19
  # OMG is anything safe?!
20
20
  @pattern = [
21
- "\\`|",
22
- "\\$_GET\\[|",
23
- "(include|require)(_once)?|",
21
+ "\\`",
22
+ "|",
23
+ "\\$_GET\\[",
24
+ "|",
25
+ "(^|[^\\nA-Za-z_])",
26
+ "(",
27
+ "(include|require)(_once)?",
28
+ "|",
24
29
  "(",
25
30
  [
26
31
  "apache_(child_terminate|setenv)",
@@ -48,7 +53,9 @@ class Zoom::SecurityProfile::UnsafePhp < Zoom::SecurityProfile
48
53
  "sys(log|tem)",
49
54
  "xmlrpc_entity_decode"
50
55
  ].join("|"),
51
- ")\\("
56
+ ")",
57
+ "\\(",
58
+ ")"
52
59
  ].join
53
60
  @taggable = true
54
61
  end
data/lib/zoom/profile/unsafe_python.rb CHANGED
@@ -11,6 +11,7 @@ class Zoom::SecurityProfile::UnsafePython < Zoom::SecurityProfile
11
11
 
12
12
  super(n, nil, f, b, a)
13
13
  @pattern = [
14
+ "(^|[^\\nA-Za-z_])",
14
15
  "(",
15
16
  [
16
17
  "c?[Pp]ickle\\.loads?",
@@ -20,7 +21,8 @@ class Zoom::SecurityProfile::UnsafePython < Zoom::SecurityProfile
20
21
  "subprocess\\.call",
21
22
  "yaml\\.load"
22
23
  ].join("|"),
23
- ")\\("
24
+ ")",
25
+ "\\("
24
26
  ].join
25
27
  @taggable = true
26
28
  end
data/lib/zoom/profile/unsafe_ruby.rb CHANGED
@@ -25,11 +25,18 @@ class Zoom::SecurityProfile::UnsafeRuby < Zoom::SecurityProfile
25
25
  super(n, nil, f, b, a)
26
26
  @pattern = [
27
27
  "%x\\(",
28
+ "|",
28
29
  "\\.constantize",
29
- "instance_eval",
30
- "(public_)?send",
31
- "system"
32
- ].join("|")
30
+ "|",
31
+ "(^|[^\\nA-Za-z_])",
32
+ "(",
33
+ [
34
+ "instance_eval",
35
+ "(public_)?send",
36
+ "system",
37
+ ].join("|"),
38
+ ")"
39
+ ].join
33
40
  @taggable = true
34
41
  end
35
42
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: ruby-zoom
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.5.4
4
+ version: 4.5.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - Miles Whittaker
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2016-11-11 00:00:00.000000000 Z
11
+ date: 2016-11-15 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: minitest