ruby-zoom 4.5.4 → 4.5.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. checksums.yaml +4 -4
  2. data/lib/zoom/profile/unsafe_c.rb +1 -0
  3. data/lib/zoom/profile/unsafe_java.rb +10 -2
  4. data/lib/zoom/profile/unsafe_js.rb +9 -1
  5. data/lib/zoom/profile/unsafe_php.rb +11 -4
  6. data/lib/zoom/profile/unsafe_python.rb +3 -1
  7. data/lib/zoom/profile/unsafe_ruby.rb +11 -4
  8. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 329434cae677eeac8fd10517aa29c429bf75a67f
4
- data.tar.gz: b785b487f1a4d6ca7c6665d2b92793829b105a34
3
+ metadata.gz: 141e398dfd381970365f9a7ac9d006d12fbb5e78
4
+ data.tar.gz: 6cfe24ba6b90cb368bd24eed6a58805be9ee5c1f
5
5
  SHA512:
6
- metadata.gz: 284c3e9edf33bc66af8402665613eab5d9984d3b4982ced5f72f157c1f3c2ac90e359820bdf9f0fc083ca7047671820f9088f60942551aeee1351f1b052bd83b
7
- data.tar.gz: 1a999fe2c8290b85429f9f7fd7fc9b900a5ddaf6be69d12ce6c3e23ee3fcccd0a24fbd07bb0bada16249c2b7fa2a715373db18e76159e05ebcf45b34de204b09
6
+ metadata.gz: '099bd9cdefabd22a413ec96781aafd202b21e498a7c9cc8cac0024398a02590ce55cf0b2ea6425ed3e9a80ee5aa4cc53e4e8b16b46bd067f884cf8f56961d83e'
7
+ data.tar.gz: ad060d42f0f9d2e64010460cd17ce9b9cb938958e9227a6b8b21822d0f3cc9525daf6a4f0e362847853f42297dba9800c881a620e85ddfcf6b02478b19280b05
data/lib/zoom/profile/unsafe_c.rb CHANGED
@@ -11,6 +11,7 @@ class Zoom::SecurityProfile::UnsafeC < Zoom::SecurityProfile
11
11
 
12
12
  super(n, nil, f, b, a)
13
13
  @pattern = [
14
+ "(^|[^\\nA-Za-z_])",
14
15
  "(",
15
16
  [
16
17
  "_splitpath",
data/lib/zoom/profile/unsafe_java.rb CHANGED
@@ -16,8 +16,16 @@ class Zoom::SecurityProfile::UnsafeJava < Zoom::SecurityProfile
16
16
  super(n, nil, f, b, a)
17
17
  @pattern = [
18
18
  "(sun\\.misc\\.)?Unsafe",
19
- "(\\.getRuntime|readObject|Runtime)\\("
20
- ].join("|")
19
+ "|",
20
+ "(",
21
+ [
22
+ "\\.getRuntime",
23
+ "readObject",
24
+ "Runtime"
25
+ ].join("|"),
26
+ ")",
27
+ "\\("
28
+ ].join
21
29
  @taggable = true
22
30
  end
23
31
  end
data/lib/zoom/profile/unsafe_js.rb CHANGED
@@ -10,7 +10,15 @@ class Zoom::SecurityProfile::UnsafeJs < Zoom::SecurityProfile
10
10
  end
11
11
 
12
12
  super(n, nil, f, b, a)
13
- @pattern = "\\.((append|eval|html)\\(|innerHTML)"
13
+ @pattern = [
14
+ "\\.",
15
+ "(",
16
+ [
17
+ "(append|eval|html)\\(",
18
+ "innerHTML"
19
+ ].join("|"),
20
+ ")"
21
+ ].join
14
22
  @taggable = true
15
23
  end
16
24
  end
data/lib/zoom/profile/unsafe_php.rb CHANGED
@@ -18,9 +18,14 @@ class Zoom::SecurityProfile::UnsafePhp < Zoom::SecurityProfile
18
18
  # From here: https://www.eukhost.com/blog/webhosting/dangerous-php-functions-must-be-disabled/
19
19
  # OMG is anything safe?!
20
20
  @pattern = [
21
- "\\`|",
22
- "\\$_GET\\[|",
23
- "(include|require)(_once)?|",
21
+ "\\`",
22
+ "|",
23
+ "\\$_GET\\[",
24
+ "|",
25
+ "(^|[^\\nA-Za-z_])",
26
+ "(",
27
+ "(include|require)(_once)?",
28
+ "|",
24
29
  "(",
25
30
  [
26
31
  "apache_(child_terminate|setenv)",
@@ -48,7 +53,9 @@ class Zoom::SecurityProfile::UnsafePhp < Zoom::SecurityProfile
48
53
  "sys(log|tem)",
49
54
  "xmlrpc_entity_decode"
50
55
  ].join("|"),
51
- ")\\("
56
+ ")",
57
+ "\\(",
58
+ ")"
52
59
  ].join
53
60
  @taggable = true
54
61
  end
data/lib/zoom/profile/unsafe_python.rb CHANGED
@@ -11,6 +11,7 @@ class Zoom::SecurityProfile::UnsafePython < Zoom::SecurityProfile
11
11
 
12
12
  super(n, nil, f, b, a)
13
13
  @pattern = [
14
+ "(^|[^\\nA-Za-z_])",
14
15
  "(",
15
16
  [
16
17
  "c?[Pp]ickle\\.loads?",
@@ -20,7 +21,8 @@ class Zoom::SecurityProfile::UnsafePython < Zoom::SecurityProfile
20
21
  "subprocess\\.call",
21
22
  "yaml\\.load"
22
23
  ].join("|"),
23
- ")\\("
24
+ ")",
25
+ "\\("
24
26
  ].join
25
27
  @taggable = true
26
28
  end
data/lib/zoom/profile/unsafe_ruby.rb CHANGED
@@ -25,11 +25,18 @@ class Zoom::SecurityProfile::UnsafeRuby < Zoom::SecurityProfile
25
25
  super(n, nil, f, b, a)
26
26
  @pattern = [
27
27
  "%x\\(",
28
+ "|",
28
29
  "\\.constantize",
29
- "instance_eval",
30
- "(public_)?send",
31
- "system"
32
- ].join("|")
30
+ "|",
31
+ "(^|[^\\nA-Za-z_])",
32
+ "(",
33
+ [
34
+ "instance_eval",
35
+ "(public_)?send",
36
+ "system",
37
+ ].join("|"),
38
+ ")"
39
+ ].join
33
40
  @taggable = true
34
41
  end
35
42
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: ruby-zoom
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.5.4
4
+ version: 4.5.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - Miles Whittaker
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2016-11-11 00:00:00.000000000 Z
11
+ date: 2016-11-15 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: minitest