securenative 0.1.30 → 0.1.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 37b0720aab5431b97f1b2313e9e1e88d6a3ce712ba342575c86884a5d3ed9f7c
-  data.tar.gz: 74258ad8d16b072378bda84119bb65831cb1441f186fcb49a893308d777249d6
+  metadata.gz: 20dc3ef7982fbbe1393a802c4b3e146bc5e2c156bbe47d69ab51de349af96897
+  data.tar.gz: 7f45ebdfc1015a73c592e38bb51b1dde881db64268c7de7844a0891fcebfd6af
 SHA512:
-  metadata.gz: bb0ce8d22b7b1ce832c49a3690856312b298cc8cc55046ebe966cf7ddb410079ae5d13cc93a4fd25b4a111fd971ec7be9782f92b5716103bba2842ce72607d8e
-  data.tar.gz: 17dece79e7f8dabed7fd270d1da3d7cc50f94691bfed65324e45b961ac8bd0a33371d4390f941cb3fa460e24a72fb86487a466ceaff91ec6d23595fc6cb6b9a8
+  metadata.gz: d9dec72d78c52595114438d45f22d14ae719f1852050af0c694791e66cc8292d9b9b1a6eabd4ea459f192bac694272f2f1167d9e147512df01e9c605a7bef9cd
+  data.tar.gz: e88c021e75f087d06f7ba6ba9760fe71ee9b49c950d9d69da424a95e17b2b17e9f6b56c08b70486e245425f5147954ab9bed60a37c9b34784dcda4d29a8ca9b9

data/Gemfile.lock

@@ -1,61 +1,61 @@
 PATH
   remote: .
   specs:
-    securenative (0.1.30)
+    securenative (0.1.35)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (6.0.3.3)
-      actionpack (= 6.0.3.3)
+    actioncable (6.0.3.4)
+      actionpack (= 6.0.3.4)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionmailbox (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       mail (>= 2.7.1)
-    actionmailer (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
+    actionmailer (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      actionview (= 6.0.3.4)
+      activejob (= 6.0.3.4)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.0.3.3)
-      actionview (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionpack (6.0.3.4)
+      actionview (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actiontext (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       nokogiri (>= 1.8.5)
-    actionview (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionview (6.0.3.4)
+      activesupport (= 6.0.3.4)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    activejob (6.0.3.4)
+      activesupport (= 6.0.3.4)
       globalid (>= 0.3.6)
-    activemodel (6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activerecord (6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activestorage (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
+    activemodel (6.0.3.4)
+      activesupport (= 6.0.3.4)
+    activerecord (6.0.3.4)
+      activemodel (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
+    activestorage (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
       marcel (~> 0.3.1)
-    activesupport (6.0.3.3)
+    activesupport (6.0.3.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -64,7 +64,7 @@ GEM
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     builder (3.2.4)
-    codecov (0.2.11)
+    codecov (0.2.12)
       json
       simplecov
     concurrent-ruby (1.1.7)
@@ -177,29 +177,29 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (6.0.3.3)
-      actioncable (= 6.0.3.3)
-      actionmailbox (= 6.0.3.3)
-      actionmailer (= 6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actiontext (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    rails (6.0.3.4)
+      actioncable (= 6.0.3.4)
+      actionmailbox (= 6.0.3.4)
+      actionmailer (= 6.0.3.4)
+      actionpack (= 6.0.3.4)
+      actiontext (= 6.0.3.4)
+      actionview (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activemodel (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       bundler (>= 1.3.0)
-      railties (= 6.0.3.3)
+      railties (= 6.0.3.4)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    railties (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    railties (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.20.3, < 2.0)
@@ -242,7 +242,7 @@ GEM
       thread_safe (~> 0.1)
     url_mount (0.2.1)
       rack
-    webmock (3.9.1)
+    webmock (3.9.2)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)

data/README.md

@@ -114,7 +114,7 @@ require 'securenative'
 
 def track(request)
     securenative = SecureNative::Client.instance
-    context = SecureNative::Context.from_http_request(request)
+    context = securenative.from_http_request(request)
     
     event_options = SecureNative::EventOptions.new(event: SecureNative::EventTypes::LOG_IN, user_id: '1234', context: context,
                                      user_traits: SecureNative::UserTraits.new(name: 'Your Name', email: 'name@gmail.com', phone: '+1234567890'),
@@ -136,7 +136,7 @@ require 'securenative'
 
 def verify(request)
     securenative = SecureNative::Client.instance
-    context = SecureNative::Context.from_http_request(request)
+    context = securenative.from_http_request(request)
 
     event_options = SecureNative::EventOptions.new(event: SecureNative::EventTypes::LOG_IN, user_id: '1234', context: context,
                                          user_traits: SecureNative::UserTraits.new(name: 'Your Name', email: 'name@gmail.com', phone: '+1234567890'),

data/lib/securenative/api_manager.rb

@@ -20,15 +20,21 @@ module SecureNative
       begin
         res = @event_manager.send_sync(event, SecureNative::Enums::ApiRoute::VERIFY)
         ver_result = JSON.parse(res.body)
+        if res.code != "200"
+          if @options.fail_over_strategy == SecureNative::FailOverStrategy::FAIL_OPEN
+            return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: [])
+          end
+          return VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: [])
+        end
         return VerifyResult.new(risk_level: ver_result['riskLevel'], score: ver_result['score'], triggers: ver_result['triggers'])
       rescue StandardError => e
         SecureNative::Log.debug("Failed to call verify; #{e}")
       end
       if @options.fail_over_strategy == SecureNative::FailOverStrategy::FAIL_OPEN
-        return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: nil)
+        return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: [])
       end
 
-      VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: nil)
+      VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: [])
     end
   end
 end

data/lib/securenative/client.rb

@@ -42,6 +42,10 @@ module SecureNative
       end
     end
 
+    def from_http_request(request)
+      SecureNative::Context.from_http_request(request, @options)
+    end
+
     def self.init
       options = SecureNative::Config::ConfigurationManager.load_config
       init_with_options(options)

data/lib/securenative/context.rb

@@ -21,7 +21,7 @@ module SecureNative
       SecureNative::Context.new
     end
 
-    def self.from_http_request(request)
+    def self.from_http_request(request, options)
       client_token = SecureNative::Frameworks::Rails.get_client_token(request)
       client_token = SecureNative::Frameworks::Sinatra.get_client_token(request) if client_token.nil?
       client_token = SecureNative::Frameworks::Hanami.get_client_token(request) if client_token.nil?
@@ -34,7 +34,7 @@ module SecureNative
         # Standard Ruby request
         headers = request.header.to_hash if headers.nil?
       rescue StandardError
-        headers = []
+        headers = {}
       end
 
       url = SecureNative::Frameworks::Rails.get_url(request)
@@ -54,12 +54,12 @@ module SecureNative
       end
 
       if SecureNative::Utils::Utils.null_or_empty?(client_token)
-        client_token = SecureNative::Utils::RequestUtils.get_secure_header_from_request(headers)
+        client_token = SecureNative::Utils::RequestUtils.get_secure_header_from_request(request.headers)
       end
 
-      SecureNative::Context.new(client_token: client_token, ip: SecureNative::Utils::RequestUtils.get_client_ip_from_request(request),
-                     remote_ip: SecureNative::Utils::RequestUtils.get_remote_ip_from_request(request),
-                     headers: headers, url: url, http_method: method || '', body: body)
+      SecureNative::Context.new(client_token: client_token, ip: SecureNative::Utils::RequestUtils.get_client_ip_from_request(request, options),
+                                remote_ip: SecureNative::Utils::RequestUtils.get_remote_ip_from_request(request),
+                                headers: headers, url: url, http_method: method || '', body: body)
     end
   end
 end

data/lib/securenative/frameworks/hanami.rb

@@ -35,8 +35,11 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          { 'user-agent' => request.env['HTTP_USER_AGENT'] }
+          headers = {}
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/frameworks/rails.rb

@@ -37,8 +37,11 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          {'user-agent' => request.env['HTTP_USER_AGENT']}
+          headers = {}
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/frameworks/sinatra.rb

@@ -35,8 +35,11 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          {'user-agent' => request.env['HTTP_USER_AGENT']}
+          headers = {}
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/utils/request_utils.rb

@@ -5,6 +5,7 @@ module SecureNative
     class RequestUtils
       SECURENATIVE_COOKIE = '_sn'
       SECURENATIVE_HEADER = 'x-securenative'
+      PREFIX = 'HTTP_'
 
       def self.get_secure_header_from_request(headers)
         begin
@@ -15,20 +16,27 @@ module SecureNative
         []
       end
 
-      def self.get_client_ip_from_request(request, options = nil)
-        unless options.nil?
-          for header in options.proxy_headers do
+      def self.get_client_ip_from_request(request, options)
+        unless options.proxy_headers.nil?
+          options.proxy_headers.each { |header|
             begin
               h = request.env[header]
+              if h.nil?
+                h = request.env[self.parse_ip(header)]
+              end
               return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
             rescue NoMethodError
               begin
                 h = request[header]
+                if h.nil?
+                  h = request.env[self.parse_ip(header)]
+                end
                 return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
               rescue NoMethodError
+                # Ignored
               end
             end
-          end
+          }
         end
 
         begin
@@ -39,6 +47,7 @@ module SecureNative
             x_forwarded_for = request['HTTP_X_FORWARDED_FOR']
             return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
           rescue NoMethodError
+            # Ignored
           end
         end
 
@@ -50,6 +59,7 @@ module SecureNative
             x_forwarded_for = request['HTTP_X_REAL_IP']
             return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
           rescue NoMethodError
+            # Ignored
           end
         end
 
@@ -61,12 +71,14 @@ module SecureNative
             x_forwarded_for = request['REMOTE_ADDR']
             return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
           rescue NoMethodError
+            # Ignored
           end
         end
 
         begin
           return request.ip unless request.ip.nil?
         rescue NoMethodError
+          # Ignored
         end
 
         ''
@@ -79,6 +91,11 @@ module SecureNative
           ''
         end
       end
+
+      def self.parse_ip(headers)
+        h = headers.gsub('-', '_')
+        return PREFIX + h.upcase
+      end
     end
   end
 end

data/lib/securenative/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SecureNative
-  VERSION = '0.1.30'
+  VERSION = '0.1.35'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: securenative
 version: !ruby/object:Gem::Version
-  version: 0.1.30
+  version: 0.1.35
 platform: ruby
 authors:
 - SecureNative
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-01 00:00:00.000000000 Z
+date: 2020-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler