securenative 0.1.31 → 0.1.36

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e936efafd72a5c0c1a5014d6649b6fafff6494a117a7dcd04090f031971cc5af
-  data.tar.gz: db9ba27daf67f22e6764632d944a24039b617b71a4364a7180ef792b9e631ee6
+  metadata.gz: '011925ba26bc507a1b13b835a1ed500ab6dfed5fa25bac41536182ffcff9d70b'
+  data.tar.gz: 65b86aa2ab265bf3ccb65f56534f55fcd9124b191bbd6b361eacd6c13064a730
 SHA512:
-  metadata.gz: f1009b1d827f473ea051b0e9bfd406508c8e6e9019009c3cb1b43a6aee6d1c551c41dfd1956d9a45e0f2f52eea633a9f183c3327cb93eb7a94c6357570d5c1a6
-  data.tar.gz: 843dd129a073f551ce5878fc788809b3611e98769cb4723ff2563176016be7a26f7190ff0a8d20bc513420dfe067943bf16e7efd52ce1ba51a13e98b203293e6
+  metadata.gz: b7c19b0f05ab873a9066431db238043a452b12620fc1a8d2e8cabb179d59eebd671d719cfac2a6b0d7592c2bbc2b462c0b7fa598548bcf6e01a779d412904c60
+  data.tar.gz: 43e0c8215def3fd13acbcc77ec7030b5fe70f9a000e328dbfab44f50a3a28da913aaaa7fa5092e8ca8ad19aaa71cab5e7620c3d21a92bf33a24135c2e9ac0e05

data/Gemfile.lock

@@ -1,61 +1,61 @@
 PATH
   remote: .
   specs:
-    securenative (0.1.31)
+    securenative (0.1.36)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (6.0.3.3)
-      actionpack (= 6.0.3.3)
+    actioncable (6.0.3.4)
+      actionpack (= 6.0.3.4)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionmailbox (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       mail (>= 2.7.1)
-    actionmailer (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
+    actionmailer (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      actionview (= 6.0.3.4)
+      activejob (= 6.0.3.4)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.0.3.3)
-      actionview (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionpack (6.0.3.4)
+      actionview (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actiontext (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       nokogiri (>= 1.8.5)
-    actionview (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionview (6.0.3.4)
+      activesupport (= 6.0.3.4)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    activejob (6.0.3.4)
+      activesupport (= 6.0.3.4)
       globalid (>= 0.3.6)
-    activemodel (6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activerecord (6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activestorage (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
+    activemodel (6.0.3.4)
+      activesupport (= 6.0.3.4)
+    activerecord (6.0.3.4)
+      activemodel (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
+    activestorage (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
       marcel (~> 0.3.1)
-    activesupport (6.0.3.3)
+    activesupport (6.0.3.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -64,7 +64,7 @@ GEM
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     builder (3.2.4)
-    codecov (0.2.11)
+    codecov (0.2.12)
       json
       simplecov
     concurrent-ruby (1.1.7)
@@ -177,29 +177,29 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (6.0.3.3)
-      actioncable (= 6.0.3.3)
-      actionmailbox (= 6.0.3.3)
-      actionmailer (= 6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actiontext (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    rails (6.0.3.4)
+      actioncable (= 6.0.3.4)
+      actionmailbox (= 6.0.3.4)
+      actionmailer (= 6.0.3.4)
+      actionpack (= 6.0.3.4)
+      actiontext (= 6.0.3.4)
+      actionview (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activemodel (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       bundler (>= 1.3.0)
-      railties (= 6.0.3.3)
+      railties (= 6.0.3.4)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    railties (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    railties (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.20.3, < 2.0)
@@ -242,7 +242,7 @@ GEM
       thread_safe (~> 0.1)
     url_mount (0.2.1)
       rack
-    webmock (3.9.1)
+    webmock (3.9.2)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)

data/README.md

@@ -176,7 +176,7 @@ SECURENATIVE_API_KEY: dsbe27fh3437r2yd326fg3fdg36f43
 SECURENATIVE_PROXY_HEADERS: ["CF-Connecting-IP"]
 ```
 
-Initialize sdk as showed above.
+Initialize sdk as shown above.
 
 ### Options 2: Using ConfigurationBuilder
 

data/lib/securenative/api_manager.rb

@@ -20,15 +20,21 @@ module SecureNative
       begin
         res = @event_manager.send_sync(event, SecureNative::Enums::ApiRoute::VERIFY)
         ver_result = JSON.parse(res.body)
+        if res.code != "200"
+          if @options.fail_over_strategy == SecureNative::FailOverStrategy::FAIL_OPEN
+            return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: [])
+          end
+          return VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: [])
+        end
         return VerifyResult.new(risk_level: ver_result['riskLevel'], score: ver_result['score'], triggers: ver_result['triggers'])
       rescue StandardError => e
         SecureNative::Log.debug("Failed to call verify; #{e}")
       end
       if @options.fail_over_strategy == SecureNative::FailOverStrategy::FAIL_OPEN
-        return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: nil)
+        return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: [])
       end
 
-      VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: nil)
+      VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: [])
     end
   end
 end

data/lib/securenative/context.rb

@@ -34,7 +34,7 @@ module SecureNative
         # Standard Ruby request
         headers = request.header.to_hash if headers.nil?
       rescue StandardError
-        headers = []
+        headers = {}
       end
 
       url = SecureNative::Frameworks::Rails.get_url(request)
@@ -54,7 +54,7 @@ module SecureNative
       end
 
       if SecureNative::Utils::Utils.null_or_empty?(client_token)
-        client_token = SecureNative::Utils::RequestUtils.get_secure_header_from_request(headers)
+        client_token = SecureNative::Utils::RequestUtils.get_secure_header_from_request(request.headers)
       end
 
       SecureNative::Context.new(client_token: client_token, ip: SecureNative::Utils::RequestUtils.get_client_ip_from_request(request, options),

data/lib/securenative/event_manager.rb

@@ -62,7 +62,7 @@ class EventManager
     res = @http_client.post(resource_path, EventManager.serialize(event).to_json)
 
     if res.nil? || res.code != '200'
-      SecureNative::Log.info("SecureNative failed to call endpoint #{resource_path} with event #{event}. adding back to queue")
+      SecureNative::Log.info("SecureNative failed to call endpoint #{resource_path} with event #{event}")
     end
 
     res

data/lib/securenative/frameworks/hanami.rb

@@ -35,8 +35,11 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          { 'user-agent' => request.env['HTTP_USER_AGENT'] }
+          headers = {}
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/frameworks/rails.rb

@@ -37,8 +37,11 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          {'user-agent' => request.env['HTTP_USER_AGENT']}
+          headers = {}
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/frameworks/sinatra.rb

@@ -35,8 +35,11 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          {'user-agent' => request.env['HTTP_USER_AGENT']}
+          headers = {}
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/http_client.rb

@@ -27,7 +27,7 @@ module SecureNative
       headers = _headers
 
       client = Net::HTTP.new(uri.host, uri.port)
-      client.read_timeout = @options.timeout
+      client.read_timeout = @options.timeout / 1000
       client.use_ssl = true
       client.verify_mode = OpenSSL::SSL::VERIFY_NONE
 

data/lib/securenative/utils/request_utils.rb

@@ -17,25 +17,26 @@ module SecureNative
       end
 
       def self.get_client_ip_from_request(request, options)
-        unless options.nil?
-          for header in options.proxy_headers do
+        unless options.proxy_headers.nil?
+          options.proxy_headers.each { |header|
             begin
               h = request.env[header]
-              unless !h.nil?
+              if h.nil?
                 h = request.env[self.parse_ip(header)]
               end
               return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
             rescue NoMethodError
               begin
                 h = request[header]
-                unless !h.nil?
+                if h.nil?
                   h = request.env[self.parse_ip(header)]
                 end
                 return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
               rescue NoMethodError
+                # Ignored
               end
             end
-          end
+          }
         end
 
         begin
@@ -46,6 +47,7 @@ module SecureNative
             x_forwarded_for = request['HTTP_X_FORWARDED_FOR']
             return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
           rescue NoMethodError
+            # Ignored
           end
         end
 
@@ -57,6 +59,7 @@ module SecureNative
             x_forwarded_for = request['HTTP_X_REAL_IP']
             return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
           rescue NoMethodError
+            # Ignored
           end
         end
 
@@ -68,12 +71,14 @@ module SecureNative
             x_forwarded_for = request['REMOTE_ADDR']
             return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
           rescue NoMethodError
+            # Ignored
           end
         end
 
         begin
           return request.ip unless request.ip.nil?
         rescue NoMethodError
+          # Ignored
         end
 
         ''

data/lib/securenative/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SecureNative
-  VERSION = '0.1.31'
+  VERSION = '0.1.36'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: securenative
 version: !ruby/object:Gem::Version
-  version: 0.1.31
+  version: 0.1.36
 platform: ruby
 authors:
 - SecureNative
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-04 00:00:00.000000000 Z
+date: 2020-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler