securenative 0.1.33 → 0.1.38

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3fe3afee2e1f23bf0d5170952904e4e66078fb392a791dee566da36b39df2e7
-  data.tar.gz: 8b36837fe92f5a823a12d456cfc33f462a754bac28917a85a736fc37988ec72c
+  metadata.gz: dc768adcdfbc198fdda7606be0d78ae33399136a7747ec6487560c0b3e43eedc
+  data.tar.gz: bc3e5226d0bd77997b713348c9d774d3fa8f3251df5729d432b66d23761a4eee
 SHA512:
-  metadata.gz: ee1cde9a072ac6292dcb80ca41da67d925ede12be54f10c79ff59c17a2be29b566b2a0ae4cdcd17c69446e996bcc863ae4e98c4079748b184842fb2c55f171f1
-  data.tar.gz: c2c3cd008ffd8719acf11d4b31792b303cd649f090c2bb81567995fe5802d205c97601ff050f03d8bd33c1931a9cc65cca6873405df674768cfcca3a134c9f38
+  metadata.gz: f24b407bcb3dc2d90458d0c0f59d9c55f19210d82fe4cf87671271a1ff5b48c30312a84976cab76923f4720b27f2a41b9208d9bd101804115e1f7ad34086e978
+  data.tar.gz: e54bc315a48ebb30ad9355a1d89b1eeea3226608e833f16b1cd8b9906b64b89e0e0f03029e7fb946d0f5fadc8b5eb220d01b37c75aeb89d218aba75a7807b21f

data/Gemfile.lock

@@ -1,61 +1,61 @@
 PATH
   remote: .
   specs:
-    securenative (0.1.33)
+    securenative (0.1.38)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (6.0.3.3)
-      actionpack (= 6.0.3.3)
+    actioncable (6.0.3.4)
+      actionpack (= 6.0.3.4)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionmailbox (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       mail (>= 2.7.1)
-    actionmailer (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
+    actionmailer (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      actionview (= 6.0.3.4)
+      activejob (= 6.0.3.4)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.0.3.3)
-      actionview (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionpack (6.0.3.4)
+      actionview (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actiontext (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       nokogiri (>= 1.8.5)
-    actionview (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionview (6.0.3.4)
+      activesupport (= 6.0.3.4)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    activejob (6.0.3.4)
+      activesupport (= 6.0.3.4)
       globalid (>= 0.3.6)
-    activemodel (6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activerecord (6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activestorage (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
+    activemodel (6.0.3.4)
+      activesupport (= 6.0.3.4)
+    activerecord (6.0.3.4)
+      activemodel (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
+    activestorage (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
       marcel (~> 0.3.1)
-    activesupport (6.0.3.3)
+    activesupport (6.0.3.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -64,7 +64,7 @@ GEM
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     builder (3.2.4)
-    codecov (0.2.11)
+    codecov (0.2.12)
       json
       simplecov
     concurrent-ruby (1.1.7)
@@ -177,29 +177,29 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (6.0.3.3)
-      actioncable (= 6.0.3.3)
-      actionmailbox (= 6.0.3.3)
-      actionmailer (= 6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actiontext (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activerecord (= 6.0.3.3)
-      activestorage (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    rails (6.0.3.4)
+      actioncable (= 6.0.3.4)
+      actionmailbox (= 6.0.3.4)
+      actionmailer (= 6.0.3.4)
+      actionpack (= 6.0.3.4)
+      actiontext (= 6.0.3.4)
+      actionview (= 6.0.3.4)
+      activejob (= 6.0.3.4)
+      activemodel (= 6.0.3.4)
+      activerecord (= 6.0.3.4)
+      activestorage (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       bundler (>= 1.3.0)
-      railties (= 6.0.3.3)
+      railties (= 6.0.3.4)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    railties (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    railties (6.0.3.4)
+      actionpack (= 6.0.3.4)
+      activesupport (= 6.0.3.4)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.20.3, < 2.0)
@@ -242,7 +242,7 @@ GEM
       thread_safe (~> 0.1)
     url_mount (0.2.1)
       rack
-    webmock (3.9.1)
+    webmock (3.9.2)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)

data/README.md

@@ -176,7 +176,7 @@ SECURENATIVE_API_KEY: dsbe27fh3437r2yd326fg3fdg36f43
 SECURENATIVE_PROXY_HEADERS: ["CF-Connecting-IP"]
 ```
 
-Initialize sdk as showed above.
+Initialize sdk as shown above.
 
 ### Options 2: Using ConfigurationBuilder
 

data/lib/securenative/api_manager.rb

@@ -20,6 +20,12 @@ module SecureNative
       begin
         res = @event_manager.send_sync(event, SecureNative::Enums::ApiRoute::VERIFY)
         ver_result = JSON.parse(res.body)
+        if res.code != "200"
+          if @options.fail_over_strategy == SecureNative::FailOverStrategy::FAIL_OPEN
+            return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: [])
+          end
+          return VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: [])
+        end
         return VerifyResult.new(risk_level: ver_result['riskLevel'], score: ver_result['score'], triggers: ver_result['triggers'])
       rescue StandardError => e
         SecureNative::Log.debug("Failed to call verify; #{e}")

data/lib/securenative/context.rb

@@ -34,7 +34,7 @@ module SecureNative
         # Standard Ruby request
         headers = request.header.to_hash if headers.nil?
       rescue StandardError
-        headers = []
+        headers = {}
       end
 
       url = SecureNative::Frameworks::Rails.get_url(request)

data/lib/securenative/event_manager.rb

@@ -62,7 +62,7 @@ class EventManager
     res = @http_client.post(resource_path, EventManager.serialize(event).to_json)
 
     if res.nil? || res.code != '200'
-      SecureNative::Log.info("SecureNative failed to call endpoint #{resource_path} with event #{event}. adding back to queue")
+      SecureNative::Log.info("SecureNative failed to call endpoint #{resource_path} with event #{event}")
     end
 
     res

data/lib/securenative/frameworks/hanami.rb

@@ -35,8 +35,18 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          { 'user-agent' => request.env['HTTP_USER_AGENT'] }
+          headers = {}
+
+          request.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+
+          if headers.length == 0
+            request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+              headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+            }
+          end
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/frameworks/rails.rb

@@ -37,8 +37,18 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          {'user-agent' => request.env['HTTP_USER_AGENT']}
+          headers = {}
+
+          request.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+
+          if headers.length == 0
+            request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+              headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+            }
+          end
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/frameworks/sinatra.rb

@@ -35,8 +35,18 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          # Note: At the moment we're filtering out everything but user-agent since ruby's payload is way too big
-          {'user-agent' => request.env['HTTP_USER_AGENT']}
+          headers = {}
+
+          request.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+          }
+
+          if headers.length == 0
+            request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+              headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+            }
+          end
+          return headers
         rescue StandardError
           nil
         end

data/lib/securenative/http_client.rb

@@ -27,7 +27,7 @@ module SecureNative
       headers = _headers
 
       client = Net::HTTP.new(uri.host, uri.port)
-      client.read_timeout = @options.timeout
+      client.read_timeout = @options.timeout / 1000
       client.use_ssl = true
       client.verify_mode = OpenSSL::SSL::VERIFY_NONE
 

data/lib/securenative/utils/request_utils.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'ipaddr'
+
 module SecureNative
   module Utils
     class RequestUtils
@@ -24,14 +26,20 @@ module SecureNative
               if h.nil?
                 h = request.env[self.parse_ip(header)]
               end
-              return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
+              parsed = self.parse_proxy_header(h, header)
+              if self.validate_ip(parsed)
+                return parsed
+              end
             rescue NoMethodError
               begin
                 h = request[header]
                 if h.nil?
                   h = request.env[self.parse_ip(header)]
                 end
-                return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
+                parsed = self.parse_proxy_header(h, header)
+                if self.validate_ip(parsed)
+                  return parsed
+                end
               rescue NoMethodError
                 # Ignored
               end
@@ -40,36 +48,66 @@ module SecureNative
         end
 
         begin
-          x_forwarded_for = request.env['HTTP_X_FORWARDED_FOR']
-          return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+          header_value = request.env['HTTP_X_FORWARDED_FOR']
+          if header_value.include? ','
+            header_value = ip.split(',')[0]
+          end
+          if self.validate_ip(header_value)
+            return header_value
+          end
         rescue NoMethodError
           begin
-            x_forwarded_for = request['HTTP_X_FORWARDED_FOR']
-            return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+            header_value = request['HTTP_X_FORWARDED_FOR']
+            if header_value.include? ','
+              header_value = ip.split(',')[0]
+            end
+            if self.validate_ip(header_value)
+              return header_value
+            end
           rescue NoMethodError
             # Ignored
           end
         end
 
         begin
-          x_forwarded_for = request.env['HTTP_X_REAL_IP']
-          return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+          header_value = request.env['HTTP_X_REAL_IP']
+          if header_value.include? ','
+            header_value = ip.split(',')[0]
+          end
+          if self.validate_ip(header_value)
+            return header
+          end
         rescue NoMethodError
           begin
-            x_forwarded_for = request['HTTP_X_REAL_IP']
-            return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+            header_value = request['HTTP_X_REAL_IP']
+            if header_value.include? ','
+              header_value = ip.split(',')[0]
+            end
+            if self.validate_ip(header_value)
+              return header_value
+            end
           rescue NoMethodError
             # Ignored
           end
         end
 
         begin
-          x_forwarded_for = request.env['REMOTE_ADDR']
-          return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+          header_value = request.env['REMOTE_ADDR']
+          if header_value.include? ','
+            header_value = ip.split(',')[0]
+          end
+          if self.validate_ip(header_value)
+            return header_value
+          end
         rescue NoMethodError
           begin
-            x_forwarded_for = request['REMOTE_ADDR']
-            return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+            header_value = request['REMOTE_ADDR']
+            if header_value.include? ','
+              header_value = ip.split(',')[0]
+            end
+            if self.validate_ip(header_value)
+              return header_value
+            end
           rescue NoMethodError
             # Ignored
           end
@@ -96,6 +134,35 @@ module SecureNative
         h = headers.gsub('-', '_')
         return PREFIX + h.upcase
       end
+
+      def self.parse_proxy_header(headers, header_key)
+        h = headers.gsub(header_key + ': ', '')
+        if headers.include? ','
+          h = h.split(',')[0]
+        end
+        return h
+      end
+
+      def self.validate_ip(ip)
+        if ip.nil?
+          return false
+        end
+
+        begin
+          ipaddr = IPAddr.new(ip)
+          if ipaddr.ipv4?
+            return true
+          end
+
+          if ipaddr.ipv6?
+            return true
+          end
+        rescue Exception
+          # Ignored
+        end
+
+        return false
+      end
     end
   end
 end

data/lib/securenative/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SecureNative
-  VERSION = '0.1.33'
+  VERSION = '0.1.38'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: securenative
 version: !ruby/object:Gem::Version
-  version: 0.1.33
+  version: 0.1.38
 platform: ruby
 authors:
 - SecureNative
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-04 00:00:00.000000000 Z
+date: 2020-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler