securenative 0.1.34 → 0.1.39

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d37acae083e992b50287c1531d21bf1dc5794a94de5198dd3e7cf0dd29fd53c
-  data.tar.gz: 0aec5e752e9cb16c05b3ba70e4f05d9e842e34c63198575815c1f7f9f8590a52
+  metadata.gz: f51a9bf80e38a18bca0466b36a1a47266ae8dfe33df9130d0c0f22a8fa17d10e
+  data.tar.gz: 8e3e7b2cc512a4de5ff841679eea3a89083744ea281ecd26826a9ae38ccc607f
 SHA512:
-  metadata.gz: a69cf0db09fa4de8d1e3973f718d880d0ec43cef652b3a556fbfd57188907a52f0ecce1b1f452088423e05e4b44453da21c1f84f30a6ec510c906fff7217ea9c
-  data.tar.gz: 2e1949c2c0b4924eab51b93a36a5e092516830edb424ef7914389b9ec6b1d235cc50f5f62b36e7ef72d0343fe05ee7c871c486ef57a89cfd061332b886a63e17
+  metadata.gz: 975307d2f8e367f0add4255357fb90e53ee3c761f0ae9527023aac385e375d8fe5ddcd60de9c10c9b24aab4468e5e8bf88bce945fb2ffaf4e9404de9f31540cc
+  data.tar.gz: 7418c8fad032dde0bb3175d3028336662d313fc0d358664e9f2712aba83dd496c858a7c2cc950f57d0a9a73c80ab26e081f15271b5c6cfdee12e0fd70206ce64

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    securenative (0.1.34)
+    securenative (0.1.39)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -176,7 +176,7 @@ SECURENATIVE_API_KEY: dsbe27fh3437r2yd326fg3fdg36f43
 SECURENATIVE_PROXY_HEADERS: ["CF-Connecting-IP"]
 ```
 
-Initialize sdk as showed above.
+Initialize sdk as shown above.
 
 ### Options 2: Using ConfigurationBuilder
 

data/lib/securenative/api_manager.rb

@@ -20,6 +20,12 @@ module SecureNative
       begin
         res = @event_manager.send_sync(event, SecureNative::Enums::ApiRoute::VERIFY)
         ver_result = JSON.parse(res.body)
+        if res.code != "200"
+          if @options.fail_over_strategy == SecureNative::FailOverStrategy::FAIL_OPEN
+            return SecureNative::VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::LOW, score: 0, triggers: [])
+          end
+          return VerifyResult.new(risk_level: SecureNative::Enums::RiskLevel::HIGH, score: 1, triggers: [])
+        end
         return VerifyResult.new(risk_level: ver_result['riskLevel'], score: ver_result['score'], triggers: ver_result['triggers'])
       rescue StandardError => e
         SecureNative::Log.debug("Failed to call verify; #{e}")

data/lib/securenative/context.rb

@@ -34,7 +34,7 @@ module SecureNative
         # Standard Ruby request
         headers = request.header.to_hash if headers.nil?
       rescue StandardError
-        headers = []
+        headers = {}
       end
 
       url = SecureNative::Frameworks::Rails.get_url(request)

data/lib/securenative/event_manager.rb

@@ -62,7 +62,7 @@ class EventManager
     res = @http_client.post(resource_path, EventManager.serialize(event).to_json)
 
     if res.nil? || res.code != '200'
-      SecureNative::Log.info("SecureNative failed to call endpoint #{resource_path} with event #{event}. adding back to queue")
+      SecureNative::Log.info("SecureNative failed to call endpoint #{resource_path} with event #{event}")
     end
 
     res

data/lib/securenative/frameworks/hanami.rb

@@ -35,10 +35,17 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          headers = []
-          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
-            headers.append(header[0].downcase.gsub("http_", "").gsub("_", "-"))
+          headers = {}
+
+          request.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
           }
+
+          if headers.length == 0
+            request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+              headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+            }
+          end
           return headers
         rescue StandardError
           nil

data/lib/securenative/frameworks/rails.rb

@@ -37,10 +37,17 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          headers = []
-          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
-            headers.append(header[0].downcase.gsub("http_", "").gsub("_", "-"))
+          headers = {}
+
+          request.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
           }
+
+          if headers.length == 0
+            request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+              headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+            }
+          end
           return headers
         rescue StandardError
           nil

data/lib/securenative/frameworks/sinatra.rb

@@ -35,10 +35,17 @@ module SecureNative
 
       def self.get_headers(request)
         begin
-          headers = []
-          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
-            headers.append(header[0].downcase.gsub("http_", "").gsub("_", "-"))
+          headers = {}
+
+          request.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
           }
+
+          if headers.length == 0
+            request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+              headers[header[0].downcase.gsub("http_", "").gsub("_", "-")] = header[1]
+            }
+          end
           return headers
         rescue StandardError
           nil

data/lib/securenative/http_client.rb

@@ -27,7 +27,7 @@ module SecureNative
       headers = _headers
 
       client = Net::HTTP.new(uri.host, uri.port)
-      client.read_timeout = @options.timeout
+      client.read_timeout = @options.timeout / 1000
       client.use_ssl = true
       client.verify_mode = OpenSSL::SSL::VERIFY_NONE
 

data/lib/securenative/utils/request_utils.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'ipaddr'
+
 module SecureNative
   module Utils
     class RequestUtils
@@ -24,14 +26,20 @@ module SecureNative
               if h.nil?
                 h = request.env[self.parse_ip(header)]
               end
-              return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
+              parsed = self.parse_proxy_header(h, header)
+              if self.validate_ip(parsed)
+                return parsed
+              end
             rescue NoMethodError
               begin
                 h = request[header]
                 if h.nil?
                   h = request.env[self.parse_ip(header)]
                 end
-                return h.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless h.nil?
+                parsed = self.parse_proxy_header(h, header)
+                if self.validate_ip(parsed)
+                  return parsed
+                end
               rescue NoMethodError
                 # Ignored
               end
@@ -40,36 +48,66 @@ module SecureNative
         end
 
         begin
-          x_forwarded_for = request.env['HTTP_X_FORWARDED_FOR']
-          return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+          header_value = request.env['HTTP_X_FORWARDED_FOR']
+          if header_value.include? ','
+            header_value = header_value.split(',')[0]
+          end
+          if self.validate_ip(header_value)
+            return header_value
+          end
         rescue NoMethodError
           begin
-            x_forwarded_for = request['HTTP_X_FORWARDED_FOR']
-            return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+            header_value = request['HTTP_X_FORWARDED_FOR']
+            if header_value.include? ','
+              header_value = header_value.split(',')[0]
+            end
+            if self.validate_ip(header_value)
+              return header_value
+            end
           rescue NoMethodError
             # Ignored
           end
         end
 
         begin
-          x_forwarded_for = request.env['HTTP_X_REAL_IP']
-          return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+          header_value = request.env['HTTP_X_REAL_IP']
+          if header_value.include? ','
+            header_value = header_value.split(',')[0]
+          end
+          if self.validate_ip(header_value)
+            return header
+          end
         rescue NoMethodError
           begin
-            x_forwarded_for = request['HTTP_X_REAL_IP']
-            return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+            header_value = request['HTTP_X_REAL_IP']
+            if header_value.include? ','
+              header_value = header_value.split(',')[0]
+            end
+            if self.validate_ip(header_value)
+              return header_value
+            end
           rescue NoMethodError
             # Ignored
           end
         end
 
         begin
-          x_forwarded_for = request.env['REMOTE_ADDR']
-          return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+          header_value = request.env['REMOTE_ADDR']
+          if header_value.include? ','
+            header_value = header_value.split(',')[0]
+          end
+          if self.validate_ip(header_value)
+            return header_value
+          end
         rescue NoMethodError
           begin
-            x_forwarded_for = request['REMOTE_ADDR']
-            return x_forwarded_for.scan(/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/)[0] unless x_forwarded_for.nil?
+            header_value = request['REMOTE_ADDR']
+            if header_value.include? ','
+              header_value = header_value.split(',')[0]
+            end
+            if self.validate_ip(header_value)
+              return header_value
+            end
           rescue NoMethodError
             # Ignored
           end
@@ -96,6 +134,35 @@ module SecureNative
         h = headers.gsub('-', '_')
         return PREFIX + h.upcase
       end
+
+      def self.parse_proxy_header(headers, header_key)
+        h = headers.gsub(header_key + ': ', '')
+        if headers.include? ','
+          h = h.split(',')[0]
+        end
+        return h
+      end
+
+      def self.validate_ip(ip)
+        if ip.nil?
+          return false
+        end
+
+        begin
+          ipaddr = IPAddr.new(ip)
+          if ipaddr.ipv4?
+            return true
+          end
+
+          if ipaddr.ipv6?
+            return true
+          end
+        rescue Exception
+          # Ignored
+        end
+
+        return false
+      end
     end
   end
 end

data/lib/securenative/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SecureNative
-  VERSION = '0.1.34'
+  VERSION = '0.1.39'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: securenative
 version: !ruby/object:Gem::Version
-  version: 0.1.34
+  version: 0.1.39
 platform: ruby
 authors:
 - SecureNative
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-13 00:00:00.000000000 Z
+date: 2020-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler