sidekiq 5.2.8 → 6.1.3

data/lib/sidekiq/util.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
-require 'socket'
-require 'securerandom'
-require 'sidekiq/exception_handler'
+
+require "socket"
+require "securerandom"
+require "sidekiq/exception_handler"
 
 module Sidekiq
   ##
@@ -10,18 +11,16 @@ module Sidekiq
   module Util
     include ExceptionHandler
 
-    EXPIRY = 60 * 60 * 24
-
     def watchdog(last_words)
       yield
     rescue Exception => ex
-      handle_exception(ex, { context: last_words })
+      handle_exception(ex, {context: last_words})
       raise ex
     end
 
     def safe_thread(name, &block)
       Thread.new do
-        Thread.current['sidekiq_label'] = name
+        Thread.current.name = name
         watchdog(name, &block)
       end
     end
@@ -34,8 +33,12 @@ module Sidekiq
       Sidekiq.redis(&block)
     end
 
+    def tid
+      Thread.current["sidekiq_tid"] ||= (Thread.current.object_id ^ ::Process.pid).to_s(36)
+    end
+
     def hostname
-      ENV['DYNO'] || Socket.gethostname
+      ENV["DYNO"] || Socket.gethostname
     end
 
     def process_nonce
@@ -43,22 +46,20 @@ module Sidekiq
     end
 
     def identity
-      @@identity ||= "#{hostname}:#{$$}:#{process_nonce}"
+      @@identity ||= "#{hostname}:#{::Process.pid}:#{process_nonce}"
     end
 
-    def fire_event(event, options={})
+    def fire_event(event, options = {})
       reverse = options[:reverse]
       reraise = options[:reraise]
 
       arr = Sidekiq.options[:lifecycle_events][event]
       arr.reverse! if reverse
       arr.each do |block|
-        begin
-          block.call
-        rescue => ex
-          handle_exception(ex, { context: "Exception during Sidekiq lifecycle event.", event: event })
-          raise ex if reraise
-        end
+        block.call
+      rescue => ex
+        handle_exception(ex, {context: "Exception during Sidekiq lifecycle event.", event: event})
+        raise ex if reraise
       end
       arr.clear
     end

data/lib/sidekiq/version.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Sidekiq
-  VERSION = "5.2.8"
+  VERSION = "6.1.3"
 end

data/lib/sidekiq/web/action.rb

@@ -2,7 +2,7 @@
 
 module Sidekiq
   class WebAction
-    RACK_SESSION = 'rack.session'
+    RACK_SESSION = "rack.session"
 
     attr_accessor :env, :block, :type
 
@@ -19,14 +19,14 @@ module Sidekiq
     end
 
     def redirect(location)
-      throw :halt, [302, { "Location" => "#{request.base_url}#{location}" }, []]
+      throw :halt, [302, {"Location" => "#{request.base_url}#{location}"}, []]
     end
 
     def params
-      indifferent_hash = Hash.new {|hash,key| hash[key.to_s] if Symbol === key }
+      indifferent_hash = Hash.new { |hash, key| hash[key.to_s] if Symbol === key }
 
       indifferent_hash.merge! request.params
-      route_params.each {|k,v| indifferent_hash[k.to_s] = v }
+      route_params.each { |k, v| indifferent_hash[k.to_s] = v }
 
       indifferent_hash
     end
@@ -40,10 +40,14 @@ module Sidekiq
     end
 
     def erb(content, options = {})
-      if content.kind_of? Symbol
+      if content.is_a? Symbol
         unless respond_to?(:"_erb_#{content}")
           src = ERB.new(File.read("#{Web.settings.views}/#{content}.erb")).src
-          WebAction.class_eval("def _erb_#{content}\n#{src}\n end")
+          WebAction.class_eval <<-RUBY, __FILE__, __LINE__ + 1
+            def _erb_#{content}
+              #{src}
+            end
+          RUBY
         end
       end
 
@@ -64,22 +68,22 @@ module Sidekiq
     end
 
     def json(payload)
-      [200, { "Content-Type" => "application/json", "Cache-Control" => "no-cache" }, [Sidekiq.dump_json(payload)]]
+      [200, {"Content-Type" => "application/json", "Cache-Control" => "no-cache"}, [Sidekiq.dump_json(payload)]]
     end
 
     def initialize(env, block)
       @_erb = false
       @env = env
       @block = block
-      @@files ||= {}
+      @files ||= {}
     end
 
     private
 
     def _erb(file, locals)
-      locals.each {|k, v| define_singleton_method(k){ v } unless (singleton_methods.include? k)} if locals
+      locals&.each { |k, v| define_singleton_method(k) { v } unless singleton_methods.include? k }
 
-      if file.kind_of?(String)
+      if file.is_a?(String)
         ERB.new(file).result(binding)
       else
         send(:"_erb_#{file}")

data/lib/sidekiq/web/application.rb

@@ -5,8 +5,7 @@ module Sidekiq
     extend WebRouter
 
     CONTENT_LENGTH = "Content-Length"
-    CONTENT_TYPE = "Content-Type"
-    REDIS_KEYS = %w(redis_version uptime_in_days connected_clients used_memory_human used_memory_peak_human)
+    REDIS_KEYS = %w[redis_version uptime_in_days connected_clients used_memory_human used_memory_peak_human]
     CSP_HEADER = [
       "default-src 'self' https: http:",
       "child-src 'self'",
@@ -21,7 +20,7 @@ module Sidekiq
       "style-src 'self' https: http: 'unsafe-inline'",
       "worker-src 'self'",
       "base-uri 'self'"
-    ].join('; ').freeze
+    ].join("; ").freeze
 
     def initialize(klass)
       @klass = klass
@@ -44,8 +43,8 @@ module Sidekiq
     end
 
     get "/" do
-      @redis_info = redis_info.select{ |k, v| REDIS_KEYS.include? k }
-      stats_history = Sidekiq::Stats::History.new((params['days'] || 30).to_i)
+      @redis_info = redis_info.select { |k, v| REDIS_KEYS.include? k }
+      stats_history = Sidekiq::Stats::History.new((params["days"] || 30).to_i)
       @processed_history = stats_history.processed
       @failed_history = stats_history.failed
 
@@ -57,14 +56,14 @@ module Sidekiq
     end
 
     post "/busy" do
-      if params['identity']
-        p = Sidekiq::Process.new('identity' => params['identity'])
-        p.quiet! if params['quiet']
-        p.stop! if params['stop']
+      if params["identity"]
+        p = Sidekiq::Process.new("identity" => params["identity"])
+        p.quiet! if params["quiet"]
+        p.stop! if params["stop"]
       else
         processes.each do |pro|
-          pro.quiet! if params['quiet']
-          pro.stop! if params['stop']
+          pro.quiet! if params["quiet"]
+          pro.stop! if params["stop"]
         end
       end
 
@@ -82,37 +81,46 @@ module Sidekiq
 
       halt(404) unless @name
 
-      @count = (params['count'] || 25).to_i
+      @count = (params["count"] || 25).to_i
       @queue = Sidekiq::Queue.new(@name)
-      (@current_page, @total_size, @messages) = page("queue:#{@name}", params['page'], @count)
+      (@current_page, @total_size, @messages) = page("queue:#{@name}", params["page"], @count, reverse: params["direction"] == "asc")
       @messages = @messages.map { |msg| Sidekiq::Job.new(msg, @name) }
 
       erb(:queue)
     end
 
     post "/queues/:name" do
-      Sidekiq::Queue.new(route_params[:name]).clear
+      queue = Sidekiq::Queue.new(route_params[:name])
+
+      if Sidekiq.pro? && params["pause"]
+        queue.pause!
+      elsif Sidekiq.pro? && params["unpause"]
+        queue.unpause!
+      else
+        queue.clear
+      end
 
       redirect "#{root_path}queues"
     end
 
     post "/queues/:name/delete" do
       name = route_params[:name]
-      Sidekiq::Job.new(params['key_val'], name).delete
+      Sidekiq::Job.new(params["key_val"], name).delete
 
       redirect_with_query("#{root_path}queues/#{CGI.escape(name)}")
     end
 
-    get '/morgue' do
-      @count = (params['count'] || 25).to_i
-      (@current_page, @total_size, @dead) = page("dead", params['page'], @count, reverse: true)
+    get "/morgue" do
+      @count = (params["count"] || 25).to_i
+      (@current_page, @total_size, @dead) = page("dead", params["page"], @count, reverse: true)
       @dead = @dead.map { |msg, score| Sidekiq::SortedEntry.new(nil, score, msg) }
 
       erb(:morgue)
     end
 
     get "/morgue/:key" do
-      halt(404) unless key = route_params[:key]
+      key = route_params[:key]
+      halt(404) unless key
 
       @dead = Sidekiq::DeadSet.new.fetch(*parse_params(key)).first
 
@@ -123,10 +131,10 @@ module Sidekiq
       end
     end
 
-    post '/morgue' do
-      redirect(request.path) unless params['key']
+    post "/morgue" do
+      redirect(request.path) unless params["key"]
 
-      params['key'].each do |key|
+      params["key"].each do |key|
         job = Sidekiq::DeadSet.new.fetch(*parse_params(key)).first
         retry_or_delete_or_kill job, params if job
       end
@@ -147,7 +155,8 @@ module Sidekiq
     end
 
     post "/morgue/:key" do
-      halt(404) unless key = route_params[:key]
+      key = route_params[:key]
+      halt(404) unless key
 
       job = Sidekiq::DeadSet.new.fetch(*parse_params(key)).first
       retry_or_delete_or_kill job, params if job
@@ -155,9 +164,9 @@ module Sidekiq
       redirect_with_query("#{root_path}morgue")
     end
 
-    get '/retries' do
-      @count = (params['count'] || 25).to_i
-      (@current_page, @total_size, @retries) = page("retry", params['page'], @count)
+    get "/retries" do
+      @count = (params["count"] || 25).to_i
+      (@current_page, @total_size, @retries) = page("retry", params["page"], @count)
       @retries = @retries.map { |msg, score| Sidekiq::SortedEntry.new(nil, score, msg) }
 
       erb(:retries)
@@ -173,10 +182,10 @@ module Sidekiq
       end
     end
 
-    post '/retries' do
-      redirect(request.path) unless params['key']
+    post "/retries" do
+      redirect(request.path) unless params["key"]
 
-      params['key'].each do |key|
+      params["key"].each do |key|
         job = Sidekiq::RetrySet.new.fetch(*parse_params(key)).first
         retry_or_delete_or_kill job, params if job
       end
@@ -210,9 +219,9 @@ module Sidekiq
       redirect_with_query("#{root_path}retries")
     end
 
-    get '/scheduled' do
-      @count = (params['count'] || 25).to_i
-      (@current_page, @total_size, @scheduled) = page("schedule", params['page'], @count)
+    get "/scheduled" do
+      @count = (params["count"] || 25).to_i
+      (@current_page, @total_size, @scheduled) = page("schedule", params["page"], @count)
       @scheduled = @scheduled.map { |msg, score| Sidekiq::SortedEntry.new(nil, score, msg) }
 
       erb(:scheduled)
@@ -228,10 +237,10 @@ module Sidekiq
       end
     end
 
-    post '/scheduled' do
-      redirect(request.path) unless params['key']
+    post "/scheduled" do
+      redirect(request.path) unless params["key"]
 
-      params['key'].each do |key|
+      params["key"].each do |key|
         job = Sidekiq::ScheduledSet.new.fetch(*parse_params(key)).first
         delete_or_add_queue job, params if job
       end
@@ -240,7 +249,8 @@ module Sidekiq
     end
 
     post "/scheduled/:key" do
-      halt(404) unless key = route_params[:key]
+      key = route_params[:key]
+      halt(404) unless key
 
       job = Sidekiq::ScheduledSet.new.fetch(*parse_params(key)).first
       delete_or_add_queue job, params if job
@@ -248,23 +258,23 @@ module Sidekiq
       redirect_with_query("#{root_path}scheduled")
     end
 
-    get '/dashboard/stats' do
+    get "/dashboard/stats" do
       redirect "#{root_path}stats"
     end
 
-    get '/stats' do
+    get "/stats" do
       sidekiq_stats = Sidekiq::Stats.new
-      redis_stats   = redis_info.select { |k, v| REDIS_KEYS.include? k }
+      redis_stats = redis_info.select { |k, v| REDIS_KEYS.include? k }
       json(
         sidekiq: {
-          processed:       sidekiq_stats.processed,
-          failed:          sidekiq_stats.failed,
-          busy:            sidekiq_stats.workers_size,
-          processes:       sidekiq_stats.processes_size,
-          enqueued:        sidekiq_stats.enqueued,
-          scheduled:       sidekiq_stats.scheduled_size,
-          retries:         sidekiq_stats.retry_size,
-          dead:            sidekiq_stats.dead_size,
+          processed: sidekiq_stats.processed,
+          failed: sidekiq_stats.failed,
+          busy: sidekiq_stats.workers_size,
+          processes: sidekiq_stats.processes_size,
+          enqueued: sidekiq_stats.enqueued,
+          scheduled: sidekiq_stats.scheduled_size,
+          retries: sidekiq_stats.retry_size,
+          dead: sidekiq_stats.dead_size,
           default_latency: sidekiq_stats.default_queue_latency
         },
         redis: redis_stats,
@@ -272,60 +282,52 @@ module Sidekiq
       )
     end
 
-    get '/stats/queues' do
+    get "/stats/queues" do
       json Sidekiq::Stats::Queues.new.lengths
     end
 
     def call(env)
       action = self.class.match(env)
-      return [404, {"Content-Type" => "text/plain", "X-Cascade" => "pass" }, ["Not Found"]] unless action
+      return [404, {"Content-Type" => "text/plain", "X-Cascade" => "pass"}, ["Not Found"]] unless action
 
-      resp = catch(:halt) do
-        app = @klass
+      app = @klass
+      resp = catch(:halt) do # rubocop:disable Standard/SemanticBlocks
         self.class.run_befores(app, action)
-        begin
-          resp = action.instance_exec env, &action.block
-        ensure
-          self.class.run_afters(app, action)
-        end
-
-        resp
+        action.instance_exec env, &action.block
+      ensure
+        self.class.run_afters(app, action)
       end
 
-      resp = case resp
+      case resp
       when Array
+        # redirects go here
         resp
       else
+        # rendered content goes here
         headers = {
           "Content-Type" => "text/html",
           "Cache-Control" => "no-cache",
           "Content-Language" => action.locale,
           "Content-Security-Policy" => CSP_HEADER
         }
-
+        # we'll let Rack calculate Content-Length for us.
         [200, headers, [resp]]
       end
-
-      resp[1] = resp[1].dup
-
-      resp[1][CONTENT_LENGTH] = resp[2].inject(0) { |l, p| l + p.bytesize }.to_s
-
-      resp
     end
 
-    def self.helpers(mod=nil, &block)
-      if block_given?
+    def self.helpers(mod = nil, &block)
+      if block
         WebAction.class_eval(&block)
       else
         WebAction.send(:include, mod)
       end
     end
 
-    def self.before(path=nil, &block)
+    def self.before(path = nil, &block)
       befores << [path && Regexp.new("\\A#{path.gsub("*", ".*")}\\z"), block]
     end
 
-    def self.after(path=nil, &block)
+    def self.after(path = nil, &block)
       afters << [path && Regexp.new("\\A#{path.gsub("*", ".*")}\\z"), block]
     end
 
@@ -338,8 +340,8 @@ module Sidekiq
     end
 
     def self.run_hooks(hooks, app, action)
-      hooks.select { |p,_| !p || p =~ action.env[WebRouter::PATH_INFO] }.
-            each {|_,b| action.instance_exec(action.env, app, &b) }
+      hooks.select { |p, _| !p || p =~ action.env[WebRouter::PATH_INFO] }
+        .each { |_, b| action.instance_exec(action.env, app, &b) }
     end
 
     def self.befores

data/lib/sidekiq/web/csrf_protection.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+# this file originally based on authenticity_token.rb from the sinatra/rack-protection project
+#
+# The MIT License (MIT)
+#
+# Copyright (c) 2011-2017 Konstantin Haase
+# Copyright (c) 2015-2017 Zachary Scott
+#
+# Permission is hereby granted, free of charge, to any person obtaining
+# a copy of this software and associated documentation files (the
+# 'Software'), to deal in the Software without restriction, including
+# without limitation the rights to use, copy, modify, merge, publish,
+# distribute, sublicense, and/or sell copies of the Software, and to
+# permit persons to whom the Software is furnished to do so, subject to
+# the following conditions:
+#
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+require "securerandom"
+require "base64"
+require "rack/request"
+
+module Sidekiq
+  class Web
+    class CsrfProtection
+      def initialize(app, options = nil)
+        @app = app
+      end
+
+      def call(env)
+        accept?(env) ? admit(env) : deny(env)
+      end
+
+      private
+
+      def admit(env)
+        # On each successful request, we create a fresh masked token
+        # which will be used in any forms rendered for this request.
+        s = session(env)
+        s[:csrf] ||= SecureRandom.base64(TOKEN_LENGTH)
+        env[:csrf_token] = mask_token(s[:csrf])
+        @app.call(env)
+      end
+
+      def safe?(env)
+        %w[GET HEAD OPTIONS TRACE].include? env["REQUEST_METHOD"]
+      end
+
+      def logger(env)
+        @logger ||= (env["rack.logger"] || ::Logger.new(env["rack.errors"]))
+      end
+
+      def deny(env)
+        logger(env).warn "attack prevented by #{self.class}"
+        [403, {"Content-Type" => "text/plain"}, ["Forbidden"]]
+      end
+
+      def session(env)
+        env["rack.session"] || fail("you need to set up a session middleware *before* #{self.class}")
+      end
+
+      def accept?(env)
+        return true if safe?(env)
+
+        giventoken = ::Rack::Request.new(env).params["authenticity_token"]
+        valid_token?(env, giventoken)
+      end
+
+      TOKEN_LENGTH = 32
+
+      # Checks that the token given to us as a parameter matches
+      # the token stored in the session.
+      def valid_token?(env, giventoken)
+        return false if giventoken.nil? || giventoken.empty?
+
+        begin
+          token = decode_token(giventoken)
+        rescue ArgumentError # client input is invalid
+          return false
+        end
+
+        sess = session(env)
+        localtoken = sess[:csrf]
+
+        # Checks that Rack::Session::Cookie actualy contains the csrf toekn
+        return false if localtoken.nil?
+
+        # Rotate the session token after every use
+        sess[:csrf] = SecureRandom.base64(TOKEN_LENGTH)
+
+        # See if it's actually a masked token or not. We should be able
+        # to handle any unmasked tokens that we've issued without error.
+
+        if unmasked_token?(token)
+          compare_with_real_token token, localtoken
+        elsif masked_token?(token)
+          unmasked = unmask_token(token)
+          compare_with_real_token unmasked, localtoken
+        else
+          false # Token is malformed
+        end
+      end
+
+      # Creates a masked version of the authenticity token that varies
+      # on each request. The masking is used to mitigate SSL attacks
+      # like BREACH.
+      def mask_token(token)
+        token = decode_token(token)
+        one_time_pad = SecureRandom.random_bytes(token.length)
+        encrypted_token = xor_byte_strings(one_time_pad, token)
+        masked_token = one_time_pad + encrypted_token
+        Base64.strict_encode64(masked_token)
+      end
+
+      # Essentially the inverse of +mask_token+.
+      def unmask_token(masked_token)
+        # Split the token into the one-time pad and the encrypted
+        # value and decrypt it
+        token_length = masked_token.length / 2
+        one_time_pad = masked_token[0...token_length]
+        encrypted_token = masked_token[token_length..-1]
+        xor_byte_strings(one_time_pad, encrypted_token)
+      end
+
+      def unmasked_token?(token)
+        token.length == TOKEN_LENGTH
+      end
+
+      def masked_token?(token)
+        token.length == TOKEN_LENGTH * 2
+      end
+
+      def compare_with_real_token(token, local)
+        ::Rack::Utils.secure_compare(token.to_s, decode_token(local).to_s)
+      end
+
+      def decode_token(token)
+        Base64.strict_decode64(token)
+      end
+
+      def xor_byte_strings(s1, s2)
+        s1.bytes.zip(s2.bytes).map { |(c1, c2)| c1 ^ c2 }.pack("c*")
+      end
+    end
+  end
+end