sidekiq 6.5.10 → 8.1.7

data/lib/sidekiq/web/csrf_protection.rb

@@ -1,180 +0,0 @@
-# frozen_string_literal: true
-
-# this file originally based on authenticity_token.rb from the sinatra/rack-protection project
-#
-# The MIT License (MIT)
-#
-# Copyright (c) 2011-2017 Konstantin Haase
-# Copyright (c) 2015-2017 Zachary Scott
-#
-# Permission is hereby granted, free of charge, to any person obtaining
-# a copy of this software and associated documentation files (the
-# 'Software'), to deal in the Software without restriction, including
-# without limitation the rights to use, copy, modify, merge, publish,
-# distribute, sublicense, and/or sell copies of the Software, and to
-# permit persons to whom the Software is furnished to do so, subject to
-# the following conditions:
-#
-# The above copyright notice and this permission notice shall be
-# included in all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-require "securerandom"
-require "base64"
-require "rack/request"
-
-module Sidekiq
-  class Web
-    class CsrfProtection
-      def initialize(app, options = nil)
-        @app = app
-      end
-
-      def call(env)
-        accept?(env) ? admit(env) : deny(env)
-      end
-
-      private
-
-      def admit(env)
-        # On each successful request, we create a fresh masked token
-        # which will be used in any forms rendered for this request.
-        s = session(env)
-        s[:csrf] ||= SecureRandom.base64(TOKEN_LENGTH)
-        env[:csrf_token] = mask_token(s[:csrf])
-        @app.call(env)
-      end
-
-      def safe?(env)
-        %w[GET HEAD OPTIONS TRACE].include? env["REQUEST_METHOD"]
-      end
-
-      def logger(env)
-        @logger ||= (env["rack.logger"] || ::Logger.new(env["rack.errors"]))
-      end
-
-      def deny(env)
-        logger(env).warn "attack prevented by #{self.class}"
-        [403, {"Content-Type" => "text/plain"}, ["Forbidden"]]
-      end
-
-      def session(env)
-        env["rack.session"] || fail(<<~EOM)
-          Sidekiq::Web needs a valid Rack session for CSRF protection. If this is a Rails app,
-          make sure you mount Sidekiq::Web *inside* your application routes:
-
-
-          Rails.application.routes.draw do
-            mount Sidekiq::Web => "/sidekiq"
-            ....
-          end
-
-
-          If this is a Rails app in API mode, you need to enable sessions.
-
-            https://guides.rubyonrails.org/api_app.html#using-session-middlewares
-
-          If this is a bare Rack app, use a session middleware before Sidekiq::Web:
-
-            # first, use IRB to create a shared secret key for sessions and commit it
-            require 'securerandom'; File.open(".session.key", "w") {|f| f.write(SecureRandom.hex(32)) }
-
-            # now use the secret with a session cookie middleware
-            use Rack::Session::Cookie, secret: File.read(".session.key"), same_site: true, max_age: 86400
-            run Sidekiq::Web
-
-        EOM
-      end
-
-      def accept?(env)
-        return true if safe?(env)
-
-        giventoken = ::Rack::Request.new(env).params["authenticity_token"]
-        valid_token?(env, giventoken)
-      end
-
-      TOKEN_LENGTH = 32
-
-      # Checks that the token given to us as a parameter matches
-      # the token stored in the session.
-      def valid_token?(env, giventoken)
-        return false if giventoken.nil? || giventoken.empty?
-
-        begin
-          token = decode_token(giventoken)
-        rescue ArgumentError # client input is invalid
-          return false
-        end
-
-        sess = session(env)
-        localtoken = sess[:csrf]
-
-        # Checks that Rack::Session::Cookie actualy contains the csrf toekn
-        return false if localtoken.nil?
-
-        # Rotate the session token after every use
-        sess[:csrf] = SecureRandom.base64(TOKEN_LENGTH)
-
-        # See if it's actually a masked token or not. We should be able
-        # to handle any unmasked tokens that we've issued without error.
-
-        if unmasked_token?(token)
-          compare_with_real_token token, localtoken
-        elsif masked_token?(token)
-          unmasked = unmask_token(token)
-          compare_with_real_token unmasked, localtoken
-        else
-          false # Token is malformed
-        end
-      end
-
-      # Creates a masked version of the authenticity token that varies
-      # on each request. The masking is used to mitigate SSL attacks
-      # like BREACH.
-      def mask_token(token)
-        token = decode_token(token)
-        one_time_pad = SecureRandom.random_bytes(token.length)
-        encrypted_token = xor_byte_strings(one_time_pad, token)
-        masked_token = one_time_pad + encrypted_token
-        Base64.urlsafe_encode64(masked_token)
-      end
-
-      # Essentially the inverse of +mask_token+.
-      def unmask_token(masked_token)
-        # Split the token into the one-time pad and the encrypted
-        # value and decrypt it
-        token_length = masked_token.length / 2
-        one_time_pad = masked_token[0...token_length]
-        encrypted_token = masked_token[token_length..-1]
-        xor_byte_strings(one_time_pad, encrypted_token)
-      end
-
-      def unmasked_token?(token)
-        token.length == TOKEN_LENGTH
-      end
-
-      def masked_token?(token)
-        token.length == TOKEN_LENGTH * 2
-      end
-
-      def compare_with_real_token(token, local)
-        ::Rack::Utils.secure_compare(token.to_s, decode_token(local).to_s)
-      end
-
-      def decode_token(token)
-        Base64.urlsafe_decode64(token)
-      end
-
-      def xor_byte_strings(s1, s2)
-        s1.bytes.zip(s2.bytes).map { |(c1, c2)| c1 ^ c2 }.pack("c*")
-      end
-    end
-  end
-end

data/lib/sidekiq/worker.rb

@@ -1,370 +0,0 @@
-# frozen_string_literal: true
-
-require "sidekiq/client"
-
-module Sidekiq
-  ##
-  # Include this module in your worker class and you can easily create
-  # asynchronous jobs:
-  #
-  #   class HardWorker
-  #     include Sidekiq::Worker
-  #     sidekiq_options queue: 'critical', retry: 5
-  #
-  #     def perform(*args)
-  #       # do some work
-  #     end
-  #   end
-  #
-  # Then in your Rails app, you can do this:
-  #
-  #   HardWorker.perform_async(1, 2, 3)
-  #
-  # Note that perform_async is a class method, perform is an instance method.
-  #
-  # Sidekiq::Worker also includes several APIs to provide compatibility with
-  # ActiveJob.
-  #
-  #   class SomeWorker
-  #     include Sidekiq::Worker
-  #     queue_as :critical
-  #
-  #     def perform(...)
-  #     end
-  #   end
-  #
-  #   SomeWorker.set(wait_until: 1.hour).perform_async(123)
-  #
-  # Note that arguments passed to the job must still obey Sidekiq's
-  # best practice for simple, JSON-native data types. Sidekiq will not
-  # implement ActiveJob's more complex argument serialization. For
-  # this reason, we don't implement `perform_later` as our call semantics
-  # are very different.
-  #
-  module Worker
-    ##
-    # The Options module is extracted so we can include it in ActiveJob::Base
-    # and allow native AJs to configure Sidekiq features/internals.
-    module Options
-      def self.included(base)
-        base.extend(ClassMethods)
-        base.sidekiq_class_attribute :sidekiq_options_hash
-        base.sidekiq_class_attribute :sidekiq_retry_in_block
-        base.sidekiq_class_attribute :sidekiq_retries_exhausted_block
-      end
-
-      module ClassMethods
-        ACCESSOR_MUTEX = Mutex.new
-
-        ##
-        # Allows customization for this type of Worker.
-        # Legal options:
-        #
-        #   queue - name of queue to use for this job type, default *default*
-        #   retry - enable retries for this Worker in case of error during execution,
-        #      *true* to use the default or *Integer* count
-        #   backtrace - whether to save any error backtrace in the retry payload to display in web UI,
-        #      can be true, false or an integer number of lines to save, default *false*
-        #
-        # In practice, any option is allowed.  This is the main mechanism to configure the
-        # options for a specific job.
-        def sidekiq_options(opts = {})
-          opts = opts.transform_keys(&:to_s) # stringify
-          self.sidekiq_options_hash = get_sidekiq_options.merge(opts)
-        end
-
-        def sidekiq_retry_in(&block)
-          self.sidekiq_retry_in_block = block
-        end
-
-        def sidekiq_retries_exhausted(&block)
-          self.sidekiq_retries_exhausted_block = block
-        end
-
-        def get_sidekiq_options # :nodoc:
-          self.sidekiq_options_hash ||= Sidekiq.default_job_options
-        end
-
-        def sidekiq_class_attribute(*attrs)
-          instance_reader = true
-          instance_writer = true
-
-          attrs.each do |name|
-            synchronized_getter = "__synchronized_#{name}"
-
-            singleton_class.instance_eval do
-              undef_method(name) if method_defined?(name) || private_method_defined?(name)
-            end
-
-            define_singleton_method(synchronized_getter) { nil }
-            singleton_class.class_eval do
-              private(synchronized_getter)
-            end
-
-            define_singleton_method(name) { ACCESSOR_MUTEX.synchronize { send synchronized_getter } }
-
-            ivar = "@#{name}"
-
-            singleton_class.instance_eval do
-              m = "#{name}="
-              undef_method(m) if method_defined?(m) || private_method_defined?(m)
-            end
-            define_singleton_method("#{name}=") do |val|
-              singleton_class.class_eval do
-                ACCESSOR_MUTEX.synchronize do
-                  undef_method(synchronized_getter) if method_defined?(synchronized_getter) || private_method_defined?(synchronized_getter)
-                  define_method(synchronized_getter) { val }
-                end
-              end
-
-              if singleton_class?
-                class_eval do
-                  undef_method(name) if method_defined?(name) || private_method_defined?(name)
-                  define_method(name) do
-                    if instance_variable_defined? ivar
-                      instance_variable_get ivar
-                    else
-                      singleton_class.send name
-                    end
-                  end
-                end
-              end
-              val
-            end
-
-            if instance_reader
-              undef_method(name) if method_defined?(name) || private_method_defined?(name)
-              define_method(name) do
-                if instance_variable_defined?(ivar)
-                  instance_variable_get ivar
-                else
-                  self.class.public_send name
-                end
-              end
-            end
-
-            if instance_writer
-              m = "#{name}="
-              undef_method(m) if method_defined?(m) || private_method_defined?(m)
-              attr_writer name
-            end
-          end
-        end
-      end
-    end
-
-    attr_accessor :jid
-
-    def self.included(base)
-      raise ArgumentError, "Sidekiq::Worker cannot be included in an ActiveJob: #{base.name}" if base.ancestors.any? { |c| c.name == "ActiveJob::Base" }
-
-      base.include(Options)
-      base.extend(ClassMethods)
-    end
-
-    def logger
-      Sidekiq.logger
-    end
-
-    # This helper class encapsulates the set options for `set`, e.g.
-    #
-    #     SomeWorker.set(queue: 'foo').perform_async(....)
-    #
-    class Setter
-      include Sidekiq::JobUtil
-
-      def initialize(klass, opts)
-        @klass = klass
-        # NB: the internal hash always has stringified keys
-        @opts = opts.transform_keys(&:to_s)
-
-        # ActiveJob compatibility
-        interval = @opts.delete("wait_until") || @opts.delete("wait")
-        at(interval) if interval
-      end
-
-      def set(options)
-        hash = options.transform_keys(&:to_s)
-        interval = hash.delete("wait_until") || @opts.delete("wait")
-        @opts.merge!(hash)
-        at(interval) if interval
-        self
-      end
-
-      def perform_async(*args)
-        if @opts["sync"] == true
-          perform_inline(*args)
-        else
-          @klass.client_push(@opts.merge("args" => args, "class" => @klass))
-        end
-      end
-
-      # Explicit inline execution of a job. Returns nil if the job did not
-      # execute, true otherwise.
-      def perform_inline(*args)
-        raw = @opts.merge("args" => args, "class" => @klass)
-
-        # validate and normalize payload
-        item = normalize_item(raw)
-        queue = item["queue"]
-
-        # run client-side middleware
-        result = Sidekiq.client_middleware.invoke(item["class"], item, queue, Sidekiq.redis_pool) do
-          item
-        end
-        return nil unless result
-
-        # round-trip the payload via JSON
-        msg = Sidekiq.load_json(Sidekiq.dump_json(item))
-
-        # prepare the job instance
-        klass = msg["class"].constantize
-        job = klass.new
-        job.jid = msg["jid"]
-        job.bid = msg["bid"] if job.respond_to?(:bid)
-
-        # run the job through server-side middleware
-        result = Sidekiq.server_middleware.invoke(job, msg, msg["queue"]) do
-          # perform it
-          job.perform(*msg["args"])
-          true
-        end
-        return nil unless result
-        # jobs do not return a result. they should store any
-        # modified state.
-        true
-      end
-      alias_method :perform_sync, :perform_inline
-
-      def perform_bulk(args, batch_size: 1_000)
-        client = @klass.build_client
-        result = args.each_slice(batch_size).flat_map do |slice|
-          client.push_bulk(@opts.merge("class" => @klass, "args" => slice))
-        end
-
-        result.is_a?(Enumerator::Lazy) ? result.force : result
-      end
-
-      # +interval+ must be a timestamp, numeric or something that acts
-      #   numeric (like an activesupport time interval).
-      def perform_in(interval, *args)
-        at(interval).perform_async(*args)
-      end
-      alias_method :perform_at, :perform_in
-
-      private
-
-      def at(interval)
-        int = interval.to_f
-        now = Time.now.to_f
-        ts = ((int < 1_000_000_000) ? now + int : int)
-        # Optimization to enqueue something now that is scheduled to go out now or in the past
-        @opts["at"] = ts if ts > now
-        self
-      end
-    end
-
-    module ClassMethods
-      def delay(*args)
-        raise ArgumentError, "Do not call .delay on a Sidekiq::Worker class, call .perform_async"
-      end
-
-      def delay_for(*args)
-        raise ArgumentError, "Do not call .delay_for on a Sidekiq::Worker class, call .perform_in"
-      end
-
-      def delay_until(*args)
-        raise ArgumentError, "Do not call .delay_until on a Sidekiq::Worker class, call .perform_at"
-      end
-
-      def queue_as(q)
-        sidekiq_options("queue" => q.to_s)
-      end
-
-      def set(options)
-        Setter.new(self, options)
-      end
-
-      def perform_async(*args)
-        Setter.new(self, {}).perform_async(*args)
-      end
-
-      # Inline execution of job's perform method after passing through Sidekiq.client_middleware and Sidekiq.server_middleware
-      def perform_inline(*args)
-        Setter.new(self, {}).perform_inline(*args)
-      end
-      alias_method :perform_sync, :perform_inline
-
-      ##
-      # Push a large number of jobs to Redis, while limiting the batch of
-      # each job payload to 1,000. This method helps cut down on the number
-      # of round trips to Redis, which can increase the performance of enqueueing
-      # large numbers of jobs.
-      #
-      # +items+ must be an Array of Arrays.
-      #
-      # For finer-grained control, use `Sidekiq::Client.push_bulk` directly.
-      #
-      # Example (3 Redis round trips):
-      #
-      #     SomeWorker.perform_async(1)
-      #     SomeWorker.perform_async(2)
-      #     SomeWorker.perform_async(3)
-      #
-      # Would instead become (1 Redis round trip):
-      #
-      #     SomeWorker.perform_bulk([[1], [2], [3]])
-      #
-      def perform_bulk(*args, **kwargs)
-        Setter.new(self, {}).perform_bulk(*args, **kwargs)
-      end
-
-      # +interval+ must be a timestamp, numeric or something that acts
-      #   numeric (like an activesupport time interval).
-      def perform_in(interval, *args)
-        int = interval.to_f
-        now = Time.now.to_f
-        ts = ((int < 1_000_000_000) ? now + int : int)
-
-        item = {"class" => self, "args" => args}
-
-        # Optimization to enqueue something now that is scheduled to go out now or in the past
-        item["at"] = ts if ts > now
-
-        client_push(item)
-      end
-      alias_method :perform_at, :perform_in
-
-      ##
-      # Allows customization for this type of Worker.
-      # Legal options:
-      #
-      #   queue - use a named queue for this Worker, default 'default'
-      #   retry - enable retries via JobRetry, *true* to use the default
-      #      or *Integer* count
-      #   backtrace - whether to save any error backtrace in the retry payload to display in web UI,
-      #      can be true, false or an integer number of lines to save, default *false*
-      #   pool - use the given Redis connection pool to push this type of job to a given shard.
-      #
-      # In practice, any option is allowed.  This is the main mechanism to configure the
-      # options for a specific job.
-      #
-      # These options will be saved into the serialized job when enqueued by
-      # the client.
-      def sidekiq_options(opts = {})
-        super
-      end
-
-      def client_push(item) # :nodoc:
-        raise ArgumentError, "Job payloads should contain no Symbols: #{item}" if item.any? { |k, v| k.is_a?(::Symbol) }
-        build_client.push(item)
-      end
-
-      def build_client # :nodoc:
-        pool = Thread.current[:sidekiq_via_pool] || get_sidekiq_options["pool"] || Sidekiq.redis_pool
-        client_class = get_sidekiq_options["client_class"] || Sidekiq::Client
-        client_class.new(pool)
-      end
-    end
-  end
-end