spamtrap 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91ab3ea3a6d506bbc30ec82be0f584e51dbe9c51cc93b0677d9e97edc9d8ea47
-  data.tar.gz: 6c3667c9e712016f6f668db20e4e7e175290e148f4d259032a6400b9bf75986c
+  metadata.gz: 7c25ad9a77e76067aa77db7ac9f97aad1efde11b3f44a1ea6547a26da434bedd
+  data.tar.gz: 29211ceda85283fb468690b305e942246b9a00afb50e10450ca5e9b4a2839d7f
 SHA512:
-  metadata.gz: 753c5c75e6a39d958b647bc45ee1e433f59f05c514a702e35e532f6a1dfc8abcb0dfeeecf5edbb3c0d489c488ec093fddb9c3cc342dab2f71027cd5a8f483ac6
-  data.tar.gz: f5896fef5cad634cb91e2d46c52ab5b1fca74fbc76a9061fc05e209b793b0ddd8d066770ec02c33f74a45e565687ae63778140bfc5a8d485164809a0581b0a65
+  metadata.gz: ed39e2e15276baee291686c81c295bb18b180bc2d58240d48ef019cb1db36bcd90a05b67aa4e68c069d69b934a7e1533a1f16b22e8aec063310a1755cbacea64
+  data.tar.gz: 127e9108db3e7b72c0ea22f1ca586152f94a6cd6c2ba0645aa5b25dbb4c7ad1cb5249c2b7dd2587339297cbeddb0452fa549b84b143c1549f8ea8b431be248aa

data/lib/spamtrap/controller.rb

@@ -1,4 +1,5 @@
 module Spamtrap::Controller
+  include Spamtrap::Crypto
 
   def self.included(base)
     base.extend ActsAsMethods
@@ -6,18 +7,64 @@ module Spamtrap::Controller
 
   module ActsAsMethods
     def spamtrap(honeypot = 'spamtrap', options = {}, &block)
+      nonce_enabled  = options.delete(:nonce)
+      nonce_timeout  = options.delete(:nonce_timeout) || Spamtrap.nonce_timeout
+      mutate_enabled = options.delete(:mutate)
+
       before_action(options) do |controller|
         controller.instance_eval(&block) if block_given?
         controller.instance_eval do
+          spamtrap_remap_params if mutate_enabled
+
           if params[honeypot].present?
             Rails.logger.warn "Spamtrap triggered by #{request.remote_ip}."
             head 200
+          elsif nonce_enabled && !spamtrap_valid_nonce?(nonce_timeout)
+            Rails.logger.warn "Spamtrap nonce invalid from #{request.remote_ip}."
+            head 200
           end
         end
       end
     end
   end
 
+  def spamtrap_valid_nonce?(timeout)
+    timestamp = params[:spamtrap_timestamp].to_i
+    nonce = params[:spamtrap_nonce].to_s
+    return false if timestamp.zero? || nonce.empty?
+    return false if Time.now.to_i - timestamp > timeout.to_i
+
+    secret = Rails.application.secret_key_base
+    expected = OpenSSL::HMAC.hexdigest('SHA256', secret, "#{timestamp}:#{request.remote_ip}")
+    ActiveSupport::SecurityUtils.secure_compare(nonce, expected)
+  end
+
+  def spamtrap_remap_params
+    salt_hex = params[:spamtrap_mutation_salt].to_s
+    return if salt_hex.empty?
+
+    salt_bytes = [salt_hex].pack('H*')
+    return unless salt_bytes.bytesize == Spamtrap::Crypto::NONCE_LEN
+
+    spamtrap_remap_hash(params, salt_bytes)
+  rescue ArgumentError
+    nil
+  end
+
+  def spamtrap_remap_hash(hash, salt)
+    hash.each_key.to_a.each do |key|
+      real = spamtrap_decrypt_field(key.to_s, salt)
+      if real
+        hash[real] = hash.delete(key)
+        key = real
+      end
+      child = hash[key]
+      spamtrap_remap_hash(child, salt) if child.is_a?(ActionController::Parameters)
+    end
+  end
+
+  private :spamtrap_valid_nonce?, :spamtrap_remap_params, :spamtrap_remap_hash
+
 end
 
 ActionController::Base.send :include, Spamtrap::Controller

data/lib/spamtrap/crypto.rb

@@ -0,0 +1,46 @@
+require 'base64'
+
+module Spamtrap
+  module Crypto
+    CIPHER    = 'aes-128-gcm'
+    KEY_LEN   = 16
+    NONCE_LEN = 12
+    TAG_LEN   = 16
+
+    private
+
+    def spamtrap_crypto_key
+      @spamtrap_crypto_key ||= OpenSSL::KDF.hkdf(
+        Rails.application.secret_key_base,
+        salt:   'spamtrap-mutation',
+        info:   '',
+        length: KEY_LEN,
+        hash:   'SHA256'
+      )
+    end
+
+    def spamtrap_encrypt_field(field_name, salt_bytes)
+      cipher = OpenSSL::Cipher.new(CIPHER)
+      cipher.encrypt
+      cipher.key = spamtrap_crypto_key
+      cipher.iv  = salt_bytes
+      ct = cipher.update(field_name.to_s) + cipher.final
+      Base64.urlsafe_encode64(ct + cipher.auth_tag(TAG_LEN), padding: false)
+    end
+
+    def spamtrap_decrypt_field(token, salt_bytes)
+      raw = Base64.urlsafe_decode64(token)
+      return nil if raw.bytesize <= TAG_LEN
+      ct  = raw[0, raw.bytesize - TAG_LEN]
+      tag = raw[-TAG_LEN..]
+      cipher = OpenSSL::Cipher.new(CIPHER)
+      cipher.decrypt
+      cipher.key      = spamtrap_crypto_key
+      cipher.iv       = salt_bytes
+      cipher.auth_tag = tag
+      (cipher.update(ct) + cipher.final).to_sym
+    rescue OpenSSL::Cipher::CipherError, ArgumentError
+      nil
+    end
+  end
+end

data/lib/spamtrap/helper.rb

@@ -1,17 +1,68 @@
+module Spamtrap
+  module FormBuilderMutation
+    include Spamtrap::Crypto
+
+    MUTABLE_FIELDS = %i[
+      text_field email_field password_field number_field url_field telephone_field
+      text_area check_box hidden_field file_field date_field time_field
+      datetime_local_field month_field week_field search_field color_field
+      range_field select collection_select grouped_collection_select label
+    ].freeze
+
+    MUTABLE_FIELDS.each do |m|
+      define_method(m) do |field, *args, &blk|
+        field = spamtrap_encrypt_field(field.to_s, @spamtrap_salt) if @spamtrap_salt
+        super(field, *args, &blk)
+      end
+    end
+
+    def initialize(object_name, object, template, options)
+      super
+      @spamtrap_salt = options[:spamtrap_salt] if options[:spamtrap_salt]
+    end
+
+    def fields_for(record_name, record_object = nil, fields_options = {}, &block)
+      if @spamtrap_salt
+        if record_object.is_a?(Hash) && record_object.extractable_options?
+          record_object = record_object.merge(spamtrap_salt: @spamtrap_salt)
+        else
+          fields_options = fields_options.merge(spamtrap_salt: @spamtrap_salt)
+        end
+      end
+      super(record_name, record_object, fields_options, &block)
+    end
+  end
+end
+
 class ActionView::Helpers::FormBuilder
-  def spamtrap(parameter='spamtrap', options={})
-    options.reverse_merge!({:class => 'spamtrap'})
-    @template.text_area_tag(parameter, nil, options)
+  prepend Spamtrap::FormBuilderMutation
+
+  def spamtrap(parameter = 'spamtrap', options = {})
+    mutate = options.delete(:mutate)
+    nonce  = options.delete(:nonce)
+    options.reverse_merge!(class: 'spamtrap')
+
+    if mutate
+      @spamtrap_salt = SecureRandom.bytes(Spamtrap::Crypto::NONCE_LEN)
+      salt_field = @template.hidden_field_tag(
+        :spamtrap_mutation_salt, @spamtrap_salt.unpack1('H*')
+      )
+    end
+
+    @template.text_area_tag(parameter, nil, options) +
+      (nonce ? spamtrap_nonce_fields : ''.html_safe) +
+      (salt_field || ''.html_safe)
   end
 
-  # # def nonce(method, tag_value, options = {})
-  # def cryptographic_nonce(options = {})
-  #   # @template.hidden_field(@object_name, method, tag_value, objectify_options(options))
-  #   now, random = Time.now.to_i, SecureRandom.hex
-  #   # OpenSSL::HMAC.hexdigest()
-  #   cryptographic_nonce = Digest::MD5.hexdigest([timestamp, Rails.application.config.secret_key_base].join(':'))
-  #   @template.hidden_field(@object_name, :timestamp, now, objectify_options(options)) +
-  #   @template.hidden_field(@object_name, :random, random, objectify_options(options)) +
-  #   @template.hidden_field(@object_name, :spinner, cryptographic_nonce(now), objectify_options(options))
-  # end
+  private
+
+  def spamtrap_nonce_fields
+    timestamp = Time.now.to_i
+    ip        = @template.request.remote_ip
+    secret    = Rails.application.secret_key_base
+    nonce     = OpenSSL::HMAC.hexdigest('SHA256', secret, "#{timestamp}:#{ip}")
+
+    @template.hidden_field_tag(:spamtrap_timestamp, timestamp) +
+      @template.hidden_field_tag(:spamtrap_nonce, nonce)
+  end
 end

data/lib/spamtrap/version.rb

@@ -1,5 +1,5 @@
 module Spamtrap
 
-  VERSION = '0.2.0'
+  VERSION = '0.3.0'
 
 end

data/lib/spamtrap.rb

@@ -1,4 +1,15 @@
+require 'openssl'
+
 module Spamtrap
+  class << self
+    attr_writer :nonce_timeout
+
+    def nonce_timeout
+      @nonce_timeout || 1800
+    end
+  end
+
+  require 'spamtrap/crypto'
   require 'spamtrap/controller'
   require 'spamtrap/helper'
 end

data/test/controller_test.rb

@@ -1,10 +1,244 @@
 require File.join(File.dirname(__FILE__), 'test_helper')
 
-class ControllerTest < Minitest::Test
+# Test controllers — render a body so we can distinguish a real response
+# from a spamtrap-blocked one (which uses head 200 and has an empty body).
 
-  def test_foobar
-    assert true
-    assert_equal "hello", "hello"
+class HoneypotController < ActionController::Base
+  spamtrap :trap_field, only: :create
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class NonceController < ActionController::Base
+  spamtrap :trap_field, nonce: true, only: :create
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class NonceTimeoutController < ActionController::Base
+  spamtrap :trap_field, nonce: true, nonce_timeout: 60, only: :create
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class MutationController < ActionController::Base
+  spamtrap :trap_field, mutate: true, only: :create
+
+  def create
+    # Render the remapped comment param keys so tests can assert on them
+    render plain: params[:comment].to_unsafe_h.keys.sort.join(',')
+  end
+end
+
+class NestedMutationController < ActionController::Base
+  spamtrap :trap_field, mutate: true, only: :create
+
+  def create
+    # Render top-level and nested address keys to verify salt propagation
+    comment_keys = params[:comment].to_unsafe_h.except('address').keys.sort
+    address_keys = params.dig(:comment, :address).to_unsafe_h.keys.sort rescue []
+    render plain: "#{comment_keys.join(',')};#{address_keys.join(',')}"
+  end
+end
+
+module NonceTestHelper
+  REMOTE_IP = '0.0.0.0'
+
+  def generate_nonce(timestamp, ip = REMOTE_IP)
+    secret = Rails.application.secret_key_base
+    OpenSSL::HMAC.hexdigest('SHA256', secret, "#{timestamp}:#{ip}")
+  end
+end
+
+module MutationTestHelper
+  include Spamtrap::Crypto
+
+  MUTATION_SALT     = SecureRandom.bytes(Spamtrap::Crypto::NONCE_LEN)
+  MUTATION_SALT_HEX = MUTATION_SALT.unpack1('H*')
+end
+
+class HoneypotControllerTest < ActionController::TestCase
+  tests HoneypotController
+
+  def test_empty_honeypot_allows_request
+    post :create, params: { trap_field: '' }
+    assert_response :ok
+    assert_equal 'success', response.body
+  end
+
+  def test_filled_honeypot_silently_discards
+    post :create, params: { trap_field: 'buy cheap meds' }
+    assert_response :ok
+    assert_empty response.body
+  end
+end
+
+class NonceControllerTest < ActionController::TestCase
+  include NonceTestHelper
+  tests NonceController
+
+  def test_valid_nonce_allows_request
+    timestamp = Time.now.to_i
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp)
+    }
+    assert_response :ok
+    assert_equal 'success', response.body
+  end
+
+  def test_tampered_nonce_is_rejected
+    timestamp = Time.now.to_i
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: 'deadbeef'
+    }
+    assert_response :ok
+    assert_empty response.body
+  end
+
+  def test_expired_nonce_is_rejected
+    timestamp = Time.now.to_i - 7200
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp)
+    }
+    assert_response :ok
+    assert_empty response.body
+  end
+
+  def test_missing_nonce_fields_are_rejected
+    post :create, params: { trap_field: '' }
+    assert_response :ok
+    assert_empty response.body
+  end
+
+  def test_filled_honeypot_takes_priority_over_valid_nonce
+    timestamp = Time.now.to_i
+    post :create, params: {
+      trap_field: 'spam',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp)
+    }
+    assert_response :ok
+    assert_empty response.body
+  end
+end
+
+class NonceTimeoutControllerTest < ActionController::TestCase
+  include NonceTestHelper
+  tests NonceTimeoutController
+
+  def test_nonce_within_custom_timeout_passes
+    timestamp = Time.now.to_i - 30
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp)
+    }
+    assert_response :ok
+    assert_equal 'success', response.body
   end
 
+  def test_nonce_beyond_custom_timeout_is_rejected
+    timestamp = Time.now.to_i - 120
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp)
+    }
+    assert_response :ok
+    assert_empty response.body
+  end
+end
+
+class MutationControllerTest < ActionController::TestCase
+  include MutationTestHelper
+  tests MutationController
+
+  def test_encrypted_field_names_are_remapped_to_real_names
+    body_token  = spamtrap_encrypt_field('body',  MUTATION_SALT)
+    email_token = spamtrap_encrypt_field('email', MUTATION_SALT)
+
+    post :create, params: {
+      trap_field: '',
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { body_token => 'Hello world', email_token => 'test@example.com' }
+    }
+
+    assert_response :ok
+    assert_equal 'body,email', response.body
+  end
+
+  def test_unencrypted_field_names_pass_through_unchanged
+    post :create, params: {
+      trap_field: '',
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { body: 'Hello', email: 'test@example.com' }
+    }
+
+    assert_response :ok
+    assert_equal 'body,email', response.body
+  end
+
+  def test_no_salt_leaves_encrypted_params_unmapped
+    body_token = spamtrap_encrypt_field('body', MUTATION_SALT)
+
+    post :create, params: {
+      trap_field: '',
+      comment: { body_token => 'Hello' }
+    }
+
+    assert_response :ok
+    refute_equal 'body', response.body
+  end
+
+  def test_wrong_salt_fails_to_decrypt
+    other_salt     = SecureRandom.bytes(Spamtrap::Crypto::NONCE_LEN)
+    body_token     = spamtrap_encrypt_field('body', other_salt)
+
+    post :create, params: {
+      trap_field: '',
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { body_token => 'Hello' }
+    }
+
+    assert_response :ok
+    refute_equal 'body', response.body
+  end
+end
+
+class NestedMutationControllerTest < ActionController::TestCase
+  include MutationTestHelper
+  tests NestedMutationController
+
+  def test_salt_propagates_to_fields_for_child_builder
+    body_token    = spamtrap_encrypt_field('body',    MUTATION_SALT)
+    street_token  = spamtrap_encrypt_field('street',  MUTATION_SALT)
+    city_token    = spamtrap_encrypt_field('city',    MUTATION_SALT)
+
+    post :create, params: {
+      trap_field: '',
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: {
+        body_token => 'Hello',
+        address: {
+          street_token => '123 Main St',
+          city_token   => 'Springfield'
+        }
+      }
+    }
+
+    assert_response :ok
+    assert_equal 'body;city,street', response.body
+  end
 end

data/test/test_helper.rb

@@ -1,4 +1,28 @@
 require 'rubygems'
+require 'rails'
 require 'action_controller'
+require 'action_controller/test_case'
 require 'minitest/autorun'
 require 'spamtrap'
+
+class SpamtrapTestApp < Rails::Application
+  config.secret_key_base = 'a' * 64
+  config.eager_load = false
+  config.logger = Logger.new(nil)
+end
+
+Rails.application.initialize!
+
+Rails.application.routes.draw do
+  post 'honeypot/create',      to: 'honeypot#create'
+  post 'nonce/create',         to: 'nonce#create'
+  post 'nonce_timeout/create', to: 'nonce_timeout#create'
+  post 'mutation/create',      to: 'mutation#create'
+  post 'nested_mutation/create', to: 'nested_mutation#create'
+end
+
+class ActionController::TestCase
+  setup do
+    @routes = Rails.application.routes
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spamtrap
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Cedric Howe
@@ -32,6 +32,7 @@ extra_rdoc_files: []
 files:
 - lib/spamtrap.rb
 - lib/spamtrap/controller.rb
+- lib/spamtrap/crypto.rb
 - lib/spamtrap/helper.rb
 - lib/spamtrap/version.rb
 - test/controller_test.rb
@@ -54,7 +55,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Simple spamtrap for spambots.
 test_files: