spamtrap 0.4.2 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a31cf3397317c7e4fadc471f44ce713dac53bea0701ba50b24a8259a77ed4b58
-  data.tar.gz: 3c3f3f0119ae22e79a3e327ae5aa1c65b915b906c2bb8b5e3621e536d62ccab2
+  metadata.gz: 1cc68536b7186bc9fac9249043e7bd3d0713b77070fab4611c08a8ba5fb1bfc1
+  data.tar.gz: 91c9ae78401af26537bc45c7c1ea17fac4245c264e1a6ee421fb6a9fd86af2d0
 SHA512:
-  metadata.gz: 9abc563f9854fb5759371ac2973b3071b3cc86c4cab3af2566aed9b491079a2870b1df82e1dd5cf561f107a88786a818c42d294678e454cce86522cdabfe4ae0
-  data.tar.gz: 6d4b395ebb6d81a2a002919935001a77a7febdf3353fa5556de2ccd29883ecfe5f29e21b63de448ff53ccfb0233b85708547892cd089123a843775a9aace449d
+  metadata.gz: 5985f1e8600a0f2d361b94ede13e567ea8b09d8e9ff3d7b4b0c2be99987d50d85bf5271dcea1bf3a0b5cc128a0fc066d6395b8ebf0be53dbc25970333e8ddab0
+  data.tar.gz: 5adec9413ed191d8de06866db16da6b68b65ead9509749a535fe416964540da1751037f44e52a688461cd828cbe82826d4714c40d08c06fdafa8f68e0b2f07da

data/lib/generators/spamtrap/install/templates/spamtrap.rb

@@ -41,6 +41,9 @@
 # Whether mutated fields keep an id/for derived from the real field name.
 # Spamtrap.stable_ids = true
 
+# Apply config.filter_parameters to mutated field names, which the log otherwise shows unfiltered.
+# Spamtrap.filter_parameters = true
+
 # Fill time
 
 # Minimum seconds between render and submission a human needs; false or 0 disables.

data/lib/spamtrap/crypto.rb

@@ -25,6 +25,24 @@ module Spamtrap
           derived
         end
       end
+
+      # The name a mutated token decrypts to under each secret, skipping the tag and AAD check
+      # because Rails filters params before token_context can be computed. Unverified: fit only
+      # for deciding whether to mask a logged value, never for reading params.
+      def unverified_field_names(token)
+        raw = Base64.urlsafe_decode64(token)
+        return [] unless raw.bytesize > NONCE_LEN + TAG_LEN
+
+        [Spamtrap.secret_key_base, Spamtrap.previous_secret_key_base].compact.filter_map do |secret|
+          cipher = OpenSSL::Cipher.new(CIPHER).decrypt
+          cipher.key = keys_for(secret)[:mutation]
+          cipher.iv  = raw[0, NONCE_LEN]
+          name = cipher.update(raw[NONCE_LEN...-TAG_LEN]).force_encoding(Encoding::UTF_8)
+          name if name.valid_encoding? # a wrong secret yields random bytes, rarely valid UTF-8
+        end
+      rescue ArgumentError
+        []
+      end
     end
 
     private

data/lib/spamtrap/parameter_filter.rb

@@ -0,0 +1,77 @@
+module Spamtrap
+  # Rails logs params before any before_action runs, so mutated field names reach the log still
+  # encrypted and never match the app's filter_parameters. The Railtie appends BLOCK to
+  # filter_parameters; it decrypts each name and applies the app's own filters to the real one.
+  module ParameterFilter
+    # base64url of IV + at least one name byte + tag, then a date/time select's (Ni) suffix.
+    TOKEN = /\A([A-Za-z0-9_-]{39,})(\(\d+[a-z]\))?\z/
+
+    # Token key => parent paths, built once per params hash; weak so logged params aren't retained.
+    PARENTS = ObjectSpace::WeakMap.new
+
+    # Rails only calls blocks for leaf values no key filter matched, passing a copy of the
+    # value to mutate and the top-level params.
+    BLOCK = lambda do |key, value, params|
+      # Cheapest checks first: this runs for every leaf param of every request Rails filters.
+      next unless Spamtrap.filter_parameters && params.respond_to?(:key?)
+      next unless params.key?('spamtrap_timestamp') || params.key?(:spamtrap_timestamp)
+      next unless value.is_a?(String) && (token = TOKEN.match(key.to_s))
+
+      masked = Spamtrap::ParameterFilter.mask(token, value, params)
+      value.replace(masked) if masked
+    end
+
+    class << self
+      # What the app's filters turn value into at the field's real path, or nil if they leave it.
+      # Only leaf names are mutated, so the containers above the token give the real path. A token
+      # shared by fields_for children has several parents; masking if any path would is the safe side.
+      def mask(token, value, params)
+        filter  = app_filter
+        parents = (PARENTS[params] ||= parent_paths(params)).fetch(token[0], [[]])
+        Spamtrap::Crypto.unverified_field_names(token[1]).each do |name|
+          parents.each do |parent|
+            path   = [*parent, "#{name}#{token[2]}"]
+            result = path.inject(filter.filter(nest(path, value.dup))) { |node, key| node.is_a?(Hash) ? node[key] : node }
+            return result.to_s unless result == value
+          end
+        end
+        nil
+      end
+
+      # The app's filters without BLOCK itself, rebuilt when the list is reassigned or grows.
+      def app_filter
+        filters = Rails.application.config.filter_parameters
+        signature = [filters.object_id, filters.size]
+        return @app_filter if @app_filter_signature == signature
+
+        # Filter before signature, so a concurrent reader never pairs the new signature with the old filter.
+        @app_filter = ActiveSupport::ParameterFilter.new(filters.reject { |f| f.equal?(BLOCK) })
+        @app_filter_signature = signature
+        @app_filter
+      end
+
+      private
+
+      # Array positions are left out of a path, as Rails leaves them out of dotted filter matching.
+      def parent_paths(params)
+        paths = Hash.new { |hash, key| hash[key] = [] }
+        visit = lambda do |node, path|
+          if node.is_a?(Array)
+            node.each { |element| visit.call(element, path) }
+          elsif node.is_a?(Hash)
+            node.each do |key, child|
+              paths[key.to_s] |= [path] if TOKEN.match?(key.to_s)
+              visit.call(child, [*path, key.to_s])
+            end
+          end
+        end
+        visit.call(params, [])
+        paths
+      end
+
+      def nest(path, value)
+        path.reverse.inject(value) { |inner, key| { key => inner } }
+      end
+    end
+  end
+end

data/lib/spamtrap/railtie.rb

@@ -9,5 +9,12 @@ module Spamtrap
       # miss the on_load hook, so patch now if the form helpers are already loaded.
       Spamtrap.install_form_builder! if Spamtrap.form_builder_loaded?
     end
+
+    # After the app's initializers, so one that assigns filter_parameters can't drop the block.
+    # Always installed; Spamtrap.filter_parameters switches it at request time.
+    initializer 'spamtrap.filter_parameters', after: :load_config_initializers do |app|
+      filters = app.config.filter_parameters
+      filters << Spamtrap::ParameterFilter::BLOCK unless filters.include?(Spamtrap::ParameterFilter::BLOCK)
+    end
   end
 end

data/lib/spamtrap/version.rb

@@ -1,5 +1,5 @@
 module Spamtrap
 
-  VERSION = '0.4.2'
+  VERSION = '0.4.3'
 
 end

data/lib/spamtrap.rb

@@ -63,6 +63,13 @@ module Spamtrap
       @enabled.nil? ? true : @enabled
     end
 
+    attr_writer :filter_parameters
+
+    # Apply the app's filter_parameters to mutated field names in the log. Default true.
+    def filter_parameters
+      @filter_parameters.nil? ? true : @filter_parameters
+    end
+
     attr_writer :nonce_bind_ip
 
     # true binds the nonce to the full client IP (default), :prefix to its /24 or /48
@@ -185,5 +192,6 @@ module Spamtrap
   require 'spamtrap/crypto'
   require 'spamtrap/controller'
   require 'spamtrap/helper'
+  require 'spamtrap/parameter_filter'
   require 'spamtrap/railtie' if defined?(Rails::Railtie)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spamtrap
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
 platform: ruby
 authors:
 - Cedric Howe
@@ -124,6 +124,7 @@ files:
 - lib/spamtrap/controller.rb
 - lib/spamtrap/crypto.rb
 - lib/spamtrap/helper.rb
+- lib/spamtrap/parameter_filter.rb
 - lib/spamtrap/railtie.rb
 - lib/spamtrap/test_helper.rb
 - lib/spamtrap/version.rb
@@ -145,7 +146,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 4.0.21
 specification_version: 4
 summary: Simple spamtrap for spambots.
 test_files: []