spamtrap 0.4.2 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a31cf3397317c7e4fadc471f44ce713dac53bea0701ba50b24a8259a77ed4b58
-  data.tar.gz: 3c3f3f0119ae22e79a3e327ae5aa1c65b915b906c2bb8b5e3621e536d62ccab2
+  metadata.gz: c77cdc3c296d9d7add4208780853b77a22cc7e3df72c2fe86dc38371394f8d42
+  data.tar.gz: e1edf13f46c1e64c38bca0a1b1d31f5a7dd41419f8f45cba7b29a580e1761f5d
 SHA512:
-  metadata.gz: 9abc563f9854fb5759371ac2973b3071b3cc86c4cab3af2566aed9b491079a2870b1df82e1dd5cf561f107a88786a818c42d294678e454cce86522cdabfe4ae0
-  data.tar.gz: 6d4b395ebb6d81a2a002919935001a77a7febdf3353fa5556de2ccd29883ecfe5f29e21b63de448ff53ccfb0233b85708547892cd089123a843775a9aace449d
+  metadata.gz: 34d2069dd9f92c0c36e56a0b20940c1cae6382cc94cd0c6b54c6609136f58a5ca3e3a26d469111a0527dfed0d5ccfa82d776ae1c2b6464fa91c88898f0d87d49
+  data.tar.gz: 249c2fa24da70d78a0a697194cad3a0c0e493b3285199e608ce3fb3667e6cb665078bf27e684cf0d9a18482b76c6501a8f913c688c15465266af37ac0164b9a2

data/lib/generators/spamtrap/install/templates/spamtrap.rb

@@ -41,6 +41,9 @@
 # Whether mutated fields keep an id/for derived from the real field name.
 # Spamtrap.stable_ids = true
 
+# Apply config.filter_parameters to mutated field names, which the log otherwise shows unfiltered.
+# Spamtrap.filter_parameters = true
+
 # Fill time
 
 # Minimum seconds between render and submission a human needs; false or 0 disables.

data/lib/spamtrap/crypto.rb

@@ -9,6 +9,8 @@ module Spamtrap
     NONCE_LEN = 12
     TAG_LEN   = 16
 
+    TOKEN_DRAWS = 8 # see spamtrap_encrypt_field
+
     class << self
       # HKDF-derives {mutation:, nonce:} keys, memoised per secret at module level so each
       # request doesn't re-derive them; previous_secret_key_base is what keeps a rotation from
@@ -25,6 +27,24 @@ module Spamtrap
           derived
         end
       end
+
+      # The name a mutated token decrypts to under each secret, skipping the tag and AAD check
+      # because Rails filters params before token_context can be computed. Unverified: fit only
+      # for deciding whether to mask a logged value, never for reading params.
+      def unverified_field_names(token)
+        raw = Base64.urlsafe_decode64(token)
+        return [] unless raw.bytesize > NONCE_LEN + TAG_LEN
+
+        [Spamtrap.secret_key_base, Spamtrap.previous_secret_key_base].compact.filter_map do |secret|
+          cipher = OpenSSL::Cipher.new(CIPHER).decrypt
+          cipher.key = keys_for(secret)[:mutation]
+          cipher.iv  = raw[0, NONCE_LEN]
+          name = cipher.update(raw[NONCE_LEN...-TAG_LEN]).force_encoding(Encoding::UTF_8)
+          name if name.valid_encoding? # a wrong secret yields random bytes, rarely valid UTF-8
+        end
+      rescue ArgumentError
+        []
+      end
     end
 
     private
@@ -34,8 +54,20 @@ module Spamtrap
       context.nil? ? timestamp.to_s : "#{timestamp}:#{context}"
     end
 
-    # aad binds the token to the render timestamp so it can't be replayed under a different one.
+    # A token the app's filter_parameters match as it stands (one containing otp or cvv, say) is
+    # masked in the log before the real name is checked: 0.38% of draws per field under Rails'
+    # generated list. So draw again. Capped because a filter matching every token would never stop.
     def spamtrap_encrypt_field(field_name, aad)
+      token = nil
+      TOKEN_DRAWS.times do
+        token = spamtrap_encrypt_field_once(field_name, aad)
+        break unless defined?(Spamtrap::ParameterFilter) && Spamtrap::ParameterFilter.masks_token?(token)
+      end
+      token
+    end
+
+    # aad binds the token to the render timestamp so it can't be replayed under a different one.
+    def spamtrap_encrypt_field_once(field_name, aad)
       cipher = OpenSSL::Cipher.new(CIPHER)
       cipher.encrypt
       cipher.key = Spamtrap::Crypto.keys_for(Spamtrap.secret_key_base)[:mutation]

data/lib/spamtrap/parameter_filter.rb

@@ -0,0 +1,89 @@
+module Spamtrap
+  # Rails logs params before any before_action runs, so mutated field names reach the log still
+  # encrypted and never match the app's filter_parameters. The Railtie appends BLOCK to
+  # filter_parameters; it decrypts each name and applies the app's own filters to the real one.
+  module ParameterFilter
+    # base64url of IV + at least one name byte + tag, then a date/time select's (Ni) suffix.
+    TOKEN = /\A([A-Za-z0-9_-]{39,})(\(\d+[a-z]\))?\z/
+
+    # Token key => parent paths, built once per params hash; weak so logged params aren't retained.
+    PARENTS = ObjectSpace::WeakMap.new
+
+    # Rails only calls blocks for leaf values no key filter matched, passing a copy of the
+    # value to mutate and the top-level params.
+    BLOCK = lambda do |key, value, params|
+      # Cheapest checks first: this runs for every leaf param of every request Rails filters.
+      next unless Spamtrap.filter_parameters && params.respond_to?(:key?)
+      next unless params.key?('spamtrap_timestamp') || params.key?(:spamtrap_timestamp)
+      next unless value.is_a?(String) && (token = TOKEN.match(key.to_s))
+
+      masked = Spamtrap::ParameterFilter.mask(token, value, params)
+      value.replace(masked) if masked
+    end
+
+    # Stands in for a field's value when asking whether the app's filters would mask a token.
+    PROBE = 'spamtrap'.freeze
+
+    class << self
+      # Whether the app's filters mask a value by the token itself. Rails checks key filters before
+      # calling any block, so such a token hides its field whatever the real name. Leaf only, so a
+      # dotted filter such as "comment.otp" goes unchecked; it can match only a token's first letters.
+      def masks_token?(token)
+        return false unless Spamtrap.filter_parameters && defined?(Rails.application) && Rails.application
+
+        app_filter.filter(token => PROBE)[token] != PROBE
+      end
+
+      # What the app's filters turn value into at the field's real path, or nil if they leave it.
+      # Only leaf names are mutated, so the containers above the token give the real path. A token
+      # shared by fields_for children has several parents; masking if any path would is the safe side.
+      def mask(token, value, params)
+        filter  = app_filter
+        parents = (PARENTS[params] ||= parent_paths(params)).fetch(token[0], [[]])
+        Spamtrap::Crypto.unverified_field_names(token[1]).each do |name|
+          parents.each do |parent|
+            path   = [*parent, "#{name}#{token[2]}"]
+            result = path.inject(filter.filter(nest(path, value.dup))) { |node, key| node.is_a?(Hash) ? node[key] : node }
+            return result.to_s unless result == value
+          end
+        end
+        nil
+      end
+
+      # The app's filters without BLOCK itself, rebuilt when the list is reassigned or grows.
+      def app_filter
+        filters = Rails.application.config.filter_parameters
+        signature = [filters.object_id, filters.size]
+        return @app_filter if @app_filter_signature == signature
+
+        # Filter before signature, so a concurrent reader never pairs the new signature with the old filter.
+        @app_filter = ActiveSupport::ParameterFilter.new(filters.reject { |f| f.equal?(BLOCK) })
+        @app_filter_signature = signature
+        @app_filter
+      end
+
+      private
+
+      # Array positions are left out of a path, as Rails leaves them out of dotted filter matching.
+      def parent_paths(params)
+        paths = Hash.new { |hash, key| hash[key] = [] }
+        visit = lambda do |node, path|
+          if node.is_a?(Array)
+            node.each { |element| visit.call(element, path) }
+          elsif node.is_a?(Hash)
+            node.each do |key, child|
+              paths[key.to_s] |= [path] if TOKEN.match?(key.to_s)
+              visit.call(child, [*path, key.to_s])
+            end
+          end
+        end
+        visit.call(params, [])
+        paths
+      end
+
+      def nest(path, value)
+        path.reverse.inject(value) { |inner, key| { key => inner } }
+      end
+    end
+  end
+end

data/lib/spamtrap/railtie.rb

@@ -9,5 +9,12 @@ module Spamtrap
       # miss the on_load hook, so patch now if the form helpers are already loaded.
       Spamtrap.install_form_builder! if Spamtrap.form_builder_loaded?
     end
+
+    # After the app's initializers, so one that assigns filter_parameters can't drop the block.
+    # Always installed; Spamtrap.filter_parameters switches it at request time.
+    initializer 'spamtrap.filter_parameters', after: :load_config_initializers do |app|
+      filters = app.config.filter_parameters
+      filters << Spamtrap::ParameterFilter::BLOCK unless filters.include?(Spamtrap::ParameterFilter::BLOCK)
+    end
   end
 end

data/lib/spamtrap/version.rb

@@ -1,5 +1,5 @@
 module Spamtrap
 
-  VERSION = '0.4.2'
+  VERSION = '0.4.4'
 
 end

data/lib/spamtrap.rb

@@ -63,6 +63,13 @@ module Spamtrap
       @enabled.nil? ? true : @enabled
     end
 
+    attr_writer :filter_parameters
+
+    # Apply the app's filter_parameters to mutated field names in the log. Default true.
+    def filter_parameters
+      @filter_parameters.nil? ? true : @filter_parameters
+    end
+
     attr_writer :nonce_bind_ip
 
     # true binds the nonce to the full client IP (default), :prefix to its /24 or /48
@@ -185,5 +192,6 @@ module Spamtrap
   require 'spamtrap/crypto'
   require 'spamtrap/controller'
   require 'spamtrap/helper'
+  require 'spamtrap/parameter_filter'
   require 'spamtrap/railtie' if defined?(Rails::Railtie)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spamtrap
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.4
 platform: ruby
 authors:
 - Cedric Howe
@@ -124,6 +124,7 @@ files:
 - lib/spamtrap/controller.rb
 - lib/spamtrap/crypto.rb
 - lib/spamtrap/helper.rb
+- lib/spamtrap/parameter_filter.rb
 - lib/spamtrap/railtie.rb
 - lib/spamtrap/test_helper.rb
 - lib/spamtrap/version.rb
@@ -138,14 +139,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 4.0.22
 specification_version: 4
 summary: Simple spamtrap for spambots.
 test_files: []