sqreen-alt 1.10.0

data/lib/sqreen/rules_callbacks/headers_insert.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'sqreen/rule_callback'
+
+module Sqreen
+  module Rules
+    # Display sqreen presence
+    class HeadersInsertCB < RuleCB
+      def post(rv, _inst, *_args, &_block)
+        return unless rv && rv.respond_to?(:[]) && rv[1].is_a?(Hash)
+        return nil unless @data
+        headers = @data['values'] || []
+        return if headers.empty?
+        headers.each do |name, value|
+          rv[1][name] = value
+        end
+        advise_action(nil)
+      end
+    end
+  end
+end

data/lib/sqreen/rules_callbacks/inspect_rule.rb

@@ -0,0 +1,25 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'sqreen/rule_callback'
+
+module Sqreen
+  module Rules
+    class InspectRuleCB < RuleCB
+      def pre(_inst, *args, &_block)
+        Sqreen.log.debug { "<< #{@klass} #{@method} #{Thread.current}" }
+        Sqreen.log.debug { args.map(&:inspect).join(' ') }
+      end
+
+      def post(rv, _inst, *_args, &_block)
+        Sqreen.log.debug { ">> #{rv.inspect} #{@klass} #{@method} #{Thread.current}" }
+        byebug if defined? byebug && @data.is_a?(Hash) && @data[:break] == 1
+      end
+
+      def failing(rv, _inst, *_args, &_block)
+        Sqreen.log.debug { "># #{rv.inspect} #{@klass} #{@method} #{Thread.current}" }
+        byebug if defined? byebug && @data.is_a?(Hash) && @data[:break] == 1
+      end
+    end
+  end
+end

data/lib/sqreen/rules_callbacks/matcher_rule.rb

@@ -0,0 +1,138 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'sqreen/rule_callback'
+
+module Sqreen
+  module Rules
+    # matcher behavior
+    module Matcher
+      attr_reader :min_size
+      def self.prepare_re_pattern(value, options, case_sensitive)
+        res = 0
+        res |= Regexp::MULTILINE  if options.include?('multiline')
+        res |= Regexp::IGNORECASE unless case_sensitive
+        r = Regexp.compile(value, res)
+        r.match("")
+        r
+      end
+
+      ANYWHERE_OPT = 'anywhere'.freeze
+      def prepare(patterns)
+        @string = {}
+        @regexp_patterns = []
+
+        if patterns.nil?
+          msg = "no key 'values' in data (had #{@data.keys})"
+          raise Sqreen::Exception, msg
+        end
+
+        @funs = {
+          ANYWHERE_OPT => lambda { |value, str| str.include?(value) },
+          'starts_with'.freeze => lambda { |value, str| str.start_with?(value) },
+          'ends_with'.freeze => lambda { |value, str| str.end_with?(value)   },
+          'equals'.freeze    => lambda { |value, str| str == value           },
+        }
+
+        sizes = []
+        patterns.each do |entry|
+          next unless entry
+          type = entry['type']
+          val = entry['value']
+          opts = entry['options']
+          opt = ANYWHERE_OPT
+          opt = opts.first.freeze if opts && opts.first && opts.first != ''
+          case_sensitive = entry['case_sensitive'] || false
+          case type
+          when 'string'
+            if case_sensitive
+              case_type = :cs
+            else
+              case_type = :ci
+              val.downcase!
+            end
+
+            unless @funs.keys.include?(opt)
+              Sqreen.log.debug { "Error: unknown string option '#{opt}' " }
+              next
+            end
+            @string[opt] = { :ci => [], :cs => [] } unless @string.key?(opt)
+            @string[opt][case_type] << val
+            sizes << entry.fetch('min_length') { val.size }
+          when 'regexp'
+            pattern = Matcher.prepare_re_pattern(val, opt, case_sensitive)
+            next unless pattern
+            @regexp_patterns << pattern
+            sizes << entry['min_length']
+          else
+            raise Sqreen::Exception, "No such matcher type #{type}"
+          end
+        end
+
+        @min_size = sizes.min unless sizes.any?(&:nil?)
+
+        return unless [@regexp_patterns, @string].map(&:empty?).all?
+        msg = "no key 'regexp' nor 'match' in data (had #{@data.keys})"
+        raise Sqreen::Exception, msg
+      end
+
+      def match(str)
+        return if str.nil? || str.empty? || !str.is_a?(String)
+        str = enforce_encoding(str) unless str.ascii_only?
+        istr = str.downcase unless @string.empty?
+
+        @string.each do |type, cases|
+          fun = @funs[type]
+          if fun.nil?
+            Sqreen.log.debug { "no matching function found for type #{type}" }
+          end
+          cases.each do |case_type, patterns|
+            input_str = if case_type == :ci
+                          istr
+                        else
+                          str
+                        end
+            patterns.each do |pat|
+              return pat if fun.call(pat, input_str)
+            end
+          end
+        end
+
+        if defined?(Encoding)
+          @regexp_patterns.each do |p|
+            next unless Encoding.compatible?(p, str)
+            return p if p.match(str)
+          end
+        else
+          @regexp_patterns.each do |p|
+            return p if p.match(str)
+          end
+        end
+        nil
+      end
+
+      private
+
+      def enforce_encoding(str)
+        encoded8bit = str.encoding.name == 'ASCII-8BIT'
+        return str if !encoded8bit && str.valid_encoding?
+        str.chars.map do |v|
+          if !v.valid_encoding? || (encoded8bit && !v.ascii_only?)
+            ''
+          else
+            v
+          end
+        end.join
+      end
+    end
+
+    # A configurable matcher rule
+    class MatcherRuleCB < RuleCB
+      def initialize(*args)
+        super(*args)
+        prepare(@data['values'])
+      end
+      include Matcher
+    end
+  end
+end

data/lib/sqreen/rules_callbacks/rails_parameters.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'sqreen/rule_callback'
+
+module Sqreen
+  module Rules
+    class RailsParametersCB < RuleCB
+      def pre(_inst, *_args, &_block)
+        advise_action(nil)
+      end
+    end
+  end
+end

data/lib/sqreen/rules_callbacks/record_request_context.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'sqreen/rule_callback'
+require 'sqreen/instrumentation'
+
+module Sqreen
+  module Rules
+    # Save request context for handling further down
+    class RecordRequestContext < RuleCB
+      def whitelisted?
+        false
+      end
+
+      def pre(_inst, *args, &_block)
+        framework.store_request(args[0])
+        wh = framework.whitelisted_match
+        if wh
+          unless Sqreen.features.key?('whitelisted_metric') &&
+                 !Sqreen.features['whitelisted_metric']
+            record_observation(Instrumentation::WHITELISTED_METRIC, wh, 1)
+          end
+          Sqreen.log.debug { "Request was whitelisted because of #{wh}" }
+        end
+        advise_action(nil)
+      end
+
+      def post(_rv, _inst, *_args, &_block)
+        framework.clean_request
+        advise_action(nil)
+      end
+
+      def failing(_exception, _inst, *_args, &_block)
+        framework.clean_request
+        advise_action(nil)
+      end
+    end
+  end
+end

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -0,0 +1,254 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'cgi'
+
+require 'sqreen/rule_callback'
+require 'sqreen/rules_callbacks/regexp_rule'
+
+# Sqreen module
+module Sqreen
+  # Sqreen rules
+  module Rules
+    # XSSCB abstract common behaviour of tpls
+    class XSSCB < RegexpRuleCB
+      # The remaining code is only to find out if user entry was an attack,
+      # and record it. Since we don't rely on it to respond to user, it would
+      # be better to do it in background.
+      def report_dangerous_xss?(value)
+        found = match_regexp(value)
+
+        return false unless found
+        infos = {
+          :found => found,
+          :payload => value,
+        }
+        record_event(infos)
+        true
+      end
+    end
+    class ReflectedUnsafeXSSCB < XSSCB
+      def pre(_inst, *args, &_block)
+        value = args[0]
+
+        return unless value.is_a?(String)
+
+        # Sqreen::log.debug value
+
+        return unless framework.params_include?(value)
+
+        Sqreen.log.debug { format('Found unescaped user param: %s', value) }
+
+        saved_value = value.dup
+        return unless report_dangerous_xss?(saved_value)
+
+        # potential XSS! let's escape
+        if block
+          args[0].replace(CGI.escape_html(value))
+        end
+
+        advise_action(nil)
+      end
+    end
+    # look for reflected XSS with erb template engine
+    class ReflectedXSSCB < XSSCB
+      def pre(_inst, *args, &_block)
+        value = args[0]
+
+        return unless value.is_a?(String)
+
+        # If the value is not marked as html_safe, it will be escaped later
+        return unless value.html_safe?
+
+        # Sqreen::log.debug value
+
+        return unless framework.params_include?(value)
+
+        Sqreen.log.debug { format('Found unescaped user param: %s', value) }
+
+        saved_value = value.dup
+        return unless report_dangerous_xss?(saved_value)
+
+        # potential XSS! let's escape
+        if block
+          args[0].replace(CGI.escape_html(value))
+        end
+
+        advise_action(nil)
+      end
+    end
+    # look for reflected XSS with haml template engine
+    # hook function arguments of
+    # Haml::Buffer.format_script(result, preserve_script, in_tag, preserve_tag,
+    #                            escape_html, nuke_inner_whitespace,
+    #                            interpolated, ugly)
+    class ReflectedXSSHamlCB < XSSCB
+      def post(ret, _inst, *_args, &_block)
+        value = ret
+        return if value.nil?
+
+        # Sqreen::log.debug value
+
+        return unless framework.full_params_include?(value)
+
+        Sqreen.log.debug { format('Found unescaped user param: %s', value) }
+
+        return unless value.is_a?(String)
+
+        return unless report_dangerous_xss?(value)
+
+        return unless block
+        # potential XSS! let's escape
+        advise_action(:override, :new_return_value => CGI.escape_html(value))
+      end
+    end
+
+    # Hook into haml4 script parser
+    class Haml4ParserScriptHookCB < RuleCB
+      def pre(_inst, *args, &_block)
+        return unless args.size > 1
+        return unless Haml::VERSION < '5'
+        text = args[0]
+        escape_html = args[1]
+        if escape_html == false &&
+           text.respond_to?(:include?) &&
+           !text.include?('html_escape')
+          args[0].replace("Sqreen.escape_haml((#{args[0]}))")
+        end
+        nil
+      end
+    end
+
+    # Hook into haml4 tag parser
+    class Haml4ParserTagHookCB < RuleCB
+      def post(ret, _inst, *_args, &_block)
+        return unless Haml::VERSION < '5'
+        tag = ret
+        if tag.value[:escape_html] == false &&
+           tag.value[:value].respond_to?(:include?) &&
+           !tag.value[:value].include?('html_escape')
+          tag.value[:value] = "Sqreen.escape_haml((#{tag.value[:value]}))"
+          return { :status => :override, :new_return_value => tag }
+        end
+        nil
+      end
+    end
+
+    class Haml4UtilInterpolationHookCB < RuleCB
+      def pre(_inst, *args, &_block)
+        # Also work in haml5
+        str = args[0]
+        escape_html = args[1]
+        # Original code from HAML tuned up to insert escape_haml call
+        res = ''
+        rest = Haml::Util.handle_interpolation str.dump do |scan|
+          escapes = (scan[2].size - 1) / 2
+          res << scan.matched[0...-3 - escapes]
+          if escapes.odd?
+            res << '#{'
+          else
+            content = eval('"' + Haml::Util.balance(scan, '{', '}', 1)[0][0...-1] + '"')
+            content = "Haml::Helpers.html_escape((#{content}))" if escape_html
+            res << '#{Sqreen.escape_haml((' + content + '))}' # Use eval to get rid of string escapes
+          end
+        end
+        { :status => :skip, :new_return_value => res + rest }
+      end
+    end
+
+    # Hook build attributes
+    class Haml4CompilerBuildAttributeCB < XSSCB
+      def pre(inst, *args, &_block)
+        return unless Haml::VERSION < '5'
+        attrs = args[-1]
+        new_attrs, found_xss = Haml4CompilerBuildAttributeCB.clean_hash_key(attrs) do |key|
+          if !key.nil? && key.is_a?(String) && framework.full_params_include?(key) && report_dangerous_xss?(key)
+            Sqreen.log.debug { format('Found unescaped user param: %s', key) }
+            [CGI.escape_html(key), true]
+          else
+            [key, false]
+          end
+        end
+
+        return if !found_xss || !block
+        # potential XSS! let's escape
+        args[-1] = new_attrs
+        r = inst.send(method, *args)
+        { :status => :skip, :new_return_value => r }
+      end
+
+      def self.clean_hash_key(hash, limit = 10, seen = [], &block)
+        seen << hash.object_id
+        has_xss = false
+        new_h = {}
+        return if limit <= 0
+        hash.each do |k, v|
+          if seen.include?(v.object_id)
+            new_h[k] = nil
+            next
+          end
+          seen << v.object_id
+          new_key, found_xss = yield k
+          has_xss |= found_xss
+          if v.is_a?(Hash)
+            new_h[new_key], found_xss = Haml4CompilerBuildAttributeCB.clean_hash_key(v, limit - 1, seen, &block)
+            has_xss |= found_xss
+          else
+            new_h[new_key] = v
+          end
+        end
+        [new_h, has_xss]
+      end
+    end
+
+    class Haml5EscapableHookCB < RuleCB
+      def pre(_inst, *args, &_block)
+        args[0] = "Sqreen.escape_haml((#{args[0]}))"
+        { :status => :modify_args, :args => args }
+      end
+    end
+
+    # Hook into temple template rendering
+    class TempleEscapableHookCB < RuleCB
+      def post(ret, _inst, *_args, &_block)
+        ret[1] = "Sqreen.escape_temple((#{ret[1]}))"
+        { :status => :override, :new_return_value => ret }
+      end
+    end
+
+    # Hook into temple template rendering
+    class SlimSplatBuilderCB < XSSCB
+      def pre(inst, *args, &_block)
+        value = args[0]
+        return if value.nil?
+
+        return unless framework.full_params_include?(value)
+
+        Sqreen.log.debug { format('Found unescaped user param: %s', value) }
+
+        return unless value.is_a?(String)
+
+        return unless report_dangerous_xss?(value)
+
+        return unless block
+        # potential XSS! let's escape
+        if block
+          args[0] = CGI.escape_html(value)
+          r = inst.send(method, *args)
+          return { :status => :skip, :new_return_value => r }
+        end
+        nil
+      end
+    end
+  end
+
+  # Escape HAML when instrumented to do it
+  def self.escape_haml(x)
+    x
+  end
+
+  # Escape Temple when instrumented to do it
+  def self.escape_temple(x)
+    x
+  end
+end