sqreen-alt 1.13.2 → 1.13.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 390a6c7aa22959172222bef67bb4ffe94f9fe1f4af68c3b1030af93ead0f0cc9
-  data.tar.gz: 8563438c45ca98f93b23212dcefc282657be40b671b4cda5f61fdf05a917b3f6
+  metadata.gz: b7a897cefdb6a040f3833e14b4588c9f93a91e066b2e81f09c2e31b8ed93f06f
+  data.tar.gz: ce62d2759be30d1ff96e5c90d7a1e96d28ea38c7a9a88b9487b80aeb7106e07e
 SHA512:
-  metadata.gz: 4bf966912dd3ed3138cbacc52c4f20ead4b789e72169a934a8b5c92206301881a4c1524e05fa37907894fae47c11dd530ad850d2688cd1ecbeb6b8cfea3898df
-  data.tar.gz: 1094f169ae8983d2119dbc3506961cfc9bb6beed401f270d16c54ceda02d32f95164b9ffbbd4e4fb7657882c27511ea37f20e8234d37942f592a184b4c94382b
+  metadata.gz: 4c944e628dcfaaef7c6102cb8ce7bcf5455537e5a8fb0f3be435b59c531a173e4e4976acf028bccfafe9e9b51cf74bfc56d4b803063fd8cae12d1f74493528a5
+  data.tar.gz: 90f5b62eccafc3c19018333011cde0c9543cee3b92e92f57fec2749cada564d808e179c13d53fa75787b3344c603a679dfccb6e6020e55a403004967bb3e5db3

data/lib/sqreen/configuration.rb

@@ -51,6 +51,8 @@ module Sqreen
       :default => nil },
     { :env => :SQREEN_IP_HEADER, :name => :ip_header,
       :default => nil },
+    { :env => :SQREEN_STRIP_SENSITIVE_DATA, :name => :strip_sensitive_data,
+      :default => true, :convert => :to_bool },
 
   ].freeze
 

data/lib/sqreen/events/request_record.rb

@@ -52,8 +52,14 @@ module Sqreen
       else
         res[:request] = {}
       end
+
       res[:request][:parameters] = payload['params'] if payload['params']
       res[:request][:headers] = payload['headers'] if payload['headers']
+
+      if Sqreen.config_get(:strip_sensitive_data)
+        res[:request] = SensitiveDataRedactor.redact(res[:request])
+      end
+
       res
     end
 
@@ -96,4 +102,31 @@ module Sqreen
       nil
     end
   end
+
+  # For redacting sensitive data and avoid having it sent to our servers
+  class SensitiveDataRedactor
+    SENSITIVE_KEYS = Set.new(%w[password secret passwd authorization api_key apikey access_token]).freeze
+    MASK = '<Redacted by Sqreen>'.freeze
+    REGEX = /\A(?:\d[ -]*?){13,16}\z/
+
+    def self.redact(obj)
+      case obj
+      when String
+        return MASK if obj =~ REGEX
+
+      when Array
+        return obj.map(&method(:redact))
+
+      when Hash
+        return Hash[
+          obj.map do |k, v|
+            ck = k.is_a?(String) ? k.downcase : k
+            [k, SENSITIVE_KEYS.include?(ck) ? MASK : redact(v)]
+          end
+        ]
+      end
+
+      obj
+    end
+  end
 end

data/lib/sqreen/frameworks/generic.rb

@@ -393,6 +393,7 @@ module Sqreen
           each_key_value_for_hash(p) do |value|
             next unless value.is_a?(String)
             next if value.size < 5
+            value = value.force_encoding(Encoding::ISO_8859_1).encode(Encoding::UTF_8) unless value.valid_encoding?
             next if regexp && !regexp.match?(value)
             parm << value
           end
@@ -410,6 +411,7 @@ module Sqreen
           each_key_value_for_hash(p) do |value|
             next unless value.is_a?(String)
             next if value.size < 5
+            value = value.force_encoding(Encoding::ISO_8859_1).encode(Encoding::UTF_8) unless value.valid_encoding?
             next if regexp && !regexp.match(value)
             parm << value
           end

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -140,7 +140,8 @@ module Sqreen
         tag = ret
         if tag.value[:escape_html] == false &&
            tag.value[:value].respond_to?(:include?) &&
-           !tag.value[:value].include?('html_escape')
+           !tag.value[:value].include?('html_escape') &&
+            tag.value[:parse] == true
           tag.value[:value] = "Sqreen.escape_haml((#{tag.value[:value]}))"
           return { :status => :override, :new_return_value => tag }
         end

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.13.2'.freeze
+  VERSION = '1.13.4'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen-alt
 version: !ruby/object:Gem::Version
-  version: 1.13.2
+  version: 1.13.4
 platform: ruby
 authors:
 - Sqreen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-23 00:00:00.000000000 Z
+date: 2018-08-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs