sqreen 1.13.2-java → 1.13.4-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 18abfc3db56502d7447f673f0e79ad135ba5246b
-  data.tar.gz: 688b156e32f26224128fedcc4aaf3bd37b7df279
+  metadata.gz: 2d9abe0c770383b57205c2eb661c33ed286ed18a
+  data.tar.gz: d802f183cc3fe90149eb1e1ccce5faba70be653d
 SHA512:
-  metadata.gz: ad3ab2d5c7b748bd7767654687de8ab1655de2f55abd84b32713da49d7d423ece161978fd7b86149ec977ea01b31ad110bb1a2dabe6bc1c87d3e6d722a42a63f
-  data.tar.gz: e9bf1fdd0924cea32abcf0dc887b4471d671fc5215a6e668240e3c9f58610cf2d571102f6e9a9e8c63b7a9115cacd954fa1e9bde20b5d01cbc321e77bd29e937
+  metadata.gz: c4f72bc138efcde980f98924266e8dd861a46aadf2221a0e17a8520c6066bfa921c8cfdf5407143b8c8a20fa0340ced7dd02a784ea62fc86fd3079902b9de909
+  data.tar.gz: cbb3d0a5123068c0e23739d4261b731917d4ce77c9c8ceac854610b9df39b994bfe69ca23a23148a2346f7644fa4452cea468ae8737d1ff27213afe991f625bd

data/lib/sqreen/configuration.rb

@@ -51,6 +51,8 @@ module Sqreen
       :default => nil },
     { :env => :SQREEN_IP_HEADER, :name => :ip_header,
       :default => nil },
+    { :env => :SQREEN_STRIP_SENSITIVE_DATA, :name => :strip_sensitive_data,
+      :default => true, :convert => :to_bool },
 
   ].freeze
 

data/lib/sqreen/events/request_record.rb

@@ -52,8 +52,14 @@ module Sqreen
       else
         res[:request] = {}
       end
+
       res[:request][:parameters] = payload['params'] if payload['params']
       res[:request][:headers] = payload['headers'] if payload['headers']
+
+      if Sqreen.config_get(:strip_sensitive_data)
+        res[:request] = SensitiveDataRedactor.redact(res[:request])
+      end
+
       res
     end
 
@@ -96,4 +102,31 @@ module Sqreen
       nil
     end
   end
+
+  # For redacting sensitive data and avoid having it sent to our servers
+  class SensitiveDataRedactor
+    SENSITIVE_KEYS = Set.new(%w[password secret passwd authorization api_key apikey access_token]).freeze
+    MASK = '<Redacted by Sqreen>'.freeze
+    REGEX = /\A(?:\d[ -]*?){13,16}\z/
+
+    def self.redact(obj)
+      case obj
+      when String
+        return MASK if obj =~ REGEX
+
+      when Array
+        return obj.map(&method(:redact))
+
+      when Hash
+        return Hash[
+          obj.map do |k, v|
+            ck = k.is_a?(String) ? k.downcase : k
+            [k, SENSITIVE_KEYS.include?(ck) ? MASK : redact(v)]
+          end
+        ]
+      end
+
+      obj
+    end
+  end
 end

data/lib/sqreen/frameworks/generic.rb

@@ -393,6 +393,7 @@ module Sqreen
           each_key_value_for_hash(p) do |value|
             next unless value.is_a?(String)
             next if value.size < 5
+            value = value.force_encoding(Encoding::ISO_8859_1).encode(Encoding::UTF_8) unless value.valid_encoding?
             next if regexp && !regexp.match?(value)
             parm << value
           end
@@ -410,6 +411,7 @@ module Sqreen
           each_key_value_for_hash(p) do |value|
             next unless value.is_a?(String)
             next if value.size < 5
+            value = value.force_encoding(Encoding::ISO_8859_1).encode(Encoding::UTF_8) unless value.valid_encoding?
             next if regexp && !regexp.match(value)
             parm << value
           end

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -140,7 +140,8 @@ module Sqreen
         tag = ret
         if tag.value[:escape_html] == false &&
            tag.value[:value].respond_to?(:include?) &&
-           !tag.value[:value].include?('html_escape')
+           !tag.value[:value].include?('html_escape') &&
+            tag.value[:parse] == true
           tag.value[:value] = "Sqreen.escape_haml((#{tag.value[:value]}))"
           return { :status => :override, :new_return_value => tag }
         end

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.13.2'.freeze
+  VERSION = '1.13.4'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.13.2
+  version: 1.13.4
 platform: java
 authors:
 - Sqreen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-07-23 00:00:00.000000000 Z
+date: 2018-08-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement