sqreen 1.14.1 → 1.14.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a44b9da6464b0a61db469f75d4b2ff4409aaa60c994c5770b30067c374fbf5c4
-  data.tar.gz: c8f6c266dc33f646c647dd614706acc496c8140325fc03b1401f1d0151750cdf
+  metadata.gz: 1e50a974c4a6de258f73e1f7a99ad000a87a9a78a3a439211cba1aceaa08d44c
+  data.tar.gz: b2b6d9f85d26270b242febf553ae0311ecb923faa36ea840e03e5dc747f7c1b8
 SHA512:
-  metadata.gz: e610db595536d1370a6f4c56da23dc2144332fba297f65b1e64187d53a535857e9bb6769fd4653f8fe18d866fa2b96d93641f02d51c067ca0012bcfe9820029d
-  data.tar.gz: 618f2a1454edab5fe1df062506c3cdb766e32579ae7874fb47f938e53d326a463415b7729c275aded79f2cb073b1c7b13c1af6f4ed6c628b496445d6bd7cdd65
+  metadata.gz: 22f29bcd92e5f4a0e91422ec1490b8e3c32f9f0254d0fdaf1337a3b3a0f1f1b664b5e079449b382b722b0209acecf80d6677b9d6f7232c5985b34f567aaf94ca
+  data.tar.gz: a52c91b15cd6d5c56e8167b2ca05f1fa65aa929b43671bbbfe54d0047f536750d8500ed69c76671958f224253c741ce2069b1adb59d875ff428ede4f2c760116

data/lib/sqreen.rb

@@ -17,6 +17,10 @@ require 'thread'
 # Auto start the instrumentation.
 
 Sqreen.framework.on_start do |framework|
+  if RUBY_VERSION =~ /\A2\.5\.[01]\z/ && Sqreen.framework.on_pre_fork_preload?
+    STDERR.puts("Avoiding launching sqreen thread pre-fork") # sqreen log unavailable
+    next
+  end
   Thread.new do
     begin
       runner = nil

data/lib/sqreen/frameworks/generic.rb

@@ -422,6 +422,15 @@ module Sqreen
         end
       end
 
+      def on_pre_fork_preload?
+        # unlike with worker_fork_detection, we can't be instrument Puma::Cluster
+        # in time for intercepting run
+        stack = Kernel.caller_locations
+
+        puma_preload?(stack) || unicorn_preload?(stack)
+      end
+
+
       protected
 
       # Is this a whitelisted path?
@@ -519,6 +528,7 @@ module Sqreen
         Sqreen.log.warn "Failed ignoring AttackBlocked on NewRelic: #{e.inspect}"
       end
 
+      # if it doesn't detect the fork it's not a problem
       def worker_fork_detection
         # only Puma currently supported
         return unless defined?(Puma::Cluster) && Puma::Cluster.instance_methods.include?(:worker)
@@ -533,6 +543,22 @@ module Sqreen
 
       private
 
+      def puma_preload?(stack)
+        cluster_run = stack.each_with_index.find { |b, _i| b.path =~ /puma\/cluster\.rb\z/ && b.label == 'run' }
+        return false unless cluster_run
+        frame_atop = stack[cluster_run[1] - 1]
+        frame_atop.label == 'load_and_bind'
+      end
+
+      def unicorn_preload?(stack)
+        build_app = stack.each_with_index.find do |b, _i|
+          b.path =~ /unicorn\/http_server\.rb\z/ && b.label == 'build_app!'
+        end
+        return false unless build_app
+        frame_below = stack[build_app[1] + 1]
+        frame_below.label == 'start'
+      end
+
       def split_ip_addresses(ip_addresses)
         ip_addresses ? ip_addresses.strip.split(/[,\s]+/) : []
       end

data/lib/sqreen/js/execjs_adapter.rb

@@ -1,15 +1,26 @@
 require 'execjs'
+require 'weakref'
 
 module Sqreen
   module Js
     class ExecjsAdapter < JsServiceAdapter
-      def preprocess(_rule_name, code)
-        ExecJsRunnable.new(ExecJS.compile(code))
+      def preprocess(rule_name, code)
+        if thread_safe?
+          ExecJsRunnable.new(ExecJS.compile(code))
+        else
+          ThreadLocalExecJsRunnable.new(code)
+        end
       end
 
       def variant_name
         ExecJS.runtime.name + ' (ExecJS)'
       end
+
+      private
+
+      def thread_safe?
+        ExecJS.runtime.name != 'therubyrhino (Rhino)'
+      end
     end
 
     class ExecJsRunnable < ExecutableJs
@@ -21,5 +32,42 @@ module Sqreen
         @compiled.call(cbname, *arguments)
       end
     end
+
+    class ThreadLocalExecJsRunnable < ExecutableJs
+      def initialize(code)
+        @code = code
+        @tl_key = "SQREEN_EXECJS_CONTEXT_#{object_id}".freeze
+        @runtimes = [] # place where to keep strong references
+        @runtimes_mutex = Mutex.new
+      end
+
+      def run_js_cb(cbname, _budget, arguments)
+        tl_exec_js_runnable.call(cbname, *arguments)
+      end
+
+      def with_runtimes_mutex
+        @runtimes_mutex.synchronize { yield }
+      end
+
+      private
+
+      def dispose_from_dead_threads
+        with_runtimes_mutex do
+          @runtimes.delete_if { |th, _runtime| !th.alive? }
+        end
+      end
+
+      def tl_exec_js_runnable
+        runnable = Thread.current[@tl_key]
+        return runnable if runnable && runnable.weakref_alive?
+
+        dispose_from_dead_threads
+        runtime = ExecJS.compile(@code)
+        with_runtimes_mutex do
+          @runtimes << [Thread.current, runtime]
+        end
+        Thread.current[@tl_key] = WeakRef.new(runtime)
+      end
+    end
   end
 end

data/lib/sqreen/js/js_service.rb

@@ -5,7 +5,7 @@ module Sqreen
     # start public interface
 
     class JsService
-      include Singleton
+      include ::Singleton
 
       def initialize
         detect_adapter
@@ -75,7 +75,7 @@ module Sqreen
     # end public interface
 
     class JsServiceAdapter
-      def preprocess(code)
+      def preprocess(rule_name, code)
         raise Sqreen::NotImplementedYet
       end
 

data/lib/sqreen/js/mini_racer_adapter.rb

@@ -1,4 +1,5 @@
 require 'weakref'
+require 'sqreen/runner' # for Sqreen.on_forked_worker?
 
 module Sqreen
   module Js
@@ -63,8 +64,9 @@ module Sqreen
 
         mini_racer_context[:c] += 1
         begin
+          json_args = "[#{arguments.map(&method(:fixup_bad_encoding)).map(&:to_json).join(',')}]"
           mini_racer_context[:r].eval_unsafe(
-              "#{cb_name}.apply(this, #{::JSON.generate(arguments)})", nil, budget)
+              "#{cb_name}.apply(this, #{json_args})", nil, budget)
         rescue @module::ScriptTerminatedError
           nil
         end
@@ -72,6 +74,23 @@ module Sqreen
 
       private
 
+      def fixup_bad_encoding(arg)
+        # NOTE: we don't fix encoding problems in deeper structures
+        return arg unless arg.is_a?(String)
+        unless arg.valid_encoding?
+          return arg.dup.force_encoding(Encoding::ISO_8859_1)
+        end
+
+        # encoding is valid if it reaches this point
+        return arg if arg.encoding == Encoding::UTF_8
+
+        begin
+          arg.encode(Encoding::UTF_8)
+        rescue Encoding::UndefinedConversionError
+          arg.dup.force_encoding(Encoding::ISO_8859_1)
+        end
+      end
+
       def snapshot
         @snapshot ||= @module::Snapshot.new(@source)
       end

data/lib/sqreen/performance_notifications/binned_metrics.rb

@@ -58,6 +58,8 @@ module Sqreen
 
         finish_time = SQREEN_MONO_TIME ? Time.now.utc : finish
         time_millis = (finish - start) * 1000
+        # Ensure we always have a timings if we somehow missed the request start
+        SharedStorage[:sqreen_request_time] ||= 0
         SharedStorage[:sqreen_request_time] += time_millis
         metrics_store.update(metric_name, finish_time, nil, time_millis)
       end

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.14.1'.freeze
+  VERSION = '1.14.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.14.1
+  version: 1.14.2
 platform: ruby
 authors:
 - Sqreen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-09-21 00:00:00.000000000 Z
+date: 2018-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sq_mini_racer
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.0.beta3
+        version: 0.2.2.sqreen1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.0.beta3
+        version: 0.2.2.sqreen1
 description: Sqreen is a SaaS based Application protection and monitoring platform
   that integrates directly into your Ruby applications. Learn more at https://sqreen.io.
 email: contact@sqreen.io