sqreen 1.18.2-java → 1.18.3-java

data/lib/sqreen/{rules_callbacks/blacklist_ips.rb → rules/blacklist_ips_cb.rb}

@@ -2,8 +2,9 @@
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'sqreen/trie'
+require 'sqreen/prefix'
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules
@@ -46,7 +47,7 @@ module Sqreen
       def find_blacklisted_ip(rip)
         begin
           ipa = IPAddr.new(rip)
-        rescue
+        rescue StandardError
           Sqreen.log.info "invalid IP address given by framework: #{rip}"
           return nil
         end

data/lib/sqreen/{rules_callbacks → rules}/count_http_codes.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/crawler_user_agent_matches.rb → rules/crawler_user_agent_matches_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/matcher_rule'
+require 'sqreen/rules/matcher_rule'
 require 'sqreen/frameworks'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/crawler_user_agent_matches_metrics.rb → rules/crawler_user_agent_matches_metrics_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/matcher_rule'
+require 'sqreen/rules/matcher_rule'
 require 'sqreen/frameworks'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/custom_error.rb → rules/custom_error_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/exception'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/devise_auth_track.rb → rules/devise_auth_track_cb.rb}

@@ -1,8 +1,8 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/devise_signup_track.rb → rules/devise_signup_track_cb.rb}

@@ -1,8 +1,8 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/execjs.rb → rules/execjs_cb.rb}

@@ -1,11 +1,10 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-
 require 'sqreen/js/js_service'
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/condition_evaluator'
 require 'sqreen/binding_accessor'
 require 'sqreen/events/remote_exception'
@@ -14,7 +13,6 @@ module Sqreen
   module Rules
     # Exec js callbacks
     class ExecJSCB < RuleCB
-
       class << self
         # @return [Sqreen::Js::JsService]
         def js_service
@@ -77,7 +75,7 @@ module Sqreen
         when NilClass
           false
         when Hash
-          ret.keys.each do |k|
+          ret.keys.each do |k| # rubocop:disable Performance/HashEachMethods
             ret[(begin
               k.to_sym
             rescue StandardError
@@ -119,7 +117,6 @@ module Sqreen
 
         # XXX: budgets was not subtracted from
         call_callback(name, budget, inst, new_ba_args, args, rv)
-
       rescue StandardError => e
         Sqreen.log.warn { "Caught JS callback exception: #{e.inspect}" }
         Sqreen.log.debug e.backtrace
@@ -127,10 +124,11 @@ module Sqreen
         nil
       end
 
-
-      def self.build_accessors(reqs)
-        reqs.map do |req|
-          BindingAccessor.new(req, true)
+      class << self
+        def build_accessors(reqs)
+          reqs.map do |req|
+            BindingAccessor.new(req, true)
+          end
         end
       end
 
@@ -176,10 +174,10 @@ module Sqreen
           next unless haystack_idx
 
           arguments[haystack_idx] = ArgumentFilter.hash_val_included(
-              arguments[needed_idx],
-              arguments[haystack_idx],
-              min_length.to_i,
-              MAX_DEPTH
+            arguments[needed_idx],
+            arguments[haystack_idx],
+            min_length.to_i,
+            MAX_DEPTH
           )
         end
 
@@ -193,7 +191,7 @@ module Sqreen
           next unless args_or_func.is_a?(Array)
           args_bas = args_or_func[0..-2] unless args_or_func.empty?
           @ba_expressions[name] =
-              ExecJSCB.build_accessors(args_bas).map(&:expression)
+            ExecJSCB.build_accessors(args_bas).map(&:expression)
         end
       end
 
@@ -212,47 +210,48 @@ module Sqreen
         end
       end
 
-      def self.hash_val_included(needed, haystack, min_length = 8, max_depth = 20)
-        new_obj = {}
-        insert = []
-        to_do = haystack.map { |k, v| [new_obj, k, v, 0] }
-        until to_do.empty?
-          where, key, value, deepness = to_do.pop
-          safe_key = key.is_a?(Integer) ? key : key.to_s
-          if value.is_a?(Hash) && deepness < max_depth
-            val = {}
-            insert << [where, safe_key, val]
-            to_do += value.map { |k, v| [val, k, v, deepness + 1] }
-          elsif value.is_a?(Array) && deepness < max_depth
-            val = []
-            insert << [where, safe_key, val]
-            i = -1
-            to_do += value.map { |v| [val, i += 1, v, deepness + 1] }
-          elsif deepness >= max_depth # if we are after max_depth don't try to filter
-            insert << [where, safe_key, value]
-          else
-            v = value.to_s
-            if v.size >= min_length && ConditionEvaluator.str_include?(needed.to_s, v)
-              case where
-              when Array
-                where << value
-              else
-                where[safe_key] = value
+      class << self
+        def hash_val_included(needed, haystack, min_length = 8, max_depth = 20)
+          new_obj = {}
+          insert = []
+          to_do = haystack.map { |k, v| [new_obj, k, v, 0] }
+          until to_do.empty?
+            where, key, value, deepness = to_do.pop
+            safe_key = key.is_a?(Integer) ? key : key.to_s
+            if value.is_a?(Hash) && deepness < max_depth
+              val = {}
+              insert << [where, safe_key, val]
+              to_do += value.map { |k, v| [val, k, v, deepness + 1] }
+            elsif value.is_a?(Array) && deepness < max_depth
+              val = []
+              insert << [where, safe_key, val]
+              i = -1
+              to_do += value.map { |v| [val, i += 1, v, deepness + 1] }
+            elsif deepness >= max_depth # if we are after max_depth don't try to filter
+              insert << [where, safe_key, value]
+            else
+              v = value.to_s
+              if v.size >= min_length && ConditionEvaluator.str_include?(needed.to_s, v)
+                case where
+                when Array
+                  where << value
+                else
+                  where[safe_key] = value
+                end
               end
             end
           end
-        end
-        insert.reverse.each do |wh, ikey, ival|
-          case wh
-          when Array
-            wh << ival unless ival.respond_to?(:empty?) && ival.empty?
-          else
-            wh[ikey] = ival unless ival.respond_to?(:empty?) && ival.empty?
+          insert.reverse.each do |wh, ikey, ival|
+            case wh
+            when Array
+              wh << ival unless ival.respond_to?(:empty?) && ival.empty?
+            else
+              wh[ikey] = ival unless ival.respond_to?(:empty?) && ival.empty?
+            end
           end
+          new_obj
         end
-        new_obj
       end
     end
   end
 end
-

data/lib/sqreen/{rules_callbacks/headers_insert.rb → rules/headers_insert_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks → rules}/matcher_rule.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules
@@ -13,7 +13,7 @@ module Sqreen
         res |= Regexp::MULTILINE  if options.include?('multiline')
         res |= Regexp::IGNORECASE unless case_sensitive
         r = Regexp.compile(value, res)
-        r.match('')
+        r =~ ''
         r
       end
 

data/lib/sqreen/{rules_callbacks/not_found.rb → rules/not_found_cb.rb}

@@ -1,5 +1,5 @@
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/rails_parameters.rb → rules/rails_parameters_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks → rules}/record_request_context.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/regexp_rule.rb → rules/regexp_rule_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rule_callback.rb → rules/rule_cb.rb}

@@ -1,11 +1,11 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/callbacks'
+require 'sqreen/framework_cb'
 require 'sqreen/context'
 require 'sqreen/conditionable'
 require 'sqreen/call_countable'
-require 'sqreen/rule_attributes'
+require 'sqreen/rules/attrs'
 require 'sqreen/events/attack'
 require 'sqreen/events/remote_exception'
 require 'sqreen/payload_creator'

data/lib/sqreen/{rules_callbacks → rules}/run_req_start_actions.rb

@@ -1,9 +1,11 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/actions'
 require 'sqreen/middleware'
+require 'sqreen/rails_middleware'
+require 'sqreen/sinatra_middleware'
 
 module Sqreen
   module Rules
@@ -14,7 +16,7 @@ module Sqreen
       def initialize(framework)
         if defined?(Sqreen::Frameworks::SinatraFramework) &&
            framework.is_a?(Sqreen::Frameworks::SinatraFramework)
-          super(Sinatra::ExtendedRack, :call)
+          super(Sqreen::SinatraMiddleware, :call)
         elsif defined?(Sqreen::Frameworks::RailsFramework) &&
               framework.is_a?(Sqreen::Frameworks::RailsFramework)
           super(Sqreen::RailsMiddleware, :call)

data/lib/sqreen/{rules_callbacks → rules}/run_user_actions.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/actions'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/shell_env.rb → rules/shell_env_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/sdk_signup_track.rb → rules/signup_track_cb.rb}

@@ -1,8 +1,8 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/rules/update_request_context.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/rules/rule_cb'
+
+module Sqreen
+  module Rules
+    class UpdateRequestContext < RuleCB
+      def initialize(*args)
+        super(*args)
+        @overtimeable = false
+      end
+
+      def pre(_inst, args, _budget = nil, &_block)
+        framework.store_request(args[0])
+        advise_action(nil)
+      end
+    end
+  end
+end

data/lib/sqreen/{rules_callbacks/url_matches.rb → rules/url_matches_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/user_agent_matches.rb → rules/user_agent_matches_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/waf.rb → rules/waf_cb.rb}

@@ -2,28 +2,21 @@
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'securerandom'
-require 'sqreen/rule_attributes'
+require 'sqreen/rules/attrs'
 require 'sqreen/binding_accessor'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 require 'sqreen/exception'
+require 'sqreen/util/capper'
+require 'sqreen/dependency/libsqreen'
 
 module Sqreen
   module Rules
     class WAFCB < RuleCB
       BUDGET_MAX = 5000
 
-      # TODO: move to Dependency
-      begin
-        require 'libsqreen'
-        @libsqreen = true
-      rescue LoadError
-        Sqreen.log.warn('libsqreen gem not found')
-        @libsqreen = false
-      end
-
       def self.libsqreen?
-        @libsqreen
+        Sqreen::Dependency::LibSqreen.required?
       end
 
       def self.waf?
@@ -37,7 +30,7 @@ module Sqreen
         @overtimeable = false
 
         unless WAFCB.libsqreen? && WAFCB.waf?
-          Sqreen.log.warn('libsqreen gem not found')
+          Sqreen.log.warn('libsqreen gem with waf not found')
           return
         end
 
@@ -72,7 +65,10 @@ module Sqreen
 
         env = [binding, framework, instance, args]
 
-        waf_args = Hash[binding_accessors.map { |e, b| [e, b.resolve(*env)] }]
+        capper = Sqreen::Util::Capper.new(string_size_cap: 4096, size_cap: 150, depth_cap: 10)
+        waf_args = binding_accessors.each_with_object({}) do |(e, b), h|
+          h[e] = capper.call(b.resolve(*env))
+        end
         waf_args = Sqreen::EncodingSanitizer.sanitize(waf_args)
         action, data = ::LibSqreen::WAF.run(waf_rule_name, waf_args, budget)