sqreen 1.18.2-java → 1.19.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 06bc081efdb3dd498597a1d2a044b3ced504afd9f30d3eaf7924949fadbde242
-  data.tar.gz: 6870982f1abd957f3f676533698d9d0e74aa5b367773622b37e15793982b5287
+  metadata.gz: 5082d08022b3f107ae50c29fb9f0846ca7398bc3544dc5ee0594a5c0a4d74e72
+  data.tar.gz: a7b3e4d7ab8b5c504b9a460e0504eded5acf96a9dfa4dc9655708205540f00bd
 SHA512:
-  metadata.gz: 89323033681f35c0d1e99675d5a26dd439741b35a9a2a299c881e3e2cbc8c61fbaaf520af47e263f9dfcb6ae57c919b32573106bc3761a1c7268a90f2b930d30
-  data.tar.gz: f2fb38415d5729ea35895997c92651fd0ce6a27865622d3d9ece3ca94c0b2dab33647afd1105aa865a03493f5e9bf78cf97c1f6acede67b775c7a8c7966ce7f7
+  metadata.gz: 393969dbf38bf2ea63688500f4c1902454a0489238c00fd1d11bebfa21017b1d320936b4b2e2871e9477aaaaf23690042d594de1f2fdb1518a4bab8c2b283ee4
+  data.tar.gz: ee617d28aa7f4822dc5c0ad9afbc5562c4550a50aa32a4be937787ae3cef3b7e48acdbc278a9fe8a5ee9ee4bb31266075e92b5401e678024faf939115b734c43

data/CHANGELOG.md

@@ -1,3 +1,38 @@
+## 1.19.0
+
+* Upgrade WAF features via libsqreen 0.6.1
+* Improve time defensiveness in WAF
+* Improve compatibility with APM agents via a new optional instrumentation engine
+* Fix action reloading not being entirely cleared on reload
+* Improve handling of hash symbol keys in some security rules
+* Fix constant resolution scope on agent boot
+
+## 1.18.6
+
+* Improve default WAF time budget handling logic
+
+## 1.18.5
+
+* Fix type mismatch in WAF time budget handling
+* Improve exception handling for non-WAF errors within WAF
+
+## 1.18.4
+
+* Fix instrumentation conflict when a class defines a send method
+* Fix compatibility with Sorbet type checker
+* Improve WAF time budget handling
+
+## 1.18.3
+
+* Improve PII protection
+* Improve performance on sizeable request payloads
+* Improve handling of Rails without a database
+* Improve compatibility with Rack and Sinatra middlewares
+* Support JSON payloads with rack-contrib PostBodyContentParser
+* Add libsqreen toggle to configuration
+* Prepare for Ruby 2.7 support
+* Include license file in gem
+
 ## 1.18.2
 
 * Improve internal WAF error reporting

data/LICENSE

@@ -0,0 +1,3 @@
+Sqreen for Ruby is free-to-use, proprietary software.
+
+Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions.rb

@@ -1,51 +1,28 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'ipaddr'
-require 'sqreen/trie'
-require 'sqreen/log'
-require 'sqreen/exception'
-require 'sqreen/sdk'
-require 'sqreen/frameworks'
-require 'singleton'
+require 'sqreen/actions/unknown_action_type'
+require 'sqreen/actions/base'
+
+require 'sqreen/actions/block_user'
+require 'sqreen/actions/redirect_user'
+require 'sqreen/actions/block_ip'
+require 'sqreen/actions/redirect_ip'
+require 'sqreen/actions/repository'
+require 'sqreen/actions/unknown_action_type'
 
 module Sqreen
   # Implements actions (behavior taken in response to agent signals)
   module Actions
-    # Exception for when an unknown action type is gotten from the server
-    class UnknownActionType < ::Sqreen::Exception
-      attr_reader :action_type
-      def initialize(action_type)
-        super("no such action type: #{action_type}. Must be one of #{Base.known_types}")
-        @action_type = action_type
-      end
-    end
-
-    # Where the currently loaded actions are stored. Singleton
-    class Repository
-      include Singleton
-
-      def add(params, action)
-        action.class.index(params || {}, action)
-      end
-
-      def get(action_class, key)
-        action_class = Base.get_type_class(action_class) unless action_class.class == Class
-        action_class.actions_matching key
-      end
-
-      def clear
-        Base.known_subclasses.each(&:clear)
-      end
-    end
-
     # @return [Sqreen::Actions::Base]
     def self.deserialize_action(hash)
       action_type = hash['action']
       raise 'no action type available' unless action_type
 
-      subclass = Base.get_type_class(action_type)
-      raise UnknownActionType, action_type unless subclass
+      subclass = Sqreen::Actions::Base.get_type_class(action_type)
+      raise Sqreen::Actions::UnknownActionType, action_type unless subclass
 
       id = hash['action_id']
       raise 'no action id available' unless id
@@ -63,306 +40,5 @@ module Sqreen
 
       subclass.new(id, opts, hash['parameters'] || {})
     end
-
-    # Base class for actions
-    # subclasses must also implement some methods in their singleton classes
-    # (actions_matching, index and clear)
-    class Base
-      attr_reader :id, :expiry, :send_response
-
-      def initialize(id, opts)
-        @id = id
-        duration = opts[:duration]
-        @expiry = Time.new + duration unless duration.nil?
-        @send_response = if opts[:send_response].nil?
-                           true
-                         else
-                           !!opts[:send_response]
-                         end
-      end
-
-      # See Sqreen::CB for return values
-      def run(*args)
-        return if expiry && Time.new > expiry
-        ret = do_run *args
-        unless ret.nil? || !@send_response
-          Sqreen.internal_track(event_name,
-                                'properties' => {
-                                  'output' => event_properties(*args),
-                                  'action_id' => id,
-                                })
-        end
-        ret
-      end
-
-      protected
-
-      def do_run(*_args)
-        raise ::Sqreen::NotImplementedYet, "do_run not implemented in #{self.class}"
-        # implement in subclasses
-      end
-
-      def event_properties(*_run_args)
-        raise ::Sqreen::NotImplementedYet, "event_properties not implemented in #{self.class}"
-        # implement in subclasses
-      end
-
-      private
-
-      def event_name
-        "sq.action.#{self.class.type_name}"
-      end
-
-      @@subclasses = {}
-      class << self
-        private :new
-
-        attr_reader :type_name
-
-        def get_type_class(name)
-          @@subclasses[name]
-        end
-
-        def known_subclasses
-          @@subclasses.values
-        end
-
-        def known_types
-          @@subclasses.keys
-        end
-
-        # all actions matching, possibly already expired
-        def actions_matching(_key)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def index(_params, _action)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def clear
-          raise 'implement in singletons of subclasses'
-        end
-
-        def inherited(subclass)
-          class << subclass
-            public :new
-          end
-        end
-
-        protected
-
-        def type_name=(name)
-          @type_name = name
-          @@subclasses[name] = self
-        end
-      end
-    end
-
-    module IpRangesIndex
-      def add_prefix(prefix_str, data)
-        @trie_v4 ||= Sqreen::Trie.new
-        @trie_v6 ||= Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
-        prefix = Sqreen::Prefix.from_str(prefix_str, data)
-        trie = prefix.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
-        trie.insert prefix
-      end
-
-      def matching_actions(client_ip)
-        parsed_ip = IPAddr.new(client_ip.gsub(/%[^%\/]+/, ''))
-        trie = parsed_ip.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
-        return [] unless trie
-        found = trie.search_matching(parsed_ip.to_i, parsed_ip.family)
-        return [] unless found.size > 0
-
-        Sqreen.log.debug("Client ip #{client_ip} matches #{found.inspect}")
-        found.map(&:data)
-      end
-
-      def clear
-        @trie_v4 = Sqreen::Trie.new
-        @trie_v6 = Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
-      end
-    end
-
-    module IpRangeIndexedActionClass
-      include IpRangesIndex
-
-      def actions_matching(client_ip)
-         matching_actions client_ip
-      end
-
-      def index(params, action)
-        ranges = parse_ip_ranges params
-
-        ranges.each do |r|
-          add_prefix r, action
-        end
-      end
-
-      private
-
-      # returns array of prefixes in string form
-      def parse_ip_ranges(params)
-        ranges = params['ip_cidr']
-        unless ranges && ranges.is_a?(Array) && !ranges.empty?
-          raise 'no non-empty ip_cidr array present'
-        end
-
-        ranges
-      end
-    end
-
-    # Block a list of IP address ranges. Standard "raise" behavior.
-    class BlockIp < Base
-      extend IpRangeIndexedActionClass
-
-      self.type_name = 'block_ip'
-
-      def initialize(id, opts, params = {})
-        # no need to store the ranges for this action, the index filter the class
-        super(id, opts)
-      end
-
-      def do_run(client_ip)
-        e = Sqreen::AttackBlocked.new("Blocked client's IP #{client_ip} " \
-          "(action: #{id}). No action is required")
-        { :status => :raise, :exception => e, :skip_rem_cbs => true }
-      end
-
-      def event_properties(client_ip)
-        { 'ip_address' => client_ip }
-      end
-    end
-
-    # Block a list of IP address ranges by forcefully redirecting the user
-    # to a specific URL.
-    class RedirectIp < Base
-      extend IpRangeIndexedActionClass
-
-      self.type_name = 'redirect_ip'
-
-      attr_reader :redirect_url
-
-      def initialize(id, opts, params = {})
-        super(id, opts)
-        @redirect_url = params['url']
-        raise "no url provided for action #{id}" unless @redirect_url
-      end
-
-      def do_run(client_ip)
-        Sqreen.log.info "Will request redirect for client with IP #{client_ip} " \
-          "(action: #{id})."
-        {
-          :status => :skip,
-          :new_return_value => [303, { 'Location' => @redirect_url }, ['']],
-          :skip_rem_cbs => true,
-        }
-      end
-
-      def event_properties(client_ip)
-        { 'ip_address' => client_ip, 'url' => @redirect_url }
-      end
-    end
-
-    module UserActionClass
-      def actions_matching(identity_params)
-        return [] unless @idx
-        key = stringify_keys(identity_params)
-        actions = @idx[key]
-        actions || []
-      end
-
-      def index(params, action)
-        @idx ||= {}
-        users = params['users']
-        raise ::Sqreen::Exception, 'nil "users" param for block_user action' if users.nil?
-        raise ::Sqreen::Exception, '"users" param must be an array' unless users.is_a? Array
-
-        users.each do |u|
-          @idx[u] ||= []
-          @idx[u] << action
-        end
-      end
-
-      def clear
-        @idx = {}
-      end
-
-      private
-
-      def stringify_keys(hash)
-        Hash[
-          hash.map { |k, v| [k.to_s, v] }
-        ]
-      end
-    end
-
-    # Blocks a user at the point Sqreen::identify()
-    # or Sqreen::auth_track() are called
-    class BlockUser < Base
-      extend UserActionClass
-
-      self.type_name = 'block_user'
-
-      def initialize(id, opts, params = {})
-        super(id, opts)
-      end
-
-      def do_run(identity_params)
-        Sqreen.log.info(
-          "Will raise due to user being blocked by action #{id}. " \
-          "Blocked user identity: #{identity_params}"
-        )
-
-        e = Sqreen::AttackBlocked.new(
-          "Blocked user with identity #{identity_params} " \
-          'due to automatic security response. No action is required'
-        )
-
-        {
-          :status => :raise,
-          :exception => e,
-        }
-      end
-
-      def event_properties(identity_params)
-        { 'user' => identity_params }
-      end
-    end
-
-    # Redirects a user at the point Sqreen::identify()
-    # or Sqreen::auth_track() are called
-    class RedirectUser < Base
-      extend UserActionClass
-
-      self.type_name = 'redirect_user'
-
-      def initialize(id, opts, params = {})
-        super(id, opts)
-        @redirect_url = params['url']
-        raise "no url provided for action #{id}" unless @redirect_url
-      end
-
-      def do_run(identity_params)
-        Sqreen.log.info 'Will request redirect for user with identity ' \
-          "#{identity_params} (action: #{id})."
-
-        e = Sqreen::AttackBlocked.new(
-          "Redirected user with identity #{identity_params} " \
-          'due to automatic security response. No action is required'
-        )
-        e.redirect_url = @redirect_url
-
-        {
-          :status => :raise,
-          :exception => e,
-        }
-      end
-
-      def event_properties(identity_params)
-        { 'user' => identity_params }
-      end
-    end
   end
 end

data/lib/sqreen/actions/actions_index.rb

@@ -0,0 +1,16 @@
+# typed: true
+module Sqreen
+  module Actions
+    # documents the operations an actions index should implement
+    class ActionsIndex
+      # all actions matching, possibly already expired
+      def actions_matching(_key)
+        raise 'implement in subclasses'
+      end
+
+      def index(_params, _action)
+        raise 'implement in subclasses'
+      end
+    end
+  end
+end