sqreen 1.18.2-java → 1.19.0-java

data/lib/sqreen/performance_notifications/binned_metrics.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/performance_notifications/log.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/performance_notifications/log_performance.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/performance_notifications/metrics.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/performance_notifications/newrelic.rb

@@ -1,3 +1,5 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/prefix.rb

@@ -0,0 +1,35 @@
+# typed: false
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'ipaddr'
+
+# TODO: move to Sqreen::IP
+
+module Sqreen
+  Prefix = Struct.new(:family, :bitlen, :address, :data) do # addr is integer
+    def initialize(*args)
+      super
+      raise ArgumentError, 'no family given' unless family
+      raise ArgumentError, 'no bitlen given' unless bitlen
+      raise ArgumentError, 'no address given' unless address
+    end
+
+    def matches?(address, family)
+      raise 'family mismatch' unless family == self.family
+      shift_amount = (family == Socket::AF_INET ? 32 : 128) - bitlen
+      (address ^ self.address) >> shift_amount == 0
+    end
+  end
+
+  def Prefix.from_str(str, data = nil)
+    ip_addr = IPAddr.new(str)
+    bitlen = if str =~ /\/(\d+)$/
+               $~[1].to_i
+             else
+               ip_addr.family == Socket::AF_INET6 ? 128 : 32
+             end
+    Prefix.new(ip_addr.family, bitlen, ip_addr.to_i, data)
+  end
+end

data/lib/sqreen/rails_middleware.rb

@@ -0,0 +1,16 @@
+# typed: true
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+module Sqreen
+  class RailsMiddleware
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      @app.call(env)
+    end
+  end
+end

data/lib/sqreen/remote_command.rb

@@ -1,8 +1,11 @@
+# typed: false
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'sqreen/log'
 require 'sqreen/events/remote_exception'
+require 'sqreen/remote_command/failure_output'
 
 module Sqreen
   # Execute and sanitize remote commands
@@ -21,14 +24,6 @@ module Sqreen
       :performance_budget => :change_performance_budget,
     }.freeze
 
-    # wraps output returned by a command that should also result in status: false
-    class FailureOutput
-      attr_reader :wrapped_output
-      def initialize(output)
-        @wrapped_output = output
-      end
-    end
-
     attr_reader :uuid
 
     def initialize(json_desc)

data/lib/sqreen/remote_command/failure_output.rb

@@ -0,0 +1,16 @@
+# typed: true
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+module Sqreen
+  class RemoteCommand
+    # wraps output returned by a command that should also result in status: false
+    class FailureOutput
+      attr_reader :wrapped_output
+      def initialize(output)
+        @wrapped_output = output
+      end
+    end
+  end
+end

data/lib/sqreen/rules.rb

@@ -1,10 +1,42 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'sqreen/log'
-require 'sqreen/rule_attributes'
-require 'sqreen/rules_callbacks'
+require 'sqreen/rules/attrs'
+
+require 'sqreen/rules/regexp_rule_cb'
+require 'sqreen/rules/matcher_rule'
+
+require 'sqreen/rules/record_request_context'
+require 'sqreen/rules/update_request_context'
+require 'sqreen/rules/rails_parameters_cb'
+
+require 'sqreen/rules/headers_insert_cb'
+require 'sqreen/rules/blacklist_ips_cb'
+
+require 'sqreen/rules/shell_env_cb'
+
+require 'sqreen/rules/url_matches_cb'
+require 'sqreen/rules/user_agent_matches_cb'
+require 'sqreen/rules/crawler_user_agent_matches_cb'
+
+require 'sqreen/rules/xss_cb'
+require 'sqreen/rules/execjs_cb'
+
+require 'sqreen/rules/binding_accessor_metrics'
+require 'sqreen/rules/binding_accessor_matcher_cb'
+require 'sqreen/rules/count_http_codes'
+require 'sqreen/rules/not_found_cb'
+require 'sqreen/rules/crawler_user_agent_matches_metrics_cb'
+require 'sqreen/rules/auth_track_cb'
+require 'sqreen/rules/signup_track_cb'
+require 'sqreen/rules/devise_auth_track_cb'
+require 'sqreen/rules/devise_signup_track_cb'
 
+require 'sqreen/rules/custom_error_cb'
+require 'sqreen/rules/waf_cb'
 
 ## Rules
 #

data/lib/sqreen/{rule_attributes.rb → rules/attrs.rb}

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/{rules_callbacks/sdk_auth_track.rb → rules/auth_track_cb.rb}

@@ -1,8 +1,10 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/binding_accessor_matcher.rb → rules/binding_accessor_matcher_cb.rb}

@@ -1,10 +1,12 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/binding_accessor'
 require 'sqreen/mono_time'
-require 'sqreen/rules_callbacks/matcher_rule'
+require 'sqreen/rules/matcher_rule'
 
 module Sqreen
   module Rules
@@ -49,9 +51,7 @@ module Sqreen
       end
 
       def pre(inst, args, budget = nil, &_block)
-        unless budget.nil?
-          finish = budget + Sqreen.time
-        end
+        finish = budget + Sqreen.time unless budget.nil?
         resol_cache = Hash.new do |hash, accessor|
           hash[accessor] = accessor.resolve(binding, framework, inst, args)
         end
@@ -62,9 +62,7 @@ module Sqreen
             next unless val.respond_to?(:each)
             next if val.respond_to?(:seek)
             val.each do |v|
-              if !budget.nil? && Sqreen.time > finish
-                return nil
-              end
+              return nil if !budget.nil? && Sqreen.time > finish
               next if !v.is_a?(String) || (!matcher.min_size.nil? && v.size < matcher.min_size)
               next if v.size > MAX_LENGTH
               next if matcher.match(v).nil?

data/lib/sqreen/{rules_callbacks → rules}/binding_accessor_metrics.rb

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/binding_accessor'
 require 'sqreen/events/remote_exception'
 

data/lib/sqreen/{rules_callbacks/blacklist_ips.rb → rules/blacklist_ips_cb.rb}

@@ -1,9 +1,12 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'sqreen/trie'
+require 'sqreen/prefix'
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules
@@ -46,7 +49,7 @@ module Sqreen
       def find_blacklisted_ip(rip)
         begin
           ipa = IPAddr.new(rip)
-        rescue
+        rescue StandardError
           Sqreen.log.info "invalid IP address given by framework: #{rip}"
           return nil
         end

data/lib/sqreen/{rules_callbacks → rules}/count_http_codes.rb

@@ -1,8 +1,10 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/crawler_user_agent_matches.rb → rules/crawler_user_agent_matches_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/matcher_rule'
+require 'sqreen/rules/matcher_rule'
 require 'sqreen/frameworks'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/crawler_user_agent_matches_metrics.rb → rules/crawler_user_agent_matches_metrics_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/matcher_rule'
+require 'sqreen/rules/matcher_rule'
 require 'sqreen/frameworks'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/custom_error.rb → rules/custom_error_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/exception'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/devise_auth_track.rb → rules/devise_auth_track_cb.rb}

@@ -1,8 +1,10 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/devise_signup_track.rb → rules/devise_signup_track_cb.rb}

@@ -1,8 +1,10 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/execjs.rb → rules/execjs_cb.rb}

@@ -1,11 +1,12 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-
 require 'sqreen/js/js_service'
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/condition_evaluator'
 require 'sqreen/binding_accessor'
 require 'sqreen/events/remote_exception'
@@ -14,7 +15,6 @@ module Sqreen
   module Rules
     # Exec js callbacks
     class ExecJSCB < RuleCB
-
       class << self
         # @return [Sqreen::Js::JsService]
         def js_service
@@ -77,7 +77,7 @@ module Sqreen
         when NilClass
           false
         when Hash
-          ret.keys.each do |k|
+          ret.keys.each do |k| # rubocop:disable Performance/HashEachMethods
             ret[(begin
               k.to_sym
             rescue StandardError
@@ -119,7 +119,6 @@ module Sqreen
 
         # XXX: budgets was not subtracted from
         call_callback(name, budget, inst, new_ba_args, args, rv)
-
       rescue StandardError => e
         Sqreen.log.warn { "Caught JS callback exception: #{e.inspect}" }
         Sqreen.log.debug e.backtrace
@@ -127,10 +126,11 @@ module Sqreen
         nil
       end
 
-
-      def self.build_accessors(reqs)
-        reqs.map do |req|
-          BindingAccessor.new(req, true)
+      class << self
+        def build_accessors(reqs)
+          reqs.map do |req|
+            BindingAccessor.new(req, true)
+          end
         end
       end
 
@@ -176,10 +176,10 @@ module Sqreen
           next unless haystack_idx
 
           arguments[haystack_idx] = ArgumentFilter.hash_val_included(
-              arguments[needed_idx],
-              arguments[haystack_idx],
-              min_length.to_i,
-              MAX_DEPTH
+            arguments[needed_idx],
+            arguments[haystack_idx],
+            min_length.to_i,
+            MAX_DEPTH
           )
         end
 
@@ -193,7 +193,7 @@ module Sqreen
           next unless args_or_func.is_a?(Array)
           args_bas = args_or_func[0..-2] unless args_or_func.empty?
           @ba_expressions[name] =
-              ExecJSCB.build_accessors(args_bas).map(&:expression)
+            ExecJSCB.build_accessors(args_bas).map(&:expression)
         end
       end
 
@@ -212,47 +212,48 @@ module Sqreen
         end
       end
 
-      def self.hash_val_included(needed, haystack, min_length = 8, max_depth = 20)
-        new_obj = {}
-        insert = []
-        to_do = haystack.map { |k, v| [new_obj, k, v, 0] }
-        until to_do.empty?
-          where, key, value, deepness = to_do.pop
-          safe_key = key.is_a?(Integer) ? key : key.to_s
-          if value.is_a?(Hash) && deepness < max_depth
-            val = {}
-            insert << [where, safe_key, val]
-            to_do += value.map { |k, v| [val, k, v, deepness + 1] }
-          elsif value.is_a?(Array) && deepness < max_depth
-            val = []
-            insert << [where, safe_key, val]
-            i = -1
-            to_do += value.map { |v| [val, i += 1, v, deepness + 1] }
-          elsif deepness >= max_depth # if we are after max_depth don't try to filter
-            insert << [where, safe_key, value]
-          else
-            v = value.to_s
-            if v.size >= min_length && ConditionEvaluator.str_include?(needed.to_s, v)
-              case where
-              when Array
-                where << value
-              else
-                where[safe_key] = value
+      class << self
+        def hash_val_included(needed, haystack, min_length = 8, max_depth = 20)
+          new_obj = {}
+          insert = []
+          to_do = haystack.map { |k, v| [new_obj, k, v, 0] }
+          until to_do.empty?
+            where, key, value, deepness = to_do.pop
+            safe_key = key.is_a?(Integer) ? key : key.to_s
+            if value.is_a?(Hash) && deepness < max_depth
+              val = {}
+              insert << [where, safe_key, val]
+              to_do += value.map { |k, v| [val, k, v, deepness + 1] }
+            elsif value.is_a?(Array) && deepness < max_depth
+              val = []
+              insert << [where, safe_key, val]
+              i = -1
+              to_do += value.map { |v| [val, i += 1, v, deepness + 1] }
+            elsif deepness >= max_depth # if we are after max_depth don't try to filter
+              insert << [where, safe_key, value]
+            else
+              v = value.to_s
+              if v.size >= min_length && ConditionEvaluator.str_include?(needed.to_s, v)
+                case where
+                when Array
+                  where << value
+                else
+                  where[safe_key] = value
+                end
               end
             end
           end
-        end
-        insert.reverse.each do |wh, ikey, ival|
-          case wh
-          when Array
-            wh << ival unless ival.respond_to?(:empty?) && ival.empty?
-          else
-            wh[ikey] = ival unless ival.respond_to?(:empty?) && ival.empty?
+          insert.reverse.each do |wh, ikey, ival|
+            case wh
+            when Array
+              wh << ival unless ival.respond_to?(:empty?) && ival.empty?
+            else
+              wh[ikey] = ival unless ival.respond_to?(:empty?) && ival.empty?
+            end
           end
+          new_obj
         end
-        new_obj
       end
     end
   end
 end
-