sqreen 1.18.2-java → 1.19.0-java

data/lib/sqreen/{rules_callbacks/headers_insert.rb → rules/headers_insert_cb.rb}

@@ -1,12 +1,19 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules
     # Display sqreen presence
     class HeadersInsertCB < RuleCB
+      def initialize(*args)
+        super
+        @overtimeable = false
+      end
+
       def post(rv, _inst, _args, _budget = nil, &_block)
         return unless rv && rv.respond_to?(:[]) && rv[1].is_a?(Hash)
         return nil unless @data

data/lib/sqreen/{rules_callbacks → rules}/matcher_rule.rb

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules
@@ -13,7 +15,7 @@ module Sqreen
         res |= Regexp::MULTILINE  if options.include?('multiline')
         res |= Regexp::IGNORECASE unless case_sensitive
         r = Regexp.compile(value, res)
-        r.match('')
+        r =~ ''
         r
       end
 

data/lib/sqreen/{rules_callbacks/not_found.rb → rules/not_found_cb.rb}

@@ -1,5 +1,10 @@
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/rails_parameters.rb → rules/rails_parameters_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks → rules}/record_request_context.rb

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/regexp_rule.rb → rules/regexp_rule_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rule_callback.rb → rules/rule_cb.rb}

@@ -1,11 +1,13 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/callbacks'
+require 'sqreen/framework_cb'
 require 'sqreen/context'
 require 'sqreen/conditionable'
 require 'sqreen/call_countable'
-require 'sqreen/rule_attributes'
+require 'sqreen/rules/attrs'
 require 'sqreen/events/attack'
 require 'sqreen/events/remote_exception'
 require 'sqreen/payload_creator'

data/lib/sqreen/{rules_callbacks → rules}/run_req_start_actions.rb

@@ -1,9 +1,13 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/actions'
 require 'sqreen/middleware'
+require 'sqreen/rails_middleware'
+require 'sqreen/sinatra_middleware'
 
 module Sqreen
   module Rules
@@ -14,7 +18,7 @@ module Sqreen
       def initialize(framework)
         if defined?(Sqreen::Frameworks::SinatraFramework) &&
            framework.is_a?(Sqreen::Frameworks::SinatraFramework)
-          super(Sinatra::ExtendedRack, :call)
+          super(Sqreen::SinatraMiddleware, :call)
         elsif defined?(Sqreen::Frameworks::RailsFramework) &&
               framework.is_a?(Sqreen::Frameworks::RailsFramework)
           super(Sqreen::RailsMiddleware, :call)
@@ -60,7 +64,7 @@ module Sqreen
 
       # @return [Sqreen::Actions::Repository]
       def actions_repo
-        Sqreen::Actions::Repository.instance
+        Sqreen::Actions::Repository.current
       end
     end
   end

data/lib/sqreen/{rules_callbacks → rules}/run_user_actions.rb

@@ -1,7 +1,9 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/actions'
 
 module Sqreen
@@ -28,7 +30,7 @@ module Sqreen
 
       # @return [Sqreen::Actions::Repository]
       def actions_repo
-        Sqreen::Actions::Repository.instance
+        Sqreen::Actions::Repository.current
       end
     end
   end

data/lib/sqreen/{rules_callbacks/shell_env.rb → rules/shell_env_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/sdk_signup_track.rb → rules/signup_track_cb.rb}

@@ -1,8 +1,10 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/rules/update_request_context.rb

@@ -0,0 +1,22 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/rules/rule_cb'
+
+module Sqreen
+  module Rules
+    class UpdateRequestContext < RuleCB
+      def initialize(*args)
+        super(*args)
+        @overtimeable = false
+      end
+
+      def pre(_inst, args, _budget = nil, &_block)
+        framework.store_request(args[0])
+        advise_action(nil)
+      end
+    end
+  end
+end

data/lib/sqreen/{rules_callbacks/url_matches.rb → rules/url_matches_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/user_agent_matches.rb → rules/user_agent_matches_cb.rb}

@@ -1,7 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/waf.rb → rules/waf_cb.rb}

@@ -1,43 +1,42 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'securerandom'
-require 'sqreen/rule_attributes'
+require 'sqreen/rules/attrs'
 require 'sqreen/binding_accessor'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 require 'sqreen/exception'
+require 'sqreen/util/capper'
+require 'sqreen/dependency/libsqreen'
+require 'sqreen/encoding_sanitizer'
 
 module Sqreen
   module Rules
     class WAFCB < RuleCB
-      BUDGET_MAX = 5000
-
-      # TODO: move to Dependency
-      begin
-        require 'libsqreen'
-        @libsqreen = true
-      rescue LoadError
-        Sqreen.log.warn('libsqreen gem not found')
-        @libsqreen = false
-      end
+      # 2^30 -1 or 2^62 -1
+      MAX_FIXNUM = 1.size == 4 ? 1_073_741_823 : 4_611_686_018_427_387_903
+      # will be converted to a long, so better not to overflow
+      INFINITE_BUDGET_US = MAX_FIXNUM
 
       def self.libsqreen?
-        @libsqreen
+        Sqreen::Dependency::LibSqreen.required?
       end
 
       def self.waf?
         Sqreen::Dependency.const_exist?('LibSqreen::WAF')
       end
 
-      attr_reader :binding_accessors, :budget, :waf_rule_name
+      attr_reader :binding_accessors, :max_run_budget_us, :waf_rule_name
 
       def initialize(*args)
         super(*args)
         @overtimeable = false
 
         unless WAFCB.libsqreen? && WAFCB.waf?
-          Sqreen.log.warn('libsqreen gem not found')
+          Sqreen.log.warn('libsqreen gem with waf not found')
           return
         end
 
@@ -59,12 +58,17 @@ module Sqreen
         @binding_accessors = @data['values'].fetch('binding_accessors', []).each_with_object({}) do |e, h|
           h[e] = BindingAccessor.new(e)
         end
-        @budget = @data['values'].fetch('budget', BUDGET_MAX)
+
+        # 0 for using defaults (PW_RUN_TIMEOUT)
+        @max_run_budget_us = (@data['values'].fetch('budget_in_ms', 0) * 1000).to_i
+        @max_run_budget_us = INFINITE_BUDGET_US if @max_run_budget_us >= INFINITE_BUDGET_US
+
+        Sqreen.log.debug { "Max WAF run budget for #{@waf_rule_name} set to #{@max_run_budget_us} us" }
 
         ObjectSpace.define_finalizer(self, WAFCB.finalizer(@waf_rule_name.dup))
       end
 
-      def pre(instance, args, _budget)
+      def pre(instance, args, budget)
         return unless WAFCB.libsqreen? && WAFCB.waf?
 
         request = framework.request
@@ -72,9 +76,25 @@ module Sqreen
 
         env = [binding, framework, instance, args]
 
-        waf_args = Hash[binding_accessors.map { |e, b| [e, b.resolve(*env)] }]
+        start = Sqreen.time if budget
+
+        capper = Sqreen::Util::Capper.new(string_size_cap: 4096, size_cap: 150, depth_cap: 10)
+        waf_args = binding_accessors.each_with_object({}) do |(e, b), h|
+          h[e] = capper.call(b.resolve(*env))
+        end
         waf_args = Sqreen::EncodingSanitizer.sanitize(waf_args)
-        action, data = ::LibSqreen::WAF.run(waf_rule_name, waf_args, budget)
+
+        if budget
+          rem_budget_s = budget - (Sqreen.time - start)
+          return advise_action(nil) if rem_budget_s <= 0.0
+
+          waf_gen_budget_us = [(rem_budget_s * 1_000_000).to_i, MAX_FIXNUM].min
+        else # no budget
+          waf_gen_budget_us = INFINITE_BUDGET_US
+        end
+
+        action, data = ::LibSqreen::WAF.run(waf_rule_name, waf_args,
+                                            waf_gen_budget_us, @max_run_budget_us)
 
         case action
         when :monitor
@@ -106,13 +126,13 @@ module Sqreen
         lambda do |object_id|
           return unless WAFCB.libsqreen?
 
-          ::LibSqreen::WAF.delete(waf_rule_name, waf_args, budget)
+          ::LibSqreen::WAF.delete(waf_rule_name)
           Sqreen.log.debug("WAF rule #{rule_name} deleted, from #<#{name}:0x#{object_id.to_s(16).rjust(16, '0')}>")
         end
       end
 
       def record_exception(exception, infos = {}, at = Time.now.utc)
-        infos.merge!(exception_to_infos(exception))
+        infos.merge!(exception_to_infos(exception)) if exception.is_a?(Sqreen::WAFError)
         super(exception, infos, at)
       end
 

data/lib/sqreen/{rules_callbacks/reflected_xss.rb → rules/xss_cb.rb}

@@ -1,10 +1,12 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'cgi'
 
-require 'sqreen/rule_callback'
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/rule_cb'
+require 'sqreen/rules/regexp_rule_cb'
 
 # Sqreen module
 module Sqreen
@@ -21,6 +23,7 @@ module Sqreen
         return nil unless framework
         framework.xss_params(@union_pattern)
       end
+
       # The remaining code is only to find out if user entry was an attack,
       # and record it. Since we don't rely on it to respond to user, it would
       # be better to do it in background.
@@ -36,6 +39,7 @@ module Sqreen
         true
       end
     end
+
     class ReflectedUnsafeXSSCB < XSSCB
       def pre(_inst, args, _budget = nil, &_block)
         value = args[0]
@@ -52,13 +56,12 @@ module Sqreen
         return unless report_dangerous_xss?(saved_value)
 
         # potential XSS! let's escape
-        if block
-          args[0].replace(CGI.escape_html(value))
-        end
+        args[0].replace(CGI.escape_html(value)) if block
 
         advise_action(nil)
       end
     end
+
     # look for reflected XSS with erb template engine
     class ReflectedXSSCB < XSSCB
       def pre(_inst, args, _budget = nil, &_block)
@@ -84,6 +87,7 @@ module Sqreen
         advise_action(nil)
       end
     end
+
     # look for reflected XSS with haml template engine
     # hook function arguments of
     # Haml::Buffer.format_script(result, preserve_script, in_tag, preserve_tag,
@@ -145,7 +149,7 @@ module Sqreen
         if tag.value[:escape_html] == false &&
            tag.value[:value].respond_to?(:include?) &&
            !tag.value[:value].include?('html_escape') &&
-            tag.value[:parse] == true
+           tag.value[:parse] == true
           tag.value[:value] = "Sqreen.escape_haml((#{tag.value[:value]}))"
           return { :status => :override, :new_return_value => tag }
         end
@@ -172,7 +176,8 @@ module Sqreen
             res << '#{'
           else
             # Use eval to get rid of string escapes
-            content = eval('"' + Haml::Util.balance(scan, '{', '}', 1)[0][0...-1] + '"')
+            # TODO: look for eval removal
+            content = eval('"' + Haml::Util.balance(scan, '{', '}', 1)[0][0...-1] + '"') # rubocop:disable Security/Eval
             content = "Haml::Helpers.html_escape((#{content}))" if escape_html
             res << '#{Sqreen.escape_haml((' + content + '))}'
           end

data/lib/sqreen/run_when_called_cb.rb

@@ -0,0 +1,23 @@
+# typed: true
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/cb'
+
+module Sqreen
+  class RunWhenCalledCB < CB
+    def initialize(klass, method, &block)
+      super(klass, method)
+
+      raise 'missing block' unless block_given?
+      @block = block
+    end
+
+    def pre(_inst, _args, _budget = nil, &_block)
+      # FIXME: implement this removal
+      @remove_me = true
+      @block.call
+    end
+  end
+end