sqreen 1.18.2 → 1.18.3.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0fe030250caca205c3fed7e6e7c46d9961dfac1f7399fe2cb27b1d21749c928f
-  data.tar.gz: a14b036980cb650fce6728141b8f52848770381cd22ffd3a5f63a95401a8a4db
+  metadata.gz: 0cb385fddb3e1bb873a5def8b85d4e0865650ba97268d8cd3f67d84640439010
+  data.tar.gz: 65d395b3926571d088603a7e604a3c377a6e57c334ab4c106354812e65d8f84d
 SHA512:
-  metadata.gz: 843bd65c121e4c5e39528d70bbdc2748641f853f66bef216c78036fce72dde1c5d8b4f9d893bbb6e62243aaf9818a043bad3d19d065bc66b241c938b4b5fb3f7
-  data.tar.gz: 432295babcb8c44adc72d720b6262a08b9a5f29c71fe774d6c5c04b7bdd0542e1a7b0cc108b048acaf28b5b20e761c12f6a01fe91ca7b7bf206daa733c9ac671
+  metadata.gz: b0ae2a6ebe375573a26372a63fb383e7176bda425e52d977b9e42172c6e95b13143f3be83f069985bdcbea5816f61a53a4b6fabc98ed004ffb8142a17f10400c
+  data.tar.gz: 8d233a01e2ef20ed7b1f1fd6d1ddbb384b482ca62d01ebec4100a1138430064e04368d9e078313364e8c99885bb0b137e2cc19a52b5e91e1ab5f50dbeaf67967

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 1.18.3.beta1
+
+* Improve middleware hookpoints on Sinatra
+* Support application/json payloads on Sinatra
+
 ## 1.18.2
 
 * Improve internal WAF error reporting

data/lib/sqreen/dependency/detector.rb

@@ -38,7 +38,7 @@ module Sqreen
           end
         end if Sqreen::Dependency::Rails.required?
 
-        Sqreen::Dependency::Hook.add('Sinatra::Base.setup_default_middleware') do
+        Sqreen::Dependency::Hook.add('Sinatra::Base.setup_middleware') do
           after do |_, _, _, args|
             Sqreen::Dependency::Sinatra.insert_sqreen_middlewares(args.first)
           end

data/lib/sqreen/dependency/sinatra.rb

@@ -12,25 +12,54 @@ module Sqreen
 
       def insert_sqreen_middlewares(builder, *args, &block)
         Sqreen.log.debug { 'Inserting Sqreen middlewares for Sinatra' }
-        middleware = Sqreen::ErrorHandlingMiddleware
-        use = builder.instance_variable_get('@use')
 
-        p = proc { |app| middleware.new(app, *args, &block) }
+        insert_middleware(builder, Sqreen::ErrorHandlingMiddleware, args, block) do |p, u|
+          if middlewares(builder).include?(::Sinatra::ShowExceptions)
+            Sqreen.log.warn('Sinatra :show_exceptions detected: Sinatra exception handling may prevent the Sqreen error page to display on attacks.')
+          end
 
-        return if middlewares(builder).include?(middleware)
+          if (i = middlewares(builder).index(::Rack::Head))
+            u.insert(i, p)
+          elsif (i = middlewares(builder).index(::Rack::MethodOverride))
+            u.insert(i + 1, p)
+          elsif (i = middlewares(builder).index(::Sinatra::ExtendedRack))
+            u.insert(i + 1, p)
+          else
+            u.insert(0, p)
+          end
+        end
+
+        insert_middleware(builder, Sqreen::Middleware, args, block) do |p, u|
+          if (i = middlewares(builder).index(::Sinatra::ExtendedRack))
+            u.insert(i, p)
+          else
+            u.insert(0, p)
+          end
+        end
 
-        if middlewares(builder).include?(::Sinatra::ShowExceptions)
-          Sqreen.log.warn('Sinatra :show_exceptions detected: Sinatra exception handling may prevent the Sqreen error page to display on attacks.')
+        insert_middleware(builder, Sqreen::SinatraMiddleware, args, block) do |p, u|
+          if ::Sqreen::Dependency.const_exist?('Rack::PostBodyContentTypeParser') && (i = middlewares(builder).index(::Rack::PostBodyContentTypeParser))
+            u.insert(i + 1, p)
+          elsif (i = middlewares(builder).index(::Rack::Protection))
+            u.insert(i + 1, p)
+          else
+            u.append(p)
+          end
         end
+      end
+
+      def wrap_middleware(middleware, *args, &block)
+        proc { |app| middleware.new(app, *args, &block) }
+      end
+
+      def insert_middleware(builder, middleware, args, block)
+        use = builder.instance_variable_get('@use')
+        wrapped = wrap_middleware(middleware, *args, &block)
+
+        catch(:skip) do
+          throw(:skip) if middlewares(builder).include?(middleware)
 
-        if (i = middlewares(builder).index(::Rack::Head))
-          use.insert(i, p)
-        elsif (i = middlewares(builder).index(::Rack::MethodOverride))
-          use.insert(i + 1, p)
-        elsif (i = middlewares(builder).index(::Sinatra::ExtendedRack))
-          use.insert(i + 1, p)
-        else
-          use.insert(0, p)
+          yield(wrapped, use)
         end
       end
 

data/lib/sqreen/frameworks/generic.rb

@@ -295,13 +295,14 @@ module Sqreen
         params
       end
 
-      %w(form query cookies).each do |section|
+      %w(form query cookies rack).each do |section|
         define_method("#{section}_params") do
           self.class.send("#{section}_params", request)
         end
       end
 
       P_FORM = 'form'.freeze
+      P_RACK = 'rack'.freeze
       P_QUERY = 'query'.freeze
       P_COOKIE = 'cookies'.freeze
       P_GRAPE = 'grape_params'.freeze
@@ -317,6 +318,16 @@ module Sqreen
         end
       end
 
+      def self.rack_params(request)
+        return nil unless request
+        begin
+          request.params
+        rescue => e
+          Sqreen.log.debug("Rack Parameters are invalid #{e.inspect}")
+          nil
+        end
+      end
+
       def self.cookies_params(request)
         return nil unless request
         begin
@@ -345,6 +356,9 @@ module Sqreen
           P_QUERY  => query_params(request),
           P_COOKIE => cookies_params(request),
         }
+        if (p = rack_params(request))
+          r[P_RACK] = p
+        end
         # Add grape parameters if seen
         p = request.env['grape.request.params']
         r[P_GRAPE] = p if p

data/lib/sqreen/middleware.rb

@@ -45,4 +45,14 @@ module Sqreen
       @app.call(env)
     end
   end
+
+  class SinatraMiddleware
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      @app.call(env)
+    end
+  end
 end

data/lib/sqreen/rules_callbacks/update_request_context.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/rule_callback'
+
+module Sqreen
+  module Rules
+    class UpdateRequestContext < RuleCB
+      def initialize(*args)
+        super(*args)
+        @overtimeable = false
+      end
+
+      def pre(_inst, args, _budget = nil, &_block)
+        framework.store_request(args[0])
+        advise_action(nil)
+      end
+    end
+  end
+end

data/lib/sqreen/rules_callbacks.rb

@@ -5,6 +5,7 @@ require 'sqreen/rules_callbacks/regexp_rule'
 require 'sqreen/rules_callbacks/matcher_rule'
 
 require 'sqreen/rules_callbacks/record_request_context'
+require 'sqreen/rules_callbacks/update_request_context'
 require 'sqreen/rules_callbacks/rails_parameters'
 
 require 'sqreen/rules_callbacks/headers_insert'

data/lib/sqreen/version.rb

@@ -2,5 +2,5 @@
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 module Sqreen
-  VERSION = '1.18.2'.freeze
+  VERSION = '1.18.3.beta1'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.18.2
+  version: 1.18.3.beta1
 platform: ruby
 authors:
 - Sqreen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-12 00:00:00.000000000 Z
+date: 2019-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sq_mini_racer
@@ -140,6 +140,7 @@ files:
 - lib/sqreen/rules_callbacks/sdk_auth_track.rb
 - lib/sqreen/rules_callbacks/sdk_signup_track.rb
 - lib/sqreen/rules_callbacks/shell_env.rb
+- lib/sqreen/rules_callbacks/update_request_context.rb
 - lib/sqreen/rules_callbacks/url_matches.rb
 - lib/sqreen/rules_callbacks/user_agent_matches.rb
 - lib/sqreen/rules_callbacks/waf.rb
@@ -167,7 +168,9 @@ homepage: https://www.sqreen.com/
 licenses:
 - Sqreen
 metadata: {}
-post_install_message: 
+post_install_message: |2
+      This is a Sqreen beta release and may not work in all situations.
+      Make sure to review CHANGELOG.md for important details.
 rdoc_options: []
 require_paths:
 - lib
@@ -178,12 +181,11 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.7
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Sqreen Ruby agent