sqreen 1.18.3.beta1 → 1.18.3.beta2

data/lib/sqreen/{rules_callbacks/headers_insert.rb → rules/headers_insert_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks → rules}/matcher_rule.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules
@@ -13,7 +13,7 @@ module Sqreen
         res |= Regexp::MULTILINE  if options.include?('multiline')
         res |= Regexp::IGNORECASE unless case_sensitive
         r = Regexp.compile(value, res)
-        r.match('')
+        r =~ ''
         r
       end
 

data/lib/sqreen/{rules_callbacks/not_found.rb → rules/not_found_cb.rb}

@@ -1,5 +1,5 @@
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/rails_parameters.rb → rules/rails_parameters_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks → rules}/record_request_context.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/regexp_rule.rb → rules/regexp_rule_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rule_callback.rb → rules/rule_cb.rb}

@@ -1,11 +1,11 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/callbacks'
+require 'sqreen/framework_cb'
 require 'sqreen/context'
 require 'sqreen/conditionable'
 require 'sqreen/call_countable'
-require 'sqreen/rule_attributes'
+require 'sqreen/rules/attrs'
 require 'sqreen/events/attack'
 require 'sqreen/events/remote_exception'
 require 'sqreen/payload_creator'

data/lib/sqreen/{rules_callbacks → rules}/run_req_start_actions.rb

@@ -1,9 +1,11 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/actions'
 require 'sqreen/middleware'
+require 'sqreen/rails_middleware'
+require 'sqreen/sinatra_middleware'
 
 module Sqreen
   module Rules
@@ -14,7 +16,7 @@ module Sqreen
       def initialize(framework)
         if defined?(Sqreen::Frameworks::SinatraFramework) &&
            framework.is_a?(Sqreen::Frameworks::SinatraFramework)
-          super(Sinatra::ExtendedRack, :call)
+          super(Sqreen::SinatraMiddleware, :call)
         elsif defined?(Sqreen::Frameworks::RailsFramework) &&
               framework.is_a?(Sqreen::Frameworks::RailsFramework)
           super(Sqreen::RailsMiddleware, :call)

data/lib/sqreen/{rules_callbacks → rules}/run_user_actions.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/actions'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks/shell_env.rb → rules/shell_env_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/sdk_signup_track.rb → rules/signup_track_cb.rb}

@@ -1,8 +1,8 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_attributes'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/attrs'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 
 module Sqreen

data/lib/sqreen/{rules_callbacks → rules}/update_request_context.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/url_matches.rb → rules/url_matches_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/user_agent_matches.rb → rules/user_agent_matches_cb.rb}

@@ -1,7 +1,7 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/regexp_rule_cb'
 
 module Sqreen
   module Rules

data/lib/sqreen/{rules_callbacks/waf.rb → rules/waf_cb.rb}

@@ -2,11 +2,12 @@
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'securerandom'
-require 'sqreen/rule_attributes'
+require 'sqreen/rules/attrs'
 require 'sqreen/binding_accessor'
-require 'sqreen/rule_callback'
+require 'sqreen/rules/rule_cb'
 require 'sqreen/safe_json'
 require 'sqreen/exception'
+require 'sqreen/util/capper'
 
 module Sqreen
   module Rules
@@ -72,7 +73,10 @@ module Sqreen
 
         env = [binding, framework, instance, args]
 
-        waf_args = Hash[binding_accessors.map { |e, b| [e, b.resolve(*env)] }]
+        capper = Sqreen::Util::Capper.new(string_size_cap: 4096, size_cap: 150, depth_cap: 10)
+        waf_args = binding_accessors.each_with_object({}) do |(e, b), h|
+          h[e] = capper.call(b.resolve(*env))
+        end
         waf_args = Sqreen::EncodingSanitizer.sanitize(waf_args)
         action, data = ::LibSqreen::WAF.run(waf_rule_name, waf_args, budget)
 

data/lib/sqreen/{rules_callbacks/reflected_xss.rb → rules/xss_cb.rb}

@@ -3,8 +3,8 @@
 
 require 'cgi'
 
-require 'sqreen/rule_callback'
-require 'sqreen/rules_callbacks/regexp_rule'
+require 'sqreen/rules/rule_cb'
+require 'sqreen/rules/regexp_rule_cb'
 
 # Sqreen module
 module Sqreen
@@ -21,6 +21,7 @@ module Sqreen
         return nil unless framework
         framework.xss_params(@union_pattern)
       end
+
       # The remaining code is only to find out if user entry was an attack,
       # and record it. Since we don't rely on it to respond to user, it would
       # be better to do it in background.
@@ -36,6 +37,7 @@ module Sqreen
         true
       end
     end
+
     class ReflectedUnsafeXSSCB < XSSCB
       def pre(_inst, args, _budget = nil, &_block)
         value = args[0]
@@ -52,13 +54,12 @@ module Sqreen
         return unless report_dangerous_xss?(saved_value)
 
         # potential XSS! let's escape
-        if block
-          args[0].replace(CGI.escape_html(value))
-        end
+        args[0].replace(CGI.escape_html(value)) if block
 
         advise_action(nil)
       end
     end
+
     # look for reflected XSS with erb template engine
     class ReflectedXSSCB < XSSCB
       def pre(_inst, args, _budget = nil, &_block)
@@ -84,6 +85,7 @@ module Sqreen
         advise_action(nil)
       end
     end
+
     # look for reflected XSS with haml template engine
     # hook function arguments of
     # Haml::Buffer.format_script(result, preserve_script, in_tag, preserve_tag,
@@ -145,7 +147,7 @@ module Sqreen
         if tag.value[:escape_html] == false &&
            tag.value[:value].respond_to?(:include?) &&
            !tag.value[:value].include?('html_escape') &&
-            tag.value[:parse] == true
+           tag.value[:parse] == true
           tag.value[:value] = "Sqreen.escape_haml((#{tag.value[:value]}))"
           return { :status => :override, :new_return_value => tag }
         end
@@ -172,7 +174,8 @@ module Sqreen
             res << '#{'
           else
             # Use eval to get rid of string escapes
-            content = eval('"' + Haml::Util.balance(scan, '{', '}', 1)[0][0...-1] + '"')
+            # TODO: look for eval removal
+            content = eval('"' + Haml::Util.balance(scan, '{', '}', 1)[0][0...-1] + '"') # rubocop:disable Security/Eval
             content = "Haml::Helpers.html_escape((#{content}))" if escape_html
             res << '#{Sqreen.escape_haml((' + content + '))}'
           end

data/lib/sqreen/run_when_called_cb.rb

@@ -0,0 +1,21 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/cb'
+
+module Sqreen
+  class RunWhenCalledCB < CB
+    def initialize(klass, method, &block)
+      super(klass, method)
+
+      raise 'missing block' unless block_given?
+      @block = block
+    end
+
+    def pre(_inst, _args, _budget = nil, &_block)
+      # FIXME: implement this removal
+      @remove_me = true
+      @block.call
+    end
+  end
+end

data/lib/sqreen/sensitive_data_redactor.rb

@@ -0,0 +1,111 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+# TODO: Sqreen.config_get
+
+require 'json'
+require 'sqreen/log'
+
+module Sqreen
+  # For redacting sensitive data and avoid having it sent to our servers
+  class SensitiveDataRedactor
+    DEFAULT_SENSITIVE_KEYS = Set.new(%w[password secret passwd authorization api_key apikey access_token]).freeze
+    DEFAULT_REGEX = /\A(?:\d[ -]*?){13,16}\z/
+    MASK = '<Redacted by Sqreen>'.freeze
+
+    def self.from_config
+      keys = Sqreen.config_get(:strip_sensitive_keys)
+      keys = keys.split(',') if keys && keys.is_a?(String)
+
+      regex = Sqreen.config_get(:strip_sensitive_regex)
+      if regex && regex.is_a?(String)
+        begin
+          regex = Regexp.compile(regex)
+        rescue RegexpError
+          Sqreen.log.warn("Invalid regular expression given in strip_sensitive_regex: #{regex}")
+          regex = nil
+        end
+      else
+        regex = nil
+      end
+
+      new(keys: keys, regex: regex)
+    end
+
+    def initialize(params = {})
+      @regex = params[:regex] || DEFAULT_REGEX
+      @keys = (params[:keys] || DEFAULT_SENSITIVE_KEYS).map(&:downcase)
+    end
+
+    def redact(obj)
+      result = obj
+      redacted = []
+
+      case obj
+      when String
+        if obj =~ @regex
+          result = MASK
+          redacted << obj
+        end
+      when Array
+        result = []
+        obj.each do |e|
+          e, r = redact(e)
+          result << e
+          redacted += r
+        end
+      when Hash
+        result = {}
+        obj.each do |k, v|
+          ck = k.is_a?(String) ? k.downcase : k
+          if @keys.include?(ck)
+            redacted << v
+            v = MASK
+          else
+            v, r = redact(v)
+            redacted += r
+          end
+          result[k] = v
+        end
+      end
+
+      [result, redacted]
+    end
+
+    def redact_attacks!(attacks, values)
+      return attacks if values.empty?
+
+      values = values.map { |v| v.downcase if v.is_a?(String) }
+
+      attacks.each do |e|
+        next(e) unless e[:infos]
+        next(e) unless e[:infos][:waf_data]
+
+        parsed = JSON.parse(e[:infos][:waf_data])
+        redacted = parsed.each do |w|
+          next unless (filters = w['filter'])
+
+          filters.each do |f|
+            next unless (v = f['resolved_value'])
+            next unless values.include?(v.downcase)
+
+            f['match_status'] = MASK
+            f['resolved_value'] = MASK
+          end
+        end
+        e[:infos][:waf_data] = JSON.dump(redacted)
+      end
+    end
+
+    def redact_exceptions!(exceptions, values)
+      return exceptions if values.empty?
+
+      exceptions.each do |e|
+        next(e) unless e[:infos]
+        next(e) unless e[:infos][:waf]
+
+        e[:infos][:waf].delete(:args)
+      end
+    end
+  end
+end

data/lib/sqreen/signature_verifier.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'openssl'
+
+## Rules signature
+module Sqreen
+  # Perform an EC + digest verification of a message.
+  class SignatureVerifier
+    def initialize(key, digest)
+      @pub_key              = OpenSSL::PKey.read(key)
+      @digest               = digest
+    end
+
+    def verify(sig, val)
+      hashed_val = @digest.digest(val)
+      @pub_key.dsa_verify_asn1(hashed_val, sig)
+    end
+  end
+end

data/lib/sqreen/sinatra_middleware.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+module Sqreen
+  class SinatraMiddleware
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      @app.call(env)
+    end
+  end
+end

data/lib/sqreen/{rules_signature.rb → sqreen_signed_verifier.rb}

@@ -1,8 +1,6 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/exception'
-
 require 'set'
 require 'openssl'
 require 'base64'
@@ -18,21 +16,11 @@ else
   end
 end
 
+require 'sqreen/exception'
+require 'sqreen/signature_verifier'
+
 ## Rules signature
 module Sqreen
-  # Perform an EC + digest verification of a message.
-  class SignatureVerifier
-    def initialize(key, digest)
-      @pub_key              = OpenSSL::PKey.read(key)
-      @digest               = digest
-    end
-
-    def verify(sig, val)
-      hashed_val = @digest.digest(val)
-      @pub_key.dsa_verify_asn1(hashed_val, sig)
-    end
-  end
-
   # Normalize and verify a rule
   class SqreenSignedVerifier
     REQUIRED_SIGNED_KEYS = %w[hookpoint name callbacks conditions].freeze
@@ -40,14 +28,14 @@ module Sqreen
     SIGNATURE_VALUE_KEY  = 'value'.freeze
     SIGNED_KEYS_KEY      = 'keys'.freeze
     SIGNATURE_VERSION    = 'v0_9'.freeze
-    PUBLIC_KEY           = <<-END.gsub(/^ */, '').freeze
+    PUBLIC_KEY           = <<-KEY.gsub(/^ */, '').freeze
     -----BEGIN PUBLIC KEY-----
     MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA39oWMHR8sxb9LRaM5evZ7mw03iwJ
     WNHuDeGqgPo1HmvuMfLnAyVLwaMXpGPuvbqhC1U65PG90bTJLpvNokQf0VMA5Tpi
     m+NXwl7bjqa03vO/HErLbq3zBRysrZnC4OhJOF1jazkAg0psQOea2r5HcMcPHgMK
     fnWXiKWnZX+uOWPuerE=
     -----END PUBLIC KEY-----
-    END
+    KEY
 
     attr_accessor :pub_key
     attr_accessor :required_signed_keys