sqreen 1.18.6-java → 1.20.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3e35cc01e7532fdc2de3b453ec1dd4737c408ffc63186b36a15e87233e95a1d
-  data.tar.gz: 4926e2f50f1ab393372e54771d3f507d7a0423b81eaf24082fa899292bd40ae6
+  metadata.gz: f45370a0f5c03f939b0098527398d058cf0df4ad026f7002905bdb31b79e857d
+  data.tar.gz: 516269e4979639d390e557f5f382522ebd0fdbc68e1731ea75315cb881dded9d
 SHA512:
-  metadata.gz: 2af302eb9db7834083e0d71967ca9777e8b2283ab7b39d44426696ae029a97c34e88d54182d0082ffb479f37426e89d9418e41c2e0c89dbc56375353c69296e6
-  data.tar.gz: bbd4764c0192e2f8ae8e84bb6737459ac0c84934187d1537071defd6a68cdd510e118f2328e870c02be777785d85fab37ecfe8292bd240e3a5a176640457ad8d
+  metadata.gz: dbaec7b5608f60ef43922c970895b0c3aa3b547dcfc27192aff587993ade656ea6e2bdf969f01ce180d389f272b55f8df6c716be73262c251110afb53909bea5
+  data.tar.gz: a901202c4f7949711b2bb9c6fd940ea830ebf6c41e0f5e20ed17a0fa67957d49a10eb68573c41b0e5e72ccb0d8cae2e2dc5a9fd29c0644da4845a56164898505

data/CHANGELOG.md

@@ -1,3 +1,30 @@
+## 1.20.0
+
+* Enable new instrumentation engine by default
+* Add signal-based backend communication
+
+## 1.19.3
+
+* Improve WAF PII protection
+
+## 1.19.2
+
+* Handle unexpected rule callback return values more gracefully
+* Fix incorrect return value for 404 native callback
+
+## 1.19.1
+
+* Fix LocalJumpError when reaching a Rack app nested in a Rails app
+
+## 1.19.0
+
+* Upgrade WAF features via libsqreen 0.6.1
+* Improve time defensiveness in WAF
+* Improve compatibility with APM agents via a new optional instrumentation engine
+* Fix action reloading not being entirely cleared on reload
+* Improve handling of hash symbol keys in some security rules
+* Fix constant resolution scope on agent boot
+
 ## 1.18.6
 
 * Improve default WAF time budget handling logic

data/lib/sqreen/actions.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/actions_index.rb

@@ -0,0 +1,16 @@
+# typed: true
+module Sqreen
+  module Actions
+    # documents the operations an actions index should implement
+    class ActionsIndex
+      # all actions matching, possibly already expired
+      def actions_matching(_key)
+        raise 'implement in subclasses'
+      end
+
+      def index(_params, _action)
+        raise 'implement in subclasses'
+      end
+    end
+  end
+end

data/lib/sqreen/actions/base.rb

@@ -1,8 +1,11 @@
+# typed: false
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 # TODO: remove class vars
 
+require 'sqreen/sdk'
 require 'sqreen/exception'
 
 module Sqreen
@@ -75,16 +78,7 @@ module Sqreen
           subclasses.keys
         end
 
-        # all actions matching, possibly already expired
-        def actions_matching(_key)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def index(_params, _action)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def clear
+        def new_index
           raise 'implement in singletons of subclasses'
         end
 

data/lib/sqreen/actions/block_ip.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/block_user.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/ip_range_indexed_action_class.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -6,30 +8,8 @@ require 'sqreen/actions/ip_ranges_index'
 module Sqreen
   module Actions
     module IpRangeIndexedActionClass
-      include IpRangesIndex
-
-      def actions_matching(client_ip)
-        matching_actions client_ip
-      end
-
-      def index(params, action)
-        ranges = parse_ip_ranges params
-
-        ranges.each do |r|
-          add_prefix r, action
-        end
-      end
-
-      private
-
-      # returns array of prefixes in string form
-      def parse_ip_ranges(params)
-        ranges = params['ip_cidr']
-        unless ranges && ranges.is_a?(Array) && !ranges.empty?
-          raise 'no non-empty ip_cidr array present'
-        end
-
-        ranges
+      def new_index
+        IpRangesIndex.new
       end
     end
   end

data/lib/sqreen/actions/ip_ranges_index.rb

@@ -1,22 +1,30 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'ipaddr'
+require 'sqreen/actions/actions_index'
 require 'sqreen/trie'
 require 'sqreen/prefix'
 
 module Sqreen
   module Actions
-    module IpRangesIndex
-      def add_prefix(prefix_str, data)
-        @trie_v4 ||= Sqreen::Trie.new
-        @trie_v6 ||= Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
-        prefix = Sqreen::Prefix.from_str(prefix_str, data)
-        trie = prefix.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
-        trie.insert prefix
+    class IpRangesIndex < ActionsIndex
+      def initialize
+        @trie_v4 = Sqreen::Trie.new
+        @trie_v6 = Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
+      end
+
+      def index(params, action)
+        ranges = parse_ip_ranges params
+
+        ranges.each do |r|
+          add_prefix r, action
+        end
       end
 
-      def matching_actions(client_ip)
+      def actions_matching(client_ip)
         parsed_ip = IPAddr.new(client_ip.gsub(/%[^%\/]+/, ''))
         trie = parsed_ip.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
         return [] unless trie
@@ -27,9 +35,22 @@ module Sqreen
         found.map(&:data)
       end
 
-      def clear
-        @trie_v4 = Sqreen::Trie.new
-        @trie_v6 = Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
+      private
+
+      # returns array of prefixes in string form
+      def parse_ip_ranges(params)
+        ranges = params['ip_cidr']
+        unless ranges && ranges.is_a?(Array) && !ranges.empty?
+          raise 'no non-empty ip_cidr array present'
+        end
+
+        ranges
+      end
+
+      def add_prefix(prefix_str, data)
+        prefix = Sqreen::Prefix.from_str(prefix_str, data)
+        trie = prefix.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
+        trie.insert prefix
       end
     end
   end

data/lib/sqreen/actions/redirect_ip.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/redirect_user.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/repository.rb

@@ -1,24 +1,43 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 module Sqreen
   module Actions
-    # Where the currently loaded actions are stored. Singleton
+    # Where the actions are stored
+    # The current ones are stored in Repository.current
     class Repository
-      include Singleton
+      def initialize
+        @indexes = Hash[Base.known_subclasses.map do |clazz|
+          [clazz.type_name, clazz.new_index]
+        end]
+      end
 
       def add(params, action)
-        action.class.index(params || {}, action)
+        @indexes[action.class.type_name].index(params || {}, action)
       end
 
-      def get(action_class, key)
-        action_class = Base.get_type_class(action_class) unless action_class.class == Class
-        action_class.actions_matching key
+      # type is either a class or a type name
+      def get(type, key)
+        type = type.type_name if type.class == Class
+        @indexes[type].actions_matching key
       end
 
-      def clear
-        Base.known_subclasses.each(&:clear)
+      singleton_class.class_eval do
+        attr_reader :current
+        def current=(new_inst)
+          raise 'nil is unacceptable' if new_inst.nil?
+          @current = new_inst
+        end
+
+        def clear
+          self.current = Repository.new
+        end
       end
+
+      # initialize current to empty repository
+      clear
     end
   end
 end

data/lib/sqreen/actions/unknown_action_type.rb

@@ -1,6 +1,10 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
+require 'sqreen/exception'
+
 module Sqreen
   # Implements actions (behavior taken in response to agent signals)
   module Actions

data/lib/sqreen/actions/user_action_class.rb

@@ -1,40 +1,15 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/exception'
+require 'sqreen/actions/users_index'
 
 module Sqreen
   module Actions
     module UserActionClass
-      def actions_matching(identity_params)
-        return [] unless @idx
-        key = stringify_keys(identity_params)
-        actions = @idx[key]
-        actions || []
-      end
-
-      def index(params, action)
-        @idx ||= {}
-        users = params['users']
-        raise ::Sqreen::Exception, 'nil "users" param for block_user action' if users.nil?
-        raise ::Sqreen::Exception, '"users" param must be an array' unless users.is_a? Array
-
-        users.each do |u|
-          @idx[u] ||= []
-          @idx[u] << action
-        end
-      end
-
-      def clear
-        @idx = {}
-      end
-
-      private
-
-      def stringify_keys(hash)
-        Hash[
-          hash.map { |k, v| [k.to_s, v] }
-        ]
+      def new_index
+        UsersIndex.new
       end
     end
   end

data/lib/sqreen/actions/users_index.rb

@@ -0,0 +1,35 @@
+# typed: true
+require 'sqreen/actions/actions_index'
+
+module Sqreen
+  module Actions
+    class UsersIndex < ActionsIndex
+      def actions_matching(identity_params)
+        return [] unless @idx
+        key = stringify_keys(identity_params)
+        actions = @idx[key]
+        actions || []
+      end
+
+      def index(params, action)
+        @idx ||= {}
+        users = params['users']
+        raise ::Sqreen::Exception, 'nil "users" param for block_user action' if users.nil?
+        raise ::Sqreen::Exception, '"users" param must be an array' unless users.is_a? Array
+
+        users.each do |u|
+          @idx[u] ||= []
+          @idx[u] << action
+        end
+      end
+
+      private
+
+      def stringify_keys(hash)
+        Hash[
+          hash.map { |k, v| [k.to_s, v] }
+        ]
+      end
+    end
+  end
+end

data/lib/sqreen/agent.rb

@@ -1,8 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'sqreen/version'
-require 'sqreen/instrumentation'
 require 'sqreen/session'
 require 'sqreen/runner'
 require 'sqreen/log'

data/lib/sqreen/aggregated_metric.rb

@@ -0,0 +1,25 @@
+require 'sqreen/rules/rule_cb'
+require 'sqreen/metrics/base'
+
+module Sqreen
+  class AggregatedMetric
+    def initialize(values = {})
+      values.each do |k, v|
+        public_send "#{k}=", v
+      end
+    end
+
+    # @return [Sqreen::Rules::RuleCB]
+    attr_accessor :rule # optional
+
+    # @return [Sqreen::Metric::Base]
+    attr_accessor :metric
+
+    attr_accessor :start, :finish
+    attr_accessor :data
+
+    def name
+      metric.name
+    end
+  end
+end

data/lib/sqreen/attack_blocked.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/binding_accessor.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/binding_accessor/path_elem.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/binding_accessor/transforms.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -19,7 +21,8 @@ module Sqreen
           next unless seen.add?(val.object_id)
           case val
           when Hash
-            keys.concat(val.keys)
+            # convert symbols are converted to strings (ARB-60)
+            keys.concat(val.keys.map { |x| sym_to_s(x) })
             look_into.concat(val.values)
           when Array
             look_into.concat(val)
@@ -75,6 +78,10 @@ module Sqreen
 
       private
 
+      def sym_to_s(value)
+        value.is_a?(Symbol) ? value.to_s : value
+      end
+
       def descend(value, max_iter = 1000)
         seen = Set.new
         look_into = [value]