sqreen 1.21.1 → 1.23.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6611caf7add24e05a248fce4026be48a4c47612335c5fc9a26c64c33cd0409e9
-  data.tar.gz: 8381eba611e37df32a8744848661bcf144eaffe00c818e306355508fe0267394
+  metadata.gz: 8e1881ab1def0e4a82ccfe791c150b0213517084619d71f5c942a0d14a0189e1
+  data.tar.gz: beeef4f164a84efbc00824a5c63926da6a4e3fcc5952577442061e1c509e8fda
 SHA512:
-  metadata.gz: 65c820c306961ed812360c2c73a1f37396433238cff8fd79e2676132d7842eaa86d3555bf860d7c2f6fd465783f8c1aeb59100c94349b8c53588d83513265d2e
-  data.tar.gz: 38cda532df6f1037ac243c8cd5ccaecd708b880ff377d3fcbcecad329be184d40ec9f27deb61b69124be3d37ff74a16f88a7ab1032a6e6a0f6b5387645181027
+  metadata.gz: b1d1ea43737baa0db830e556fc835f93104dc70465fc5695372c5a922e8108cb9e657e915cc7ffe06f655dc632b0d5e56daf659e0c6ef499b66484fcd6d33076
+  data.tar.gz: 98b0e405e39de271a9d8988692ea037b5f462b2af9314d384b7ca7dfec9dce43229b1aa317fbb8fccde84f1cd743d90637dabde392a2c7bfe88d6a6353e25235

data/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 1.23.2
+
+* Fix compatibility with NewRelic for attack events
+* Fix incorrect rule rejection despite all signature checks individually passing
+
+## 1.23.1
+
+* Improve compatibility with gems such as puma and graphql on Ruby 3.0
+
+## 1.23.0
+
+* Implement GraphQL support
+
+## 1.22.1
+
+* Fix excessive exception reporting, reducing CPU and network load
+* Fix sensitive information attachment on pure tracing payloads
+* Redact more sensitive fields by default
+* Ensure preliminary compatibility with Ruby 3.0 previews
+* Allow update to Sqreen MiniRacer 0.3.1
+
+## 1.22.0
+
+* Update WAF via libsqreen
+* Add support for raw body
+* Improve signature check
+* Improve APM detection
+
 ## 1.21.1
 
 * Work around NewRelic initialisation (see https://github.com/newrelic/newrelic-ruby-agent/issues/461)

data/bin/sqreen

@@ -0,0 +1,43 @@
+#!/usr/bin/env ruby
+
+def logger
+  @logger ||= Logger.new(STDOUT, level: :debug)
+end
+
+def verify(rules)
+  verifier = Sqreen::SqreenSignedVerifier.new
+
+  invalid_rules = rules.reject do |rule|
+    valid = verifier.verify(rule)
+
+    if valid
+      logger.debug { "rule: #{rule['name']} signed: true result: ok" }
+    else
+      logger.error { "rule: #{rule['name']} singed: true result: fail" }
+    end
+
+    valid
+  end
+
+  if invalid_rules.any?
+    logger.error { "weave: instrument status: abort reason: signature result: fail" }
+    raise Sqreen::Exception, "Signature error: rules: #{invalid_rules.map { |r| r['name'] }.inspect}"
+  else
+    logger.info { "weave: instrument rules: signed result: ok" }
+  end
+end
+
+def check_signature(file)
+  require 'json'
+  require 'logger'
+  require 'sqreen/sqreen_signed_verifier'
+
+  content = File.open(file, 'rb', &:read)
+  json = JSON.parse(content)
+
+  p verify(json)
+end
+
+case ARGV[0]
+when 'check-signature' then check_signature(ARGV[1]) || exit(1)
+end

data/lib/sqreen/actions.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/actions_index.rb

@@ -1,4 +1,8 @@
-# typed: true
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 module Sqreen
   module Actions
     # documents the operations an actions index should implement

data/lib/sqreen/actions/base.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/block_ip.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/block_user.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/ip_range_indexed_action_class.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/ip_ranges_index.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/redirect_ip.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/redirect_user.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/repository.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/unknown_action_type.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/user_action_class.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/actions/users_index.rb

@@ -1,4 +1,8 @@
-# typed: true
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/actions/actions_index'
 
 module Sqreen

data/lib/sqreen/agent_message.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'digest'
 
 module Sqreen

data/lib/sqreen/aggregated_metric.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/rules/rule_cb'
 require 'sqreen/metrics/base'
 

data/lib/sqreen/attack_blocked.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/binding_accessor.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/binding_accessor/path_elem.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/binding_accessor/transforms.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/call_countable.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/capped_queue.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/cb.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/condition_evaluator.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/conditionable.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/configuration.rb

@@ -56,6 +56,8 @@ module Sqreen
       :default => nil },
     { :env => :SQREEN_RULES_SIGNATURE, :name => :rules_verify_signature,
       :default => true },
+    { :env => :SQREEN_RULES_DUMP, :name => :rules_dump,
+      :default => false },
     { :env => :SQREEN_LOG_LEVEL, :name => :log_level,
       :default => 'INFO', :choice => %w[UNKNOWN FATAL ERROR WARN INFO DEBUG] },
     { :env => :SQREEN_LOG_LOCATION, :name => :log_location,

data/lib/sqreen/context.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/default_cb.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/deferred_logger.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/deliveries.rb

@@ -1,4 +1,4 @@
-# typed: strong
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/deliveries/batch.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/deliveries/simple.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/dependency.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/dependency/new_relic.rb

@@ -19,7 +19,7 @@ module Sqreen
       def ignore_sqreen_exceptions
         return unless required?
 
-        NewRelic::Agent::Agent.instance.error_collector.ignore(['Sqreen::AttackBlocked'])
+        ::NewRelic::Agent::Agent.instance.error_collector.ignore(['Sqreen::AttackBlocked'])
       rescue ::Exception => e # rubocop:disable Lint/RescueException
         Sqreen.log.warn "Failed ignoring AttackBlocked on NewRelic: #{e.inspect}"
       end

data/lib/sqreen/deprecation.rb

@@ -1,4 +1,4 @@
-# typed: strong
+# typed: ignore
 
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html

data/lib/sqreen/ecosystem.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'securerandom'
 require 'sqreen/ecosystem/module_registry'
 require 'sqreen/ecosystem/tracing/sampling_configuration'

data/lib/sqreen/ecosystem/databases/database_connection_data.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/ecosystem/module_api/tracing/client_data'
 
 module Sqreen

data/lib/sqreen/ecosystem/databases/mongo.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/ecosystem/module_api'
 require 'sqreen/ecosystem/module_api/instrumentation'
 require 'sqreen/ecosystem/module_api/message_producer'

data/lib/sqreen/ecosystem/databases/mysql.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/ecosystem/module_api'
 require 'sqreen/ecosystem/module_api/instrumentation'
 require 'sqreen/ecosystem/module_api/message_producer'

data/lib/sqreen/ecosystem/databases/postgres.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/ecosystem/module_api'
 require 'sqreen/ecosystem/module_api/instrumentation'
 require 'sqreen/ecosystem/module_api/message_producer'

data/lib/sqreen/ecosystem/databases/redis.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/ecosystem/module_api'
 require 'sqreen/ecosystem/module_api/instrumentation'
 require 'sqreen/ecosystem/module_api/message_producer'

data/lib/sqreen/ecosystem/dispatch_table.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'logger'
 
 module Sqreen

data/lib/sqreen/ecosystem/exception_reporting.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/ecosystem/dispatch_table'
 require 'sqreen/ecosystem/loggable'
 require 'sqreen/kit/configuration'

data/lib/sqreen/ecosystem/http/net_http.rb

@@ -1,3 +1,8 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
 require 'sqreen/ecosystem/module_api'
 require 'sqreen/ecosystem/module_api/instrumentation'
 require 'sqreen/ecosystem/module_api/message_producer'