RubyGems - sqreen - Versions diffs - 1.5.0-java → 1.6.0-java - Mend

sqreen 1.5.0-java → 1.6.0-java

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

checksums.yaml +4 -4
data/lib/sqreen/attack_detected.html +2 -0
data/lib/sqreen/binding_accessor.rb +247 -157
data/lib/sqreen/condition_evaluator.rb +191 -189
data/lib/sqreen/frameworks/generic.rb +6 -0
data/lib/sqreen/frameworks/rails.rb +1 -0
data/lib/sqreen/frameworks/sinatra.rb +18 -0
data/lib/sqreen/middleware.rb +10 -0
data/lib/sqreen/rules_callbacks.rb +3 -0
data/lib/sqreen/rules_callbacks/binding_accessor_matcher.rb +75 -0
data/lib/sqreen/rules_callbacks/custom_error.rb +57 -0
data/lib/sqreen/rules_callbacks/execjs.rb +4 -7
data/lib/sqreen/rules_callbacks/matcher_rule.rb +26 -20
data/lib/sqreen/version.rb +1 -1
metadata +6 -3

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7dabc8645b6eaca59937e5742c95229b6a4016b4
-  data.tar.gz: 0a9b782a69bd8b807d4bfc6077bad91b9e9b537f
+  metadata.gz: b6b96afe645e834947aa8a4ba899a0c94d9b8037
+  data.tar.gz: b09d59bff4ba050f2d3409c2896e7df6ba26c5b7
 SHA512:
-  metadata.gz: 7d2f9dd053786379e7b8a2834bb4e73499c7a4d74ab1835710ea4341196b428b71759d905543e108eede149b1ea7ba2fb47ce8741a63424f019a43113f7708dd
-  data.tar.gz: df8b05e55f77b2a34bdbcc89c5dbe0586fa476597c4784a20818418880bba75d43c3ee6176125f7594fccf9a26a9e3e8c1ff53b4947d63438757360267c3696f
+  metadata.gz: bf2acd08c3047ba024c7479859118cd5b4eeef937a5562184bb83c329bc60d266ccf35d6da7318e59d8b3fc79a0d33ec9fd0d888a37f3afc70306507cde7a700
+  data.tar.gz: b22575e52f4df22aea73f12bd1b719238fbcd7062c659f75d70c69c0c65a98112efca7c887b81847a74be27c76cc02d4afbe110ecb90be2c245eca90a1524efc

data/lib/sqreen/attack_detected.html ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <title>Sqreen has detected an attack.</title> <style>html,body,div,span,h1,a{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1}svg,h1,p{display:block}svg{margin:0 auto 4vh}h1{font-family:sans-serif;font-weight:300;font-size:34px;color:#384886;line-height:normal}p{font-size:18px;line-height:normal;color:#b8bccc;font-family:sans-serif;font-weight:300}a{color:#b8bccc}.flex{text-align:center}</style></head><body> <div class="flex"> <svg xmlns="http://www.w3.org/2000/svg" width="230" height="250" xmlns:xlink="http://www.w3.org/1999/xlink"> <defs> <path id="b" d="M176.55 22.93v-.03c-.17-1.13-.8-2.1-1.9-2.77C170.93 18.07 136.8.03 88.98 0 40.25 0 4.8 19.28 3.28 20.14c-.98.6-1.63 1.6-1.77 2.72-14.8 123.1 84.7 176.2 85.7 176.7.6.3 1.2.44 1.8.44.6 0 1.2-.15 1.7-.42 1-.52 100.4-55.03 85.9-176.65z"/> <filter id="a" width="151.7%" height="146%" x="-25.8%" y="-16%" filterUnits="objectBoundingBox"> <feOffset dy="14" in="SourceAlpha" result="shadowOffsetOuter1"/> <feGaussianBlur stdDeviation="13" in="shadowOffsetOuter1" result="shadowBlurOuter1"/> <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0" in="shadowBlurOuter1"/> </filter> </defs> <g fill="none" fill-rule="evenodd"> <g fill-rule="nonzero" transform="translate(26 12)"> <use fill="#000" filter="url(#a)" xlink:href="#b"/> <use fill="#FFF" fill-rule="evenodd" xlink:href="#b"/> </g> <path fill="#374886" d="M153.85 75.8s0 .68-.35 1.13c-.46.57-8.52 10.74-12.32 15.6-3.8 4.98-11.52 2.26-11.52 2.26s2.54-1.5 4.15-3.4c4.3-5.3 12.5-15.7 12.5-15.7s-8.2-10.2-12.4-15.6c-1.5-2-4.1-3.4-4.1-3.4s7.7-2.6 11.5 2.2c3.8 4.9 11.9 15.1 12.2 15.7.5.4.5 1.1.5 1.1m-78 .1s0 .6.4 1.1c.4.4 8.5 10.7 12.2 15.6 3.7 4.8 11.5 2.2 11.5 2.2s-2.5-1.5-4.1-3.4c-4.3-5.2-12.5-15.5-12.5-15.5l12.4-15.7c1.5-2 4.2-3.4 4.2-3.4s-7.7-2.6-11.5 2.2C84.8 63.7 76.9 74 76.5 74.6c-.32.55-.44 1.12-.44 1.12M115 62.82c-7.03 0-12.9 5.78-12.9 12.9s5.75 12.9 12.9 12.9c7.13 0 12.9-5.8 12.9-12.9s-5.9-12.9-12.9-12.9m-33.38 58.6c3.46 0 5.4-1.77 5.4-4.1 0-5.15-7.4-3.56-7.4-5.47 0-.8.78-1.3 1.97-1.3 1.5 0 2.9.6 3.7 1.5l1.3-2.3c-1.3-1-2.9-1.8-5.1-1.8-3.3 0-5.1 1.9-5.1 4 0 5 7.5 3.3 7.5 5.4 0 .8-.6 1.4-2.1 1.4s-3.4-.9-4.3-1.8l-1.4 2.4c1.4 1.2 3.4 2 5.6 2zm13.53-3c-1.8 0-3.1-1.5-3.1-3.7s1.3-3.7 3.2-3.7c1.1 0 2.3.6 2.8 1.44v4.5c-.5.8-1.7 1.46-2.8 1.46zm-1 3c1.5 0 2.9-.64 3.9-1.96v6.5h3.3v-17.63H98v1.6c-.96-1.23-2.33-1.92-3.86-1.92-3.2 0-5.52 2.5-5.52 6.7 0 4.3 2.33 6.7 5.53 6.7zm13.7-.32v-8.42c.6-.8 2-1.4 3.1-1.4.4 0 .7.1.9.1v-3.3c-1.5 0-3.1 1-3.9 2.1v-1.7h-3.3v12.8h3.3zm11.9.33c2 0 3.9-.6 5.2-1.77l-1.4-2.2c-.8.8-2.26 1.2-3.32 1.2-2.1 0-3.4-1.4-3.6-3h9.3v-.7c0-4.2-2.53-7.1-6.25-7.1-3.8 0-6.45 3-6.45 6.7 0 4.05 2.8 6.7 6.6 6.7zm2.9-7.9h-6.1c.2-1.27 1.07-2.83 3.1-2.83 2.18 0 3 1.6 3.08 2.87zm11.4 7.9c2 0 3.9-.6 5.2-1.77l-1.42-2.2c-.8.8-2.3 1.2-3.34 1.2-2.2 0-3.4-1.4-3.6-3h9.2v-.7c0-4.2-2.6-7.1-6.3-7.1-3.8 0-6.4 3-6.4 6.7 0 4.05 2.82 6.7 6.62 6.7zm2.9-7.9h-6.1c.17-1.27 1.05-2.83 3.1-2.83 2.2 0 3 1.6 3.1 2.87zm17.3 7.58v-9c0-2.5-1.3-4-4.03-4-2.08 0-3.6 1-4.4 2v-1.64h-3.3v12.76h3.3v-8.6c.53-.74 1.53-1.5 2.82-1.5 1.4 0 2.3.63 2.3 2.4v7.7h3.2z"/> </g> </svg> <h1>Uh Oh! Sqreen has detected an attack.</h1> <p>If you are the application owner, check the Sqreen <a href="https://my.sqreen.io/">dashboard</a> for more information.</p></div></body></html>
2	+

data/lib/sqreen/binding_accessor.rb CHANGED Viewed

@@ -2,195 +2,285 @@
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 require 'strscan'
+require 'sqreen/exception'
+require 'set'
-# the value located at the given binding
-class BindingAccessor
-  PathElem = Struct.new(:kind, :value)
-  attr_reader :path, :expression
-  # Expression to be accessed
-  # @param expression [String] expression to read
-  # @param convert [Boolean] wheter to convert objects to simpler types (Array, Hash, String...)
-  def initialize(expression, convert = false)
-    @expression = expression
-    @path = []
-    @convert = convert
-    parse(expression)
-  end
+module Sqreen
+  # the value located at the given binding
+  class BindingAccessor
+    PathElem = Struct.new(:kind, :value)
+    attr_reader :path, :expression, :final_transform
-  # Resolve this expression for the give binding
-  def resolve(binding, framework = nil, instance = nil, arguments = nil, cbdata = nil, last_return = nil)
-    env = [framework, instance, arguments, cbdata, last_return]
-    value = nil
-    @path.each do |component|
-      value = resolve_component(value, component, binding, env)
+    # Expression to be accessed
+    # @param expression [String] expression to read
+    # @param convert [Boolean] wheter to convert objects to
+    #                          simpler types (Array, Hash, String...)
+    def initialize(expression, convert = false)
+      @final_transform = nil
+      @expression = expression
+      @path = []
+      @convert = convert
+      parse(expression)
+    end
+    # Access data from the expression
+    def access(binding, framework = nil, instance = nil, arguments = nil, cbdata = nil, last_return = nil)
+      env = [framework, instance, arguments, cbdata, last_return]
+      value = nil
+      @path.each do |component|
+        value = resolve_component(value, component, binding, env)
+      end
+      value
+    end
+    # access and transform expression for the given binding
+    def resolve(*args)
+      value = access(*args)
+      value = transform(value) if @final_transform
+      return convert(value) if @convert
+      value
     end
-    return convert(value) if @convert
-    value
-  end
-  protected
+    protected
-  STRING_KIND = 'string'.freeze
-  SYMBOL_KIND = 'symbol'.freeze
-  INTEGER_KIND = 'integer'.freeze
-  LOCAL_VAR_KIND = 'local-variable'.freeze
-  INSTANCE_VAR_KIND = 'instance-variable'.freeze
-  CLASS_VAR_KIND = 'class-variable'.freeze
-  GLOBAL_VAR_KIND = 'global-variable'.freeze
-  CONSTANT_KIND = 'constant'.freeze
-  METHOD_KIND = 'method'.freeze
-  INDEX_KIND = 'index'.freeze
-  SQREEN_VAR_KIND = 'sqreen-variable'.freeze
+    STRING_KIND = 'string'.freeze
+    SYMBOL_KIND = 'symbol'.freeze
+    INTEGER_KIND = 'integer'.freeze
+    LOCAL_VAR_KIND = 'local-variable'.freeze
+    INSTANCE_VAR_KIND = 'instance-variable'.freeze
+    CLASS_VAR_KIND = 'class-variable'.freeze
+    GLOBAL_VAR_KIND = 'global-variable'.freeze
+    CONSTANT_KIND = 'constant'.freeze
+    METHOD_KIND = 'method'.freeze
+    INDEX_KIND = 'index'.freeze
+    SQREEN_VAR_KIND = 'sqreen-variable'.freeze
-  if binding.respond_to?(:local_variable_get)
-    def get_local(name, bind)
-      bind.local_variable_get(name)
+    if binding.respond_to?(:local_variable_get)
+      def get_local(name, bind)
+        bind.local_variable_get(name)
+      end
+    else
+      def get_local(name, bind)
+        eval(name, bind)
+      end
     end
-  else
-    def get_local(name, bind)
-      eval(name, bind)
+    def resolve_component(current_value, component, binding, env)
+      case component[:kind]
+      when STRING_KIND, SYMBOL_KIND, INTEGER_KIND
+        component[:value]
+      when LOCAL_VAR_KIND
+        get_local(component[:value], binding)
+      when INSTANCE_VAR_KIND
+        current_value.instance_variable_get("@#{component[:value]}")
+      when CLASS_VAR_KIND
+        current_value.class.class_variable_get("@@#{component[:value]}")
+      when GLOBAL_VAR_KIND
+        instance_eval("$#{component[:value]}")
+      when CONSTANT_KIND
+        if current_value
+          current_value.const_get(component[:value].to_s)
+        else
+          Object.const_get(component[:value].to_s)
+        end
+      when METHOD_KIND
+        current_value.send(component[:value])
+      when INDEX_KIND
+        current_value[component[:value]]
+      when SQREEN_VAR_KIND
+        resolve_sqreen_variable(component[:value], *env)
+      else
+        raise "Do not know how to handle this component #{component.inspect}"
+      end
     end
-  end
-  def resolve_component(current_value, component, binding, env)
-    case component[:kind]
-    when STRING_KIND, SYMBOL_KIND, INTEGER_KIND
-      component[:value]
-    when LOCAL_VAR_KIND
-      get_local(component[:value], binding)
-    when INSTANCE_VAR_KIND
-      current_value.instance_variable_get("@#{component[:value]}")
-    when CLASS_VAR_KIND
-      current_value.class.class_variable_get("@@#{component[:value]}")
-    when GLOBAL_VAR_KIND
-      instance_eval("$#{component[:value]}")
-    when CONSTANT_KIND
-      if current_value
-        current_value.const_get(component[:value].to_s)
+    def resolve_sqreen_variable(what, framework, instance, args, cbdata, rv)
+      case what
+      when 'data'
+        cbdata
+      when 'rv'
+        rv
+      when 'args'
+        args
+      when 'inst'
+        instance
       else
-        Object.const_get(component[:value].to_s)
+        framework.send(what)
       end
-    when METHOD_KIND
-      current_value.send(component[:value])
-    when INDEX_KIND
-      current_value[component[:value]]
-    when SQREEN_VAR_KIND
-      resolve_sqreen_variable(component[:value], *env)
-    else
-      raise "Do not know how to handle this component #{component.inspect}"
     end
-  end
-  def resolve_sqreen_variable(what, framework, instance, args, cbdata, rv)
-    case what
-    when 'data'
-      cbdata
-    when 'rv'
-      rv
-    when 'args'
-      args
-    when 'inst'
-      instance
-    else
-      framework.send(what)
+    def parse(expression)
+      expression = extract_transform(expression)
+      @scan = StringScanner.new(expression)
+      until @scan.eos?
+        pos = @scan.pos
+        scalar = scan_scalar
+        if scalar
+          @path.push scalar
+          return
+        end
+        if @path.empty?
+          scan_push_variable
+        else
+          scan_push_method
+        end
+        scan_push_indexes
+        scan_push_more_constant if @scan.scan(/\./).nil?
+        raise Sqreen::Exception, error_state('Scan stuck') if @scan.pos == pos
+      end
+    ensure
+      @scan = nil
+    end
+    def extract_transform(expression)
+      parts = expression.split('|')
+      self.final_transform = parts.pop if parts.size > 1
+      parts.join('|').rstrip
     end
-  end
-  def parse(expression)
-    @scan = StringScanner.new(expression)
-    until @scan.eos?
-      pos = @scan.pos
-      scalar = scan_scalar
-      if scalar
-        @path.push scalar
-        return
+    def final_transform=(transform)
+      transform.strip!
+      unless KNOWN_TRANSFORMS.include?(transform)
+        raise Sqreen::Exception, "Invalid transform #{transform}"
       end
-      if @path.empty?
-        scan_push_variable
-      else
-        scan_push_method
+      @final_transform = transform
+    end
+    def scan_scalar
+      if @scan.scan(/\d+/)
+        PathElem.new(INTEGER_KIND, @scan[0].to_i)
+      elsif @scan.scan(/:(\w+)/)
+        PathElem.new(SYMBOL_KIND, @scan[1].to_sym)
+      elsif @scan.scan(/'((?:\\.|[^\\'])*)'/)
+        PathElem.new(STRING_KIND, @scan[1])
       end
-      scan_push_indexes
-      scan_push_more_constant if @scan.scan(/\./).nil?
-      raise error_state('Scan stuck') if @scan.pos == pos
     end
-  ensure
-    @scan = nil
-  end
-  def scan_scalar
-    if @scan.scan(/\d+/)
-      return PathElem.new(INTEGER_KIND, @scan[0].to_i)
-    elsif @scan.scan(/:(\w+)/)
-      return PathElem.new(SYMBOL_KIND, @scan[1].to_sym)
-    elsif @scan.scan(/'((?:\\.|[^\\'])*)'/)
-      return PathElem.new(STRING_KIND, @scan[1])
+    RUBY_IDENTIFIER_CHAR = if ''.respond_to? :encoding
+                             '[\w\u0080-\u{10ffff}]'
+                           else
+                             '[\w\x80-\xFF]'
+                           end
+    def scan_push_constant
+      return unless @scan.scan(/([A-Z]#{RUBY_IDENTIFIER_CHAR}+)/)
+      @path << PathElem.new(CONSTANT_KIND, @scan[1])
     end
-  end
-  RUBY_IDENTIFIER_CHAR = if ''.respond_to? :encoding
-                           '[\w\u0080-\u{10ffff}]'
-                         else
-                           '[\w\x80-\xFF]'
-                         end
+    def scan_push_more_constant
+      while @scan.scan(/::/)
+        unless scan_push_constant
+          raise Sqreen::Exception, error_state('No more constant')
+        end
+      end
+    end
-  def scan_push_constant
-    return unless @scan.scan(/([A-Z]#{RUBY_IDENTIFIER_CHAR}+)/)
-    @path << PathElem.new(CONSTANT_KIND, @scan[1])
-  end
+    def scan_push_variable
+      if @scan.scan(/\$(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(GLOBAL_VAR_KIND, @scan[1])
+      elsif @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
+      elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
+      elsif @scan.scan(/#\.(\w+)/)
+        @path << PathElem.new(SQREEN_VAR_KIND, @scan[1])
+      elsif scan_push_constant
+        nil
+      elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/u)
+        @path << PathElem.new(LOCAL_VAR_KIND, @scan[1])
+      end
+    end
-  def scan_push_more_constant
-    while @scan.scan(/::/)
-      raise error_state('No more constant') unless scan_push_constant
+    def scan_push_method
+      if @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
+      elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
+      elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(METHOD_KIND, @scan[1])
+      end
     end
-  end
-  def scan_push_variable
-    if @scan.scan(/\$(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(GLOBAL_VAR_KIND, @scan[1])
-    elsif @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
-    elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
-    elsif @scan.scan(/#\.(\w+)/)
-      return @path << PathElem.new(SQREEN_VAR_KIND, @scan[1])
-    elsif scan_push_constant
-      return
-    elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/u)
-      return @path << PathElem.new(LOCAL_VAR_KIND, @scan[1])
+    def scan_push_indexes
+      while @scan.scan(/\[/)
+        scalar = scan_scalar
+        raise Sqreen::Exception, error_state('Invalid index') unless scalar
+        unless @scan.scan(/\]/)
+          raise Sqreen::Exception, error_state('Unfinished index')
+        end
+        @path << PathElem.new(INDEX_KIND, scalar[:value])
+      end
     end
-  end
-  def scan_push_method
-    if @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
-    elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
-    elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(METHOD_KIND, @scan[1])
+    def error_state(msg)
+      "#{msg} at #{@scan.pos} after #{@scan.string[0...@scan.pos]} (#{@scan.string})"
     end
-  end
-  def scan_push_indexes
-    while @scan.scan(/\[/)
-      scalar = scan_scalar
-      raise error_state('Invalid index') unless scalar
-      raise error_state('Unfinished index') unless @scan.scan(/\]/)
-      @path << PathElem.new(INDEX_KIND, scalar[:value])
+    def convert(value)
+      case value
+      when ::Exception
+        { 'message' => value.message, 'backtrace' => value.backtrace }
+      else
+        value
+      end
     end
-  end
-  def error_state(msg)
-    "#{msg} at #{@scan.pos} after #{@scan.string[0...@scan.pos]} (#{@scan.string})"
-  end
+    # Available final transformations
+    module Transforms
+      def flat_keys(value, max_iter = 1000)
+        return nil if value.nil?
+        seen = Set.new
+        look_into = [value]
+        keys = []
+        idx = 0
+        until look_into.empty? || max_iter <= idx
+          idx += 1
+          val = look_into.pop
+          next unless seen.add?(val.object_id)
+          case val
+          when Hash
+            keys.concat(val.keys)
+            look_into.concat(val.values)
+          when Array
+            look_into.concat(val)
+          else
+            val.each { |v| look_into << v } if val.respond_to?(:each)
+          end
+        end
+        keys
+      end
-  def convert(value)
-    case value
-    when Exception
-      return { 'message' => value.message, 'backtrace' => value.backtrace }
-    else
-      return value
+      def flat_values(value, max_iter = 1000)
+        return nil if value.nil?
+        seen = Set.new
+        look_into = [value]
+        values = []
+        idx = 0
+        until look_into.empty? || max_iter <= idx
+          idx += 1
+          val = look_into.shift
+          next unless seen.add?(val.object_id)
+          case val
+          when Hash
+            look_into.concat(val.values)
+          when Array
+            look_into.concat(val)
+          else
+            if val.respond_to?(:each)
+              val.each { |v| look_into << v }
+            else
+              values << val
+            end
+          end
+        end
+        values
+      end
+    end
+    include Transforms
+    KNOWN_TRANSFORMS = Transforms.public_instance_methods.map(&:to_s)
+    def transform(value)
+      send(@final_transform, value) if @final_transform
     end
   end
 end