RubyGems - sqreen - Versions diffs - 1.5.0 → 1.6.0 - Mend

sqreen 1.5.0 → 1.6.0

Files changed (15) hide show

checksums.yaml +4 -4
data/lib/sqreen/attack_detected.html +2 -0
data/lib/sqreen/binding_accessor.rb +247 -157
data/lib/sqreen/condition_evaluator.rb +191 -189
data/lib/sqreen/frameworks/generic.rb +6 -0
data/lib/sqreen/frameworks/rails.rb +1 -0
data/lib/sqreen/frameworks/sinatra.rb +18 -0
data/lib/sqreen/middleware.rb +10 -0
data/lib/sqreen/rules_callbacks.rb +3 -0
data/lib/sqreen/rules_callbacks/binding_accessor_matcher.rb +75 -0
data/lib/sqreen/rules_callbacks/custom_error.rb +57 -0
data/lib/sqreen/rules_callbacks/execjs.rb +4 -7
data/lib/sqreen/rules_callbacks/matcher_rule.rb +26 -20
data/lib/sqreen/version.rb +1 -1
metadata +6 -3

checksums.yaml CHANGED

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6d96899ae72184cb34509aab39eba75cb2ba0cf8
-  data.tar.gz: 4201f6dbc906404d35dfb4352a32f4b1b2cc9775
+  metadata.gz: bc6cce74b4d4613315018a182cc2d908cef00eb0
+  data.tar.gz: 3aee24c4aff6693fd17f9333408a1b012f468ae5
 SHA512:
-  metadata.gz: 63b4dc8db5a2709f720614ecf0e8b57fd91648ce02124a6fafd083435aa3c8d7e6c1de5b877c4b65be1aa9e7adb5214b93861b93e3e50d842d21f74967b76570
-  data.tar.gz: f589404093b80c59cf48680f4de58b2b3e8ebd164f5912ed4daa4b6a8c3b0de0348581fab382ae912ae4e5cc134d3883818f13e6c86998e833e65fc043c83b4b
+  metadata.gz: 156f389b4753efe02dab840026988ab5981417a79f95a9d540dc3941ce66761354feafed02b07cb4adab50bb10fce0a5bff0162f8f7b5f5195a25a6c15aa0828
+  data.tar.gz: 737febf536e98c7fd1753c0e4d55f843c2546fe3ae010e167dfbe83b0351628146f3ca0b27f7b24cb2800ffdd37f9ec993ab3b6b1eb59b4dae46f1b8a71cb835

data/lib/sqreen/attack_detected.html ADDED

	@@ -0,0 +1,2 @@
1	+ <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <title>Sqreen has detected an attack.</title> <style>html,body,div,span,h1,a{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1}svg,h1,p{display:block}svg{margin:0 auto 4vh}h1{font-family:sans-serif;font-weight:300;font-size:34px;color:#384886;line-height:normal}p{font-size:18px;line-height:normal;color:#b8bccc;font-family:sans-serif;font-weight:300}a{color:#b8bccc}.flex{text-align:center}</style></head><body> <div class="flex"> <svg xmlns="http://www.w3.org/2000/svg" width="230" height="250" xmlns:xlink="http://www.w3.org/1999/xlink"> <defs> <path id="b" d="M176.55 22.93v-.03c-.17-1.13-.8-2.1-1.9-2.77C170.93 18.07 136.8.03 88.98 0 40.25 0 4.8 19.28 3.28 20.14c-.98.6-1.63 1.6-1.77 2.72-14.8 123.1 84.7 176.2 85.7 176.7.6.3 1.2.44 1.8.44.6 0 1.2-.15 1.7-.42 1-.52 100.4-55.03 85.9-176.65z"/> <filter id="a" width="151.7%" height="146%" x="-25.8%" y="-16%" filterUnits="objectBoundingBox"> <feOffset dy="14" in="SourceAlpha" result="shadowOffsetOuter1"/> <feGaussianBlur stdDeviation="13" in="shadowOffsetOuter1" result="shadowBlurOuter1"/> <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0" in="shadowBlurOuter1"/> </filter> </defs> <g fill="none" fill-rule="evenodd"> <g fill-rule="nonzero" transform="translate(26 12)"> <use fill="#000" filter="url(#a)" xlink:href="#b"/> <use fill="#FFF" fill-rule="evenodd" xlink:href="#b"/> </g> <path fill="#374886" d="M153.85 75.8s0 .68-.35 1.13c-.46.57-8.52 10.74-12.32 15.6-3.8 4.98-11.52 2.26-11.52 2.26s2.54-1.5 4.15-3.4c4.3-5.3 12.5-15.7 12.5-15.7s-8.2-10.2-12.4-15.6c-1.5-2-4.1-3.4-4.1-3.4s7.7-2.6 11.5 2.2c3.8 4.9 11.9 15.1 12.2 15.7.5.4.5 1.1.5 1.1m-78 .1s0 .6.4 1.1c.4.4 8.5 10.7 12.2 15.6 3.7 4.8 11.5 2.2 11.5 2.2s-2.5-1.5-4.1-3.4c-4.3-5.2-12.5-15.5-12.5-15.5l12.4-15.7c1.5-2 4.2-3.4 4.2-3.4s-7.7-2.6-11.5 2.2C84.8 63.7 76.9 74 76.5 74.6c-.32.55-.44 1.12-.44 1.12M115 62.82c-7.03 0-12.9 5.78-12.9 12.9s5.75 12.9 12.9 12.9c7.13 0 12.9-5.8 12.9-12.9s-5.9-12.9-12.9-12.9m-33.38 58.6c3.46 0 5.4-1.77 5.4-4.1 0-5.15-7.4-3.56-7.4-5.47 0-.8.78-1.3 1.97-1.3 1.5 0 2.9.6 3.7 1.5l1.3-2.3c-1.3-1-2.9-1.8-5.1-1.8-3.3 0-5.1 1.9-5.1 4 0 5 7.5 3.3 7.5 5.4 0 .8-.6 1.4-2.1 1.4s-3.4-.9-4.3-1.8l-1.4 2.4c1.4 1.2 3.4 2 5.6 2zm13.53-3c-1.8 0-3.1-1.5-3.1-3.7s1.3-3.7 3.2-3.7c1.1 0 2.3.6 2.8 1.44v4.5c-.5.8-1.7 1.46-2.8 1.46zm-1 3c1.5 0 2.9-.64 3.9-1.96v6.5h3.3v-17.63H98v1.6c-.96-1.23-2.33-1.92-3.86-1.92-3.2 0-5.52 2.5-5.52 6.7 0 4.3 2.33 6.7 5.53 6.7zm13.7-.32v-8.42c.6-.8 2-1.4 3.1-1.4.4 0 .7.1.9.1v-3.3c-1.5 0-3.1 1-3.9 2.1v-1.7h-3.3v12.8h3.3zm11.9.33c2 0 3.9-.6 5.2-1.77l-1.4-2.2c-.8.8-2.26 1.2-3.32 1.2-2.1 0-3.4-1.4-3.6-3h9.3v-.7c0-4.2-2.53-7.1-6.25-7.1-3.8 0-6.45 3-6.45 6.7 0 4.05 2.8 6.7 6.6 6.7zm2.9-7.9h-6.1c.2-1.27 1.07-2.83 3.1-2.83 2.18 0 3 1.6 3.08 2.87zm11.4 7.9c2 0 3.9-.6 5.2-1.77l-1.42-2.2c-.8.8-2.3 1.2-3.34 1.2-2.2 0-3.4-1.4-3.6-3h9.2v-.7c0-4.2-2.6-7.1-6.3-7.1-3.8 0-6.4 3-6.4 6.7 0 4.05 2.82 6.7 6.62 6.7zm2.9-7.9h-6.1c.17-1.27 1.05-2.83 3.1-2.83 2.2 0 3 1.6 3.1 2.87zm17.3 7.58v-9c0-2.5-1.3-4-4.03-4-2.08 0-3.6 1-4.4 2v-1.64h-3.3v12.76h3.3v-8.6c.53-.74 1.53-1.5 2.82-1.5 1.4 0 2.3.63 2.3 2.4v7.7h3.2z"/> </g> </svg> <h1>Uh Oh! Sqreen has detected an attack.</h1> <p>If you are the application owner, check the Sqreen <a href="https://my.sqreen.io/">dashboard</a> for more information.</p></div></body></html>
2	+

data/lib/sqreen/binding_accessor.rb CHANGED

@@ -2,195 +2,285 @@
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 require 'strscan'
+require 'sqreen/exception'
+require 'set'
-# the value located at the given binding
-class BindingAccessor
-  PathElem = Struct.new(:kind, :value)
-  attr_reader :path, :expression
-  # Expression to be accessed
-  # @param expression [String] expression to read
-  # @param convert [Boolean] wheter to convert objects to simpler types (Array, Hash, String...)
-  def initialize(expression, convert = false)
-    @expression = expression
-    @path = []
-    @convert = convert
-    parse(expression)
-  end
+module Sqreen
+  # the value located at the given binding
+  class BindingAccessor
+    PathElem = Struct.new(:kind, :value)
+    attr_reader :path, :expression, :final_transform
-  # Resolve this expression for the give binding
-  def resolve(binding, framework = nil, instance = nil, arguments = nil, cbdata = nil, last_return = nil)
-    env = [framework, instance, arguments, cbdata, last_return]
-    value = nil
-    @path.each do |component|
-      value = resolve_component(value, component, binding, env)
+    # Expression to be accessed
+    # @param expression [String] expression to read
+    # @param convert [Boolean] wheter to convert objects to
+    #                          simpler types (Array, Hash, String...)
+    def initialize(expression, convert = false)
+      @final_transform = nil
+      @expression = expression
+      @path = []
+      @convert = convert
+      parse(expression)
+    end
+    # Access data from the expression
+    def access(binding, framework = nil, instance = nil, arguments = nil, cbdata = nil, last_return = nil)
+      env = [framework, instance, arguments, cbdata, last_return]
+      value = nil
+      @path.each do |component|
+        value = resolve_component(value, component, binding, env)
+      end
+      value
+    end
+    # access and transform expression for the given binding
+    def resolve(*args)
+      value = access(*args)
+      value = transform(value) if @final_transform
+      return convert(value) if @convert
+      value
     end
-    return convert(value) if @convert
-    value
-  end
-  protected
+    protected
-  STRING_KIND = 'string'.freeze
-  SYMBOL_KIND = 'symbol'.freeze
-  INTEGER_KIND = 'integer'.freeze
-  LOCAL_VAR_KIND = 'local-variable'.freeze
-  INSTANCE_VAR_KIND = 'instance-variable'.freeze
-  CLASS_VAR_KIND = 'class-variable'.freeze
-  GLOBAL_VAR_KIND = 'global-variable'.freeze
-  CONSTANT_KIND = 'constant'.freeze
-  METHOD_KIND = 'method'.freeze
-  INDEX_KIND = 'index'.freeze
-  SQREEN_VAR_KIND = 'sqreen-variable'.freeze
+    STRING_KIND = 'string'.freeze
+    SYMBOL_KIND = 'symbol'.freeze
+    INTEGER_KIND = 'integer'.freeze
+    LOCAL_VAR_KIND = 'local-variable'.freeze
+    INSTANCE_VAR_KIND = 'instance-variable'.freeze
+    CLASS_VAR_KIND = 'class-variable'.freeze
+    GLOBAL_VAR_KIND = 'global-variable'.freeze
+    CONSTANT_KIND = 'constant'.freeze
+    METHOD_KIND = 'method'.freeze
+    INDEX_KIND = 'index'.freeze
+    SQREEN_VAR_KIND = 'sqreen-variable'.freeze
-  if binding.respond_to?(:local_variable_get)
-    def get_local(name, bind)
-      bind.local_variable_get(name)
+    if binding.respond_to?(:local_variable_get)
+      def get_local(name, bind)
+        bind.local_variable_get(name)
+      end
+    else
+      def get_local(name, bind)
+        eval(name, bind)
+      end
     end
-  else
-    def get_local(name, bind)
-      eval(name, bind)
+    def resolve_component(current_value, component, binding, env)
+      case component[:kind]
+      when STRING_KIND, SYMBOL_KIND, INTEGER_KIND
+        component[:value]
+      when LOCAL_VAR_KIND
+        get_local(component[:value], binding)
+      when INSTANCE_VAR_KIND
+        current_value.instance_variable_get("@#{component[:value]}")
+      when CLASS_VAR_KIND
+        current_value.class.class_variable_get("@@#{component[:value]}")
+      when GLOBAL_VAR_KIND
+        instance_eval("$#{component[:value]}")
+      when CONSTANT_KIND
+        if current_value
+          current_value.const_get(component[:value].to_s)
+        else
+          Object.const_get(component[:value].to_s)
+        end
+      when METHOD_KIND
+        current_value.send(component[:value])
+      when INDEX_KIND
+        current_value[component[:value]]
+      when SQREEN_VAR_KIND
+        resolve_sqreen_variable(component[:value], *env)
+      else
+        raise "Do not know how to handle this component #{component.inspect}"
+      end
     end
-  end
-  def resolve_component(current_value, component, binding, env)
-    case component[:kind]
-    when STRING_KIND, SYMBOL_KIND, INTEGER_KIND
-      component[:value]
-    when LOCAL_VAR_KIND
-      get_local(component[:value], binding)
-    when INSTANCE_VAR_KIND
-      current_value.instance_variable_get("@#{component[:value]}")
-    when CLASS_VAR_KIND
-      current_value.class.class_variable_get("@@#{component[:value]}")
-    when GLOBAL_VAR_KIND
-      instance_eval("$#{component[:value]}")
-    when CONSTANT_KIND
-      if current_value
-        current_value.const_get(component[:value].to_s)
+    def resolve_sqreen_variable(what, framework, instance, args, cbdata, rv)
+      case what
+      when 'data'
+        cbdata
+      when 'rv'
+        rv
+      when 'args'
+        args
+      when 'inst'
+        instance
       else
-        Object.const_get(component[:value].to_s)
+        framework.send(what)
       end
-    when METHOD_KIND
-      current_value.send(component[:value])
-    when INDEX_KIND
-      current_value[component[:value]]
-    when SQREEN_VAR_KIND
-      resolve_sqreen_variable(component[:value], *env)
-    else
-      raise "Do not know how to handle this component #{component.inspect}"
     end
-  end
-  def resolve_sqreen_variable(what, framework, instance, args, cbdata, rv)
-    case what
-    when 'data'
-      cbdata
-    when 'rv'
-      rv
-    when 'args'
-      args
-    when 'inst'
-      instance
-    else
-      framework.send(what)
+    def parse(expression)
+      expression = extract_transform(expression)
+      @scan = StringScanner.new(expression)
+      until @scan.eos?
+        pos = @scan.pos
+        scalar = scan_scalar
+        if scalar
+          @path.push scalar
+          return
+        end
+        if @path.empty?
+          scan_push_variable
+        else
+          scan_push_method
+        end
+        scan_push_indexes
+        scan_push_more_constant if @scan.scan(/\./).nil?
+        raise Sqreen::Exception, error_state('Scan stuck') if @scan.pos == pos
+      end
+    ensure
+      @scan = nil
+    end
+    def extract_transform(expression)
+      parts = expression.split('|')
+      self.final_transform = parts.pop if parts.size > 1
+      parts.join('|').rstrip
     end
-  end
-  def parse(expression)
-    @scan = StringScanner.new(expression)
-    until @scan.eos?
-      pos = @scan.pos
-      scalar = scan_scalar
-      if scalar
-        @path.push scalar
-        return
+    def final_transform=(transform)
+      transform.strip!
+      unless KNOWN_TRANSFORMS.include?(transform)
+        raise Sqreen::Exception, "Invalid transform #{transform}"
       end
-      if @path.empty?
-        scan_push_variable
-      else
-        scan_push_method
+      @final_transform = transform
+    end
+    def scan_scalar
+      if @scan.scan(/\d+/)
+        PathElem.new(INTEGER_KIND, @scan[0].to_i)
+      elsif @scan.scan(/:(\w+)/)
+        PathElem.new(SYMBOL_KIND, @scan[1].to_sym)
+      elsif @scan.scan(/'((?:\\.|[^\\'])*)'/)
+        PathElem.new(STRING_KIND, @scan[1])
       end
-      scan_push_indexes
-      scan_push_more_constant if @scan.scan(/\./).nil?
-      raise error_state('Scan stuck') if @scan.pos == pos
     end
-  ensure
-    @scan = nil
-  end
-  def scan_scalar
-    if @scan.scan(/\d+/)
-      return PathElem.new(INTEGER_KIND, @scan[0].to_i)
-    elsif @scan.scan(/:(\w+)/)
-      return PathElem.new(SYMBOL_KIND, @scan[1].to_sym)
-    elsif @scan.scan(/'((?:\\.|[^\\'])*)'/)
-      return PathElem.new(STRING_KIND, @scan[1])
+    RUBY_IDENTIFIER_CHAR = if ''.respond_to? :encoding
+                             '[\w\u0080-\u{10ffff}]'
+                           else
+                             '[\w\x80-\xFF]'
+                           end
+    def scan_push_constant
+      return unless @scan.scan(/([A-Z]#{RUBY_IDENTIFIER_CHAR}+)/)
+      @path << PathElem.new(CONSTANT_KIND, @scan[1])
     end
-  end
-  RUBY_IDENTIFIER_CHAR = if ''.respond_to? :encoding
-                           '[\w\u0080-\u{10ffff}]'
-                         else
-                           '[\w\x80-\xFF]'
-                         end
+    def scan_push_more_constant
+      while @scan.scan(/::/)
+        unless scan_push_constant
+          raise Sqreen::Exception, error_state('No more constant')
+        end
+      end
+    end
-  def scan_push_constant
-    return unless @scan.scan(/([A-Z]#{RUBY_IDENTIFIER_CHAR}+)/)
-    @path << PathElem.new(CONSTANT_KIND, @scan[1])
-  end
+    def scan_push_variable
+      if @scan.scan(/\$(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(GLOBAL_VAR_KIND, @scan[1])
+      elsif @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
+      elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
+      elsif @scan.scan(/#\.(\w+)/)
+        @path << PathElem.new(SQREEN_VAR_KIND, @scan[1])
+      elsif scan_push_constant
+        nil
+      elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/u)
+        @path << PathElem.new(LOCAL_VAR_KIND, @scan[1])
+      end
+    end
-  def scan_push_more_constant
-    while @scan.scan(/::/)
-      raise error_state('No more constant') unless scan_push_constant
+    def scan_push_method
+      if @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
+      elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
+      elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/)
+        @path << PathElem.new(METHOD_KIND, @scan[1])
+      end
     end
-  end
-  def scan_push_variable
-    if @scan.scan(/\$(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(GLOBAL_VAR_KIND, @scan[1])
-    elsif @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
-    elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
-    elsif @scan.scan(/#\.(\w+)/)
-      return @path << PathElem.new(SQREEN_VAR_KIND, @scan[1])
-    elsif scan_push_constant
-      return
-    elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/u)
-      return @path << PathElem.new(LOCAL_VAR_KIND, @scan[1])
+    def scan_push_indexes
+      while @scan.scan(/\[/)
+        scalar = scan_scalar
+        raise Sqreen::Exception, error_state('Invalid index') unless scalar
+        unless @scan.scan(/\]/)
+          raise Sqreen::Exception, error_state('Unfinished index')
+        end
+        @path << PathElem.new(INDEX_KIND, scalar[:value])
+      end
     end
-  end
-  def scan_push_method
-    if @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(CLASS_VAR_KIND, @scan[1])
-    elsif @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(INSTANCE_VAR_KIND, @scan[1])
-    elsif @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/)
-      return @path << PathElem.new(METHOD_KIND, @scan[1])
+    def error_state(msg)
+      "#{msg} at #{@scan.pos} after #{@scan.string[0...@scan.pos]} (#{@scan.string})"
     end
-  end
-  def scan_push_indexes
-    while @scan.scan(/\[/)
-      scalar = scan_scalar
-      raise error_state('Invalid index') unless scalar
-      raise error_state('Unfinished index') unless @scan.scan(/\]/)
-      @path << PathElem.new(INDEX_KIND, scalar[:value])
+    def convert(value)
+      case value
+      when ::Exception
+        { 'message' => value.message, 'backtrace' => value.backtrace }
+      else
+        value
+      end
     end
-  end
-  def error_state(msg)
-    "#{msg} at #{@scan.pos} after #{@scan.string[0...@scan.pos]} (#{@scan.string})"
-  end
+    # Available final transformations
+    module Transforms
+      def flat_keys(value, max_iter = 1000)
+        return nil if value.nil?
+        seen = Set.new
+        look_into = [value]
+        keys = []
+        idx = 0
+        until look_into.empty? || max_iter <= idx
+          idx += 1
+          val = look_into.pop
+          next unless seen.add?(val.object_id)
+          case val
+          when Hash
+            keys.concat(val.keys)
+            look_into.concat(val.values)
+          when Array
+            look_into.concat(val)
+          else
+            val.each { |v| look_into << v } if val.respond_to?(:each)
+          end
+        end
+        keys
+      end
-  def convert(value)
-    case value
-    when Exception
-      return { 'message' => value.message, 'backtrace' => value.backtrace }
-    else
-      return value
+      def flat_values(value, max_iter = 1000)
+        return nil if value.nil?
+        seen = Set.new
+        look_into = [value]
+        values = []
+        idx = 0
+        until look_into.empty? || max_iter <= idx
+          idx += 1
+          val = look_into.shift
+          next unless seen.add?(val.object_id)
+          case val
+          when Hash
+            look_into.concat(val.values)
+          when Array
+            look_into.concat(val)
+          else
+            if val.respond_to?(:each)
+              val.each { |v| look_into << v }
+            else
+              values << val
+            end
+          end
+        end
+        values
+      end
+    end
+    include Transforms
+    KNOWN_TRANSFORMS = Transforms.public_instance_methods.map(&:to_s)
+    def transform(value)
+      send(@final_transform, value) if @final_transform
     end
   end
 end