sqreen 1.9.1-java → 1.9.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 37d3a22e3058785af671a89e73cc469b60fdd010
-  data.tar.gz: 347a2279b06c9ec23e06b8a054239f44e77b41c1
+  metadata.gz: ad04bee0a61218373cab51d02d3690ddd5f19021
+  data.tar.gz: f4921ac550a7801022795f66f959a2e5e1ebd8e4
 SHA512:
-  metadata.gz: 1c71b83145340e66c5c9665592cb66d7352218a9430c6fbf29027e58f43655e89050dd58b36964230f0addd3afb5a014524cf1acf802cee6222636037e00d022
-  data.tar.gz: c3c70217629d3f13f6b24546bd2fc373f84a0972008c42651aeac3d5cfa5e20e4caf159f7892695fd2b61d6a1b5142417afb9bc226b87d161cd60c95d37698ad
+  metadata.gz: 4ed1ca9938ab9bcb1b6277641ac1470270f3c9bd350a32e5f58eb9ca9bf7fb42c1a6951fd7cc1f5d97ea40a6cd79aa76e970f1b166823bc15610b9eafb940de7
+  data.tar.gz: aacc4964978719bf65037639a063a9c8a5d00eaad956fb81c1f9f579e997f38b5fb7f064a1bbd460a9748471ec0db62be5d350c45d34c355ffd7480639f0b3cd

data/lib/sqreen/events/request_record.rb

@@ -14,18 +14,26 @@ module Sqreen
     def to_hash
       res = { :version => '20171208' }
       if payload[:observed]
-        res[:observed] = payload[:observed]
+        res[:observed] = payload[:observed].dup
         rulespack = nil
-        observed.fetch(:attacks, []).each do |att|
-          rulespack = att.delete(:rulespack_id) || rulespack
+        if observed[:attacks]
+          res[:observed][:attacks] = observed[:attacks].map do |att|
+            natt = att.dup
+            rulespack = natt.delete(:rulespack_id) || rulespack
+            natt
+          end
         end
-        observed.fetch(:sqreen_exceptions, []).each do |exc|
-          excp = exc.delete(:exception)
-          if excp
-            exc[:message] = excp.message
-            exc[:klass] = excp.class.name
+        if observed[:sqreen_exceptions]
+          res[:observed][:sqreen_exceptions] = observed[:sqreen_exceptions].map do |exc|
+            nex = exc.dup
+            excp = nex.delete(:exception)
+            if excp
+              nex[:message] = excp.message
+              nex[:klass] = excp.class.name
+            end
+            rulespack = nex.delete(:rulespack_id) || rulespack
+            nex
           end
-          rulespack = exc.delete(:rulespack_id) || rulespack
         end
         res[:rulespack_id] = rulespack unless rulespack.nil?
         if observed[:observations]
@@ -34,14 +42,14 @@ module Sqreen
           end
         end
         if observed[:sdk]
-          payload[:observed][:sdk] = observed[:sdk].map do |meth, time, *args|
+          res[:observed][:sdk] = observed[:sdk].map do |meth, time, *args|
             { :name => meth, :time => time, :args => args }
           end
         end
       end
       res[:local] = payload['local'] if payload['local']
       if payload['request']
-        res[:request] = payload['request']
+        res[:request] = payload['request'].dup
         res[:client_ip] = res[:request].delete(:client_ip) if res[:request][:client_ip]
       else
         res[:request] = {}

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -27,6 +27,29 @@ module Sqreen
         true
       end
     end
+    class ReflectedUnsafeXSSCB < XSSCB
+      def pre(_inst, *args, &_block)
+        value = args[0]
+
+        return unless value.is_a?(String)
+
+        # Sqreen::log.debug value
+
+        return unless framework.params_include?(value)
+
+        Sqreen.log.debug { format('Found unescaped user param: %s', value) }
+
+        saved_value = value.dup
+        return unless report_dangerous_xss?(saved_value)
+
+        # potential XSS! let's escape
+        if block
+          args[0].replace(CGI.escape_html(value))
+        end
+
+        advise_action(nil)
+      end
+    end
     # look for reflected XSS with erb template engine
     class ReflectedXSSCB < XSSCB
       def pre(_inst, *args, &_block)

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.9.1'.freeze
+  VERSION = '1.9.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.9.1
+  version: 1.9.2
 platform: java
 authors:
 - Sqreen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-01-23 00:00:00.000000000 Z
+date: 2018-02-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs