sqreen 1.9.1 → 1.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: acdbd441e6a336b097173d0945efa941df670e24
-  data.tar.gz: 7608472b65debb8c64d5820ac1b7076edb876202
+  metadata.gz: e18e5e4043a3cb2cfa23b0de7e196fb36b2cb180
+  data.tar.gz: 62cc6f1b5b08aa6b01b9401085dea466e45bb2bc
 SHA512:
-  metadata.gz: d432c4a0e7a22e4b1d7dcfe7932e63253a498c076b45cdc3bb9bde767ca97f4d874f0df74dba2b2e1d946b88b0646040ac37f22206b2cc1694d177912bf9300d
-  data.tar.gz: 6df07a63fc61a412ed1c51504a6ef9d2fe40022272563b5226d10204db58c28c248f3a1f9fd8b20be791c689e87955aef8f7a7f7aa0e38b2f1fdad76a809a07e
+  metadata.gz: 0217afc0de67b065771e9cb102b94c12c6885ffd27031043f96fc14af7754b0f25a845c1a44a69b7dc5ef798f72300a4fc657aea583dab71398ebae01ad75c30
+  data.tar.gz: 929ae4a93889afb4ec576932c7e92993c9e52385f247d2bab928796ae6cb07037ccfad1fe42d53d459918f1024460003f5c74b0aa30d46ad1900c0cfedee23b1

data/lib/sqreen/events/request_record.rb

@@ -14,18 +14,26 @@ module Sqreen
     def to_hash
       res = { :version => '20171208' }
       if payload[:observed]
-        res[:observed] = payload[:observed]
+        res[:observed] = payload[:observed].dup
         rulespack = nil
-        observed.fetch(:attacks, []).each do |att|
-          rulespack = att.delete(:rulespack_id) || rulespack
+        if observed[:attacks]
+          res[:observed][:attacks] = observed[:attacks].map do |att|
+            natt = att.dup
+            rulespack = natt.delete(:rulespack_id) || rulespack
+            natt
+          end
         end
-        observed.fetch(:sqreen_exceptions, []).each do |exc|
-          excp = exc.delete(:exception)
-          if excp
-            exc[:message] = excp.message
-            exc[:klass] = excp.class.name
+        if observed[:sqreen_exceptions]
+          res[:observed][:sqreen_exceptions] = observed[:sqreen_exceptions].map do |exc|
+            nex = exc.dup
+            excp = nex.delete(:exception)
+            if excp
+              nex[:message] = excp.message
+              nex[:klass] = excp.class.name
+            end
+            rulespack = nex.delete(:rulespack_id) || rulespack
+            nex
           end
-          rulespack = exc.delete(:rulespack_id) || rulespack
         end
         res[:rulespack_id] = rulespack unless rulespack.nil?
         if observed[:observations]
@@ -34,14 +42,14 @@ module Sqreen
           end
         end
         if observed[:sdk]
-          payload[:observed][:sdk] = observed[:sdk].map do |meth, time, *args|
+          res[:observed][:sdk] = observed[:sdk].map do |meth, time, *args|
             { :name => meth, :time => time, :args => args }
           end
         end
       end
       res[:local] = payload['local'] if payload['local']
       if payload['request']
-        res[:request] = payload['request']
+        res[:request] = payload['request'].dup
         res[:client_ip] = res[:request].delete(:client_ip) if res[:request][:client_ip]
       else
         res[:request] = {}

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -27,6 +27,29 @@ module Sqreen
         true
       end
     end
+    class ReflectedUnsafeXSSCB < XSSCB
+      def pre(_inst, *args, &_block)
+        value = args[0]
+
+        return unless value.is_a?(String)
+
+        # Sqreen::log.debug value
+
+        return unless framework.params_include?(value)
+
+        Sqreen.log.debug { format('Found unescaped user param: %s', value) }
+
+        saved_value = value.dup
+        return unless report_dangerous_xss?(saved_value)
+
+        # potential XSS! let's escape
+        if block
+          args[0].replace(CGI.escape_html(value))
+        end
+
+        advise_action(nil)
+      end
+    end
     # look for reflected XSS with erb template engine
     class ReflectedXSSCB < XSSCB
       def pre(_inst, *args, &_block)

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.9.1'.freeze
+  VERSION = '1.9.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.9.1
+  version: 1.9.2
 platform: ruby
 authors:
 - Sqreen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-23 00:00:00.000000000 Z
+date: 2018-02-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs