sqreen 0.7.01461158029-java

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: e8c011305549e3109c30c68516bf0edc45c940ee
+  data.tar.gz: 6040794b8b829c4a161fb0420ea1a9d7681b3365
+SHA512:
+  metadata.gz: 7aeaee9638c3aa975d4cc1ef111fe20c4daf0f9e755ccc9d8f0e236e34d7cfe7ff0c6b24b5d5eb1587f5bbcb62a090c4427303aaf7cc0085b81218e5e81bc763
+  data.tar.gz: 90cf3ebcf08647027e2b70c057334c832701b48fc384fec4c8006c9febfc31fc1107d21069d935fb7a727a76f7788a30c3f60ae046edb1caf11181c09fe54442

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,22 @@
+# Contributor Code of Conduct
+
+As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities.
+
+We are committed to making participation in this project a harassment-free experience for everyone, regardless of level of experience, gender, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing other's private information, such as physical or electronic addresses, without explicit permission
+* Other unethical or unprofessional conduct.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct. By adopting this Code of Conduct, project maintainers commit themselves to fairly and consistently applying these principles to every aspect of managing this project. Project maintainers who do not follow or enforce the Code of Conduct may be permanently removed from the project team.
+
+This code of conduct applies both within project spaces and in public spaces when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by opening an issue or contacting one or more of the project maintainers.
+
+This Code of Conduct is adapted from the [Contributor Covenant](http://contributor-covenant.org), version 1.2.0, available at [http://contributor-covenant.org/version/1/2/0/](http://contributor-covenant.org/version/1/2/0/)

data/README.md

@@ -0,0 +1,77 @@
+# Sqreen
+
+Auto protection for you application.
+
+Copyright (c) 2015 Sqreen. All Rights Reserved.
+Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'sqreen'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install sqreen
+
+## Configuration
+
+The only required parameter is your application's `token`.
+
+### By file
+- for Rails:
+```shell
+  $ echo token: your_token > /path/to/RailsApp/config/sqreen.yml
+```
+- for anything else:
+```shell
+      $ echo token: your_token > ~/sqreen.yml
+    ```
+
+### By environment:
+    ```shell
+          $ export SQREEN_TOKEN=your_token
+    ```
+
+The following can be set:
+
+*file*      | *environment*
+------------|-------------
+token       | SQREEN_TOKEN
+url         | SQREEN_URL
+verbosity   | SQREEN_VERBOSITY
+local_rules | SQREEN_RULES
+
+SQREEN_RULES allows the agent to use rules that do not come from the server, but
+from a local file.
+
+## Usage
+
+TODO: Write usage instructions here
+
+## Development
+
+```shell
+$ gem install bundler
+$ bundle
+```
+
+Check that everything is all right:
+```shell
+$ bundle exec rake test
+```
+
+Use `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/sqreen/RubyAgent. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](contributor-covenant.org) code of conduct.

data/Rakefile

@@ -0,0 +1,40 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'bundler/gem_tasks'
+require 'rake/testtask'
+
+if RUBY_VERSION >= '1.9.3'
+  require 'ci/reporter/rake/minitest'
+  task :testunit => 'ci:setup:minitest'
+else
+  task :testunit => :test
+end
+
+Rake::TestTask.new do |t|
+  t.pattern = 'test/**/*.rb'
+  t.libs << 'test'
+end
+
+desc 'Run tests'
+task :default => :test
+
+task :pre_build do
+  version = Bundler::GemHelper.new.send(:version)
+  template = <<-EOF.gsub(/^\s{0,3}/m, '')
+  # Copyright (c) 2015 Sqreen. All Rights Reserved.
+  # Please refer to our terms for more information: https://www.sqreen.io/terms.html
+  # Warning This file is auto generated! DO NOT edit.
+
+  module Sqreen
+     VERSION = #{version.to_s.inspect}.freeze
+  end
+  EOF
+  fname = File.join(File.dirname(__FILE__), 'lib', 'sqreen', 'version.rb')
+  File.open(fname, 'w') do |f|
+    f.puts template
+  end
+end
+
+default_build = Rake::Task['build']
+default_build.prerequisites.push(Rake::Task['pre_build'])

data/lib/sqreen.rb

@@ -0,0 +1,67 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'sqreen/instrumentation'
+require 'sqreen/session'
+require 'sqreen/runner'
+require 'sqreen/callbacks'
+require 'sqreen/version'
+require 'sqreen/log'
+require 'sqreen/stats'
+require 'sqreen/exception'
+require 'sqreen/configuration'
+require 'sqreen/events/attack'
+
+require 'thread'
+
+# Auto start the instrumentation.
+
+Sqreen.framework.on_start do |framework|
+  Thread.new do
+    begin
+      runner = nil
+      configuration = Sqreen.config_init(framework)
+      Sqreen.log.debug("Starting Sqreen #{Sqreen::VERSION}")
+      framework.sqreen_configuration = configuration
+      prevent_startup = Sqreen.framework.prevent_startup
+      if !prevent_startup
+        runner = Sqreen::Runner.new(configuration, framework)
+        runner.do_heartbeat
+        runner.run_watcher
+      else
+        Sqreen.log.debug("#{prevent_startup} prevented Sqreen startup")
+      end
+    rescue Sqreen::TokenNotFoundException
+      Sqreen.log.error "Sorry but we couldn't find your Sqreen token.\nYour application is NOT currently protected by Sqreen.\n\nHave you filled your config/sqreen.yml?\n\n"
+    rescue Sqreen::TokenInvalidException
+      Sqreen.log.error "Sorry but your Sqreen token appears to be invalid.\nYour application is NOT currently protected by Sqreen.\n\nHave you correctly filled your config/sqreen.yml?\n\n"
+    rescue Exception => e
+      Sqreen.log.error e.inspect
+      Sqreen.log.info e.backtrace.join("\n")
+      if runner
+        # immediately post exception
+        runner.session.post_sqreen_exception(Sqreen::RemoteException.new(e))
+        Sqreen.log.debug("runner = #{runner.inspect}")
+        begin
+          runner.remove_instrumentation
+        rescue => remove_exception
+          Sqreen.log.error(remove_exception.inspect)
+          # We did not managed to remove instrumentation, state is unclear:
+          # terminate thread
+          return nil
+        end
+        begin
+          runner.logout(false)
+        rescue => logout_exception
+          Sqreen.log.error(logout_exception.inspect)
+          nil
+        end
+      end
+      # Wait a few seconds before retrying
+      delay = rand(120)
+      Sqreen.log.debug("Sleeping #{delay} seconds before retry")
+      sleep(delay)
+      retry
+    end
+  end
+end unless ENV['SQREEN_DISABLE'].to_i == 1

data/lib/sqreen/binding_accessor.rb

@@ -0,0 +1,184 @@
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.io/terms.html
+
+require 'strscan'
+
+# the value located at the given binding
+class BindingAccessor
+  attr_reader :path, :expression, :convert
+
+  # Expression to be accessed
+  # @param expression [String] expression to read
+  # @param convert [Boolean] wheter to convert objects to simpler types (Array, Hash, String...)
+  def initialize(expression, convert = false)
+    @expression = expression
+    @path = []
+    @convert = convert
+    parse(expression)
+  end
+
+  # Resolve this expression for the give binding
+  def resolve(binding, framework = nil, instance = nil, arguments = nil, cbdata = nil, last_return = nil)
+    env = [framework, instance, arguments, cbdata, last_return]
+    value = nil
+    @path.each do |component|
+      value = resolve_component(value, component, binding, env)
+    end
+    return convert(value) if @convert
+    value
+  end
+
+  protected
+
+  if binding.respond_to?(:local_variable_get)
+    def get_local(name, bind)
+      bind.local_variable_get(name)
+    end
+  else
+    def get_local(name, bind)
+      eval(name, bind)
+    end
+  end
+
+  def resolve_component(current_value, component, binding, env)
+    case component[:kind]
+    when 'string', 'symbol', 'integer'
+      component[:value]
+    when 'local-variable'
+      get_local(component[:name], binding)
+    when 'instance-variable'
+      current_value.instance_variable_get("@#{component[:name]}")
+    when 'class-variable'
+      current_value.class.class_variable_get("@@#{component[:name]}")
+    when 'global-variable'
+      instance_eval("$#{component[:name]}")
+    when 'constant'
+      if current_value
+        current_value.const_get(component[:name].to_s)
+      else
+        Object.const_get(component[:name].to_s)
+      end
+    when 'method'
+      current_value.send(component[:name])
+    when 'index'
+      current_value[component[:index]]
+    when 'sqreen-variable'
+      resolve_sqreen_variable(component[:name], *env)
+    else
+      raise "Do not know how to handle this component #{component.inspect}"
+    end
+  end
+
+  def resolve_sqreen_variable(what, framework, instance, args, cbdata, rv)
+    case what
+    when 'data'
+      cbdata
+    when 'rv'
+      rv
+    when 'args'
+      args
+    when 'inst'
+      instance
+    else
+      framework.send(what)
+    end
+  end
+
+  def parse(expression)
+    @scan = StringScanner.new(expression)
+    until @scan.eos?
+      pos = @scan.pos
+      scalar = scan_scalar
+      if scalar
+        @path.push scalar
+        return
+      end
+      if @path.size == 0
+        scan_push_variable
+      else
+        scan_push_method
+      end
+      scan_push_indexes
+      scan_push_more_constant if @scan.scan(/\./).nil?
+      raise error_state('Scan stuck') if @scan.pos == pos
+    end
+  end
+
+  def scan_scalar
+    case
+    when @scan.scan(/\d+/)
+      return { :value => @scan[0].to_i, :kind => 'integer' }
+    when @scan.scan(/:(\w+)/)
+      return { :value => @scan[1].to_sym, :kind => 'symbol' }
+    when @scan.scan(/'((?:\\.|[^\\'])*)'/)
+      return { :value => @scan[1], :kind => 'string' }
+    end
+  end
+
+  RUBY_IDENTIFIER_CHAR = if ''.respond_to? :encoding
+                           '[\w\u0080-\u{10ffff}]'
+                         else
+                           '[\w\x80-\xFF]'
+               end
+
+  def scan_push_constant
+    return unless @scan.scan(/([A-Z]#{RUBY_IDENTIFIER_CHAR}+)/)
+    @path << { :name => @scan[1], :kind => 'constant' }
+  end
+
+  def scan_push_more_constant
+    while @scan.scan(/::/)
+      raise error_state('No more constant') unless scan_push_constant
+    end
+  end
+
+  def scan_push_variable
+    case
+    when @scan.scan(/\$(#{RUBY_IDENTIFIER_CHAR}+)/)
+      return @path << { :name => @scan[1], :kind => 'global-variable' }
+    when @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
+      return @path << { :name => @scan[1], :kind => 'class-variable' }
+    when @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
+      return @path << { :name => @scan[1], :kind => 'instance-variable' }
+    when @scan.scan(/#\.(\w+)/)
+      return @path << { :name => @scan[1], :kind => 'sqreen-variable' }
+    when scan_push_constant
+      return
+    when @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/u)
+      return @path << { :name => @scan[1], :kind => 'local-variable' }
+    end
+  end
+
+  def scan_push_method
+    case
+    when @scan.scan(/@@(#{RUBY_IDENTIFIER_CHAR}+)/)
+      return @path << { :name => @scan[1], :kind => 'class-variable' }
+    when @scan.scan(/@(#{RUBY_IDENTIFIER_CHAR}+)/)
+      return @path << { :name => @scan[1], :kind => 'instance-variable' }
+    when @scan.scan(/(#{RUBY_IDENTIFIER_CHAR}+)/)
+      return @path << { :name => @scan[1], :kind => 'method' }
+    end
+  end
+
+  def scan_push_indexes
+    while @scan.scan(/\[/)
+      scalar = scan_scalar
+      raise error_state('Invalid index') unless scalar
+      raise error_state('Unfinished index') unless @scan.scan(/\]/)
+      @path << { :kind => 'index', :index => scalar[:value] }
+    end
+  end
+
+  def error_state(msg)
+    "#{msg} at #{@scan.pos} after #{@scan.string[0...@scan.pos]} (#{@scan.string})"
+  end
+
+  def convert(value)
+    case value
+    when Exception
+      return { 'message' => value.message, 'backtrace' => value.backtrace }
+    else
+      return value
+    end
+  end
+end

data/lib/sqreen/ca.crt

@@ -0,0 +1,72 @@
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
+ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
+MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
+LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
+RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
+PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
+xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
+Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
+hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
+EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
+FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
+nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
+eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
+hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
+Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
+vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
++OkuE6N36B9K
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDfDCCAmSgAwIBAgIQGKy1av1pthU6Y2yv2vrEoTANBgkqhkiG9w0BAQUFADBY
+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjExMC8GA1UEAxMo
+R2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEx
+MjcwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQK
+Ew1HZW9UcnVzdCBJbmMuMTEwLwYDVQQDEyhHZW9UcnVzdCBQcmltYXJ5IENlcnRp
+ZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAvrgVe//UfH1nrYNke8hCUy3f9oQIIGHWAVlqnEQRr+92/ZV+zmEwu3qDXwK9
+AWbK7hWNb6EwnL2hhZ6UOvNWiAAxz9juapYC2e0DjPt1befquFUWBRaa9OBesYjA
+ZIVcFU2Ix7e64HXprQU9nceJSOC7KMgD4TCTZF5SwFlwIjVXiIrxlQqD17wxcwE0
+7e9GceBrAqg1cmuXm2bgyxx5X9gaBGgeRwLmnWDiNpcB3841kt++Z8dtd1k7j53W
+kBWUvEI0EME5+bEnPn7WinXFsq+W06Lem+SYvn3h6YGttm/81w7a4DSwDRp35+MI
+mO9Y+pyEtzavwt+s0vQQBnBxNQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4G
+A1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQULNVQQZcVi/CPNmFbSvtr2ZnJM5IwDQYJ
+KoZIhvcNAQEFBQADggEBAFpwfyzdtzRP9YZRqSa+S7iq8XEN3GHHoOo0Hnp3DwQ1
+6CePbJC/kRYkRj5KTs4rFtULUh38H2eiAkUxT87z+gOneZ1TatnaYzr4gNfTmeGl
+4b7UVXGYNTq+k+qurUKykG/g/CFNNWMziUnWm07Kx+dOCQD32sfvmWKZd7aVIl6K
+oKv0uHiYyjgZmclynnjNS6yvGaBzEi38wkG6gZHaFloxt/m0cYASSJlyc1pZU8Fj
+UjPtp8nSOQJw+uCxQmYpqptR7TBUIhRf2asdweSU8Pj1K/fqynhG1riR/aYNKxoU
+AT6A8EKglQdebc3MS6RFjasS6LPeWuWgfOgPIh1a6Vk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB
+yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
+ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
+U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
+ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
+aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjEL
+MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW
+ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2ln
+biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp
+U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y
+aXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1
+nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbex
+t0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIz
+SdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQG
+BO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+
+rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/
+NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E
+BAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAH
+BgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVy
+aXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKv
+MzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzE
+p6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y
+5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlK
+WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ
+4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N
+hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq
+-----END CERTIFICATE-----