sqreen 1.13.2 → 1.13.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9cc15db540d04e2f69f67dc7d0f8b94ef4ab5815177c9fd198690c2d5e1238c8
-  data.tar.gz: 6e525c6bc24a2663fcef4d18995cf773d1e82af006d00d5c6953151c4f374216
+  metadata.gz: 67667de7c101298b439e12b54ab0a2572dce27cec1e60237e9baa54b2f3791fb
+  data.tar.gz: b689401bd7b0bc4731d93a511e458f1aec7bd0257c7f318090278962597be245
 SHA512:
-  metadata.gz: 5a12c3aec3897301e0b16d1505d1580ceb5fe24b0111b2047026fd83ce7a330bae2655b7eb333545cb6ed9c262593415e48146a5820c772efa2fe59189e5eee5
-  data.tar.gz: e04823e167597aa34782c8c5b29843f8d642b72d9d9e66a2d56bc3cd598d2bea432b4fa438fb05694316fb543f4ce8c2a1425baff6466eafcdab9248038231b2
+  metadata.gz: c2b627b8d752c78eb16a9a0a9ea050b0bf6c59b2a99dd86568c30d8926bf10d60f9ebc62ee241267c187c47f2621bae275f5bcce7ffb15779ae42570df61de51
+  data.tar.gz: c272f746230f351ce74f3fd6d7b7118cf4dcebf0f6f0fc5a38a64cedbfbfee07f21c9d5f577d1c36a9b8264b4bbb92d06ea99cd9776ff47a35415f6f5791e2f0

data/lib/sqreen/configuration.rb

@@ -51,6 +51,8 @@ module Sqreen
       :default => nil },
     { :env => :SQREEN_IP_HEADER, :name => :ip_header,
       :default => nil },
+    { :env => :SQREEN_STRIP_SENSITIVE_DATA, :name => :strip_sensitive_data,
+      :default => true, :convert => :to_bool },
 
   ].freeze
 

data/lib/sqreen/events/request_record.rb

@@ -52,8 +52,14 @@ module Sqreen
       else
         res[:request] = {}
       end
+
       res[:request][:parameters] = payload['params'] if payload['params']
       res[:request][:headers] = payload['headers'] if payload['headers']
+
+      if Sqreen.config_get(:strip_sensitive_data)
+        res[:request] = SensitiveDataRedactor.redact(res[:request])
+      end
+
       res
     end
 
@@ -96,4 +102,31 @@ module Sqreen
       nil
     end
   end
+
+  # For redacting sensitive data and avoid having it sent to our servers
+  class SensitiveDataRedactor
+    SENSITIVE_KEYS = Set.new(%w[password secret passwd authorization api_key apikey access_token]).freeze
+    MASK = '<Redacted by Sqreen>'.freeze
+    REGEX = /\A(?:\d[ -]*?){13,16}\z/
+
+    def self.redact(obj)
+      case obj
+      when String
+        return MASK if obj =~ REGEX
+
+      when Array
+        return obj.map(&method(:redact))
+
+      when Hash
+        return Hash[
+          obj.map do |k, v|
+            ck = k.is_a?(String) ? k.downcase : k
+            [k, SENSITIVE_KEYS.include?(ck) ? MASK : redact(v)]
+          end
+        ]
+      end
+
+      obj
+    end
+  end
 end

data/lib/sqreen/frameworks/generic.rb

@@ -393,6 +393,7 @@ module Sqreen
           each_key_value_for_hash(p) do |value|
             next unless value.is_a?(String)
             next if value.size < 5
+            value = value.force_encoding(Encoding::ISO_8859_1).encode(Encoding::UTF_8) unless value.valid_encoding?
             next if regexp && !regexp.match?(value)
             parm << value
           end
@@ -410,6 +411,7 @@ module Sqreen
           each_key_value_for_hash(p) do |value|
             next unless value.is_a?(String)
             next if value.size < 5
+            value = value.force_encoding(Encoding::ISO_8859_1).encode(Encoding::UTF_8) unless value.valid_encoding?
             next if regexp && !regexp.match(value)
             parm << value
           end

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -140,7 +140,8 @@ module Sqreen
         tag = ret
         if tag.value[:escape_html] == false &&
            tag.value[:value].respond_to?(:include?) &&
-           !tag.value[:value].include?('html_escape')
+           !tag.value[:value].include?('html_escape') &&
+            tag.value[:parse] == true
           tag.value[:value] = "Sqreen.escape_haml((#{tag.value[:value]}))"
           return { :status => :override, :new_return_value => tag }
         end

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.13.2'.freeze
+  VERSION = '1.13.4'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.13.2
+  version: 1.13.4
 platform: ruby
 authors:
 - Sqreen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-23 00:00:00.000000000 Z
+date: 2018-08-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.12.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.12.1
 description: Sqreen is a SaaS based Application protection and monitoring platform
   that integrates directly into your Ruby applications. Learn more at https://sqreen.io.
 email: contact@sqreen.io