sqreen 1.21.1-java → 1.22.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 7da0143942d8b7ab1904204694ff425b28063c4a
-  data.tar.gz: 9c18ce7181ba9e6d059f7265108fa1abbc8d9c99
+SHA256:
+  metadata.gz: bcd3c75be7987ecc85661f689c667541848198edeab5261e255bc02d2423c4b4
+  data.tar.gz: '05923eb03e291f3e81701829b74ce77f3eea258c6b6dedf9c6c702a8112bdcab'
 SHA512:
-  metadata.gz: 54eba17e83cb41dd546c16caa7543da24b72b7c2768e782a667278a0ce7d07c18cbd6477fa72f71530e0fe34cf64e1a691ed179a6c07c9d883030560791f7659
-  data.tar.gz: 3e716230761babffbe1abe97d18062887ea371800d98c5a6a85a92970c61b59cf7d2ca2d99f3947be54b1e6ef99ed19e557b8c39a662bdaeefaebec8e148f937
+  metadata.gz: 67047add0d2b639f78d4af087a628fd4d922f7e3b3dacac29654787a40e5122bdcc0269535187f80cb10afb122c098db8eed288faa24f2a615e743f1b0174bb4
+  data.tar.gz: '088347e94c0e70376871a1fa8fc3c01b0e7324f750418b361055b3db3c78fd2ab2a11100ff9bcc4a404c8f19216cb13e9ef41bbd26ad41d6221bc87391870105'

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 1.22.0
+
+* Update WAF via libsqreen
+* Add support for raw body
+* Improve signature check
+* Improve APM detection
+
 ## 1.21.1
 
 * Work around NewRelic initialisation (see https://github.com/newrelic/newrelic-ruby-agent/issues/461)

data/lib/sqreen/frameworks/generic.rb

@@ -400,6 +400,18 @@ module Sqreen
         r
       end
 
+      def body
+        return nil unless request.respond_to?(:body)
+        return nil unless request.body.respond_to?(:read)
+        return nil unless request.body.respond_to?(:rewind)
+
+        body_io = request.body
+        body = body_io.read(4096)
+        body_io.rewind
+
+        body
+      end
+
       # Expose current working directory
       def cwd
         Dir.getwd

data/lib/sqreen/version.rb

@@ -4,5 +4,5 @@
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 module Sqreen
-  VERSION = '1.21.1'.freeze
+  VERSION = '1.22.0'.freeze
 end

data/lib/sqreen/weave/legacy/instrumentation.rb

@@ -96,25 +96,77 @@ class Sqreen::Weave::Legacy::Instrumentation
   def instrument!(rules, framework)
     Sqreen::Weave.logger.debug { "#{rules.count} rules, #{framework}" }
 
+    # TODO: make config able to see if value was user-set or default
     strategy = Sqreen.config_get(:weave_strategy)
+    # TODO: factor generic hint system out
+    # TODO: factor those hint definitions to dependency
+    strategy_hints = []
     if strategy == :prepend && !Module.respond_to?(:prepend)
-      Sqreen::Weave.logger.warn { "strategy: #{strategy.inspect} unavailable, falling back to :chain" }
-      strategy = :chain
-    elsif strategy == :chain && Gem::Specification.select { |s| s.name == 'scout_apm' && Gem::Requirement.new('>= 2.5.2').satisfied_by?(Gem::Version.new(s.version)) }.any?
-      Sqreen::Weave.logger.warn { "strategy: #{strategy.inspect} unavailable with scout_apm >= 2.5.2, switching to :prepend" }
-      strategy = :prepend
+      Sqreen::Weave.logger.debug { "strategy: #{strategy.inspect} unavailable, falling back to :chain" }
+      strategy_hints << [:chain, 'Module.respond_to?(:prepend)', 'false']
+    end
+    if Gem::Specification.select { |s| s.name == 'scout_apm' && Gem::Requirement.new('< 2.5.2').satisfied_by?(Gem::Version.new(s.version)) }.any?
+      Sqreen::Weave.logger.debug { "strategy: :prepend unavailable with scout_apm < 2.5.2, switching to :chain" }
+      strategy_hints << [:chain, 'scout_apm', '< 2.5.2']
+    end
+    if Gem::Specification.select { |s| s.name == 'scout_apm' && Gem::Requirement.new('>= 2.5.2').satisfied_by?(Gem::Version.new(s.version)) }.any?
+      Sqreen::Weave.logger.debug { "strategy: :chain unavailable with scout_apm >= 2.5.2, switching to :prepend" }
+      strategy_hints << [:prepend, 'scout_apm', '>= 2.5.2']
+    end
+    if Gem::Specification.select { |s| s.name == 'ddtrace' && Gem::Requirement.new('< 0.27').satisfied_by?(Gem::Version.new(s.version)) }.any?
+      Sqreen::Weave.logger.debug { "strategy: :prepend unavailable with ddtrace < 0.27, switching to :chain" }
+      strategy_hints << [:chain, 'ddtrace', '< 0.27']
+    end
+    if Gem::Specification.select { |s| s.name == 'ddtrace' && Gem::Requirement.new('>= 0.27').satisfied_by?(Gem::Version.new(s.version)) }.any?
+      Sqreen::Weave.logger.debug { "strategy: :chain unavailable with ddtrace >= 0.27, switching to :prepend" }
+      strategy_hints << [:prepend, 'ddtrace', '>= 0.27']
+    end
+    if Gem::Specification.select { |s| s.name == 'skylight' && Gem::Requirement.new('< 5.0.0.beta').satisfied_by?(Gem::Version.new(s.version)) }.any?
+      Sqreen::Weave.logger.debug { "strategy: :prepend unavailable with skylight < 5.0.0.beta, switching to :chain" }
+      strategy_hints << [:chain, 'skylight', '< 5.0.0.beta']
+    end
+    if Gem::Specification.select { |s| s.name == 'skylight' && Gem::Requirement.new('>= 5.0.0.beta').satisfied_by?(Gem::Version.new(s.version)) }.any?
+      Sqreen::Weave.logger.debug { "strategy: :chain unavailable with skylight >= 5.0.0.beta, switching to :prepend" }
+      strategy_hints << [:prepend, 'skylight', '>= 5.0.0.beta']
+    end
+    if strategy_hints.map(&:first).uniq.count > 1
+      raise Sqreen::Exception, "conflicting instrumentation strategies: #{strategy_hints.inspect}"
+    end
+    if strategy_hints.map(&:first).uniq.count == 1 && strategy != strategy_hints.first.first
+      was = strategy
+      strategy = strategy_hints.first.first
+      Sqreen::Weave.logger.warn { "strategy: #{strategy.inspect} was: #{was.inspect} hints: #{strategy_hints.inspect}" }
+    else
+      Sqreen::Weave.logger.info { "strategy: #{strategy.inspect}" }
     end
-    Sqreen::Weave.logger.debug { "strategy: #{strategy.inspect}" }
 
     ### set up rule signature verifier
     verifier = nil
-    if Sqreen.features['rules_signature'] &&
-       Sqreen.config_get(:rules_verify_signature) == true &&
-       !defined?(::JRUBY_VERSION)
+    # TODO: check for JRuby via dependency
+    # TODO: reinstate signatures for JRuby
+    if Sqreen.config_get(:rules_verify_signature) == true && !defined?(::JRUBY_VERSION)
       verifier = Sqreen::SqreenSignedVerifier.new
-      Sqreen::Weave.logger.debug('Rules signature enabled')
+      Sqreen::Weave.logger.debug('rules: signature status: enabled')
     else
-      Sqreen::Weave.logger.debug('Rules signature disabled')
+      Sqreen::Weave.logger.debug('rules: signature status: disabled')
+    end
+
+    if verifier
+      invalid_rules = rules.reject do |rule|
+        valid = verifier.verify(rule)
+
+        if valid
+          Sqreen::Weave.logger.debug { "rule: #{rule['name']} signed: true result: ok" }
+        else
+          Sqreen::Weave.logger.error { "rule: #{rule['name']} singed: true result: fail" }
+        end
+      end
+      if invalid_rules.any?
+        Sqreen::Weave.logger.error { "weave: instrument status: abort reason: signature result: fail" }
+        raise Sqreen::Exception, "Signature error: rules: #{invalid_rules.map { |r| r['name'] }.inspect}"
+      else
+        Sqreen::Weave.logger.info { "weave: instrument rules: signed result: ok" }
+      end
     end
 
     ### force clean instrumentation callback list

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.21.1
+  version: 1.22.0
 platform: java
 authors:
 - Sqreen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-10-06 00:00:00.000000000 Z
+date: 2020-11-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -17,8 +17,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.1.0
   name: sqreen-backport
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -31,8 +31,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.2.2
   name: sqreen-kit
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -45,8 +45,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: therubyrhino
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -59,8 +59,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.3.0
   name: execjs
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -342,8 +342,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project:
-rubygems_version: 2.6.14.1
+rubygems_version: 3.0.6
 signing_key:
 specification_version: 4
 summary: Sqreen Ruby agent