sqreen 1.8.1 → 1.8.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ef2dbc8903b61003aedcc44461ae121ecacea571
-  data.tar.gz: cedd1b946d70f7d4847494b1a738220b52f9fb1e
+  metadata.gz: 9315ecf6d216389270fd8ecbd7f761649ea79e11
+  data.tar.gz: d327d13f60ef6b9c152f916c575a559e6cc6f5f9
 SHA512:
-  metadata.gz: 24cd29f10bc02fd07b07238eb9e079e5778a46047dea6c5a9ddf06bf8f8727080a55f6e8d1d1959a0f7603578ccf8d53ee167441228c261ef07c403c218b5a05
-  data.tar.gz: b2cd8120970440c06c9549fcd08fa0f988a6833c8e97257495cce1084de8d38cc9a64a2d944569b2ca7e7d2f74c566fa919224766bef0cd53e715ca4c69d8e08
+  metadata.gz: 421f877ad79464c5cad95ccdb31327f4d7e0118b6f1f8eff0c4c53dcb182c8f6253e005c3d9b38e49b7aff38d4b95258d6e2f7e2d96a52302314b87a9b3b445a
+  data.tar.gz: d9d378343df12409db43d396fe0fee79118264537fe623eba69fb83c284d149ce93b4c564a6f749e30dde80b01b51fbae3db5ba793d415380de592f96d58b15a

data/lib/sqreen/condition_evaluator.rb

@@ -30,7 +30,7 @@ module Sqreen
     # @params value [Object] object to find
     # @params hash [Hash] Hash to search into
     # @params min_value_size [Fixnum] to compare against
-    def self.hash_val_include?(value, hash, min_value_size, rem = 10)
+    def self.hash_val_include?(value, hash, min_value_size, rem = 20)
       return true if rem <= 0
       vals = hash
       vals = hash.values if hash.is_a?(Hash)

data/lib/sqreen/frameworks/generic.rb

@@ -64,16 +64,25 @@ module Sqreen
 
       # Sourced from rack:Request#trusted_proxy?
       TRUSTED_PROXIES = /\A127\.0\.0\.1\Z|\A(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\.|\A::1\Z|\Afd[0-9a-f]{2}:.+|\Alocalhost\Z|\Aunix\Z|\Aunix:/i
+      LOCALHOST = /\A127\.0\.0\.1\Z|\A::1\Z|\Alocalhost\Z|\Aunix\Z|\Aunix:/i
 
       # What is the current client IP
       def client_ip
         req = request
         return nil unless req
+        # Look for an external address being forwarded
         forwarded = req.env['HTTP_X_FORWARDED_FOR']
         ips = split_ip_addresses(forwarded)
         last = ips.find { |ip| (ip !~ TRUSTED_PROXIES) && valid_ip?(ip) }
         return last unless last.nil?
-        req.env['REMOTE_ADDR']
+        # Else fall back to declared remote addr
+        r = req.env['REMOTE_ADDR']
+        # If this is localhost get the last hop before
+        if !ips.empty? && r =~ LOCALHOST
+          last = ips.find { |ip| (ip !~ LOCALHOST) && valid_ip?(ip) }
+          return last unless last.nil?
+        end
+        r
       end
 
       # Get a header by name

data/lib/sqreen/rules_callbacks/execjs.rb

@@ -9,7 +9,9 @@ end
 
 require 'execjs'
 
+require 'sqreen/rule_attributes'
 require 'sqreen/rule_callback'
+require 'sqreen/condition_evaluator'
 require 'sqreen/binding_accessor'
 require 'sqreen/events/remote_exception'
 
@@ -19,7 +21,8 @@ module Sqreen
     class ExecJSCB < RuleCB
       def initialize(klass, method, rule_hash)
         super(klass, method, rule_hash)
-        callbacks = @rule['callbacks']
+        callbacks = @rule[Attrs::CALLBACKS]
+        @conditions = @rule.fetch(Attrs::CONDITIONS, {})
 
         if callbacks['pre'].nil? &&
            callbacks['post'].nil? &&
@@ -61,6 +64,48 @@ module Sqreen
         call_callback('failing', inst, args, rv)
       end
 
+      def self.hash_val_included(needed, haystack, min_length = 8, max_depth = 20)
+        new_obj = {}
+        insert = []
+        to_do = haystack.map { |k, v| [new_obj, k, v, 0] }
+        until to_do.empty?
+          where, key, value, deepness = to_do.pop
+          safe_key = key.kind_of?(Integer) ? key : key.to_s
+          if value.is_a?(Hash) && deepness < max_depth
+            val = {}
+            insert << [where, safe_key, val]
+            to_do += value.map { |k, v| [val, k, v, deepness + 1] }
+          elsif value.is_a?(Array) && deepness < max_depth
+            val = []
+            insert << [where, safe_key, val]
+            i = -1
+            to_do += value.map { |v| [val, i += 1, v, deepness + 1] }
+          elsif deepness >= max_depth # if we are after max_depth don't try to filter
+            insert << [where, safe_key, value]
+          else
+            v = value.to_s
+            if v.size >= min_length && ConditionEvaluator.str_include?(needed.to_s, v)
+              case where
+              when Array
+                where << value
+              else
+                where[safe_key] = value
+              end
+            end
+          end
+        end
+        insert.reverse.each do |wh, ikey, ival|
+          case wh
+          when Array
+            wh << ival unless ival.empty?
+          else
+            wh[ikey] = ival unless ival.empty?
+          end
+        end
+
+        new_obj
+      end
+
       protected
 
       def record_and_continue?(ret)
@@ -92,6 +137,7 @@ module Sqreen
           arguments = (args_override || @argument_requirements[name]).map do |accessor|
             accessor.resolve(binding, framework, inst, args, @data, rv)
           end
+          arguments = restrict(name, arguments) if @conditions.key?(name)
           Sqreen.log.debug { [name, arguments].inspect }
           ret = @compiled.call(name, *arguments)
           unless record_and_continue?(ret)
@@ -110,6 +156,41 @@ module Sqreen
         nil
       end
 
+      def each_hash_val_include(condition, depth = 10)
+        return if depth <= 0
+        condition.each do |key, values|
+          if key == ConditionEvaluator::HASH_INC_OPERATOR
+            yield values
+          else
+            values.map do |v|
+              each_hash_val_include(v, depth - 1) { |vals| yield vals } if v.is_a?(Hash)
+            end
+          end
+        end
+      end
+
+      def restrict(cbname, arguments)
+        condition = @conditions[cbname]
+        return arguments if condition.nil? or @argument_requirements[cbname].nil?
+
+        each_hash_val_include(condition) do |needle, haystack, min_length|
+          # We could actually run the binding accessor expression here.
+          needed_idx = @argument_requirements[cbname].map(&:expression).index(needle)
+          next unless needed_idx
+
+          haystack_idx = @argument_requirements[cbname].map(&:expression).index(haystack)
+          next unless haystack_idx
+
+          arguments[haystack_idx] = ExecJSCB.hash_val_included(
+            arguments[needed_idx],
+            arguments[haystack_idx],
+            min_length.to_i
+          )
+        end
+
+        arguments
+      end
+
       def build_accessor(reqs)
         reqs.map do |req|
           BindingAccessor.new(req, true)

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.8.1'.freeze
+  VERSION = '1.8.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.8.1
+  version: 1.8.2
 platform: ruby
 authors:
 - Sqreen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-08-09 00:00:00.000000000 Z
+date: 2017-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs