subdomainbox 0.2.0 → 0.3.3

data/README.md

@@ -1,10 +1,22 @@
 subdomainbox
 ============
 
-Subdomain boxing was inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html). Subdomain boxing limits the reach of any XSS attacks. If an attacker manages to insert javascript onto a page of your application, the javascript on that page will be unable to read data from or post data to any pages on different subdomains in your application. Post protection is achieved by creating a separate CSRF token for each subdomain. CSRF protection is also strengthened by changing the CSRF token based on session id.
+Subdomain boxing was inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html). Subdomain boxing limits the reach of any XSS attacks. If an attacker manages to insert javascript onto a page of your application, the javascript on that page will be unable to read data from or post data to any pages on different subdomains in your application. POST protection is achieved by creating a separate CSRF token for each subdomain. CSRF protection is also strengthened by changing the CSRF token based on session id.
 
 The subdomainbox gem is simple to add even to existing Rails applications:
 
+    class ApplicationController
+
+      # set up a default subdomain box for all controllers that won't get an explicit subdomain box
+      # this protects regular pages that don't get a dedicated subdomain box from being accessed
+      # from a subdomain boxed page
+      default_subdomainbox ''
+
+      ...
+
+    end
+
+
     class PostsController < ApplicationController
 
       subdomainbox 'posts', :only => :index
@@ -25,6 +37,32 @@ The subdomainbox gem is simple to add even to existing Rails applications:
     end
 
 
+    class AvatarIcon < ApplicationController
+
+      # for controllers that need to be accessed from many places, that don't need boxing
+      # protection, the default subdomain box can be removed (thereby allowing ajax calls
+      # from any subdomain)
+      remove_default_subdomainbox
+
+      ...
+
+    end
+
+There is no need to adjust your routes or your path / url helpers. Subdomainbox automatically redirects the browser as needed based on your subdomainbox directives.
+
+
+Installation
+============
+
+Add subdomainbox to your gemfile and bundle install.
+
+Run the generator (for generating the CSRF token secret):
+
+    $ rails generate subdomainbox
+
+Make sure your application has a wildcard SSL certificate.
+
+
 Testing
 =======
 
@@ -59,4 +97,4 @@ Contributing to subdomainbox
 Credits
 =======
 
-Inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html).
+Written by Daniel Nelson. Inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html).

data/VERSION

@@ -1 +1 @@
-0.2.0
+0.3.3

data/lib/subdomainbox.rb

@@ -4,14 +4,39 @@ module ActionController
     class SubdomainboxDomainViolation < StandardError
     end
 
-    def self.subdomainbox(allowed, options={})
-      before_filter(lambda { subdomainbox(:allowed => allowed) }, options)
+    def self.subdomainbox(box_definitions, options={})
+      prepend_before_filter(lambda { subdomainbox(box_definitions) }, options)
     end
 
-    def subdomainbox(options)
-      allowed = subdomainbox_process_definitions(options)
+    def self.remove_default_subdomainbox(options={})
+      prepend_before_filter(:remove_default_subdomainbox, options)
+    end
+
+    def self.default_subdomainbox(box_definitions)
+      before_filter(lambda { default_subdomainbox(box_definitions) }, {})
+    end
+
+    def subdomainbox(box_definitions)
+      @remove_default_subdomainbox = true
+      allowed = subdomainbox_process_definitions(box_definitions)
       subdomain_match = subdomainbox_find_subdomain_match(allowed)
-      subdomainbox_no_subdomain_match!(allowed) if subdomain_match.empty?
+      subdomainbox_no_subdomain_match!(allowed) if subdomain_match.nil?
+    end
+
+    # for controllers that need to be accessed from many places, that don't need boxing
+    # protection, the default subdomain box can be removed (thereby allowing ajax calls
+    # from any subdomain)
+    #
+    def remove_default_subdomainbox
+      @remove_default_subdomainbox = true
+    end
+
+    # set up a default subdomain box for all controllers that won't get an explicit subdomain box
+    # this protects regular pages that don't get a dedicated subdomain box from being accessed
+    # from a subdomain boxed page
+    #
+    def default_subdomainbox(box_definitions)
+      subdomainbox(box_definitions) unless @remove_default_subdomainbox
     end
 
     private
@@ -44,31 +69,35 @@ module ActionController
     end
 
     def subdomainbox_find_subdomain_match(allowed)
-      allowed.each do |allowed_subdomain, separator, allowed_id_name|
-        if allowed_subdomain == ''
-          next unless request.subdomain.nil? || request.subdomain.empty?
+      matches = allowed.collect do |allowed_subdomain, separator, allowed_id_name|
+        subdomainbox_check_subdomain(allowed_subdomain, separator, allowed_id_name)
+      end
+      matches.compact.first
+    end
+
+    def subdomainbox_check_subdomain(allowed_subdomain, separator, allowed_id_name)
+      return nil if allowed_subdomain == '' unless request.subdomain == ''
+      allowed_prefix = "#{allowed_subdomain}#{separator}"
+      return nil unless request.subdomain.index(allowed_prefix) == 0
+
+      id = request.subdomain[allowed_prefix.length..-1]
+      if allowed_id_name
+        return nil if id == ''
+        if params.keys.include?(allowed_id_name)
+          return nil unless id == params[allowed_id_name]
         else
-          next unless request.subdomain =~ /\A#{allowed_subdomain}\.?/
+          params[allowed_id_name] = id
         end
-        if allowed_id_name
-          if id = request.subdomain.sub(/\A#{allowed_subdomain}\.?/, '')
-            if params.keys.include?(allowed_id_name)
-              return [] unless id == params[allowed_id_name]
-            else
-              params[allowed_id_name] = id
-            end
-          end
-        end
-        return [allowed_subdomain, separator, id]
+      else
+        return nil unless id == ''
       end
-      []
+      [allowed_subdomain, separator, id]
     end
 
-    def subdomainbox_process_definitions(options)
+    def subdomainbox_process_definitions(box_definitions)
       allowed = []
-      raw_definitions = options[:allowed]
-      raw_definitions = [raw_definitions] unless raw_definitions.is_a?(Array)
-      raw_definitions.each do |definition|
+      box_definitions = [box_definitions] unless box_definitions.is_a?(Array)
+      box_definitions.each do |definition|
         discard, allowed_subdomain, separator, allowed_id_name = definition.match(/([^%]*?)(\.?)\%\{([^}]*)\}/).to_a
         allowed_subdomain = definition if allowed_subdomain.nil?
         allowed_id_name = allowed_id_name if allowed_id_name

data/spec/subdomainbox_spec.rb

@@ -33,7 +33,7 @@ describe ActionController::Base do
           params = { 'pet_id' => 'abc' }
           controller.stub(:params).and_return(params)
           lambda {
-            controller.subdomainbox :allowed => 'pets.%{pet_id}'
+            controller.subdomainbox('pets.%{pet_id}')
           }.should_not raise_error
         end
       end
@@ -44,14 +44,14 @@ describe ActionController::Base do
           params = { 'id' => 'efg' }
           controller.stub(:params).and_return(params)
           lambda {
-            controller.subdomainbox :allowed => 'pets.%{pet_id}'
+            controller.subdomainbox('pets.%{pet_id}')
           }.should_not raise_error
         end
 
         it "should set a param of the specified name on params" do
           params = {}
           controller.stub(:params).and_return(params)
-          controller.subdomainbox :allowed => 'pets.%{pet_id}'
+          controller.subdomainbox('pets.%{pet_id}')
           params['pet_id'].should == 'abc'
         end
       end
@@ -78,11 +78,11 @@ describe ActionController::Base do
 
           controller.should_receive(:redirect_to).with('https://pets.efg.peanuts.com:8080/pets?e=123')
           request.stub(:subdomain).and_return('pets')
-          controller.subdomainbox :allowed => 'pets.%{pet_id}'
+          controller.subdomainbox('pets.%{pet_id}')
 
           controller.should_receive(:redirect_to).with('https://pets.efg.peanuts.com:8080/pets?e=123')
           request.stub(:subdomain).and_return('pets.abc')
-          controller.subdomainbox :allowed => 'pets.%{pet_id}'
+          controller.subdomainbox('pets.%{pet_id}')
         end
       end
 
@@ -90,7 +90,7 @@ describe ActionController::Base do
         it "should not raise an exception or redirect" do
           controller.should_not_receive(:redirect_to)
           lambda {
-            controller.subdomainbox :allowed => 'pets'
+            controller.subdomainbox('pets')
           }.should_not raise_error
         end
 
@@ -101,7 +101,7 @@ describe ActionController::Base do
             controller.stub(:params).and_return(params)
             controller.should_not_receive(:redirect_to)
             lambda {
-              controller.subdomainbox :allowed => 'pets.%{pet_id}'
+              controller.subdomainbox('pets.%{pet_id}')
             }.should_not raise_error
           end
         end
@@ -111,7 +111,7 @@ describe ActionController::Base do
         it "should not raise an exception or redirect" do
           controller.should_not_receive(:redirect_to)
           lambda {
-            controller.subdomainbox :allowed => ['activities', 'pets']
+            controller.subdomainbox(['activities', 'pets'])
           }.should_not raise_error
         end
 
@@ -122,7 +122,7 @@ describe ActionController::Base do
             controller.stub(:params).and_return(params)
             controller.should_not_receive(:redirect_to)
             lambda {
-              controller.subdomainbox :allowed => ['activities%{pet_id}', 'pets%{pet_id}']
+              controller.subdomainbox(['activities%{pet_id}', 'pets%{pet_id}'])
             }.should_not raise_error
           end
         end
@@ -152,18 +152,18 @@ describe ActionController::Base do
             flash.should_receive(:[]=).with(:notice, 'The notice flash')
             flash.should_receive(:[]=).with(:info, 'The info flash')
 
-            controller.subdomainbox :allowed => 'pets'
+            controller.subdomainbox('pets')
           end
 
           it "should redirect to the same path (including http variables) at the specified subdomain prefixing the root of the origin domain" do
             controller.should_receive(:redirect_to).with('https://pets.peanuts.com:8080/pets?e=123')
-            controller.subdomainbox :allowed => 'pets'
+            controller.subdomainbox('pets')
           end
 
           context "when the specified subdomain is an empty string" do
             it "should redirect to the root domain" do
               controller.should_receive(:redirect_to).with('https://peanuts.com:8080/pets?e=123')
-              controller.subdomainbox :allowed => ''
+              controller.subdomainbox('')
             end
           end
 
@@ -172,7 +172,7 @@ describe ActionController::Base do
               controller.should_receive(:redirect_to).with('https://pets.abc.peanuts.com:8080/pets?e=123')
               params = { 'pet_id' => 'abc' }
               controller.stub(:params).and_return(params)
-              controller.subdomainbox :allowed => 'pets.%{pet_id}'
+              controller.subdomainbox('pets.%{pet_id}')
             end
 
             context "when no id param matching the specified id name exists" do
@@ -180,7 +180,7 @@ describe ActionController::Base do
                 controller.should_receive(:redirect_to).with('https://pets.peanuts.com:8080/pets?e=123')
                 params = { 'id' => 'abc' }
                 controller.stub(:params).and_return(params)
-                controller.subdomainbox :allowed => 'pets.%{pet_id}'
+                controller.subdomainbox('pets.%{pet_id}')
               end
             end
           end
@@ -190,7 +190,7 @@ describe ActionController::Base do
               controller.should_receive(:redirect_to).with('https://pets.peanuts.com:8080/pets?e=123')
               params = { 'pet_id' => 'abc' }
               controller.stub(:params).and_return(params)
-              controller.subdomainbox :allowed => 'pets'
+              controller.subdomainbox('pets')
             end
           end
         end
@@ -199,7 +199,7 @@ describe ActionController::Base do
           it "should raise SubdomainboxDomainViolation" do
             request.stub(:get?).and_return(false)
             lambda {
-              controller.subdomainbox :allowed => 'pets'
+              controller.subdomainbox('pets')
             }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
           end
         end
@@ -219,7 +219,7 @@ describe ActionController::Base do
           it "should redirect to the same path (http variables) at the first subdomain in the list prefixing the root of the origin domain" do
             request.stub(:get?).and_return(true)
             controller.should_receive(:redirect_to).with('https://activities.peanuts.com:8080/pets?e=123')
-            controller.subdomainbox :allowed => ['activities', 'pets']
+            controller.subdomainbox(['activities', 'pets'])
           end
         end
 
@@ -227,7 +227,7 @@ describe ActionController::Base do
           it "should raise SubdomainboxDomainViolation" do
             request.stub(:get?).and_return(false)
             lambda {
-              controller.subdomainbox :allowed => ['activities', 'pets']
+              controller.subdomainbox(['activities', 'pets'])
             }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
           end
         end
@@ -247,18 +247,9 @@ describe ActionController::Base do
         it "should not raise an exception" do
           request.stub(:subdomain).and_return('pets')
           lambda {
-            controller.subdomainbox :allowed => 'pets'
+            controller.subdomainbox('pets')
           }.should_not raise_error
         end
-
-        context "when the origin subdomain includes an id" do
-          it "should not raise an exception" do
-            request.stub(:subdomain).and_return('pets.abc')
-            lambda {
-              controller.subdomainbox :allowed => 'pets'
-            }.should_not raise_error
-          end
-        end
       end
 
 
@@ -266,18 +257,9 @@ describe ActionController::Base do
         it "should not raise an exception" do
           request.stub(:subdomain).and_return('pets')
           lambda {
-            controller.subdomainbox :allowed => ['activities', 'pets']
+            controller.subdomainbox(['activities', 'pets'])
           }.should_not raise_error
         end
-
-        context "when the origin subdomain includes an id" do
-          it "should not raise an exception" do
-            request.stub(:subdomain).and_return('pets.abc')
-            lambda {
-              controller.subdomainbox :allowed => ['activities', 'pets']
-            }.should_not raise_error
-          end
-        end
       end
 
 
@@ -286,7 +268,7 @@ describe ActionController::Base do
           # recommend using around filter to rescue these exceptions and respond accordingly from that one place
           request.stub(:subdomain).and_return('houses')
           lambda {
-            controller.subdomainbox :allowed => 'pets'
+            controller.subdomainbox('pets')
           }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
         end
 
@@ -294,7 +276,7 @@ describe ActionController::Base do
           it "should not raise an exception" do
             request.stub(:subdomain).and_return('houses.abc')
             lambda {
-              controller.subdomainbox :allowed => 'pets'
+              controller.subdomainbox('pets')
             }.should raise_error
           end
         end
@@ -304,7 +286,7 @@ describe ActionController::Base do
         it "should raise SubdomainboxDomainViolation" do
           request.stub(:subdomain).and_return('houses')
           lambda {
-            controller.subdomainbox :allowed => ['activities', 'pets']
+            controller.subdomainbox(['activities', 'pets'])
           }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
         end
 
@@ -312,15 +294,53 @@ describe ActionController::Base do
           it "should raise an exception" do
             request.stub(:subdomain).and_return('houses.abc')
             lambda {
-              controller.subdomainbox :allowed => ['activities', 'pets']
+              controller.subdomainbox(['activities', 'pets'])
             }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
           end
         end
       end
 
+      context "when the subdomainbox specifies no id, but the current subdomain includes an id" do
+        it "should raise an exception (eg: a specific post is trying to reach the index of posts)" do
+          request.stub(:subdomain).and_return('pets-abc')
+          lambda {
+            controller.subdomainbox('pets')
+          }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+        end
+      end
+
+      context "when the subdomainbox specifies multiple subdomains, some with an id, some without an id" do
+        it "should raise an exception whenever the subdomain includes an id but matches a subdomainbox that specifies no id" do
+          request.stub(:subdomain).and_return('pets-abc')
+          lambda {
+            controller.subdomainbox(['pets', 'houses-%{id}'])
+          }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+        end
+
+        it "should raise an exception whenever the subdomain omits an id but matches a subdomainbox that specifies an id" do
+          request.stub(:subdomain).and_return('houses')
+          lambda {
+            controller.subdomainbox(['pets', 'houses-%{id}'])
+          }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+        end
+
+        it "should not raise an exception whenever the subdomain includes an id and matches a subdomainbox that specifies an id" do
+          request.stub(:subdomain).and_return('houses-abc')
+          lambda {
+            controller.subdomainbox(['pets', 'houses-%{id}'])
+          }.should_not raise_error
+        end
+
+        it "should not raise an exception whenever the subdomain omits an id and matches a subdomainbox that specifies no id" do
+          request.stub(:subdomain).and_return('pets')
+          lambda {
+            controller.subdomainbox(['pets', 'houses-%{id}'])
+          }.should_not raise_error
+        end
+      end
+
     end
 
   end
 
-
 end

data/subdomainbox.gemspec

@@ -0,0 +1,70 @@
+# Generated by jeweler
+# DO NOT EDIT THIS FILE DIRECTLY
+# Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = "subdomainbox"
+  s.version = "0.3.3"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Daniel Nelson"]
+  s.date = "2013-03-16"
+  s.description = "use subdomains to prevent XSS from accessing your entire application if it should happen to be injected into some page in your app"
+  s.email = "dnelson@centresource.com"
+  s.extra_rdoc_files = [
+    "LICENSE.txt",
+    "README.md"
+  ]
+  s.files = [
+    ".document",
+    ".rspec",
+    ".rvmrc",
+    "Gemfile",
+    "Gemfile.lock",
+    "LICENSE.txt",
+    "README.md",
+    "Rakefile",
+    "VERSION",
+    "lib/generators/subdomainbox_generator.rb",
+    "lib/secure_xsrf_token.rb",
+    "lib/subdomainbox.rb",
+    "spec/secure_xsrf_token_spec.rb",
+    "spec/spec_helper.rb",
+    "spec/subdomainbox_spec.rb",
+    "subdomainbox.gemspec"
+  ]
+  s.homepage = "http://github.com/populr/subdomainbox"
+  s.licenses = ["MIT"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = "1.8.10"
+  s.summary = "prevent XSS incursions from accessing entire application"
+
+  if s.respond_to? :specification_version then
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<uuidtools>, [">= 0"])
+      s.add_development_dependency(%q<rspec>, ["= 2.10.0"])
+      s.add_development_dependency(%q<jeweler>, ["~> 1.8.4"])
+      s.add_development_dependency(%q<pry>, [">= 0"])
+      s.add_development_dependency(%q<pry-nav>, [">= 0"])
+      s.add_development_dependency(%q<pry-stack_explorer>, [">= 0"])
+    else
+      s.add_dependency(%q<uuidtools>, [">= 0"])
+      s.add_dependency(%q<rspec>, ["= 2.10.0"])
+      s.add_dependency(%q<jeweler>, ["~> 1.8.4"])
+      s.add_dependency(%q<pry>, [">= 0"])
+      s.add_dependency(%q<pry-nav>, [">= 0"])
+      s.add_dependency(%q<pry-stack_explorer>, [">= 0"])
+    end
+  else
+    s.add_dependency(%q<uuidtools>, [">= 0"])
+    s.add_dependency(%q<rspec>, ["= 2.10.0"])
+    s.add_dependency(%q<jeweler>, ["~> 1.8.4"])
+    s.add_dependency(%q<pry>, [">= 0"])
+    s.add_dependency(%q<pry-nav>, [">= 0"])
+    s.add_dependency(%q<pry-stack_explorer>, [">= 0"])
+  end
+end
+

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: subdomainbox
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-15 00:00:00.000000000 Z
+date: 2013-03-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: uuidtools
-  requirement: &2152124540 !ruby/object:Gem::Requirement
+  requirement: &2156188260 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2152124540
+  version_requirements: *2156188260
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &2152122180 !ruby/object:Gem::Requirement
+  requirement: &2156187400 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - =
@@ -32,10 +32,10 @@ dependencies:
         version: 2.10.0
   type: :development
   prerelease: false
-  version_requirements: *2152122180
+  version_requirements: *2156187400
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &2152121100 !ruby/object:Gem::Requirement
+  requirement: &2156186760 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: 1.8.4
   type: :development
   prerelease: false
-  version_requirements: *2152121100
+  version_requirements: *2156186760
 - !ruby/object:Gem::Dependency
   name: pry
-  requirement: &2152119700 !ruby/object:Gem::Requirement
+  requirement: &2156095860 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,10 +54,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152119700
+  version_requirements: *2156095860
 - !ruby/object:Gem::Dependency
   name: pry-nav
-  requirement: &2152133520 !ruby/object:Gem::Requirement
+  requirement: &2156091720 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +65,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152133520
+  version_requirements: *2156091720
 - !ruby/object:Gem::Dependency
   name: pry-stack_explorer
-  requirement: &2152131660 !ruby/object:Gem::Requirement
+  requirement: &2152127700 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,7 +76,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152131660
+  version_requirements: *2152127700
 description: use subdomains to prevent XSS from accessing your entire application
   if it should happen to be injected into some page in your app
 email: dnelson@centresource.com
@@ -101,6 +101,7 @@ files:
 - spec/secure_xsrf_token_spec.rb
 - spec/spec_helper.rb
 - spec/subdomainbox_spec.rb
+- subdomainbox.gemspec
 homepage: http://github.com/populr/subdomainbox
 licenses:
 - MIT
@@ -116,7 +117,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1510684682428060724
+      hash: 21616900788936139
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: