torquebox-console 0.2.5 → 0.3.0

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/base.rb

@@ -1,107 +0,0 @@
-require 'rack/protection'
-require 'digest'
-require 'logger'
-require 'uri'
-
-module Rack
-  module Protection
-    class Base
-      DEFAULT_OPTIONS = {
-        :reaction    => :default_reaction, :logging   => true,
-        :message     => 'Forbidden',       :encryptor => Digest::SHA1,
-        :session_key => 'rack.session',    :status    => 403,
-        :allow_empty_referrer => true,
-        :html_types           => %w[text/html application/xhtml]
-      }
-
-      attr_reader :app, :options
-
-      def self.default_options(options)
-        define_method(:default_options) { super().merge(options) }
-      end
-
-      def self.default_reaction(reaction)
-        alias_method(:default_reaction, reaction)
-      end
-
-      def default_options
-        DEFAULT_OPTIONS
-      end
-
-      def initialize(app, options = {})
-        @app, @options = app, default_options.merge(options)
-      end
-
-      def safe?(env)
-        %w[GET HEAD OPTIONS TRACE].include? env['REQUEST_METHOD']
-      end
-
-      def accepts?(env)
-        raise NotImplementedError, "#{self.class} implementation pending"
-      end
-
-      def call(env)
-        unless accepts? env
-          warn env, "attack prevented by #{self.class}"
-          result = react env
-        end
-        result or app.call(env)
-      end
-
-      def react(env)
-        result = send(options[:reaction], env)
-        result if Array === result and result.size == 3
-      end
-
-      def warn(env, message)
-        return unless options[:logging]
-        l = options[:logger] || env['rack.logger'] || ::Logger.new(env['rack.errors'])
-        l.warn(message)
-      end
-
-      def deny(env)
-        [options[:status], {'Content-Type' => 'text/plain'}, [options[:message]]]
-      end
-
-      def session?(env)
-        env.include? options[:session_key]
-      end
-
-      def session(env)
-        return env[options[:session_key]] if session? env
-        fail "you need to set up a session middleware *before* #{self.class}"
-      end
-
-      def drop_session(env)
-        session(env).clear if session? env
-      end
-
-      def referrer(env)
-        ref = env['HTTP_REFERER'].to_s
-        return if !options[:allow_empty_referrer] and ref.empty?
-        URI.parse(ref).host || Request.new(env).host
-      end
-
-      def origin(env)
-        env['HTTP_ORIGIN'] || env['HTTP_X_ORIGIN']
-      end
-
-      def random_string(secure = defined? SecureRandom)
-        secure ? SecureRandom.hex(32) : "%032x" % rand(2**128-1)
-      rescue NotImplementedError
-        random_string false
-      end
-
-      def encrypt(value)
-        options[:encryptor].hexdigest value.to_s
-      end
-
-      alias default_reaction deny
-
-      def html?(headers)
-        return false unless header = headers.detect { |k,v| k.downcase == 'content-type' }
-        options[:html_types].include? header.last[/^\w+\/\w+/]
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/escaped_params.rb

@@ -1,87 +0,0 @@
-require 'rack/protection'
-require 'rack/utils'
-
-begin
-  require 'escape_utils'
-rescue LoadError
-end
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   XSS
-    # Supported browsers:: all
-    # More infos::         http://en.wikipedia.org/wiki/Cross-site_scripting
-    #
-    # Automatically escapes Rack::Request#params so they can be embedded in HTML
-    # or JavaScript without any further issues. Calls +html_safe+ on the escaped
-    # strings if defined, to avoid double-escaping in Rails.
-    #
-    # Options:
-    # escape:: What escaping modes to use, should be Symbol or Array of Symbols.
-    #          Available: :html (default), :javascript, :url
-    class EscapedParams < Base
-      extend Rack::Utils
-
-      class << self
-        alias escape_url escape
-        public :escape_html
-      end
-
-      default_options :escape => :html,
-        :escaper => defined?(EscapeUtils) ? EscapeUtils : self
-
-      def initialize(*)
-        super
-
-        modes       = Array options[:escape]
-        @escaper    = options[:escaper]
-        @html       = modes.include? :html
-        @javascript = modes.include? :javascript
-        @url        = modes.include? :url
-
-        if @javascript and not @escaper.respond_to? :escape_javascript
-          fail("Use EscapeUtils for JavaScript escaping.")
-        end
-      end
-
-      def call(env)
-        request  = Request.new(env)
-        get_was  = handle(request.GET)
-        post_was = handle(request.POST) rescue nil
-        app.call env
-      ensure
-        request.GET.replace  get_was  if get_was
-        request.POST.replace post_was if post_was
-      end
-
-      def handle(hash)
-        was = hash.dup
-        hash.replace escape(hash)
-        was
-      end
-
-      def escape(object)
-        case object
-        when Hash   then escape_hash(object)
-        when Array  then object.map { |o| escape(o) }
-        when String then escape_string(object)
-        else nil
-        end
-      end
-
-      def escape_hash(hash)
-        hash = hash.dup
-        hash.each { |k,v| hash[k] = escape(v) }
-        hash
-      end
-
-      def escape_string(str)
-        str = @escaper.escape_url(str)        if @url
-        str = @escaper.escape_html(str)       if @html
-        str = @escaper.escape_javascript(str) if @javascript
-        str
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/form_token.rb

@@ -1,23 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   CSRF
-    # Supported browsers:: all
-    # More infos::         http://en.wikipedia.org/wiki/Cross-site_request_forgery
-    #
-    # Only accepts submitted forms if a given access token matches the token
-    # included in the session. Does not expect such a token from Ajax request.
-    #
-    # This middleware is not used when using the Rack::Protection collection,
-    # since it might be a security issue, depending on your application
-    #
-    # Compatible with Rails and rack-csrf.
-    class FormToken < AuthenticityToken
-      def accepts?(env)
-        env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest" or super
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/frame_options.rb

@@ -1,37 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   Clickjacking
-    # Supported browsers:: Internet Explorer 8, Firefox 3.6.9, Opera 10.50,
-    #                      Safari 4.0, Chrome 4.1.249.1042 and later
-    # More infos::         https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header
-    #
-    # Sets X-Frame-Options header to tell the browser avoid embedding the page
-    # in a frame.
-    #
-    # Options:
-    #
-    # frame_options:: Defines who should be allowed to embed the page in a
-    #                 frame. Use :deny to forbid any embedding, :sameorigin
-    #                 to allow embedding from the same origin (default).
-    class FrameOptions < Base
-      default_options :frame_options => :sameorigin
-
-      def frame_options
-        @frame_options ||= begin
-          frame_options = options[:frame_options]
-          frame_options = options[:frame_options].to_s.upcase unless frame_options.respond_to? :to_str
-          frame_options.to_str
-        end
-      end
-
-      def call(env)
-        status, headers, body        = @app.call(env)
-        headers['X-Frame-Options'] ||= frame_options if html? headers
-        [status, headers, body]
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/http_origin.rb

@@ -1,32 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   CSRF
-    # Supported browsers:: Google Chrome 2, Safari 4 and later
-    # More infos::         http://en.wikipedia.org/wiki/Cross-site_request_forgery
-    #                      http://tools.ietf.org/html/draft-abarth-origin
-    #
-    # Does not accept unsafe HTTP requests when value of Origin HTTP request header
-    # does not match default or whitelisted URIs.
-    class HttpOrigin < Base
-      DEFAULT_PORTS = { 'http' => 80, 'https' => 443, 'coffee' => 80 }
-      default_reaction :deny
-
-      def base_url(env)
-        request = Rack::Request.new(env)
-        port = ":#{request.port}" unless request.port == DEFAULT_PORTS[request.scheme]
-        "#{request.scheme}://#{request.host}#{port}"
-      end
-
-      def accepts?(env)
-        return true if safe? env
-        return true unless origin = env['HTTP_ORIGIN']
-        return true if base_url(env) == origin
-        Array(options[:origin_whitelist]).include? origin
-      end
-
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/ip_spoofing.rb

@@ -1,23 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   IP spoofing
-    # Supported browsers:: all
-    # More infos::         http://blog.c22.cc/2011/04/22/surveymonkey-ip-spoofing/
-    #
-    # Detect (some) IP spoofing attacks.
-    class IPSpoofing < Base
-      default_reaction :deny
-
-      def accepts?(env)
-        return true unless env.include? 'HTTP_X_FORWARDED_FOR'
-        ips = env['HTTP_X_FORWARDED_FOR'].split(/\s*,\s*/)
-        return false if env.include? 'HTTP_CLIENT_IP' and not ips.include? env['HTTP_CLIENT_IP']
-        return false if env.include? 'HTTP_X_REAL_IP' and not ips.include? env['HTTP_X_REAL_IP']
-        true
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/json_csrf.rb

@@ -1,35 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   CSRF
-    # Supported browsers:: all
-    # More infos::         http://flask.pocoo.org/docs/security/#json-security
-    #
-    # JSON GET APIs are vulnerable to being embedded as JavaScript while the
-    # Array prototype has been patched to track data. Checks the referrer
-    # even on GET requests if the content type is JSON.
-    class JsonCsrf < Base
-      default_reaction :deny
-
-      def call(env)
-        request               = Request.new(env)
-        status, headers, body = app.call(env)
-
-        if has_vector? request, headers
-          warn env, "attack prevented by #{self.class}"
-          react(env)
-        else
-          [status, headers, body]
-        end
-      end
-
-      def has_vector?(request, headers)
-        return false if request.xhr?
-        return false unless headers['Content-Type'].to_s.split(';', 2).first =~ /^\s*application\/json\s*$/
-        origin(request.env).nil? and referrer(request.env) != request.host
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/path_traversal.rb

@@ -1,36 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   Directory traversal
-    # Supported browsers:: all
-    # More infos::         http://en.wikipedia.org/wiki/Directory_traversal
-    #
-    # Unescapes '/' and '.', expands +path_info+.
-    # Thus <tt>GET /foo/%2e%2e%2fbar</tt> becomes <tt>GET /bar</tt>.
-    class PathTraversal < Base
-      def call(env)
-        path_was         = env["PATH_INFO"]
-        env["PATH_INFO"] = cleanup path_was if path_was && !path_was.empty?
-        app.call env
-      ensure
-        env["PATH_INFO"] = path_was
-      end
-
-      def cleanup(path)
-        parts     = []
-        unescaped = path.gsub('%2e', '.').gsub('%2f', '/')
-
-        unescaped.split('/').each do |part|
-          next if part.empty? or part == '.'
-          part == '..' ? parts.pop : parts << part
-        end
-
-        cleaned = '/' << parts.join('/')
-        cleaned << '/' if parts.any? and unescaped =~ /\/\.{0,2}$/
-        cleaned
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/remote_referrer.rb

@@ -1,20 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   CSRF
-    # Supported browsers:: all
-    # More infos::         http://en.wikipedia.org/wiki/Cross-site_request_forgery
-    #
-    # Does not accept unsafe HTTP requests if the Referer [sic] header is set to
-    # a different host.
-    class RemoteReferrer < Base
-      default_reaction :deny
-
-      def accepts?(env)
-        safe?(env) or referrer(env) == Request.new(env).host
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/remote_token.rb

@@ -1,22 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   CSRF
-    # Supported browsers:: all
-    # More infos::         http://en.wikipedia.org/wiki/Cross-site_request_forgery
-    #
-    # Only accepts unsafe HTTP requests if a given access token matches the token
-    # included in the session *or* the request comes from the same origin.
-    #
-    # Compatible with Rails and rack-csrf.
-    class RemoteToken < AuthenticityToken
-      default_reaction :deny
-
-      def accepts?(env)
-        super or referrer(env) == Request.new(env).host
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/session_hijacking.rb

@@ -1,36 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   Session Hijacking
-    # Supported browsers:: all
-    # More infos::         http://en.wikipedia.org/wiki/Session_hijacking
-    #
-    # Tracks request properties like the user agent in the session and empties
-    # the session if those properties change. This essentially prevents attacks
-    # from Firesheep. Since all headers taken into consideration might be
-    # spoofed, too, this will not prevent all hijacking attempts.
-    class SessionHijacking < Base
-      default_reaction :drop_session
-      default_options :tracking_key => :tracking, :encrypt_tracking => true,
-        :track => %w[HTTP_USER_AGENT HTTP_ACCEPT_ENCODING HTTP_ACCEPT_LANGUAGE]
-
-      def accepts?(env)
-        session = session env
-        key     = options[:tracking_key]
-        if session.include? key
-          session[key].all? { |k,v| v == encrypt(env[k]) }
-        else
-          session[key] = {}
-          options[:track].each { |k| session[key][k] = encrypt(env[k]) }
-        end
-      end
-
-      def encrypt(value)
-        value = value.to_s.downcase
-        options[:encrypt_tracking] ? super(value) : value
-      end
-    end
-  end
-end