torquebox-console 0.2.5 → 0.3.0

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/version.rb

@@ -1,16 +0,0 @@
-module Rack
-  module Protection
-    def self.version
-      VERSION
-    end
-
-    SIGNATURE = [1, 4, 0]
-    VERSION   = SIGNATURE.join('.')
-
-    VERSION.extend Comparable
-    def VERSION.<=>(other)
-      other = other.split('.').map { |i| i.to_i } if other.respond_to? :split
-      SIGNATURE <=> Array(other)
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/lib/rack/protection/xss_header.rb

@@ -1,25 +0,0 @@
-require 'rack/protection'
-
-module Rack
-  module Protection
-    ##
-    # Prevented attack::   Non-permanent XSS
-    # Supported browsers:: Internet Explorer 8 and later
-    # More infos::         http://blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx
-    #
-    # Sets X-XSS-Protection header to tell the browser to block attacks.
-    #
-    # Options:
-    # xss_mode:: How the browser should prevent the attack (default: :block)
-    class XSSHeader < Base
-      default_options :xss_mode => :block, :nosniff => true
-
-      def call(env)
-        status, headers, body = @app.call(env)
-        headers['X-XSS-Protection']       ||= "1; mode=#{options[:xss_mode]}" if html? headers
-        headers['X-Content-Type-Options'] ||= 'nosniff'                       if options[:nosniff]
-        [status, headers, body]
-      end
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/rack-protection.gemspec

@@ -1,92 +0,0 @@
-# Run `rake rack-protection.gemspec` to update the gemspec.
-Gem::Specification.new do |s|
-  # general infos
-  s.name        = "rack-protection"
-  s.version     = "1.4.0"
-  s.description = "You should use protection!"
-  s.homepage    = "http://github.com/rkh/rack-protection"
-  s.summary     = s.description
-
-  # generated from git shortlog -sn
-  s.authors = [
-    "Konstantin Haase",
-    "Alex Rodionov",
-    "Chris Heald",
-    "Chris Mytton",
-    "Corey Ward",
-    "David Kellum",
-    "Egor Homakov",
-    "Fojas",
-    "Mael Clerambault",
-    "Martin Mauch",
-    "SAKAI, Kazuaki",
-    "Stanislav Savulchik",
-    "Steve Agalloco",
-    "Akzhan Abdulin",
-    "TOBY",
-    "Bj\u00F8rge N\u00E6ss"
-  ]
-
-  # generated from git shortlog -sne
-  s.email = [
-    "konstantin.mailinglists@googlemail.com",
-    "p0deje@gmail.com",
-    "cheald@gmail.com",
-    "self@hecticjeff.net",
-    "coreyward@me.com",
-    "dek-oss@gravitext.com",
-    "homakov@gmail.com",
-    "developer@fojasaur.us",
-    "mael@clerambault.fr",
-    "martin.mauch@gmail.com",
-    "kaz.july.7@gmail.com",
-    "s.savulchik@gmail.com",
-    "steve.agalloco@gmail.com",
-    "akzhan.abdulin@gmail.com",
-    "toby.net.info.mail+git@gmail.com",
-    "bjoerge@bengler.no"
-  ]
-
-  # generated from git ls-files
-  s.files = [
-    "License",
-    "README.md",
-    "Rakefile",
-    "lib/rack-protection.rb",
-    "lib/rack/protection.rb",
-    "lib/rack/protection/authenticity_token.rb",
-    "lib/rack/protection/base.rb",
-    "lib/rack/protection/escaped_params.rb",
-    "lib/rack/protection/form_token.rb",
-    "lib/rack/protection/frame_options.rb",
-    "lib/rack/protection/http_origin.rb",
-    "lib/rack/protection/ip_spoofing.rb",
-    "lib/rack/protection/json_csrf.rb",
-    "lib/rack/protection/path_traversal.rb",
-    "lib/rack/protection/remote_referrer.rb",
-    "lib/rack/protection/remote_token.rb",
-    "lib/rack/protection/session_hijacking.rb",
-    "lib/rack/protection/version.rb",
-    "lib/rack/protection/xss_header.rb",
-    "rack-protection.gemspec",
-    "spec/authenticity_token_spec.rb",
-    "spec/escaped_params_spec.rb",
-    "spec/form_token_spec.rb",
-    "spec/frame_options_spec.rb",
-    "spec/http_origin_spec.rb",
-    "spec/ip_spoofing_spec.rb",
-    "spec/json_csrf_spec.rb",
-    "spec/path_traversal_spec.rb",
-    "spec/protection_spec.rb",
-    "spec/remote_referrer_spec.rb",
-    "spec/remote_token_spec.rb",
-    "spec/session_hijacking_spec.rb",
-    "spec/spec_helper.rb",
-    "spec/xss_header_spec.rb"
-  ]
-
-  # dependencies
-  s.add_dependency "rack"
-  s.add_development_dependency "rack-test"
-  s.add_development_dependency "rspec", "~> 2.0"
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/authenticity_token_spec.rb

@@ -1,33 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::AuthenticityToken do
-  it_behaves_like "any rack application"
-
-  it "denies post requests without any token" do
-    post('/').should_not be_ok
-  end
-
-  it "accepts post requests with correct X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "a")
-    last_response.should be_ok
-  end
-
-  it "denies post requests with wrong X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "b")
-    last_response.should_not be_ok
-  end
-
-  it "accepts post form requests with correct authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "a"})
-    last_response.should be_ok
-  end
-
-  it "denies post form requests with wrong authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "b"})
-    last_response.should_not be_ok
-  end
-
-  it "prevents ajax requests without a valid token" do
-    post('/', {}, "HTTP_X_REQUESTED_WITH" => "XMLHttpRequest").should_not be_ok
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/escaped_params_spec.rb

@@ -1,44 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::EscapedParams do
-  it_behaves_like "any rack application"
-
-  context 'escaping' do
-    it 'escapes html entities' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, [request.params['foo']]]
-      end
-      get '/', :foo => "<bar>"
-      body.should == '&lt;bar&gt;'
-    end
-
-    it 'leaves normal params untouched' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, [request.params['foo']]]
-      end
-      get '/', :foo => "bar"
-      body.should == 'bar'
-    end
-
-    it 'copes with nested arrays' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, [request.params['foo']['bar']]]
-      end
-      get '/', :foo => {:bar => "<bar>"}
-      body.should == '&lt;bar&gt;'
-    end
-
-    it 'leaves cache-breaker params untouched' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, ['hi']]
-      end
-
-      get '/?95df8d9bf5237ad08df3115ee74dcb10'
-      body.should == 'hi'
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/form_token_spec.rb

@@ -1,33 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::FormToken do
-  it_behaves_like "any rack application"
-
-  it "denies post requests without any token" do
-    post('/').should_not be_ok
-  end
-
-  it "accepts post requests with correct X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "a")
-    last_response.should be_ok
-  end
-
-  it "denies post requests with wrong X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "b")
-    last_response.should_not be_ok
-  end
-
-  it "accepts post form requests with correct authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "a"})
-    last_response.should be_ok
-  end
-
-  it "denies post form requests with wrong authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "b"})
-    last_response.should_not be_ok
-  end
-
-  it "accepts ajax requests without a valid token" do
-    post('/', {}, "HTTP_X_REQUESTED_WITH" => "XMLHttpRequest").should be_ok
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/frame_options_spec.rb

@@ -1,39 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::FrameOptions do
-  it_behaves_like "any rack application"
-
-  it 'should set the X-Frame-Options' do
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "SAMEORIGIN"
-  end
-
-  it 'should not set the X-Frame-Options for other content types' do
-    get('/', {}, 'wants' => 'text/foo').headers["X-Frame-Options"].should be_nil
-  end
-
-  it 'should allow changing the protection mode' do
-    # I have no clue what other modes are available
-    mock_app do
-      use Rack::Protection::FrameOptions, :frame_options => :deny
-      run DummyApp
-    end
-
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "DENY"
-  end
-
-
-  it 'should allow changing the protection mode to a string' do
-    # I have no clue what other modes are available
-    mock_app do
-      use Rack::Protection::FrameOptions, :frame_options => "ALLOW-FROM foo"
-      run DummyApp
-    end
-
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "ALLOW-FROM foo"
-  end
-
-  it 'should not override the header if already set' do
-    mock_app with_headers("X-Frame-Options" => "allow")
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "allow"
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/http_origin_spec.rb

@@ -1,38 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::HttpOrigin do
-  it_behaves_like "any rack application"
-
-  before(:each) do
-    mock_app do
-      use Rack::Protection::HttpOrigin
-      run DummyApp
-    end
-  end
-
-  %w(GET HEAD POST PUT DELETE).each do |method|
-    it "accepts #{method} requests with no Origin" do
-      send(method.downcase, '/').should be_ok
-    end
-  end
-
-  %w(GET HEAD).each do |method|
-    it "accepts #{method} requests with non-whitelisted Origin" do
-      send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://malicious.com').should be_ok
-    end
-  end
-
-  %w(POST PUT DELETE).each do |method|
-    it "denies #{method} requests with non-whitelisted Origin" do
-      send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://malicious.com').should_not be_ok
-    end
-
-    it "accepts #{method} requests with whitelisted Origin" do
-      mock_app do
-        use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://www.friend.com']
-        run DummyApp
-      end
-      send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://www.friend.com').should be_ok
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/ip_spoofing_spec.rb

@@ -1,35 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::IPSpoofing do
-  it_behaves_like "any rack application"
-
-  it 'accepts requests without X-Forward-For header' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.4', 'HTTP_X_REAL_IP' => '4.3.2.1')
-    last_response.should be_ok
-  end
-
-  it 'accepts requests with proper X-Forward-For header' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.4',
-      'HTTP_X_FORWARDED_FOR' => '192.168.1.20, 1.2.3.4, 127.0.0.1')
-    last_response.should be_ok
-  end
-
-  it 'denies requests where the client spoofs X-Forward-For but not the IP' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.4', 'HTTP_X_FORWARDED_FOR' => '1.2.3.5')
-    last_response.should_not be_ok
-  end
-
-  it 'denies requests where the client spoofs the IP but not X-Forward-For' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.5',
-      'HTTP_X_FORWARDED_FOR' => '192.168.1.20, 1.2.3.4, 127.0.0.1')
-    last_response.should_not be_ok
-  end
-
-  it 'denies requests where IP and X-Forward-For are spoofed but not X-Real-IP' do
-    get('/', {},
-      'HTTP_CLIENT_IP'       => '1.2.3.5',
-      'HTTP_X_FORWARDED_FOR' => '1.2.3.5',
-      'HTTP_X_REAL_IP'       => '1.2.3.4')
-    last_response.should_not be_ok
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/json_csrf_spec.rb

@@ -1,44 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::JsonCsrf do
-  it_behaves_like "any rack application"
-
-  describe 'json response' do
-    before do
-      mock_app { |e| [200, {'Content-Type' => 'application/json'}, []]}
-    end
-
-    it "denies get requests with json responses with a remote referrer" do
-      get('/', {}, 'HTTP_REFERER' => 'http://evil.com').should_not be_ok
-    end
-
-    it "accepts requests with json responses with a remote referrer when there's an origin header set" do
-      get('/', {}, 'HTTP_REFERER' => 'http://good.com', 'HTTP_ORIGIN' => 'http://good.com').should be_ok
-    end
-
-    it "accepts requests with json responses with a remote referrer when there's an x-origin header set" do
-      get('/', {}, 'HTTP_REFERER' => 'http://good.com', 'HTTP_X_ORIGIN' => 'http://good.com').should be_ok
-    end
-
-    it "accepts get requests with json responses with a local referrer" do
-      get('/', {}, 'HTTP_REFERER' => '/').should be_ok
-    end
-
-    it "accepts get requests with json responses with no referrer" do
-      get('/', {}).should be_ok
-    end
-
-    it "accepts XHR requests" do
-      get('/', {}, 'HTTP_REFERER' => 'http://evil.com', 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest').should be_ok
-    end
-  end
-
-  describe 'not json response' do
-
-    it "accepts get requests with 304 headers" do
-      mock_app { |e| [304, {}, []]}
-      get('/', {}).status.should == 304
-    end
-
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/path_traversal_spec.rb

@@ -1,28 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::PathTraversal do
-  it_behaves_like "any rack application"
-
-  context 'escaping' do
-    before do
-      mock_app { |e| [200, {'Content-Type' => 'text/plain'}, [e['PATH_INFO']]] }
-    end
-
-    %w[/foo/bar /foo/bar/ / /.f /a.x].each do |path|
-      it("does not touch #{path.inspect}") { get(path).body.should == path }
-    end
-
-    { # yes, this is ugly, feel free to change that
-      '/..' => '/', '/a/../b' => '/b', '/a/../b/' => '/b/', '/a/.' => '/a/',
-      '/%2e.' => '/', '/a/%2e%2e/b' => '/b', '/a%2f%2e%2e%2fb/' => '/b/',
-      '//' => '/', '/%2fetc%2fpasswd' => '/etc/passwd'
-    }.each do |a, b|
-      it("replaces #{a.inspect} with #{b.inspect}") { get(a).body.should == b }
-    end
-
-    it 'should be able to deal with PATH_INFO = nil (fcgi?)' do
-      app = Rack::Protection::PathTraversal.new(proc { 42 })
-      app.call({}).should be == 42
-    end
-  end
-end

data/vendor/bundle/ruby/1.8/gems/rack-protection-1.4.0/spec/protection_spec.rb

@@ -1,37 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection do
-  it_behaves_like "any rack application"
-
-  it 'passes on options' do
-    mock_app do
-      use Rack::Protection, :track => ['HTTP_FOO']
-      run proc { |e| [200, {'Content-Type' => 'text/plain'}, ['hi']] }
-    end
-
-    session = {:foo => :bar}
-    get '/', {}, 'rack.session' => session, 'HTTP_ACCEPT_ENCODING' => 'a'
-    get '/', {}, 'rack.session' => session, 'HTTP_ACCEPT_ENCODING' => 'b'
-    session[:foo].should be == :bar
-
-    get '/', {}, 'rack.session' => session, 'HTTP_FOO' => 'BAR'
-    session.should be_empty
-  end
-
-  describe "#html?" do
-    context "given an appropriate content-type header" do
-      subject { Rack::Protection::Base.new(nil).html? 'content-type' => "text/html" }
-      it { should be_true }
-    end
-
-    context "given an inappropriate content-type header" do
-      subject { Rack::Protection::Base.new(nil).html? 'content-type' => "image/gif" }
-      it { should be_false }
-    end
-
-    context "given no content-type header" do
-      subject { Rack::Protection::Base.new(nil).html?({}) }
-      it { should be_false }
-    end
-  end
-end