123456789_123456789_123456789_123456789_123456789_

Class: Rack::Protection::Base

Overview

Base class for middlewares provided by rack-protection.

Options

These may be given to any subclass, however they may affect different subclasses differently.

[:reaction] - name of a method of the class that will be used to respond when the middleware rejects the response. Default behavior is to use #default_reaction. [:logging] - if true, debug and warning statements are sent to the logger. [:message] - if set, this is the message sent when a request is rejected via deny. See DEFAULT_OPTIONS. [:session_key] - string to use as the key into env where the current session is stored. See DEFAULT_OPTIONS. [:status] - HTTP status to use when a request is rejected via deny. See DEFAULT_OPTIONS. [:report_key] - key set in env if the request has been denied and :reaction is set to :report (see #report). See DEFAULT_OPTIONS. [:html_types] - Array of strings containing content types that are consider HTML for the purposes of this gem. See DEFAULT_OPTIONS.

Constant Summary

Class Method Summary

Instance Attribute Summary

Instance Method Summary

Constructor Details

.new(app, options = {}) ⇒ Base

[ GitHub ] 

  


# File 'rack-protection/lib/rack/protection/base.rb', line 61



def initialize(app, options = {})
  @app = app
  @options = default_options.merge(options)
end


  







Class Method Details



  

    .default_options(options)  
  



  

    
Used by subclasses to declare default values for options they require.
These defaults are merged onto the DEFAULT_OPTIONS provided by this class.

  



  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 46



def self.default_options(options)
  define_method(:default_options) { super().merge(options) }
end


  








  

    .default_reaction(reaction)  
  



  

    
Used by subclasses to declare default reaction when a request is rejected.
This replaces the default provided by this class.
See #default_reaction.

  



  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 53



def self.default_reaction(reaction)
  alias_method(:default_reaction, reaction)
end


  







Instance Attribute Details



  

    #app   (readonly)
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 42



attr_reader :app, :options


  








  

    #options   (readonly)
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 42



attr_reader :app, :options


  







Instance Method Details



  

    #accepts?(env)  ⇒ Boolean 
  



  

    
  





  
Raises:


    
  
  • 
    (NotImplementedError)
  
    • 





  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 70



def accepts?(env)
  raise NotImplementedError, "#{self.class} implementation pending"
end


  








  

    #call(env)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 74



def call(env)
  unless accepts? env
    instrument env
    result = react env
  end
  result or app.call(env)
end


  








  

    #debug(env, message)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 87



def debug(env, message)
  return unless options[:logging]

  l = options[:logger] || env['rack.logger'] || ::Logger.new(env['rack.errors'])
  l.debug(message)
end


  








  

    #default_options  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 57



def default_options
  DEFAULT_OPTIONS
end


  








  

    #default_reaction(env)  
  



  

    
Alias for #deny.

  



  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 170



alias default_reaction deny


  








  

    #deny(env)  
    Also known as: #default_reaction, #react
  



  

    
Deny the request.  Sends a content type of "text/plain" using
the status and message set in the options.

  



  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 110



def deny(env)
  warn env, "attack prevented by #{self.class}"
  [options[:status], { 'content-type' => 'text/plain' }, [options[:message]]]
end


  








  

    #drop_session(env)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 134



def drop_session(env)
  return unless session? env

  session(env).clear

  return if ["1", "true"].include?(ENV["RACK_PROTECTION_SILENCE_DROP_SESSION_WARNING"])

  warn env, "session dropped by #{self.class}"
end


  








  

    #encrypt(value)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 162



def encrypt(value)
  options[:encryptor].hexdigest value.to_s
end


  








  

    #html?(headers)  ⇒ Boolean 
  



  

    
  





  


  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 172



def html?(headers)
  return false unless (header = headers.detect { |k, _v| k.downcase == 'content-type' })

  options[:html_types].include? header.last[%r{^\w+/\w+}]
end


  








  

    #instrument(env)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 101



def instrument(env)
  return unless (i = options[:instrumenter])

  env['rack.protection.attack'] = self.class.name.split('::').last.downcase
  i.instrument('rack.protection', env)
end


  








  

    #origin(env)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 152



def origin(env)
  env['HTTP_ORIGIN'] || env['HTTP_X_ORIGIN']
end


  








  

    #random_string(secure = defined? SecureRandom))  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 156



def random_string(secure = defined? SecureRandom)
  secure ? SecureRandom.hex(16) : '%032x' % rand((2**128) - 1)
rescue NotImplementedError
  random_string false
end


  








  

    #react(env)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 82



def react(env)
  result = send(options[:reaction], env)
  result if (Array === result) && (result.size == 3)
end


  








  

    #referrer(env)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 144



def referrer(env)
  ref = env['HTTP_REFERER'].to_s
  return if !options[:allow_empty_referrer] && ref.empty?

  URI.parse(ref).host || Request.new(env).host
rescue URI::InvalidURIError
end


  








  

    #report(env)  
  



  

    
When used as a reaction (with option reaction: :report),
any rejected request will be allowed through, and a warning is
omitted (note that warnings will not be shown if the
:logging option has been set to false).

  



  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 119



def report(env)
  warn env, "attack reported by #{self.class}"
  env[options[:report_key]] = true
end


  








  

    #safe?(env)  ⇒ Boolean 
  



  

    
  





  


  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 66



def safe?(env)
  %w[GET HEAD OPTIONS TRACE].include? env['REQUEST_METHOD']
end


  








  

    #secure_compare(a, b)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 166



def secure_compare(a, b)
  Rack::Utils.secure_compare(a.to_s, b.to_s)
end


  








  

    #session(env)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 128



def session(env)
  return env[options[:session_key]] if session? env

  raise "you need to set up a session middleware *before* #{self.class}"
end


  








  

    #session?(env)  ⇒ Boolean 
  



  

    
  





  


  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 124



def session?(env)
  env.include? options[:session_key]
end


  








  

    #warn(env, message)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/base.rb', line 94



def warn(env, message)
  return unless options[:logging]

  l = options[:logger] || env['rack.logger'] || ::Logger.new(env['rack.errors'])
  l.warn(message)
end