Class: Rack::Protection::Base

# File 'rack-protection/lib/rack/protection/base.rb', line 27

def self.default_reaction(reaction)
  alias_method(:default_reaction, reaction)
end

# File 'rack-protection/lib/rack/protection/base.rb', line 21

attr_reader :app, :options

# File 'rack-protection/lib/rack/protection/base.rb', line 48

def call(env)
  unless accepts? env
    instrument env
    result = react env
  end
  result or app.call(env)
end

# File 'rack-protection/lib/rack/protection/base.rb', line 31

def default_options
  DEFAULT_OPTIONS
end

# File 'rack-protection/lib/rack/protection/base.rb', line 131

alias default_reaction deny

# File 'rack-protection/lib/rack/protection/base.rb', line 75

def deny(env)
  warn env, "attack prevented by #{self.class}"
  [options[:status], { 'content-type' => 'text/plain' }, [options[:message]]]
end

# File 'rack-protection/lib/rack/protection/base.rb', line 95

def drop_session(env)
  return unless session? env

  session(env).clear

  return if ["1", "true"].include?(ENV["RACK_PROTECTION_SILENCE_DROP_SESSION_WARNING"])

  warn env, "session dropped by #{self.class}"
end

# File 'rack-protection/lib/rack/protection/base.rb', line 123

def encrypt(value)
  options[:encryptor].hexdigest value.to_s
end

# File 'rack-protection/lib/rack/protection/base.rb', line 133

def html?(headers)
  return false unless (header = headers.detect { |k, _v| k.downcase == 'content-type' })

  options[:html_types].include? header.last[%r{^\w+/\w+}]
end

# File 'rack-protection/lib/rack/protection/base.rb', line 68

def instrument(env)
  return unless (i = options[:instrumenter])

  env['rack.protection.attack'] = self.class.name.split('::').last.downcase
  i.instrument('rack.protection', env)
end

# File 'rack-protection/lib/rack/protection/base.rb', line 113

def origin(env)
  env['HTTP_ORIGIN'] || env['HTTP_X_ORIGIN']
end

# File 'rack-protection/lib/rack/protection/base.rb', line 117

def random_string(secure = defined? SecureRandom)
  secure ? SecureRandom.hex(16) : '%032x' % rand((2**128) - 1)
rescue NotImplementedError
  random_string false
end

# File 'rack-protection/lib/rack/protection/base.rb', line 56

def react(env)
  result = send(options[:reaction], env)
  result if (Array === result) && (result.size == 3)
end

# File 'rack-protection/lib/rack/protection/base.rb', line 105

def referrer(env)
  ref = env['HTTP_REFERER'].to_s
  return if !options[:allow_empty_referrer] && ref.empty?

  URI.parse(ref).host || Request.new(env).host
rescue URI::InvalidURIError
end

# File 'rack-protection/lib/rack/protection/base.rb', line 80

def report(env)
  warn env, "attack reported by #{self.class}"
  env[options[:report_key]] = true
end

# File 'rack-protection/lib/rack/protection/base.rb', line 40

def safe?(env)
  %w[GET HEAD OPTIONS TRACE].include? env['REQUEST_METHOD']
end

# File 'rack-protection/lib/rack/protection/base.rb', line 127

def secure_compare(a, b)
  Rack::Utils.secure_compare(a.to_s, b.to_s)
end

# File 'rack-protection/lib/rack/protection/base.rb', line 89

def session(env)
  return env[options[:session_key]] if session? env

  raise "you need to set up a session middleware *before* #{self.class}"
end

# File 'rack-protection/lib/rack/protection/base.rb', line 85

def session?(env)
  env.include? options[:session_key]
end

# File 'rack-protection/lib/rack/protection/base.rb', line 61

def warn(env, message)
  return unless options[:logging]

  l = options[:logger] || env['rack.logger'] || ::Logger.new(env['rack.errors'])
  l.warn(message)
end