mirror of
https://github.com/samsonjs/rack-attack.git
synced 2026-04-27 15:07:41 +00:00
commit
4fc4d79c9d
15 changed files with 243 additions and 189 deletions
27
.rubocop.yml
27
.rubocop.yml
|
|
@ -1,3 +1,6 @@
|
||||||
|
require:
|
||||||
|
- rubocop-performance
|
||||||
|
|
||||||
inherit_mode:
|
inherit_mode:
|
||||||
merge:
|
merge:
|
||||||
- Exclude
|
- Exclude
|
||||||
|
|
@ -26,6 +29,9 @@ Naming:
|
||||||
Exclude:
|
Exclude:
|
||||||
- "lib/rack/attack/path_normalizer.rb"
|
- "lib/rack/attack/path_normalizer.rb"
|
||||||
|
|
||||||
|
Metrics/LineLength:
|
||||||
|
Max: 120
|
||||||
|
|
||||||
Performance:
|
Performance:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
|
||||||
|
|
@ -34,13 +40,25 @@ Security:
|
||||||
|
|
||||||
Style/BlockDelimiters:
|
Style/BlockDelimiters:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
IgnoredMethods: [] # Workaround rubocop bug: https://github.com/rubocop-hq/rubocop/issues/6179
|
||||||
|
|
||||||
Style/BracesAroundHashParameters:
|
Style/BracesAroundHashParameters:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
|
||||||
|
Style/ClassAndModuleChildren:
|
||||||
|
Enabled: true
|
||||||
|
Exclude:
|
||||||
|
- "spec/**/*"
|
||||||
|
|
||||||
|
Style/ConditionalAssignment:
|
||||||
|
Enabled: true
|
||||||
|
|
||||||
Style/Encoding:
|
Style/Encoding:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
|
||||||
|
Style/ExpandPathArguments:
|
||||||
|
Enabled: true
|
||||||
|
|
||||||
Style/EmptyMethod:
|
Style/EmptyMethod:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
|
||||||
|
|
@ -53,6 +71,9 @@ Style/HashSyntax:
|
||||||
Style/OptionalArguments:
|
Style/OptionalArguments:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
|
||||||
|
Style/ParallelAssignment:
|
||||||
|
Enabled: true
|
||||||
|
|
||||||
Style/RaiseArgs:
|
Style/RaiseArgs:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
|
||||||
|
|
@ -70,3 +91,9 @@ Style/Semicolon:
|
||||||
|
|
||||||
Style/SingleLineMethods:
|
Style/SingleLineMethods:
|
||||||
Enabled: true
|
Enabled: true
|
||||||
|
|
||||||
|
Style/SpecialGlobalVars:
|
||||||
|
Enabled: true
|
||||||
|
|
||||||
|
Style/UnneededPercentQ:
|
||||||
|
Enabled: true
|
||||||
|
|
|
||||||
|
|
@ -6,7 +6,8 @@ require 'rack/attack/path_normalizer'
|
||||||
require 'rack/attack/request'
|
require 'rack/attack/request'
|
||||||
require "ipaddr"
|
require "ipaddr"
|
||||||
|
|
||||||
class Rack::Attack
|
module Rack
|
||||||
|
class Attack
|
||||||
class MisconfiguredStoreError < StandardError; end
|
class MisconfiguredStoreError < StandardError; end
|
||||||
class MissingStoreError < StandardError; end
|
class MissingStoreError < StandardError; end
|
||||||
|
|
||||||
|
|
@ -118,7 +119,10 @@ class Rack::Attack
|
||||||
end
|
end
|
||||||
|
|
||||||
def clear_configuration
|
def clear_configuration
|
||||||
@safelists, @blocklists, @throttles, @tracks = {}, {}, {}, {}
|
@safelists = {}
|
||||||
|
@blocklists = {}
|
||||||
|
@throttles = {}
|
||||||
|
@tracks = {}
|
||||||
self.anonymous_blocklists = []
|
self.anonymous_blocklists = []
|
||||||
self.anonymous_safelists = []
|
self.anonymous_safelists = []
|
||||||
end
|
end
|
||||||
|
|
@ -134,10 +138,10 @@ class Rack::Attack
|
||||||
@anonymous_safelists = []
|
@anonymous_safelists = []
|
||||||
@notifier = ActiveSupport::Notifications if defined?(ActiveSupport::Notifications)
|
@notifier = ActiveSupport::Notifications if defined?(ActiveSupport::Notifications)
|
||||||
@blocklisted_response = lambda { |_env| [403, { 'Content-Type' => 'text/plain' }, ["Forbidden\n"]] }
|
@blocklisted_response = lambda { |_env| [403, { 'Content-Type' => 'text/plain' }, ["Forbidden\n"]] }
|
||||||
@throttled_response = lambda { |env|
|
@throttled_response = lambda do |env|
|
||||||
retry_after = (env['rack.attack.match_data'] || {})[:period]
|
retry_after = (env['rack.attack.match_data'] || {})[:period]
|
||||||
[429, { 'Content-Type' => 'text/plain', 'Retry-After' => retry_after.to_s }, ["Retry later\n"]]
|
[429, { 'Content-Type' => 'text/plain', 'Retry-After' => retry_after.to_s }, ["Retry later\n"]]
|
||||||
}
|
end
|
||||||
|
|
||||||
def initialize(app)
|
def initialize(app)
|
||||||
@app = app
|
@app = app
|
||||||
|
|
@ -161,4 +165,5 @@ class Rack::Attack
|
||||||
|
|
||||||
extend Forwardable
|
extend Forwardable
|
||||||
def_delegators self, :safelisted?, :blocklisted?, :throttled?, :tracked?
|
def_delegators self, :safelisted?, :blocklisted?, :throttled?, :tracked?
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -73,7 +73,10 @@ module Rack
|
||||||
|
|
||||||
def enforce_store_method_presence!(method_name)
|
def enforce_store_method_presence!(method_name)
|
||||||
if !store.respond_to?(method_name)
|
if !store.respond_to?(method_name)
|
||||||
raise Rack::Attack::MisconfiguredStoreError, "Configured store #{store.class.name} doesn't respond to ##{method_name} method"
|
raise(
|
||||||
|
Rack::Attack::MisconfiguredStoreError,
|
||||||
|
"Configured store #{store.class.name} doesn't respond to ##{method_name} method"
|
||||||
|
)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -5,7 +5,8 @@ module Rack
|
||||||
class Check
|
class Check
|
||||||
attr_reader :name, :block, :type
|
attr_reader :name, :block, :type
|
||||||
def initialize(name, options = {}, &block)
|
def initialize(name, options = {}, &block)
|
||||||
@name, @block = name, block
|
@name = name
|
||||||
|
@block = block
|
||||||
@type = options.fetch(:type, nil)
|
@type = options.fetch(:type, nil)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,7 @@
|
||||||
# frozen_string_literal: true
|
# frozen_string_literal: true
|
||||||
|
|
||||||
class Rack::Attack
|
module Rack
|
||||||
|
class Attack
|
||||||
# When using Rack::Attack with a Rails app, developers expect the request path
|
# When using Rack::Attack with a Rails app, developers expect the request path
|
||||||
# to be normalized. In particular, trailing slashes are stripped.
|
# to be normalized. In particular, trailing slashes are stripped.
|
||||||
# (See https://git.io/v0rrR for implementation.)
|
# (See https://git.io/v0rrR for implementation.)
|
||||||
|
|
@ -21,4 +22,5 @@ class Rack::Attack
|
||||||
else
|
else
|
||||||
FallbackPathNormalizer
|
FallbackPathNormalizer
|
||||||
end
|
end
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -7,7 +7,9 @@ module Rack
|
||||||
module StoreProxy
|
module StoreProxy
|
||||||
class ActiveSupportRedisStoreProxy < SimpleDelegator
|
class ActiveSupportRedisStoreProxy < SimpleDelegator
|
||||||
def self.handle?(store)
|
def self.handle?(store)
|
||||||
defined?(::Redis) && defined?(::ActiveSupport::Cache::RedisStore) && store.is_a?(::ActiveSupport::Cache::RedisStore)
|
defined?(::Redis) &&
|
||||||
|
defined?(::ActiveSupport::Cache::RedisStore) &&
|
||||||
|
store.is_a?(::ActiveSupport::Cache::RedisStore)
|
||||||
end
|
end
|
||||||
|
|
||||||
def increment(name, amount = 1, options = {})
|
def increment(name, amount = 1, options = {})
|
||||||
|
|
|
||||||
|
|
@ -7,7 +7,9 @@ module Rack
|
||||||
module StoreProxy
|
module StoreProxy
|
||||||
class MemCacheStoreProxy < SimpleDelegator
|
class MemCacheStoreProxy < SimpleDelegator
|
||||||
def self.handle?(store)
|
def self.handle?(store)
|
||||||
defined?(::Dalli) && defined?(::ActiveSupport::Cache::MemCacheStore) && store.is_a?(::ActiveSupport::Cache::MemCacheStore)
|
defined?(::Dalli) &&
|
||||||
|
defined?(::ActiveSupport::Cache::MemCacheStore) &&
|
||||||
|
store.is_a?(::ActiveSupport::Cache::MemCacheStore)
|
||||||
end
|
end
|
||||||
|
|
||||||
def write(name, value, options = {})
|
def write(name, value, options = {})
|
||||||
|
|
|
||||||
|
|
@ -7,7 +7,8 @@ module Rack
|
||||||
|
|
||||||
attr_reader :name, :limit, :period, :block, :type
|
attr_reader :name, :limit, :period, :block, :type
|
||||||
def initialize(name, options, &block)
|
def initialize(name, options, &block)
|
||||||
@name, @block = name, block
|
@name = name
|
||||||
|
@block = block
|
||||||
MANDATORY_OPTIONS.each do |opt|
|
MANDATORY_OPTIONS.each do |opt|
|
||||||
raise ArgumentError, "Must pass #{opt.inspect} option" unless options[opt]
|
raise ArgumentError, "Must pass #{opt.inspect} option" unless options[opt]
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -8,10 +8,11 @@ module Rack
|
||||||
def initialize(name, options = {}, &block)
|
def initialize(name, options = {}, &block)
|
||||||
options[:type] = :track
|
options[:type] = :track
|
||||||
|
|
||||||
|
@filter =
|
||||||
if options[:limit] && options[:period]
|
if options[:limit] && options[:period]
|
||||||
@filter = Throttle.new(name, options, &block)
|
Throttle.new(name, options, &block)
|
||||||
else
|
else
|
||||||
@filter = Check.new(name, options, &block)
|
Check.new(name, options, &block)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
# frozen_string_literal: true
|
# frozen_string_literal: true
|
||||||
|
|
||||||
lib = File.expand_path('../lib/', __FILE__)
|
lib = File.expand_path('lib', __dir__)
|
||||||
$:.unshift lib unless $:.include?(lib)
|
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
||||||
|
|
||||||
require 'rack/attack/version'
|
require 'rack/attack/version'
|
||||||
|
|
||||||
|
|
@ -18,7 +18,7 @@ Gem::Specification.new do |s|
|
||||||
s.homepage = 'https://github.com/kickstarter/rack-attack'
|
s.homepage = 'https://github.com/kickstarter/rack-attack'
|
||||||
s.rdoc_options = ["--charset=UTF-8"]
|
s.rdoc_options = ["--charset=UTF-8"]
|
||||||
s.require_paths = ["lib"]
|
s.require_paths = ["lib"]
|
||||||
s.summary = %q{Block & throttle abusive requests}
|
s.summary = 'Block & throttle abusive requests'
|
||||||
s.test_files = Dir.glob("spec/**/*")
|
s.test_files = Dir.glob("spec/**/*")
|
||||||
|
|
||||||
s.metadata = {
|
s.metadata = {
|
||||||
|
|
@ -37,7 +37,8 @@ Gem::Specification.new do |s|
|
||||||
s.add_development_dependency "minitest-stub-const", "~> 0.6"
|
s.add_development_dependency "minitest-stub-const", "~> 0.6"
|
||||||
s.add_development_dependency 'rack-test', "~> 1.0"
|
s.add_development_dependency 'rack-test', "~> 1.0"
|
||||||
s.add_development_dependency 'rake', "~> 12.3"
|
s.add_development_dependency 'rake', "~> 12.3"
|
||||||
s.add_development_dependency "rubocop", "0.67.2"
|
s.add_development_dependency "rubocop", "0.74.0"
|
||||||
|
s.add_development_dependency "rubocop-performance", "~> 1.4.1"
|
||||||
s.add_development_dependency "timecop", "~> 0.9.1"
|
s.add_development_dependency "timecop", "~> 0.9.1"
|
||||||
|
|
||||||
# byebug only works with MRI
|
# byebug only works with MRI
|
||||||
|
|
|
||||||
|
|
@ -15,8 +15,6 @@ if defined?(::ConnectionPool) && defined?(::Dalli)
|
||||||
Rack::Attack.cache.store.clear
|
Rack::Attack.cache.store.clear
|
||||||
end
|
end
|
||||||
|
|
||||||
it_works_for_cache_backed_features(fetch_from_store: ->(key) {
|
it_works_for_cache_backed_features(fetch_from_store: ->(key) { Rack::Attack.cache.store.read(key) })
|
||||||
Rack::Attack.cache.store.read(key)
|
|
||||||
})
|
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,13 @@
|
||||||
|
|
||||||
require_relative "../../spec_helper"
|
require_relative "../../spec_helper"
|
||||||
|
|
||||||
if defined?(::ConnectionPool) && defined?(::Redis) && Gem::Version.new(::Redis::VERSION) >= Gem::Version.new("4") && defined?(::ActiveSupport::Cache::RedisCacheStore)
|
should_run =
|
||||||
|
defined?(::ConnectionPool) &&
|
||||||
|
defined?(::Redis) &&
|
||||||
|
Gem::Version.new(::Redis::VERSION) >= Gem::Version.new("4") &&
|
||||||
|
defined?(::ActiveSupport::Cache::RedisCacheStore)
|
||||||
|
|
||||||
|
if should_run
|
||||||
require_relative "../../support/cache_store_helper"
|
require_relative "../../support/cache_store_helper"
|
||||||
require "timecop"
|
require "timecop"
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,12 @@
|
||||||
|
|
||||||
require_relative "../../spec_helper"
|
require_relative "../../spec_helper"
|
||||||
|
|
||||||
if defined?(::Redis) && Gem::Version.new(::Redis::VERSION) >= Gem::Version.new("4") && defined?(::ActiveSupport::Cache::RedisCacheStore)
|
should_run =
|
||||||
|
defined?(::Redis) &&
|
||||||
|
Gem::Version.new(::Redis::VERSION) >= Gem::Version.new("4") &&
|
||||||
|
defined?(::ActiveSupport::Cache::RedisCacheStore)
|
||||||
|
|
||||||
|
if should_run
|
||||||
require_relative "../../support/cache_store_helper"
|
require_relative "../../support/cache_store_helper"
|
||||||
require "timecop"
|
require "timecop"
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -17,8 +17,8 @@ if defined?(::Dalli) && defined?(::ConnectionPool)
|
||||||
Rack::Attack.cache.store.with { |client| client.flush_all }
|
Rack::Attack.cache.store.with { |client| client.flush_all }
|
||||||
end
|
end
|
||||||
|
|
||||||
it_works_for_cache_backed_features(fetch_from_store: ->(key) {
|
it_works_for_cache_backed_features(
|
||||||
Rack::Attack.cache.store.with { |client| client.fetch(key) }
|
fetch_from_store: ->(key) { Rack::Attack.cache.store.with { |client| client.fetch(key) } }
|
||||||
})
|
)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -22,9 +22,9 @@ describe 'Rack::Attack' do
|
||||||
Rack::Attack.blocklist("ip #{@bad_ip}") { |req| req.ip == @bad_ip }
|
Rack::Attack.blocklist("ip #{@bad_ip}") { |req| req.ip == @bad_ip }
|
||||||
end
|
end
|
||||||
|
|
||||||
it('has a blocklist') {
|
it 'has a blocklist' do
|
||||||
Rack::Attack.blocklists.key?("ip #{@bad_ip}").must_equal true
|
Rack::Attack.blocklists.key?("ip #{@bad_ip}").must_equal true
|
||||||
}
|
end
|
||||||
|
|
||||||
describe "a bad request" do
|
describe "a bad request" do
|
||||||
before { get '/', {}, 'REMOTE_ADDR' => @bad_ip }
|
before { get '/', {}, 'REMOTE_ADDR' => @bad_ip }
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue