Class: Rack::Protection::Base

Inherits:
Object
  • Object
show all
Defined in:
lib/rack/protection/base.rb

Constant Summary collapse

DEFAULT_OPTIONS = 
{
  :reaction    => :default_reaction, :logging   => true,
  :message     => 'Forbidden',       :encryptor => Digest::SHA1,
  :session_key => 'rack.session',    :status    => 403,
  :allow_empty_referrer => true
}

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(app, options = {}) ⇒ Base

Returns a new instance of Base.



30
31
32
 
# File 'lib/rack/protection/base.rb', line 30

def initialize(app, options = {})
  @app, @options = app, default_options.merge(options)
end

Instance Attribute Details

#app ⇒ Object (readonly)

Returns the value of attribute app.



16
17
18
 
# File 'lib/rack/protection/base.rb', line 16

def app
  @app
end

#options ⇒ Object (readonly)

Returns the value of attribute options.



16
17
18
 
# File 'lib/rack/protection/base.rb', line 16

def options
  @options
end

Class Method Details

.default_options(options) ⇒ Object 



18
19
20
 
# File 'lib/rack/protection/base.rb', line 18

def self.default_options(options)
  define_method(:default_options) { super().merge(options) }
end

.default_reaction(reaction) ⇒ Object 



22
23
24
 
# File 'lib/rack/protection/base.rb', line 22

def self.default_reaction(reaction)
  alias_method(:default_reaction, reaction)
end

Instance Method Details

#accepts?(env) ⇒ Boolean

Returns:

  • (Boolean)

Raises:

  • (NotImplementedError) 


38
39
40
 
# File 'lib/rack/protection/base.rb', line 38

def accepts?(env)
  raise NotImplementedError, "#{self.class} implementation pending"
end

#call(env) ⇒ Object 



42
43
44
45
46
47
48
 
# File 'lib/rack/protection/base.rb', line 42

def call(env)
  unless accepts? env
    warn env, "attack prevented by #{self.class}"
    result = react env
  end
  result or app.call(env)
end

#default_options ⇒ Object 



26
27
28
 
# File 'lib/rack/protection/base.rb', line 26

def default_options
  DEFAULT_OPTIONS
end

#deny(env) ⇒ Object Also known as: default_reaction 



61
62
63
 
# File 'lib/rack/protection/base.rb', line 61

def deny(env)
  [options[:status], {'Content-Type' => 'text/plain'}, [options[:message]]]
end

#drop_session(env) ⇒ Object 



74
75
76
 
# File 'lib/rack/protection/base.rb', line 74

def drop_session(env)
  session(env).clear if session? env
end

#encrypt(value) ⇒ Object 



90
91
92
 
# File 'lib/rack/protection/base.rb', line 90

def encrypt(value)
  options[:encryptor].hexdigest value.to_s
end

#random_string(secure = defined? SecureRandom)) ⇒ Object 



84
85
86
87
88
 
# File 'lib/rack/protection/base.rb', line 84

def random_string(secure = defined? SecureRandom)
  secure ? SecureRandom.hex(32) : "%032x" % rand(2**128-1)
rescue NotImpelentedError
  random_string false
end

#react(env) ⇒ Object 



50
51
52
53
 
# File 'lib/rack/protection/base.rb', line 50

def react(env)
  result = send(options[:reaction], env)
  result if Array === result and result.size == 3
end

#referrer(env) ⇒ Object 



78
79
80
81
82
 
# File 'lib/rack/protection/base.rb', line 78

def referrer(env)
  ref = env['HTTP_REFERER'].to_s
  return if !options[:allow_empty_referrer] and ref.empty?
  URI.parse(ref).host || Request.new(env).host
end

#safe?(env) ⇒ Boolean

Returns:

  • (Boolean) 


34
35
36
 
# File 'lib/rack/protection/base.rb', line 34

def safe?(env)
  %w[GET HEAD OPTIONS TRACE].include? env['REQUEST_METHOD']
end

#session(env) ⇒ Object 



69
70
71
72
 
# File 'lib/rack/protection/base.rb', line 69

def session(env)
  return env[options[:session_key]] if session? env
  fail "you need to set up a session middleware *before* #{self.class}"
end

#session?(env) ⇒ Boolean

Returns:

  • (Boolean) 


65
66
67
 
# File 'lib/rack/protection/base.rb', line 65

def session?(env)
  env.include? options[:session_key]
end

#warn(env, message) ⇒ Object 



55
56
57
58
59
 
# File 'lib/rack/protection/base.rb', line 55

def warn(env, message)
  return unless options[:logging]
  l = options[:logger] || env['rack.logger'] || ::Logger.new(env['rack.errors'])
  l.warn(message)
end