Skip to content

Commit 9df4227

Browse files
dentargdentarg
committed
Update prebuilt files
Ran and committed the changes from bundle exec rake pull build Looks like we have been accepting changes here that should have gone into the sinatra/sinatra repo. Oh well.
1 parent ec0d74f commit 9df4227

15 files changed

Lines changed: 191 additions & 169 deletions

‎_includes/README.html‎

Lines changed: 143 additions & 124 deletions
Large diffs are not rendered by default.

‎_includes/rack-protection-authenticity-token.html‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<p>all</p>
77
</dd><dt>More infos
88
<dd>
9-
<p><a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a></p>
9+
<p><a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a></p>
1010
</dd></dl>
1111

1212
<p>This middleware only accepts requests other than <code>GET</code>, <code>HEAD</code>, <code>OPTIONS</code>, <code>TRACE</code> if their given access token matches the token included in the session.</p>
@@ -48,6 +48,7 @@ <h2 id="label-Example-3A+Forms+application">Example: Forms application<span><a h
4848
<p>Here is <code>server.rb</code>:</p>
4949

5050
<pre class="ruby"><span class="ruby-identifier">require</span> <span class="ruby-string">&#39;rack/protection&#39;</span>
51+
<span class="ruby-identifier">require</span> <span class="ruby-string">&#39;rack/session&#39;</span>
5152

5253
<span class="ruby-identifier">app</span> = <span class="ruby-constant">Rack</span><span class="ruby-operator">::</span><span class="ruby-constant">Builder</span>.<span class="ruby-identifier">app</span> <span class="ruby-keyword">do</span>
5354
<span class="ruby-identifier">use</span> <span class="ruby-constant">Rack</span><span class="ruby-operator">::</span><span class="ruby-constant">Session</span><span class="ruby-operator">::</span><span class="ruby-constant">Cookie</span>, <span class="ruby-value">secret:</span> <span class="ruby-string">&#39;secret&#39;</span>

‎_includes/rack-protection-content-security-policy.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@
99
<p>Content Security Policy, a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). Content Security Policy is a declarative policy that lets the authors (or server administrators) of a web application inform the client about the sources from which the application expects to load resources.</p>
1010
</dd><dt>More info
1111
<dd>
12-
<p>W3C CSP Level 1 : <a href="https://www.w3.org/TR/CSP1">www.w3.org/TR/CSP1</a>/ (deprecated) W3C CSP Level 2 : <a href="https://www.w3.org/TR/CSP2">www.w3.org/TR/CSP2</a>/ (current) W3C CSP Level 3 : <a href="https://www.w3.org/TR/CSP3">www.w3.org/TR/CSP3</a>/ (draft) <a href="https://developer.mozilla.org/en-US/docs/Web/Security/CSP">developer.mozilla.org/en-US/docs/Web/Security/CSP</a> <a href="https://caniuse.com/#search=ContentSecurityPolicy">caniuse.com/#search=ContentSecurityPolicy</a> <a href="https://content-security-policy.com">content-security-policy.com</a>/ <a href="https://securityheaders.io">securityheaders.io</a> <a href="https://scotthelme.co.uk/csp-cheat-sheet">scotthelme.co.uk/csp-cheat-sheet</a>/ <a href="https://www.html5rocks.com/en/tutorials/security/content-security-policy">www.html5rocks.com/en/tutorials/security/content-security-policy</a>/</p>
12+
<p>W3C CSP Level 1 : <a href="https://www.w3.org/TR/CSP1">www.w3.org/TR/CSP1</a>/ (deprecated) W3C CSP Level 2 : <a href="https://www.w3.org/TR/CSP2">www.w3.org/TR/CSP2</a>/ (current) W3C CSP Level 3 : <a href="https://www.w3.org/TR/CSP3">www.w3.org/TR/CSP3</a>/ (draft) <a href="https://developer.mozilla.org/en-US/docs/Web/Security/CSP">developer.mozilla.org/en-US/docs/Web/Security/CSP</a> <a href="http://caniuse.com/#search=ContentSecurityPolicy">caniuse.com/#search=ContentSecurityPolicy</a> <a href="http://content-security-policy.com">content-security-policy.com</a>/ <a href="https://securityheaders.io">securityheaders.io</a> <a href="https://scotthelme.co.uk/csp-cheat-sheet">scotthelme.co.uk/csp-cheat-sheet</a>/ <a href="http://www.html5rocks.com/en/tutorials/security/content-security-policy">www.html5rocks.com/en/tutorials/security/content-security-policy</a>/</p>
1313
</dd></dl>
1414

15-
<p>Sets the ‘<a href="-Report-Only">Content-Security-Policy</a>’ header.</p>
15+
<p>Sets the ‘<a href="-report-only">content-security-policy</a>’ header.</p>
1616

1717
<p>Options: ContentSecurityPolicy configuration is a complex topic with</p>
1818

‎_includes/rack-protection-escaped-params.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<p>all</p>
77
</dd><dt>More infos
88
<dd>
9-
<p><a href="https://en.wikipedia.org/wiki/Cross-site_scripting">en.wikipedia.org/wiki/Cross-site_scripting</a></p>
9+
<p><a href="http://en.wikipedia.org/wiki/Cross-site_scripting">en.wikipedia.org/wiki/Cross-site_scripting</a></p>
1010
</dd></dl>
1111

1212
<p>Automatically escapes Rack::Request#params so they can be embedded in HTML or JavaScript without any further issues.</p>

‎_includes/rack-protection-form-token.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<p>all</p>
77
</dd><dt>More infos
88
<dd>
9-
<p><a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a></p>
9+
<p><a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a></p>
1010
</dd></dl>
1111

1212
<p>Only accepts submitted forms if a given access token matches the token included in the session. Does not expect such a token from Ajax request.</p>

‎_includes/rack-protection-http-origin.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,14 @@
66
<p>Google Chrome 2, Safari 4 and later</p>
77
</dd><dt>More infos
88
<dd>
9-
<p><a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a> <a href="https://tools.ietf.org/html/draft-abarth-origin">tools.ietf.org/html/draft-abarth-origin</a></p>
9+
<p><a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a> <a href="http://tools.ietf.org/html/draft-abarth-origin">tools.ietf.org/html/draft-abarth-origin</a></p>
1010
</dd></dl>
1111

1212
<p>Does not accept unsafe HTTP requests when value of Origin HTTP request header does not match default or permitted URIs.</p>
1313

1414
<p>If you want to permit a specific domain, you can pass in as the ‘:permitted_origins` option:</p>
1515

16-
<pre class="ruby"><span class="ruby-identifier">use</span> <span class="ruby-constant">Rack</span><span class="ruby-operator">::</span><span class="ruby-constant">Protection</span>, <span class="ruby-value">permitted_origins:</span> [<span class="ruby-string">&quot;http://localhost:3000&quot;</span>, <span class="ruby-string">&quot;https://127.0.01:3000&quot;</span>]
16+
<pre class="ruby"><span class="ruby-identifier">use</span> <span class="ruby-constant">Rack</span><span class="ruby-operator">::</span><span class="ruby-constant">Protection</span>, <span class="ruby-value">permitted_origins:</span> [<span class="ruby-string">&quot;http://localhost:3000&quot;</span>, <span class="ruby-string">&quot;http://127.0.01:3000&quot;</span>]
1717
</pre>
1818

1919
<p>The ‘:allow_if` option can also be set to a proc to use custom allow/deny logic.</p>

‎_includes/rack-protection-ip-spoofing.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<p>all</p>
77
</dd><dt>More infos
88
<dd>
9-
<p><a href="https://blog.c22.cc/2011/04/22/surveymonkey-ip-spoofing">blog.c22.cc/2011/04/22/surveymonkey-ip-spoofing</a>/</p>
9+
<p><a href="http://blog.c22.cc/2011/04/22/surveymonkey-ip-spoofing">blog.c22.cc/2011/04/22/surveymonkey-ip-spoofing</a>/</p>
1010
</dd></dl>
1111

1212
<p>Detect (some) IP spoofing attacks.</p>

‎_includes/rack-protection-json-csrf.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<p>all</p>
77
</dd><dt>More infos
88
<dd>
9-
<p><a href="https://flask.pocoo.org/docs/0.10/security/#json-security">flask.pocoo.org/docs/0.10/security/#json-security</a> <a href="https://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx">haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx</a></p>
9+
<p><a href="http://flask.pocoo.org/docs/0.10/security/#json-security">flask.pocoo.org/docs/0.10/security/#json-security</a> <a href="http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx">haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx</a></p>
1010
</dd></dl>
1111

1212
<p>JSON GET APIs are vulnerable to being embedded as JavaScript when the Array prototype has been patched to track data. Checks the referrer even on GET requests if the content type is JSON.</p>

‎_includes/rack-protection-path-traversal.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<p>all</p>
77
</dd><dt>More infos
88
<dd>
9-
<p><a href="https://en.wikipedia.org/wiki/Directory_traversal">en.wikipedia.org/wiki/Directory_traversal</a></p>
9+
<p><a href="http://en.wikipedia.org/wiki/Directory_traversal">en.wikipedia.org/wiki/Directory_traversal</a></p>
1010
</dd></dl>
1111

1212
<p>Unescapes ‘/’ and ‘.’, expands <code>path_info</code>. Thus <code>GET /foo/%2e%2e%2fbar</code> becomes <code>GET /bar</code>.</p>

‎_includes/rack-protection-readme.html‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,14 @@ <h2 id="cross-site-request-forgery">Cross Site Request Forgery</h2>
3636

3737
<ul>
3838
<li>
39-
<a href="https://www.sinatrarb.com/protection/authenticity_token"><code>Rack::Protection::AuthenticityToken</code></a> (not included by <code>use Rack::Protection</code>)</li>
39+
<a href="http://www.sinatrarb.com/protection/authenticity_token"><code>Rack::Protection::AuthenticityToken</code></a> (not included by <code>use Rack::Protection</code>)</li>
4040
<li>
41-
<a href="https://www.sinatrarb.com/protection/form_token"><code>Rack::Protection::FormToken</code></a> (not included by <code>use Rack::Protection</code>)</li>
42-
<li><a href="https://www.sinatrarb.com/protection/json_csrf"><code>Rack::Protection::JsonCsrf</code></a></li>
41+
<a href="http://www.sinatrarb.com/protection/form_token"><code>Rack::Protection::FormToken</code></a> (not included by <code>use Rack::Protection</code>)</li>
42+
<li><a href="http://www.sinatrarb.com/protection/json_csrf"><code>Rack::Protection::JsonCsrf</code></a></li>
4343
<li>
44-
<a href="https://www.sinatrarb.com/protection/remote_referrer"><code>Rack::Protection::RemoteReferrer</code></a> (not included by <code>use Rack::Protection</code>)</li>
45-
<li><a href="https://www.sinatrarb.com/protection/remote_token"><code>Rack::Protection::RemoteToken</code></a></li>
46-
<li><a href="https://www.sinatrarb.com/protection/http_origin"><code>Rack::Protection::HttpOrigin</code></a></li>
44+
<a href="http://www.sinatrarb.com/protection/remote_referrer"><code>Rack::Protection::RemoteReferrer</code></a> (not included by <code>use Rack::Protection</code>)</li>
45+
<li><a href="http://www.sinatrarb.com/protection/remote_token"><code>Rack::Protection::RemoteToken</code></a></li>
46+
<li><a href="http://www.sinatrarb.com/protection/http_origin"><code>Rack::Protection::HttpOrigin</code></a></li>
4747
</ul>
4848

4949
<h2 id="cross-site-scripting">Cross Site Scripting</h2>
@@ -52,50 +52,52 @@ <h2 id="cross-site-scripting">Cross Site Scripting</h2>
5252

5353
<ul>
5454
<li>
55-
<a href="https://www.sinatrarb.com/protection/escaped_params"><code>Rack::Protection::EscapedParams</code></a> (not included by <code>use Rack::Protection</code>)</li>
55+
<a href="http://www.sinatrarb.com/protection/escaped_params"><code>Rack::Protection::EscapedParams</code></a> (not included by <code>use Rack::Protection</code>)</li>
5656
<li>
57-
<a href="https://www.sinatrarb.com/protection/xss_header"><code>Rack::Protection::XSSHeader</code></a> (Internet Explorer and Chrome only)</li>
58-
<li><a href="https://www.sinatrarb.com/protection/content_security_policy"><code>Rack::Protection::ContentSecurityPolicy</code></a></li>
57+
<a href="http://www.sinatrarb.com/protection/xss_header"><code>Rack::Protection::XSSHeader</code></a> (Internet Explorer and Chrome only)</li>
58+
<li><a href="http://www.sinatrarb.com/protection/content_security_policy"><code>Rack::Protection::ContentSecurityPolicy</code></a></li>
5959
</ul>
6060

6161
<h2 id="clickjacking">Clickjacking</h2>
6262

6363
<p>Prevented by:</p>
6464

6565
<ul>
66-
<li><a href="https://www.sinatrarb.com/protection/frame_options"><code>Rack::Protection::FrameOptions</code></a></li>
66+
<li><a href="http://www.sinatrarb.com/protection/frame_options"><code>Rack::Protection::FrameOptions</code></a></li>
6767
</ul>
6868

6969
<h2 id="directory-traversal">Directory Traversal</h2>
7070

7171
<p>Prevented by:</p>
7272

7373
<ul>
74-
<li><a href="https://www.sinatrarb.com/protection/path_traversal"><code>Rack::Protection::PathTraversal</code></a></li>
74+
<li><a href="http://www.sinatrarb.com/protection/path_traversal"><code>Rack::Protection::PathTraversal</code></a></li>
7575
</ul>
7676

7777
<h2 id="session-hijacking">Session Hijacking</h2>
7878

7979
<p>Prevented by:</p>
8080

8181
<ul>
82-
<li><a href="https://www.sinatrarb.com/protection/session_hijacking"><code>Rack::Protection::SessionHijacking</code></a></li>
82+
<li>
83+
<a href="http://www.sinatrarb.com/protection/session_hijacking"><code>Rack::Protection::SessionHijacking</code></a> (not included by <code>use Rack::Protection</code>)</li>
8384
</ul>
8485

8586
<h2 id="cookie-tossing">Cookie Tossing</h2>
8687

8788
<p>Prevented by:</p>
8889

8990
<ul>
90-
<li><a href="https://www.sinatrarb.com/protection/cookie_tossing"><code>Rack::Protection::CookieTossing</code></a> (not included by <code>use Rack::Protection</code>)</li>
91+
<li>
92+
<a href="http://www.sinatrarb.com/protection/cookie_tossing"><code>Rack::Protection::CookieTossing</code></a> (not included by <code>use Rack::Protection</code>)</li>
9193
</ul>
9294

9395
<h2 id="ip-spoofing">IP Spoofing</h2>
9496

9597
<p>Prevented by:</p>
9698

9799
<ul>
98-
<li><a href="https://www.sinatrarb.com/protection/ip_spoofing"><code>Rack::Protection::IPSpoofing</code></a></li>
100+
<li><a href="http://www.sinatrarb.com/protection/ip_spoofing"><code>Rack::Protection::IPSpoofing</code></a></li>
99101
</ul>
100102

101103
<h2 id="helps-to-protect-against-protocol-downgrade-attacks-and-cookie-hijacking">Helps to protect against protocol downgrade attacks and cookie hijacking</h2>
@@ -104,7 +106,7 @@ <h2 id="helps-to-protect-against-protocol-downgrade-attacks-and-cookie-hijacking
104106

105107
<ul>
106108
<li>
107-
<a href="https://www.sinatrarb.com/protection/strict_transport"><code>Rack::Protection::StrictTransport</code></a> (not included by <code>use Rack::Protection</code>)</li>
109+
<a href="http://www.sinatrarb.com/protection/strict_transport"><code>Rack::Protection::StrictTransport</code></a> (not included by <code>use Rack::Protection</code>)</li>
108110
</ul>
109111

110112
<h1 id="installation">Installation</h1>
@@ -114,9 +116,9 @@ <h1 id="installation">Installation</h1>
114116

115117
<h1 id="instrumentation">Instrumentation</h1>
116118

117-
<p>Instrumentation is enabled by passing in an instrumenter as an option.
119+
<p>Instrumentation is enabled by passing in an instrumenter as an option.</p>
118120

119-
<pre><code> use Rack::Protection, instrumenter: ActiveSupport::Notifications
121+
<pre><code>use Rack::Protection, instrumenter: ActiveSupport::Notifications
120122
</code></pre>
121123

122124
<p>The instrumenter is passed a namespace (String) and environment (Hash). The namespace is ‘rack.protection’ and the attack type can be obtained from the environment key ‘rack.protection.attack’.</p>

0 commit comments

Comments
 (0)