From f69890687ae4a1c7d3f61f87089c9f40c6ba5df3 Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Mon, 14 Aug 2017 22:36:05 +0800
Subject: [PATCH 1/9] sanitize events#show page's comment

---
 app/views/events/show.html.erb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb
index 0e89067..14feb24 100644
--- a/app/views/events/show.html.erb
+++ b/app/views/events/show.html.erb
@@ -22,7 +22,7 @@
     </div>
 
     <div class="panel-body">
-      <%= raw comment.content %>
+      <%= sanitize comment.content %>
     </div>
 
     <div class="panel-footer text-right">
@@ -50,4 +50,4 @@
   <div class="form-group">
     <%= f.submit "Comment", :class => "btn btn-primary" %>
   </div>
-<% end %>
\ No newline at end of file
+<% end %>

From b086c5316f298dcb9869ab91500b72f8c60712d9 Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Mon, 14 Aug 2017 22:47:12 +0800
Subject: [PATCH 2/9] add .html_safe where needed

---
 app/helpers/users_helper.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb
index ed49051..fc95205 100644
--- a/app/helpers/users_helper.rb
+++ b/app/helpers/users_helper.rb
@@ -7,9 +7,11 @@ def user_avatar_link(user)
     email_md5 = Digest::MD5.hexdigest(user.email)
     gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}"
 
-    str = "<div class ='user-link'>" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "</div>"
+    # str = "<div class ='user-link'>" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "</div>"
 
-    str.html_safe
+    # str.html_safe
+
+    "<div class='user-link'>".html_safe + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "<div>".html_safe
   end
 
 end

From d0ef258c41ce22be97040cc98609a19235baead2 Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Mon, 14 Aug 2017 22:49:53 +0800
Subject: [PATCH 3/9] use content_tag helper

---
 app/helpers/users_helper.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb
index fc95205..13e81ad 100644
--- a/app/helpers/users_helper.rb
+++ b/app/helpers/users_helper.rb
@@ -11,7 +11,9 @@ def user_avatar_link(user)
 
     # str.html_safe
 
-    "<div class='user-link'>".html_safe + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "<div>".html_safe
+    content_tag(:div,
+      link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name,
+      :class => "user-link")
   end
 
 end

From 4ed159049d8aef26453c5f5fb9b9a62b2285ba5d Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Tue, 15 Aug 2017 22:55:29 +0800
Subject: [PATCH 4/9] change highlight route from get to post for CSRF

---
 app/views/events/show.html.erb | 2 +-
 config/routes.rb               | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb
index 14feb24..2996fec 100644
--- a/app/views/events/show.html.erb
+++ b/app/views/events/show.html.erb
@@ -29,7 +29,7 @@
       <%= comment.created_at.to_s %>
 
       <% if current_user && current_user.is_admin? %>
-        <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :class => "btn btn-default" %>
+        <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :method => :post, :class => "btn btn-default" %>
       <% end %>
 
       <% if comment.can_deleted_by(current_user) %>
diff --git a/config/routes.rb b/config/routes.rb
index 2cfd938..a5ccf3e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -7,7 +7,7 @@
   resources :events do
     resources :comments do
       member do
-        get :highlight
+        post :highlight
       end
     end
   end

From 5d4bb05cb5caa743a761cd5dd4666c88c3fa866b Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Tue, 15 Aug 2017 23:08:19 +0800
Subject: [PATCH 5/9] add protect_from_forgery with: :exception

---
 app/controllers/application_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 682a07d..cd6ea53 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,6 +1,6 @@
 class ApplicationController < ActionController::Base
 
-  # protect_from_forgery with: :exception
+  protect_from_forgery with: :exception
 
   helper_method :current_cart
 

From 4415ce28eb2ca6ef557f84fa94151c629caaa804 Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Tue, 15 Aug 2017 23:48:24 +0800
Subject: [PATCH 6/9] array/hash escape for where & sanitize for SQL injection

---
 app/controllers/events_controller.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb
index 245dece..8f28b01 100644
--- a/app/controllers/events_controller.rb
+++ b/app/controllers/events_controller.rb
@@ -9,10 +9,10 @@ def show
     @comments = @event.comments
 
     if params[:keyword]
-      @comments = @comments.where( "comments.content LIKE '%#{params[:keyword]}%'")
+      @comments = @comments.where( "comments.content LIKE ?", "%#{params[:keyword]}%")
     end
 
-    if params[:sort]
+    if params[:sort] && ["id DESC", "id ASC"].include?(params[:sort])
       @comments = @comments.order(params[:sort])
     end
 

From f926d49e2a7734272845e1213ba7fb06b66b120b Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Wed, 16 Aug 2017 13:18:50 +0800
Subject: [PATCH 7/9] add rack-attack gem for DOS attack

---
 Gemfile                             |  1 +
 Gemfile.lock                        |  3 ++
 app/controllers/users_controller.rb |  2 +-
 config/application.rb               |  4 +-
 config/initializers/rack-attack.rb  | 59 +++++++++++++++++++++++++++++
 5 files changed, 67 insertions(+), 2 deletions(-)
 create mode 100644 config/initializers/rack-attack.rb

diff --git a/Gemfile b/Gemfile
index e91c3ae..c261b5a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -39,6 +39,7 @@ gem 'jbuilder', '~> 2.5'
 
 # Use Capistrano for deployment
 # gem 'capistrano-rails', group: :development
+gem 'rack-attack'
 
 group :development, :test do
   gem 'rspec-rails'
diff --git a/Gemfile.lock b/Gemfile.lock
index 30c443b..8ba62cd 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -98,6 +98,8 @@ GEM
     orm_adapter (0.5.0)
     puma (3.8.2)
     rack (2.0.1)
+    rack-attack (5.0.1)
+      rack
     rack-test (0.6.3)
       rack (>= 1.0)
     rails (5.0.2)
@@ -200,6 +202,7 @@ DEPENDENCIES
   jquery-rails
   listen (~> 3.0.5)
   puma (~> 3.0)
+  rack-attack
   rails (~> 5.0.2)
   rspec-rails
   sass-rails (~> 5.0)
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index f1d232d..fd6cac4 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -21,7 +21,7 @@ def update
   protected
 
   def user_params
-    params.require(:user).permit(:nickname, :role)
+    params.require(:user).permit(:nickname)
   end
 
 end
diff --git a/config/application.rb b/config/application.rb
index 2d9ee51..3e2def3 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -16,4 +16,6 @@ class Application < Rails::Application
   end
 end
 
-Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d')
\ No newline at end of file
+Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d')
+
+config.middleware.use Rack::Attack 
diff --git a/config/initializers/rack-attack.rb b/config/initializers/rack-attack.rb
new file mode 100644
index 0000000..61a40b9
--- /dev/null
+++ b/config/initializers/rack-attack.rb
@@ -0,0 +1,59 @@
+class Rack::Attack
+
+  throttle('req/ip', :limit => 180, :period => 1.minutes) do |req|
+    req.ip
+  end
+
+  ### Prevent Brute-Force Login Attacks ###
+
+
+  # The most common brute-force login attack is a brute-force password
+
+  # attack where an attacker simply tries a large number of emails and
+
+  # passwords to see if any credentials match.
+
+  #
+
+  # Another common method of attack is to use a swarm of computers with
+
+  # different IPs to try brute-forcing a password for a specific account.
+
+
+  # Throttle POST requests to /login by IP address
+
+  #
+
+  # Key: "rack::attack:#{Time.now.to_i/:period}:logins/ip:#{req.ip}"
+
+  throttle('logins/ip', :limit => 5, :period => 20.seconds) do |req|
+    if req.path == '/users/sign_in' && req.post?
+      req.ip
+    end
+  end
+
+  # Throttle POST requests to /login by email param
+
+  #
+
+  # Key: "rack::attack:#{Time.now.to_i/:period}:logins/email:#{req.email}"
+
+  #
+
+  # Note: This creates a problem where a malicious user could intentionally
+
+  # throttle logins for another user and force their login requests to be
+
+  # denied, but that's not very common and shouldn't happen to you. (Knock
+
+  # on wood!)
+
+  throttle("logins/email", :limit => 5, :period => 20.seconds) do |req|
+    if req.path == '/users/sign_in' && req.post?
+      # return the email if present, nil otherwise
+
+      req.params['email'].presence
+    end
+  end
+
+end

From 3656decc4e78a6f5f0168e76574c93acfd2fcd26 Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Wed, 16 Aug 2017 13:23:49 +0800
Subject: [PATCH 8/9] add brakeman gem

---
 Gemfile               | 1 +
 Gemfile.lock          | 2 ++
 config/application.rb | 3 +--
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Gemfile b/Gemfile
index c261b5a..6b6eb22 100644
--- a/Gemfile
+++ b/Gemfile
@@ -48,6 +48,7 @@ group :development, :test do
 end
 
 group :development do
+  gem 'brakeman'
   gem 'faker'
 
   # Access an IRB console on exception pages or by using <%= console %> anywhere in the code.
diff --git a/Gemfile.lock b/Gemfile.lock
index 8ba62cd..1464860 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -46,6 +46,7 @@ GEM
     bootstrap-sass (3.3.7)
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
+    brakeman (3.7.0)
     builder (3.2.3)
     byebug (9.0.6)
     coffee-rails (4.2.1)
@@ -194,6 +195,7 @@ PLATFORMS
 
 DEPENDENCIES
   bootstrap-sass
+  brakeman
   byebug
   coffee-rails (~> 4.2)
   devise
diff --git a/config/application.rb b/config/application.rb
index 3e2def3..95e7a7e 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -12,10 +12,9 @@ class Application < Rails::Application
     # Application configuration should go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded.
     config.time_zone = "Beijing"
+    config.middleware.use Rack::Attack 
 
   end
 end
 
 Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d')
-
-config.middleware.use Rack::Attack 

From 87ceaf32464c7d991adec5b0f53bde919827b72b Mon Sep 17 00:00:00 2001
From: jiaowagn <wangjiaohere@gmail.com>
Date: Wed, 16 Aug 2017 13:26:55 +0800
Subject: [PATCH 9/9] add bundler-audit

---
 Gemfile      |  1 +
 Gemfile.lock | 10 +++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index 6b6eb22..b578f59 100644
--- a/Gemfile
+++ b/Gemfile
@@ -48,6 +48,7 @@ group :development, :test do
 end
 
 group :development do
+  gem 'bundler-audit'
   gem 'brakeman'
   gem 'faker'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 1464860..16fde1e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -48,6 +48,9 @@ GEM
       sass (>= 3.3.4)
     brakeman (3.7.0)
     builder (3.2.3)
+    bundler-audit (0.6.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
     byebug (9.0.6)
     coffee-rails (4.2.1)
       coffee-script (>= 2.2.0)
@@ -90,12 +93,12 @@ GEM
     mime-types (3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2016.0521)
-    mini_portile2 (2.1.0)
+    mini_portile2 (2.2.0)
     minitest (5.10.1)
     multi_json (1.12.1)
     nio4r (2.0.0)
-    nokogiri (1.7.1)
-      mini_portile2 (~> 2.1.0)
+    nokogiri (1.8.0)
+      mini_portile2 (~> 2.2.0)
     orm_adapter (0.5.0)
     puma (3.8.2)
     rack (2.0.1)
@@ -196,6 +199,7 @@ PLATFORMS
 DEPENDENCIES
   bootstrap-sass
   brakeman
+  bundler-audit
   byebug
   coffee-rails (~> 4.2)
   devise