From 02a652b99ca6618eb8519f6c651081f5d7573169 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 19:21:03 +0800 Subject: [PATCH 01/15] fix method v01 --- app/views/events/show.html.erb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb index 0e89067..191194c 100644 --- a/app/views/events/show.html.erb +++ b/app/views/events/show.html.erb @@ -22,7 +22,7 @@
- <%= raw comment.content %> + <%= comment.content %>
@@ -50,4 +50,4 @@
<%= f.submit "Comment", :class => "btn btn-primary" %>
-<% end %> \ No newline at end of file +<% end %> From c2fcb3b4752d40b64a9234dc0493b13c652ba4d7 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 19:23:42 +0800 Subject: [PATCH 02/15] method update v02 --- app/views/events/show.html.erb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb index 191194c..14feb24 100644 --- a/app/views/events/show.html.erb +++ b/app/views/events/show.html.erb @@ -22,7 +22,7 @@
- <%= comment.content %> + <%= sanitize comment.content %>
From 17f24ad9220a10a9a803c692c27d8d7e26863850 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 19:44:04 +0800 Subject: [PATCH 03/15] method v01 --- app/helpers/users_helper.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb index ed49051..1d62a20 100644 --- a/app/helpers/users_helper.rb +++ b/app/helpers/users_helper.rb @@ -7,9 +7,7 @@ def user_avatar_link(user) email_md5 = Digest::MD5.hexdigest(user.email) gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}" - str = "
" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
" - - str.html_safe + "
".html_safe + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
".html_safe end end From 7ad96058b13858f835135ffa5cacf9be49017955 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 19:48:55 +0800 Subject: [PATCH 04/15] method v02 --- app/helpers/users_helper.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb index 1d62a20..bafe0d1 100644 --- a/app/helpers/users_helper.rb +++ b/app/helpers/users_helper.rb @@ -7,7 +7,9 @@ def user_avatar_link(user) email_md5 = Digest::MD5.hexdigest(user.email) gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}" - "
".html_safe + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
".html_safe + content_tag(:div, + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name , + :class => "user-link" ) end end From c43155f07a640caafb0681ebcf904193f1563f82 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 20:52:10 +0800 Subject: [PATCH 05/15] CSRF hack --- app/views/events/show.html.erb | 2 +- config/routes.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb index 14feb24..2996fec 100644 --- a/app/views/events/show.html.erb +++ b/app/views/events/show.html.erb @@ -29,7 +29,7 @@ <%= comment.created_at.to_s %> <% if current_user && current_user.is_admin? %> - <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :class => "btn btn-default" %> + <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :method => :post, :class => "btn btn-default" %> <% end %> <% if comment.can_deleted_by(current_user) %> diff --git a/config/routes.rb b/config/routes.rb index 2cfd938..a5ccf3e 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -7,7 +7,7 @@ resources :events do resources :comments do member do - get :highlight + post :highlight end end end From 08e2bb4e3e69d3644f9b7c8e417a4874d1c01b47 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 21:14:02 +0800 Subject: [PATCH 06/15] CSRF add token --- app/controllers/application_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 682a07d..cd6ea53 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,6 +1,6 @@ class ApplicationController < ActionController::Base - # protect_from_forgery with: :exception + protect_from_forgery with: :exception helper_method :current_cart From 9f7dba7b363083460b30b11b12847751d328c4b6 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 22:46:58 +0800 Subject: [PATCH 07/15] add gem pry & awesome rails console --- Gemfile | 3 +++ Gemfile.lock | 15 +++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/Gemfile b/Gemfile index e91c3ae..64fddf7 100644 --- a/Gemfile +++ b/Gemfile @@ -13,6 +13,9 @@ gem 'bootstrap-sass' gem 'devise' +gem 'pry' +gem 'awesome_rails_console' + # Use sqlite3 as the database for Active Record gem 'sqlite3' # Use Puma as the app server diff --git a/Gemfile.lock b/Gemfile.lock index 30c443b..151ef69 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -41,6 +41,11 @@ GEM arel (7.1.4) autoprefixer-rails (6.7.6) execjs + awesome_print (1.7.0) + awesome_rails_console (0.4.0) + awesome_print + pry-rails + railties bcrypt (3.1.11) bindex (0.5.0) bootstrap-sass (3.3.7) @@ -48,6 +53,7 @@ GEM sass (>= 3.3.4) builder (3.2.3) byebug (9.0.6) + coderay (1.1.1) coffee-rails (4.2.1) coffee-script (>= 2.2.0) railties (>= 4.0.0, < 5.2.x) @@ -96,6 +102,12 @@ GEM nokogiri (1.7.1) mini_portile2 (~> 2.1.0) orm_adapter (0.5.0) + pry (0.10.4) + coderay (~> 1.1.0) + method_source (~> 0.8.1) + slop (~> 3.4) + pry-rails (0.3.6) + pry (>= 0.10.4) puma (3.8.2) rack (2.0.1) rack-test (0.6.3) @@ -153,6 +165,7 @@ GEM sprockets (>= 2.8, < 4.0) sprockets-rails (>= 2.0, < 4.0) tilt (>= 1.1, < 3) + slop (3.6.0) spring (2.0.1) activesupport (>= 4.2) spring-watcher-listen (2.0.1) @@ -191,6 +204,7 @@ PLATFORMS ruby DEPENDENCIES + awesome_rails_console bootstrap-sass byebug coffee-rails (~> 4.2) @@ -199,6 +213,7 @@ DEPENDENCIES jbuilder (~> 2.5) jquery-rails listen (~> 3.0.5) + pry puma (~> 3.0) rails (~> 5.0.2) rspec-rails From 2337fdfb0a6298662da96d68fe0e92d54d328988 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 22:58:00 +0800 Subject: [PATCH 08/15] fix hack attack SQL --- app/controllers/events_controller.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb index 245dece..ec8214d 100644 --- a/app/controllers/events_controller.rb +++ b/app/controllers/events_controller.rb @@ -9,7 +9,8 @@ def show @comments = @event.comments if params[:keyword] - @comments = @comments.where( "comments.content LIKE '%#{params[:keyword]}%'") + keyword = ActiveRecord::Base::connection.quote_string( params[:keyword] ) + @comments = @comments.where( "comments.content LIKE '%#{keyword}%'") end if params[:sort] From 79f6d0df11ad62a39cfd3b7fcfdbac3d5952b9c1 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 23:08:02 +0800 Subject: [PATCH 09/15] fix hack accack SQL v2 --- app/controllers/events_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb index ec8214d..f150ddd 100644 --- a/app/controllers/events_controller.rb +++ b/app/controllers/events_controller.rb @@ -10,7 +10,7 @@ def show if params[:keyword] keyword = ActiveRecord::Base::connection.quote_string( params[:keyword] ) - @comments = @comments.where( "comments.content LIKE '%#{keyword}%'") + @comments = @comments.where( "comments.content LIKE ?", "%#{params[:keyword]}%") end if params[:sort] From 82641b84a5d36f145246d6797ce10bc88a4536f7 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 23:19:19 +0800 Subject: [PATCH 10/15] fix sort by DESC & ASC to attack SQL --- app/controllers/events_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb index f150ddd..75470e3 100644 --- a/app/controllers/events_controller.rb +++ b/app/controllers/events_controller.rb @@ -13,7 +13,7 @@ def show @comments = @comments.where( "comments.content LIKE ?", "%#{params[:keyword]}%") end - if params[:sort] + if params[:sort] && ["id DESC", "id ASC"].include?(params[:sort]) # 只有白名单内的参数可以用 @comments = @comments.order(params[:sort]) end From ed257843010e01d919d5c7793b8fe57d5ed6be13 Mon Sep 17 00:00:00 2001 From: Antarts Date: Tue, 27 Jun 2017 23:55:26 +0800 Subject: [PATCH 11/15] fix attack user role params --- app/controllers/users_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index f1d232d..fd6cac4 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -21,7 +21,7 @@ def update protected def user_params - params.require(:user).permit(:nickname, :role) + params.require(:user).permit(:nickname) end end From a2e9b511cb17fa3f1f288695379e3823c7facefd Mon Sep 17 00:00:00 2001 From: Antarts Date: Wed, 28 Jun 2017 00:40:54 +0800 Subject: [PATCH 12/15] add cookie store --- config/initializers/cookies_serializer.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/initializers/cookies_serializer.rb b/config/initializers/cookies_serializer.rb index 5a6a32d..2715706 100644 --- a/config/initializers/cookies_serializer.rb +++ b/config/initializers/cookies_serializer.rb @@ -2,4 +2,5 @@ # Specify a serializer for the signed and encrypted cookie jars. # Valid options are :json, :marshal, and :hybrid. -Rails.application.config.action_dispatch.cookies_serializer = :json +# Rails.application.config.action_dispatch.cookies_serializer = :json +Rails.application.config.session_store :cookie_store, key: '-hackme-app_session"' From 30d5a11d859dfc10dc067bfea0d14cd8b63d8696 Mon Sep 17 00:00:00 2001 From: Antarts Date: Wed, 28 Jun 2017 17:06:56 +0800 Subject: [PATCH 13/15] add gem rack-attack --- Gemfile | 1 + Gemfile.lock | 3 ++ config/application.rb | 4 +- config/initializers/rack-attack.rb | 59 ++++++++++++++++++++++++++++++ 4 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 config/initializers/rack-attack.rb diff --git a/Gemfile b/Gemfile index 64fddf7..181f5cb 100644 --- a/Gemfile +++ b/Gemfile @@ -15,6 +15,7 @@ gem 'devise' gem 'pry' gem 'awesome_rails_console' +gem 'rack-attack' # Use sqlite3 as the database for Active Record gem 'sqlite3' diff --git a/Gemfile.lock b/Gemfile.lock index 151ef69..c3ffc92 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -110,6 +110,8 @@ GEM pry (>= 0.10.4) puma (3.8.2) rack (2.0.1) + rack-attack (5.0.1) + rack rack-test (0.6.3) rack (>= 1.0) rails (5.0.2) @@ -215,6 +217,7 @@ DEPENDENCIES listen (~> 3.0.5) pry puma (~> 3.0) + rack-attack rails (~> 5.0.2) rspec-rails sass-rails (~> 5.0) diff --git a/config/application.rb b/config/application.rb index 2d9ee51..5a62e93 100644 --- a/config/application.rb +++ b/config/application.rb @@ -13,7 +13,9 @@ class Application < Rails::Application # -- all .rb files in that directory are automatically loaded. config.time_zone = "Beijing" + config.middleware.use Rack::Attack + end end -Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d') \ No newline at end of file +Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d') diff --git a/config/initializers/rack-attack.rb b/config/initializers/rack-attack.rb new file mode 100644 index 0000000..61a40b9 --- /dev/null +++ b/config/initializers/rack-attack.rb @@ -0,0 +1,59 @@ +class Rack::Attack + + throttle('req/ip', :limit => 180, :period => 1.minutes) do |req| + req.ip + end + + ### Prevent Brute-Force Login Attacks ### + + + # The most common brute-force login attack is a brute-force password + + # attack where an attacker simply tries a large number of emails and + + # passwords to see if any credentials match. + + # + + # Another common method of attack is to use a swarm of computers with + + # different IPs to try brute-forcing a password for a specific account. + + + # Throttle POST requests to /login by IP address + + # + + # Key: "rack::attack:#{Time.now.to_i/:period}:logins/ip:#{req.ip}" + + throttle('logins/ip', :limit => 5, :period => 20.seconds) do |req| + if req.path == '/users/sign_in' && req.post? + req.ip + end + end + + # Throttle POST requests to /login by email param + + # + + # Key: "rack::attack:#{Time.now.to_i/:period}:logins/email:#{req.email}" + + # + + # Note: This creates a problem where a malicious user could intentionally + + # throttle logins for another user and force their login requests to be + + # denied, but that's not very common and shouldn't happen to you. (Knock + + # on wood!) + + throttle("logins/email", :limit => 5, :period => 20.seconds) do |req| + if req.path == '/users/sign_in' && req.post? + # return the email if present, nil otherwise + + req.params['email'].presence + end + end + +end From 4ed8d61a82d195cd03bd80325daac221254570c4 Mon Sep 17 00:00:00 2001 From: Antarts Date: Wed, 28 Jun 2017 17:14:03 +0800 Subject: [PATCH 14/15] add gem brakeman --- Gemfile | 1 + Gemfile.lock | 2 ++ 2 files changed, 3 insertions(+) diff --git a/Gemfile b/Gemfile index 181f5cb..4ac2453 100644 --- a/Gemfile +++ b/Gemfile @@ -59,6 +59,7 @@ group :development do # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring gem 'spring' gem 'spring-watcher-listen', '~> 2.0.0' + gem 'brakeman' end # Windows does not include zoneinfo files, so bundle the tzinfo-data gem diff --git a/Gemfile.lock b/Gemfile.lock index c3ffc92..6e8aa68 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -51,6 +51,7 @@ GEM bootstrap-sass (3.3.7) autoprefixer-rails (>= 5.2.1) sass (>= 3.3.4) + brakeman (3.6.2) builder (3.2.3) byebug (9.0.6) coderay (1.1.1) @@ -208,6 +209,7 @@ PLATFORMS DEPENDENCIES awesome_rails_console bootstrap-sass + brakeman byebug coffee-rails (~> 4.2) devise From 3f0e535f4c611fb9095e120961ab3a53d9ec7710 Mon Sep 17 00:00:00 2001 From: Antarts Date: Wed, 28 Jun 2017 17:19:14 +0800 Subject: [PATCH 15/15] add gem bundle-audit --- Gemfile | 1 + Gemfile.lock | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/Gemfile b/Gemfile index 4ac2453..8114873 100644 --- a/Gemfile +++ b/Gemfile @@ -60,6 +60,7 @@ group :development do gem 'spring' gem 'spring-watcher-listen', '~> 2.0.0' gem 'brakeman' + gem 'bundler-audit' end # Windows does not include zoneinfo files, so bundle the tzinfo-data gem diff --git a/Gemfile.lock b/Gemfile.lock index 6e8aa68..d5a6a59 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -53,6 +53,9 @@ GEM sass (>= 3.3.4) brakeman (3.6.2) builder (3.2.3) + bundler-audit (0.5.0) + bundler (~> 1.2) + thor (~> 0.18) byebug (9.0.6) coderay (1.1.1) coffee-rails (4.2.1) @@ -210,6 +213,7 @@ DEPENDENCIES awesome_rails_console bootstrap-sass brakeman + bundler-audit byebug coffee-rails (~> 4.2) devise