Antarts homework

Gemfile

@@ -13,6 +13,10 @@ gem 'bootstrap-sass'
 
 gem 'devise'
 
+gem 'pry'
+gem 'awesome_rails_console'
+gem 'rack-attack'
+
 # Use sqlite3 as the database for Active Record
 gem 'sqlite3'
 # Use Puma as the app server
@@ -55,6 +59,8 @@ group :development do
   # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
   gem 'spring'
   gem 'spring-watcher-listen', '~> 2.0.0'
+  gem 'brakeman'
+  gem 'bundler-audit'
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem

Gemfile.lock

@@ -41,13 +41,23 @@ GEM
     arel (7.1.4)
     autoprefixer-rails (6.7.6)
       execjs
+    awesome_print (1.7.0)
+    awesome_rails_console (0.4.0)
+      awesome_print
+      pry-rails
+      railties
     bcrypt (3.1.11)
     bindex (0.5.0)
     bootstrap-sass (3.3.7)
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
+    brakeman (3.6.2)
     builder (3.2.3)
+    bundler-audit (0.5.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
     byebug (9.0.6)
+    coderay (1.1.1)
     coffee-rails (4.2.1)
       coffee-script (>= 2.2.0)
       railties (>= 4.0.0, < 5.2.x)
@@ -96,8 +106,16 @@ GEM
     nokogiri (1.7.1)
       mini_portile2 (~> 2.1.0)
     orm_adapter (0.5.0)
+    pry (0.10.4)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-rails (0.3.6)
+      pry (>= 0.10.4)
     puma (3.8.2)
     rack (2.0.1)
+    rack-attack (5.0.1)
+      rack
     rack-test (0.6.3)
       rack (>= 1.0)
     rails (5.0.2)
@@ -153,6 +171,7 @@ GEM
       sprockets (>= 2.8, < 4.0)
       sprockets-rails (>= 2.0, < 4.0)
       tilt (>= 1.1, < 3)
+    slop (3.6.0)
     spring (2.0.1)
       activesupport (>= 4.2)
     spring-watcher-listen (2.0.1)
@@ -191,15 +210,20 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  awesome_rails_console
   bootstrap-sass
+  brakeman
+  bundler-audit
   byebug
   coffee-rails (~> 4.2)
   devise
   faker
   jbuilder (~> 2.5)
   jquery-rails
   listen (~> 3.0.5)
+  pry
   puma (~> 3.0)
+  rack-attack
   rails (~> 5.0.2)
   rspec-rails
   sass-rails (~> 5.0)

app/controllers/application_controller.rb

@@ -1,6 +1,6 @@
 class ApplicationController < ActionController::Base
 
-  # protect_from_forgery with: :exception
+  protect_from_forgery with: :exception
 
   helper_method :current_cart
 

app/controllers/events_controller.rb

@@ -9,10 +9,11 @@ def show
     @comments = @event.comments
 
     if params[:keyword]
-      @comments = @comments.where( "comments.content LIKE '%#{params[:keyword]}%'")
+      keyword = ActiveRecord::Base::connection.quote_string( params[:keyword] )
+      @comments = @comments.where( "comments.content LIKE ?", "%#{params[:keyword]}%")
     end
 
-    if params[:sort]
+    if params[:sort] && ["id DESC", "id ASC"].include?(params[:sort])   # 只有白名单内的参数可以用
       @comments = @comments.order(params[:sort])
     end
 

app/controllers/users_controller.rb

@@ -21,7 +21,7 @@ def update
   protected
 
   def user_params
-    params.require(:user).permit(:nickname, :role)
+    params.require(:user).permit(:nickname)
   end
 
 end

app/helpers/users_helper.rb

@@ -7,9 +7,9 @@ def user_avatar_link(user)
     email_md5 = Digest::MD5.hexdigest(user.email)
     gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}"
 
-    str = "<div class ='user-link'>" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "</div>"
-
-    str.html_safe
+    content_tag(:div,
+      link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name ,
+      :class => "user-link" )
   end
 
 end

app/views/events/show.html.erb

@@ -22,14 +22,14 @@
     </div>
 
     <div class="panel-body">
-      <%= raw comment.content %>
+      <%= sanitize comment.content %>
     </div>
 
     <div class="panel-footer text-right">
       <%= comment.created_at.to_s %>
 
       <% if current_user && current_user.is_admin? %>
-        <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :class => "btn btn-default" %>
+        <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :method => :post, :class => "btn btn-default" %>
       <% end %>
 
       <% if comment.can_deleted_by(current_user) %>
@@ -50,4 +50,4 @@
   <div class="form-group">
     <%= f.submit "Comment", :class => "btn btn-primary" %>
   </div>
-<% end %>
+<% end %>

config/application.rb

@@ -13,7 +13,9 @@ class Application < Rails::Application
     # -- all .rb files in that directory are automatically loaded.
     config.time_zone = "Beijing"
 
+    config.middleware.use Rack::Attack
+
   end
 end
 
-Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d')
+Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d')

config/initializers/cookies_serializer.rb

@@ -2,4 +2,5 @@
 
 # Specify a serializer for the signed and encrypted cookie jars.
 # Valid options are :json, :marshal, and :hybrid.
-Rails.application.config.action_dispatch.cookies_serializer = :json
+# Rails.application.config.action_dispatch.cookies_serializer = :json
+Rails.application.config.session_store :cookie_store, key: '-hackme-app_session"'

config/initializers/rack-attack.rb

@@ -0,0 +1,59 @@
+class Rack::Attack
+
+  throttle('req/ip', :limit => 180, :period => 1.minutes) do |req|
+    req.ip
+  end
+
+  ### Prevent Brute-Force Login Attacks ###
+
+
+  # The most common brute-force login attack is a brute-force password
+
+  # attack where an attacker simply tries a large number of emails and
+
+  # passwords to see if any credentials match.
+
+  #
+
+  # Another common method of attack is to use a swarm of computers with
+
+  # different IPs to try brute-forcing a password for a specific account.
+
+
+  # Throttle POST requests to /login by IP address
+
+  #
+
+  # Key: "rack::attack:#{Time.now.to_i/:period}:logins/ip:#{req.ip}"
+
+  throttle('logins/ip', :limit => 5, :period => 20.seconds) do |req|
+    if req.path == '/users/sign_in' && req.post?
+      req.ip
+    end
+  end
+
+  # Throttle POST requests to /login by email param
+
+  #
+
+  # Key: "rack::attack:#{Time.now.to_i/:period}:logins/email:#{req.email}"
+
+  #
+
+  # Note: This creates a problem where a malicious user could intentionally
+
+  # throttle logins for another user and force their login requests to be
+
+  # denied, but that's not very common and shouldn't happen to you. (Knock
+
+  # on wood!)
+
+  throttle("logins/email", :limit => 5, :period => 20.seconds) do |req|
+    if req.path == '/users/sign_in' && req.post?
+      # return the email if present, nil otherwise
+
+      req.params['email'].presence
+    end
+  end
+
+end

config/routes.rb

@@ -7,7 +7,7 @@
   resources :events do
     resources :comments do
       member do
-        get :highlight
+        post :highlight
       end
     end
   end