Sha256: f49bf286ed56875aca3e91fc8a450bdf631dc5a5fad89bca73c4a2843de87eef
Contents?: true
Size: 1.04 KB
Versions: 8
Compression:
Stored size: 1.04 KB
Contents
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: CSRF
# Supported browsers:: all
# More infos:: http://flask.pocoo.org/docs/security/#json-security
#
# JSON GET APIs are vulnerable to being embedded as JavaScript while the
# Array prototype has been patched to track data. Checks the referrer
# even on GET requests if the content type is JSON.
class JsonCsrf < Base
default_reaction :deny
def call(env)
request = Request.new(env)
status, headers, body = app.call(env)
if has_vector? request, headers
warn env, "attack prevented by #{self.class}"
react(env)
else
[status, headers, body]
end
end
def has_vector?(request, headers)
return false if request.xhr?
return false unless headers['Content-Type'].to_s.split(';', 2).first =~ /^\s*application\/json\s*$/
origin(request.env).nil? and referrer(request.env) != request.host
end
end
end
end
Version data entries
8 entries across 6 versions & 2 rubygems