From 303c1a5dd2326c13594802bcf38a8e5368de7330 Mon Sep 17 00:00:00 2001 From: Bradley Buda Date: Fri, 2 Aug 2013 15:40:30 -0700 Subject: [PATCH] Initial commit with length-hiding middleware and railtie --- .gitignore | 17 +++++++++ Gemfile | 4 ++ LICENSE.txt | 22 +++++++++++ README.md | 51 ++++++++++++++++++++++++++ Rakefile | 1 + breach-mitigation-rails.gemspec | 23 ++++++++++++ lib/breach-mitigation-rails.rb | 1 + lib/breach_mitigation/length_hiding.rb | 50 +++++++++++++++++++++++++ lib/breach_mitigation/railtie.rb | 9 +++++ lib/breach_mitigation/version.rb | 3 ++ 10 files changed, 181 insertions(+) create mode 100644 .gitignore create mode 100644 Gemfile create mode 100644 LICENSE.txt create mode 100644 README.md create mode 100644 Rakefile create mode 100644 breach-mitigation-rails.gemspec create mode 100644 lib/breach-mitigation-rails.rb create mode 100644 lib/breach_mitigation/length_hiding.rb create mode 100644 lib/breach_mitigation/railtie.rb create mode 100644 lib/breach_mitigation/version.rb diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d87d4be --- /dev/null +++ b/.gitignore @@ -0,0 +1,17 @@ +*.gem +*.rbc +.bundle +.config +.yardoc +Gemfile.lock +InstalledFiles +_yardoc +coverage +doc/ +lib/bundler/man +pkg +rdoc +spec/reports +test/tmp +test/version_tmp +tmp diff --git a/Gemfile b/Gemfile new file mode 100644 index 0000000..3c40f08 --- /dev/null +++ b/Gemfile @@ -0,0 +1,4 @@ +source 'https://rubygems.org' + +# Specify your gem's dependencies in breach-mitigation-rails.gemspec +gemspec diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..23e9481 --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,22 @@ +Copyright (c) 2013 BBA, Inc. + +MIT License + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md new file mode 100644 index 0000000..b7712d4 --- /dev/null +++ b/README.md @@ -0,0 +1,51 @@ +# breach-mitigation-rails + +Makes Rails applications less susceptible to the BREACH / CRIME +attacks. See [breachattack.com](http://breachattack.com/) for details. + +## How it works + +This gem implements two of the suggestion mitigation strategies from +the paper: + +*Masking Secrets*: The Rails CSRF token is 'masked' by encrypting it +with a 32-byte one-time pad, and the pad and encrypted token are +returned to the browser, instead of the "real" CSRF token. This only +protects the CSRF token from an attacker; it does not protect other +data on your pages (see the paper for details on this). + +*Length Hiding*: The BreachMitigation::LengthHiding middleware +appends an HTML comment up to 2k in length to the end of all HTML +documents served by your app. As noted in the paper, this does not +prevent plaintext recovery, but it can slow the attack and it's +relatively inexpensive to implement. Unlike the CSRF token masking, +length hiding protects the entire page body from recovery. + +## Warning! + +BREACH and CRIME are **complicated and wide-ranging attacks**, and this +gem offers only partial protection for Rails applications. If you're +concerned about the security of your web app, you should review the +BREACH paper and look for other, application-specific things you can +do to prevent or mitigate this class of attacks. + +## Installation + +Add this line to your Rails Gemfile: + + gem 'breach-mitigation-rails' + +And then execute: + + $ bundle + +TODO And then? + +## Contributing + +Pull requests are welcome, either to enhance the existing mitigation +strategies or to add new ways to mitigate against the attack. + +## License + +MIT - see LICENSE.txt \ No newline at end of file diff --git a/Rakefile b/Rakefile new file mode 100644 index 0000000..2995527 --- /dev/null +++ b/Rakefile @@ -0,0 +1 @@ +require "bundler/gem_tasks" diff --git a/breach-mitigation-rails.gemspec b/breach-mitigation-rails.gemspec new file mode 100644 index 0000000..b50386c --- /dev/null +++ b/breach-mitigation-rails.gemspec @@ -0,0 +1,23 @@ +# coding: utf-8 +lib = File.expand_path('../lib', __FILE__) +$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) +require 'breach_mitigation/version' + +Gem::Specification.new do |spec| + spec.name = "breach-mitigation-rails" + spec.version = BreachMitigation::VERSION + spec.authors = ["Bradley Buda"] + spec.email = ["bradleybuda@gmail.com"] + spec.description = %q{Mitigates the BREACH and CRIME attacks on TLS in Rails applications} + spec.summary = %q{Uses length-hiding and CSRF token masking to make it more difficult for an attacker to recover plaintext from HTTP responses. See README.md for details.} + spec.homepage = "https://github.com/meldium/breach-mitigation-rails" + spec.license = "MIT" + + spec.files = `git ls-files`.split($/) + spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) } + spec.test_files = spec.files.grep(%r{^(test|spec|features)/}) + spec.require_paths = ["lib"] + + spec.add_development_dependency "bundler", "~> 1.3" + spec.add_development_dependency "rake" +end diff --git a/lib/breach-mitigation-rails.rb b/lib/breach-mitigation-rails.rb new file mode 100644 index 0000000..e5cef99 --- /dev/null +++ b/lib/breach-mitigation-rails.rb @@ -0,0 +1 @@ +require 'breach_mitigation/railtie' if defined?(Rails) diff --git a/lib/breach_mitigation/length_hiding.rb b/lib/breach_mitigation/length_hiding.rb new file mode 100644 index 0000000..49389ee --- /dev/null +++ b/lib/breach_mitigation/length_hiding.rb @@ -0,0 +1,50 @@ +module BreachMitigation + class LengthHiding + def initialize(app) + @app = app + end + + def call(env) + status, headers, body = @app.call(env) + + # Only pad HTML documents + if headers['Content-Type'] =~ /text\/html/ + # Copy the existing response to a new object + response = Rack::Response.new(body, status, headers) + + # Append to that response + response.write random_html_comment + + body.close if body.respond_to? :close + response.finish + else + [status, headers, body] + end + end + + private + + # Append a comment from 0 to MAX_LENGTH bytes in size to the + # response body. See section 3.1 of "BREACH: Reviving the CRIME + # attack". This should make BREACH attacks take longer, but does + # not fully protect against them. The longer MAX_LENGTH is, the + # more effective the mitigation is, however longer lengths mean + # more time spent in this middleware and more data on the wire. + + MAX_LENGTH = 2048 + ALPHABET = ('a'..'z').to_a + + def random_html_comment + # The length of the padding should be strongly random, but the + # data itself doesn't need to be strongly random; it just needs + # to be resistant to compression + length = SecureRandom.random_number(1024) + + # TODO make this faster + junk = '' + length.times { junk << ALPHABET.sample } + + "\n" + end + end +end diff --git a/lib/breach_mitigation/railtie.rb b/lib/breach_mitigation/railtie.rb new file mode 100644 index 0000000..89dff57 --- /dev/null +++ b/lib/breach_mitigation/railtie.rb @@ -0,0 +1,9 @@ +require 'breach_mitigation/length_hiding' + +module BreachMitigation + class Railtie < Rails::Railtie + initializer "breach-mitigation-rails.insert_middleware" do |app| + app.config.middleware.use "BreachMitigation::LengthHiding" + end + end +end diff --git a/lib/breach_mitigation/version.rb b/lib/breach_mitigation/version.rb new file mode 100644 index 0000000..3fc7fc0 --- /dev/null +++ b/lib/breach_mitigation/version.rb @@ -0,0 +1,3 @@ +module BreachMitigation + VERSION = "0.0.1" +end