Class: Glib::JsonCrawler::Router

Inherits:
Object
  • Object
show all
Defined in:
lib/glib/json_crawler/router.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Router

Returns a new instance of Router.



53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/glib/json_crawler/router.rb', line 53

def initialize
  @depth = -1
  @logger = ''
  @visitor = Glib::Json::Traversal::Visitor.new(crawler_test: true)
  @http_actions = Set.new
  # default rails's development host
  @host ||= 'localhost:3000'
  @page_specs = []
  @page_urls = []
  @skip_similar_page = false
end

Instance Attribute Details

#deferred_actions ⇒ Object (readonly)

Returns the value of attribute deferred_actions.



6
7
8
 
# File 'lib/glib/json_crawler/router.rb', line 6

def deferred_actions
  @deferred_actions
end

#host ⇒ Object

Returns the value of attribute host.



8
9
10
 
# File 'lib/glib/json_crawler/router.rb', line 8

def host
  @host
end

#http_actions ⇒ Object (readonly)

Returns the value of attribute http_actions.



7
8
9
 
# File 'lib/glib/json_crawler/router.rb', line 7

def http_actions
  @http_actions
end

#last_log ⇒ Object (readonly)

Returns the value of attribute last_log.



6
7
8
 
# File 'lib/glib/json_crawler/router.rb', line 6

def last_log
  @last_log
end

#logger ⇒ Object (readonly)

Returns the value of attribute logger.



6
7
8
 
# File 'lib/glib/json_crawler/router.rb', line 6

def logger
  @logger
end

#skip_similar_page ⇒ Object

Returns the value of attribute skip_similar_page.



8
9
10
 
# File 'lib/glib/json_crawler/router.rb', line 8

def skip_similar_page
  @skip_similar_page
end

Instance Method Details

#_puts(text) ⇒ Object 



28
29
30
 
# File 'lib/glib/json_crawler/router.rb', line 28

def _puts(text)
  puts '  ' * @depth + text
end

#allowed?(url) ⇒ Boolean

Returns:

  • (Boolean) 


232
233
234
235
 
# File 'lib/glib/json_crawler/router.rb', line 232

def allowed?(url)
  regex = Regexp.new("#{host}.+(?<!\.pdf)$")
  regex.match(url)
end

#assert_target_ids_exist(args) ⇒ Object 



32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/glib/json_crawler/router.rb', line 32

def assert_target_ids_exist(args)
  # This saves targetId so that later we can check to make sure that it indeed exists
  # within the page.
  if (target_ids = args['targetIds'])
    target_ids.each do |target_id|
      @visitor.defer_action(nil, target_id)
    end
  elsif (target_id = args['targetId'])
    @visitor.defer_action(nil, target_id)
  end
end

#begin_page(spec, url) ⇒ Object 



212
213
214
215
216
 
# File 'lib/glib/json_crawler/router.rb', line 212

def begin_page(spec, url)
  @page_specs << spec
  @page_urls << url
  @visitor.begin_page(spec)
end

#crawl_multiple(views, block) ⇒ Object 



208
209
210
 
# File 'lib/glib/json_crawler/router.rb', line 208

def crawl_multiple(views, block)
  @visitor.traverse_multiple views, block
end

#end_page(spec) ⇒ Object 



218
219
220
221
222
 
# File 'lib/glib/json_crawler/router.rb', line 218

def end_page(spec)
  @page_specs.pop
  @page_urls.pop
  @visitor.end_page(spec)
end

#follow_v2(http, crawler_actions) ⇒ Object 



178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
 
# File 'lib/glib/json_crawler/router.rb', line 178

def follow_v2(http, crawler_actions)
  @depth += 1
  crawler_actions.each do |crawler_action|
    action, url, params = crawler_action

    # In full mode, wrap each action in a transaction that gets rolled back
    # to ensure database state is reset between each URL check (prevent database contamination)
    if ENV['GLIB_DISABLE_PERMISSION_TEST_SKIP'] == 'true'
      # This solution is important for permissions tests (not as much in the crawler tests),
      # because in permission tests, the user hits every single available URLs with a single purpose
      # of checking the permission of every URL, meaning that one incorrect result (e.g. 403 instead of 200 due to
      # side effect from previous URL requests) cannot be tolerated.
      #
      # On the other hand, crawler tests are expected to cover only one scenario anyway, so
      # having the scenario changed (due to side effects) is fine. We decided it's better not
      # to apply this solution for crawler tests out of performance considerations.
      ActiveRecord::Base.transaction do
        execute_crawler_action(http, action, url, params)
        raise ActiveRecord::Rollback
      end
    else
      # In skip mode, add the permission test parameter
      if url.present?
        url = add_params(url, __glib_permission_test: true)
      end
      execute_crawler_action(http, action, url, params)
    end
  end
end

#last_form ⇒ Object 



174
175
176
 
# File 'lib/glib/json_crawler/router.rb', line 174

def last_form
  @visitor.forms.last
end

#log(action, key_data, response = nil) ⇒ Object 



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/glib/json_crawler/router.rb', line 10

def log(action, key_data, response = nil)
  # Sometimes `key_data` may not be an actual URL, e.g. in the context of dialogs_alert,
  # it is the alert message.
  if key_data&.start_with?('http://', 'https://')
    key_data = remove_params(key_data, [:__glib_permission_test])
  end

  @last_log = [
    action,
    response.present? ? response.code : nil,
    key_data
  ].compact.join(
    ' :: '
  )

  @logger += '  ' * @depth + @last_log + "\n"
end

#page_spec ⇒ Object 



224
225
226
 
# File 'lib/glib/json_crawler/router.rb', line 224

def page_spec
  @page_specs.last
end

#page_url ⇒ Object 



228
229
230
 
# File 'lib/glib/json_crawler/router.rb', line 228

def page_url
  @page_urls.last
end

#process_action(http, spec) ⇒ Object 



97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
 
# File 'lib/glib/json_crawler/router.rb', line 97

def process_action(http, spec)
  # Normalize to the canonical slash form so the crawler works against apps
  # configured with either separator, and so recorded/logged action names
  # stay stable (permission snapshots compare them).
  action = Glib::JsonUi::Name.normalize(spec&.fetch('action'))
  params = spec

  assert_target_ids_exist(params)

  if action.present?
    return if similar_page?(params)

    @depth += 1
    case action
    # Canonical slash spelling: the old 'initiate_navigation' pseudo-action
    # read as separator form under Name.normalize (its underscore is part
    # of the word, not a separator), so the normalized name missed this
    # branch and the crawl logged the entry without ever executing it.
    when 'initiate/navigation'
      http_actions.add([action, params['url']])
      JsonCrawler::NavInitiate.new(http, params, action)
    when 'runMultiple'
      JsonCrawler::RunMultiple.new(http, params, action)
    when 'windows/open', 'dialogs/open', 'windows/reload', 'windows/openWeb'
      if allowed?(params['url'])
        http_actions.add([action, params['url']])
        JsonCrawler::WindowsOpen.new(http, params, action)
      else
        # IMPORTANT — do not drop the `http_actions.add` below.
        #
        # This `else` is reached by BOTH genuinely external links AND by
        # same-host file/download endpoints that `allowed?` rejected for the
        # file-extension rule (e.g. *.pdf). Recording the same-host ones is the
        # ONLY way their file authorization ever gets exercised: the permission
        # test replays each recorded action per user and snapshots the response.
        # Remove this line and every file/download endpoint silently falls out
        # of permission coverage -- a wrong authorization on one would then ship
        # unnoticed (exactly the gap this was added to close).
        #
        # We do NOT traverse/download them (no WindowsOpen crawler is created
        # here), and the permission replay runs with inspect_http:false so it
        # never follows the storage redirect. External links are filtered out by
        # `internal_url?`. Behaviour is guarded by
        # test/dummy-app/test/json_crawler/router_test.rb -- if you delete the
        # line below, that test goes red.
        http_actions.add([action, params['url']]) if internal_url?(params['url'])
        self.log action, params['url']
      end
    when 'dialogs/show', 'popovers/show'
      JsonCrawler::DialogsShow.new(http, params, action)
    when 'sheets/select'
      JsonCrawler::Menu.new(http, params, action)
    when 'http/post'
      JsonCrawler::ActionHttp.new(:post, http, params, action)
    when 'forms/submit'
      # forms = @visitor.forms
      # JsonCrawler::FormsSubmit.new(http, params, forms.last)
      JsonCrawler::FormsSubmit.new(http, params)
    when 'dialogs/alert'
      JsonCrawler::DialogsAlert.new(http, params, action)
    when 'dialogs/close', 'popovers/close'
      JsonCrawler::DialogsClose.new(http, params, action)
    else
      unless [
        'http/delete',
        'dialogs/oauth'
      ].include?(
        action
             )
        http_actions.add([action, params['url']])
      end
      self.log action, params['url']
    end
    @depth -= 1
  end
end

#should_defer_crawl?(action_crawler, args) ⇒ Boolean

Returns:

  • (Boolean) 


44
45
46
47
48
49
50
51
 
# File 'lib/glib/json_crawler/router.rb', line 44

def should_defer_crawl?(action_crawler, args)
  if (target_id = args['targetId'])
    @visitor.defer_action(action_crawler, target_id)
    return true
  end

  false
end

#step(http, args) ⇒ Object 



65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/glib/json_crawler/router.rb', line 65

def step(http, args)
  # TODO: Refactor
  case Glib::JsonUi::Name.normalize(args['view'])
  when 'fields/submit'
    @depth += 1
    # forms = @visitor.forms
    # JsonCrawler::FormsSubmit.new(http, args, forms.last)
    JsonCrawler::FormsSubmit.new(http, args)
    @depth -= 1
    return
  when 'panels/web'
    # A panels/web embeds content by URL in an inline viewer -- a file
    # preview (PDF/image), an inline HTML preview, etc. There's no onClick
    # action to catch here, so when the URL is one of our own (same-host)
    # endpoints we record it directly: the client fetches it to render the
    # panel, so its authorization should be exercised by the permission test
    # (it replays each per user and snapshots the response). We only record
    # (no fetch); external embeds are filtered out by internal_url?.
    url = args['url']
    http_actions.add(['panels/web', url]) if url.present? && internal_url?(url)
  end

  if args.is_a?(Hash) && args['rel'] != 'nofollow'
    on_click = args.fetch('onClick', nil)

    if on_click && !args['disabled']
      process_action(http, on_click)
    end
  end

end