feat: setup rack-protection

Signed-off-by: Gil Desmarais <[email protected]>

Gemfile

@@ -14,6 +14,7 @@ gem 'html2rss-configs', github: 'html2rss/html2rss-configs'
 gem 'erubi'
 gem 'parallel'
 gem 'rack-cache'
+gem 'rack-protection'
 gem 'rack-timeout'
 gem 'rack-unreloader'
 gem 'roda'

Gemfile.lock

@@ -11,6 +11,7 @@ GEM
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
     ast (2.4.2)
+    base64 (0.2.0)
     byebug (11.1.3)
     concurrent-ruby (1.3.4)
     crass (1.0.6)
@@ -73,6 +74,9 @@ GEM
     rack (3.1.7)
     rack-cache (1.17.0)
       rack (>= 0.4)
+    rack-protection (4.0.0)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0, < 4)
     rack-timeout (0.7.0)
     rack-unreloader (2.1.0)
     rainbow (3.1.1)
@@ -156,6 +160,7 @@ DEPENDENCIES
   parallel
   puma
   rack-cache
+  rack-protection
   rack-timeout
   rack-unreloader
   rake

config.ru

@@ -2,26 +2,35 @@
 
 require 'rubygems'
 require 'bundler/setup'
+require 'rack/protection'
+require 'rack/protection/path_traversal'
 
-dev = ENV.fetch('RACK_ENV', nil) == 'development'
+use Rack::Protection
+use Rack::Protection::PathTraversal
 
-if dev
+if (dev = ENV.fetch('RACK_ENV', nil) == 'development')
   require 'logger'
+  require 'rack/unreloader'
+
   logger = Logger.new($stdout)
-end
+  Unreloader = Rack::Unreloader.new(subclasses: %w[Roda Html2rss],
+                                    logger:,
+                                    reload: dev) do
+    App::App
+  end
 
-require 'rack/unreloader'
-Unreloader = Rack::Unreloader.new(subclasses: %w[Roda Html2rss],
-                                  logger:,
-                                  reload: dev) do
-  App::App
-end
+  Unreloader.require('app.rb') { 'App' }
+  Unreloader.require('./app/health_check.rb')
+  Unreloader.require('./app/html2rss_facade.rb')
+  Unreloader.require('./app/http_cache.rb')
+  Unreloader.require('./app/local_config.rb')
+  Unreloader.require('./app/request_path.rb')
 
-Unreloader.require('app.rb') { 'App' }
-Unreloader.require('./app/health_check.rb')
-Unreloader.require('./app/html2rss_facade.rb')
-Unreloader.require('./app/http_cache.rb')
-Unreloader.require('./app/local_config.rb')
-Unreloader.require('./app/request_path.rb')
+  run Unreloader
+else
+  require_relative 'app'
+
+  Dir['./app/**/*.rb'].each { |f| require_relative f }
+end
 
-run(dev ? Unreloader : App::App.freeze.app)
+run App::App.freeze.app