You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

109 lines
3.4 KiB

  1. # frozen_string_literal: true
  2. require 'doorkeeper/grape/authorization_decorator'
  3. class Rack::Attack
  4. class Request
  5. def authenticated_token
  6. return @token if defined?(@token)
  7. @token = Doorkeeper::OAuth::Token.authenticate(
  8. Doorkeeper::Grape::AuthorizationDecorator.new(self),
  9. *Doorkeeper.configuration.access_token_methods
  10. )
  11. end
  12. def remote_ip
  13. @remote_ip ||= (@env["action_dispatch.remote_ip"] || ip).to_s
  14. end
  15. def authenticated_user_id
  16. authenticated_token&.resource_owner_id
  17. end
  18. def unauthenticated?
  19. !authenticated_user_id
  20. end
  21. def api_request?
  22. path.start_with?('/api')
  23. end
  24. def web_request?
  25. !api_request?
  26. end
  27. def paging_request?
  28. params['page'].present? || params['min_id'].present? || params['max_id'].present? || params['since_id'].present?
  29. end
  30. end
  31. PROTECTED_PATHS = %w(
  32. /auth/sign_in
  33. /auth
  34. /auth/password
  35. ).freeze
  36. PROTECTED_PATHS_REGEX = Regexp.union(PROTECTED_PATHS.map { |path| /\A#{Regexp.escape(path)}/ })
  37. # Always allow requests from localhost
  38. # (blocklist & throttles are skipped)
  39. Rack::Attack.safelist('allow from localhost') do |req|
  40. # Requests are allowed if the return value is truthy
  41. req.remote_ip == '127.0.0.1' || req.remote_ip == '::1'
  42. end
  43. throttle('throttle_authenticated_api', limit: 300, period: 5.minutes) do |req|
  44. req.authenticated_user_id if req.api_request?
  45. end
  46. throttle('throttle_unauthenticated_api', limit: 300, period: 5.minutes) do |req|
  47. req.remote_ip if req.api_request? && req.unauthenticated?
  48. end
  49. throttle('throttle_api_media', limit: 30, period: 30.minutes) do |req|
  50. req.authenticated_user_id if req.post? && req.path.start_with?('/api/v1/media')
  51. end
  52. throttle('throttle_media_proxy', limit: 30, period: 30.minutes) do |req|
  53. req.remote_ip if req.path.start_with?('/media_proxy')
  54. end
  55. throttle('throttle_api_sign_up', limit: 5, period: 30.minutes) do |req|
  56. req.remote_ip if req.post? && req.path == '/api/v1/accounts'
  57. end
  58. # Throttle paging, as it is mainly used for public pages and AP collections
  59. throttle('throttle_authenticated_paging', limit: 300, period: 15.minutes) do |req|
  60. req.authenticated_user_id if req.paging_request?
  61. end
  62. throttle('throttle_unauthenticated_paging', limit: 300, period: 15.minutes) do |req|
  63. req.remote_ip if req.paging_request? && req.unauthenticated?
  64. end
  65. API_DELETE_REBLOG_REGEX = /\A\/api\/v1\/statuses\/[\d]+\/unreblog/.freeze
  66. API_DELETE_STATUS_REGEX = /\A\/api\/v1\/statuses\/[\d]+/.freeze
  67. throttle('throttle_api_delete', limit: 30, period: 30.minutes) do |req|
  68. req.authenticated_user_id if (req.post? && req.path =~ API_DELETE_REBLOG_REGEX) || (req.delete? && req.path =~ API_DELETE_STATUS_REGEX)
  69. end
  70. throttle('protected_paths', limit: 25, period: 5.minutes) do |req|
  71. req.remote_ip if req.post? && req.path =~ PROTECTED_PATHS_REGEX
  72. end
  73. self.throttled_response = lambda do |env|
  74. now = Time.now.utc
  75. match_data = env['rack.attack.match_data']
  76. headers = {
  77. 'Content-Type' => 'application/json',
  78. 'X-RateLimit-Limit' => match_data[:limit].to_s,
  79. 'X-RateLimit-Remaining' => '0',
  80. 'X-RateLimit-Reset' => (now + (match_data[:period] - now.to_i % match_data[:period])).iso8601(6),
  81. }
  82. [429, headers, [{ error: I18n.t('errors.429') }.to_json]]
  83. end
  84. end