{"push_id":908623427,"size":5,"distinct_size":5,"ref":"refs/heads/normalize-paths","head":"d26b9fa6b9902634528de3a2db2308cfbdb62803","before":"4d098212ff3cc0992e224e256c3ec19dbed11f26","commits":[{"sha":"4d5e859a1247200f04c5b0da123458c909a0ea40","author":{"email":"3e23c5554d3d1d89c8a31b0d5221fde33c66040d@watsonbox.net","name":"Howard Wilson"},"message":"Add note to README.md about scoping of Fail2Ban filters","distinct":true,"url":"https://api.github.com/repos/ktheory/rack-attack/commits/4d5e859a1247200f04c5b0da123458c909a0ea40"},{"sha":"2b75edacfd628247061092c7ebbd5cee7f4157ab","author":{"email":"8987272bfbe471e27fdf1b02498eed900aacb261@users.noreply.github.com","name":"Aaron Suggs"},"message":"Merge pull request #149 from watsonbox/readme-scoping-fail2ban\n\nAdd note to README.md about scoping of Fail2Ban filters","distinct":true,"url":"https://api.github.com/repos/ktheory/rack-attack/commits/2b75edacfd628247061092c7ebbd5cee7f4157ab"},{"sha":"c993821f5d54a96dd11e74120c174d7ee44be26e","author":{"email":"5a7a6a189b47cd31d24667a751e4003cd04eced5@ktheory.com","name":"Aaron Suggs"},"message":"Add Guard testing support\n\nWhile developing rack-attack, run tests continuously with `bundle exec\nguard`","distinct":true,"url":"https://api.github.com/repos/ktheory/rack-attack/commits/c993821f5d54a96dd11e74120c174d7ee44be26e"},{"sha":"764dd82e138bc28dac4bcedcce2695859f080c06","author":{"email":"5a7a6a189b47cd31d24667a751e4003cd04eced5@ktheory.com","name":"Aaron Suggs"},"message":"specs: use pry instead of debugger","distinct":true,"url":"https://api.github.com/repos/ktheory/rack-attack/commits/764dd82e138bc28dac4bcedcce2695859f080c06"},{"sha":"d26b9fa6b9902634528de3a2db2308cfbdb62803","author":{"email":"5a7a6a189b47cd31d24667a751e4003cd04eced5@ktheory.com","name":"Aaron Suggs"},"message":"Normalize request paths when using Rails' ActionDispatch\n\nThe issue\n---\n\nWhen using rack-attack with a rails app, developers expect the request\npath to be normalized. In particular, trailing slashes are stripped so\na request path \"/login/\" becomes \"/login\" by the time you're in\nActionController.\n\nSince Rack::Attack runs before ActionDispatch, the request path is not\nyet normalized. This can cause throttles and blacklists to not work as\nexpected.\n\nE.g., a throttle:\n\n    throttle('logins', ...) {|req| req.path == \"/login\" }\n\nwould not match a request to '/login/', though Rails would route\n'/login/' to the same '/login' action.\n\nThe solution\n---\n\nThis patch looks if ActionDispatch's request normalization is loaded,\nand if so, uses it to normalize the path before processing throttles,\nblacklists, etc.\n\nIf it's not loaded, the request path is not modified.\n\nCredit\n---\nThanks to Andres Riancho at Include Security for reporting this issue.","distinct":true,"url":"https://api.github.com/repos/ktheory/rack-attack/commits/d26b9fa6b9902634528de3a2db2308cfbdb62803"}]}