feat: setup rack-protection

Signed-off-by: Gil Desmarais <git@desmarais.de>

Gemfile

@@ -14,6 +14,7 @@ gem 'html2rss-configs', github: 'html2rss/html2rss-configs'
 gem 'erubi'
 gem 'parallel'
 gem 'rack-cache'
+gem 'rack-protection'
 gem 'rack-timeout'
 gem 'rack-unreloader'
 gem 'roda'

Gemfile.lock

@@ -11,6 +11,7 @@ GEM
  addressable (2.8.7)
  public_suffix (>= 2.0.2, < 7.0)
  ast (2.4.2)
+ base64 (0.2.0)
  byebug (11.1.3)
  concurrent-ruby (1.3.4)
  crass (1.0.6)
@@ -73,6 +74,9 @@ GEM
  rack (3.1.7)
  rack-cache (1.17.0)
  rack (>= 0.4)
+ rack-protection (4.0.0)
+ base64 (>= 0.1.0)
+ rack (>= 3.0.0, < 4)
  rack-timeout (0.7.0)
  rack-unreloader (2.1.0)
  rainbow (3.1.1)
@@ -156,6 +160,7 @@ DEPENDENCIES
  parallel
  puma
  rack-cache
+ rack-protection
  rack-timeout
  rack-unreloader
  rake

config.ru

@@ -2,26 +2,35 @@
 
 require 'rubygems'
 require 'bundler/setup'
+require 'rack/protection'
+require 'rack/protection/path_traversal'
 
-dev = ENV.fetch('RACK_ENV', nil) == 'development'
+use Rack::Protection
+use Rack::Protection::PathTraversal
 
-if dev
+if (dev = ENV.fetch('RACK_ENV', nil) == 'development')
  require 'logger'
+ require 'rack/unreloader'
+
  logger = Logger.new($stdout)
-end
+ Unreloader = Rack::Unreloader.new(subclasses: %w[Roda Html2rss],
+ logger:,
+ reload: dev) do
+ App::App
+ end
 
-require 'rack/unreloader'
-Unreloader = Rack::Unreloader.new(subclasses: %w[Roda Html2rss],
-  logger:,
-  reload: dev) do
- App::App
-end
+ Unreloader.require('app.rb') { 'App' }
+ Unreloader.require('./app/health_check.rb')
+ Unreloader.require('./app/html2rss_facade.rb')
+ Unreloader.require('./app/http_cache.rb')
+ Unreloader.require('./app/local_config.rb')
+ Unreloader.require('./app/request_path.rb')
 
-Unreloader.require('app.rb') { 'App' }
-Unreloader.require('./app/health_check.rb')
-Unreloader.require('./app/html2rss_facade.rb')
-Unreloader.require('./app/http_cache.rb')
-Unreloader.require('./app/local_config.rb')
-Unreloader.require('./app/request_path.rb')
+ run Unreloader
+else
+ require_relative 'app'
+
+ Dir['./app/**/*.rb'].each { |f| require_relative f }
+end
 
-run(dev ? Unreloader : App::App.freeze.app)
+run App::App.freeze.app