bloodinary 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 69921337267f3dd4f7f5b1a5e08fa447936d7375a94017823dc92b8ef208b2a6
+  data.tar.gz: 9b24cd2fb45e569fe951f2cfe383ed0f2c778e4d1521861a088fd7f81c1e3421
+SHA512:
+  metadata.gz: 4c5eb35e452bd1b4f3c6b6877428dc54ca7ede23945248867a74fa719802b2461026f4fe460a8fdd07e179528a957a9eff1eecbf934e53f2399feaab0d88abb5
+  data.tar.gz: 9854d8f4021617498db3ed75771f1b0b227f268644b7c1e825301d8bfee6d31c194908104321c7c1e008bdb6e098e579dd749aec71d578c75a8afe83ad97217a

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 IshikawaUta
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,93 @@
+<p align="center">
+  <img src="assets/logo.webp" alt="Bloodinary Logo" width="600">
+</p>
+
+---
+
+# 🩸 Bloodinary v1.0.0
+
+[![Gem Version](https://img.shields.io/badge/gem-v1.0.0-red.svg)](https://rubygems.org/gems/bloodinary)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+**Bloodinary** adalah alat analisis keamanan statis (*Static Analysis Security Testing* - SAST) premium untuk aplikasi Ruby. Dirancang khusus untuk mendeteksi kerentanan keamanan tingkat tinggi dengan tingkat akurasi yang lebih tajam dibandingkan alat tradisional pada framework kustom.
+
+---
+
+## ✨ Fitur Unggulan
+
+- **🔍 Analisis AST**: Melakukan pemindaian kode sumber tanpa mengeksekusinya, menjamin keamanan 100% pada lingkungan pengembangan.
+- **🚀 Ultra Fast**: Performa pemindaian kilat, mampu memproses ribuan baris kode dalam hitungan milidetik.
+- **📁 Dukungan ERB & Template**: Mendeteksi celah XSS di file `.erb`, `.html`, `.haml`, dan `.slim`.
+- **🛡️ Aturan Keamanan Komprehensif**:
+  - **SQL Injection**: Mendeteksi kueri database yang tidak aman.
+  - **Cross-Site Scripting (XSS)**: Memantau output dinamis yang berbahaya.
+  - **Command Injection**: Melacak eksekusi sistem yang berisiko.
+  - **Path Traversal**: Mengaudit akses file sistem secara dinamis.
+  - **Insecure Redirect**: Mencegah pengalihan ke situs phishing.
+  - **Weak Crypto**: Mendeteksi algoritma hashing usang (MD5/SHA1).
+
+---
+
+## 🛠️ Instalasi
+
+Tambahkan baris ini ke dalam Gemfile aplikasi Anda:
+
+```ruby
+gem 'bloodinary'
+```
+
+Lalu jalankan:
+```bash
+bundle install
+```
+
+Atau instal secara manual dengan:
+```bash
+gem install bloodinary
+```
+
+---
+
+## 🚀 Penggunaan
+
+Jalankan Bloodinary pada direktori proyek Anda:
+
+```bash
+# Pemindaian standar
+bloodinary .
+
+# Output dalam format JSON untuk integrasi CI/CD
+bloodinary . --format json
+
+# Menyimpan laporan ke file
+bloodinary . --output laporan_keamanan.txt
+
+# Mengabaikan folder tertentu
+bloodinary . --ignore-path vendor/,spec/
+```
+
+### Opsi CLI Lengkap:
+
+| Opsi | Deskripsi |
+|------|-----------|
+| `-f, --format` | Pilih format laporan (`text`, `json`). |
+| `-o, --output` | Simpan laporan ke file tertentu. |
+| `--ignore-path` | Lewati folder atau file (pisahkan dengan koma). |
+| `--exit-on-warn` | Berhenti dengan kode 1 jika menemukan celah keamanan. |
+| `-v, --version` | Tampilkan versi Bloodinary. |
+
+---
+
+## 🧩 Pengabaian Temuan (Ignore)
+
+Jika Anda yakin suatu baris kode aman, Anda bisa menambah komentar di akhir baris untuk mengabaikannya:
+
+```ruby
+system("ls #{user_input}") # bloodinary:ignore
+```
+
+---
+
+## 📄 Lisensi
+
+Proyek ini dilisensikan di bawah **Lisensi MIT** - lihat file [LICENSE](LICENSE) untuk detail lebih lanjut.

data/bin/bloodinary

@@ -0,0 +1,91 @@
+#!/usr/bin/env ruby
+$LOAD_PATH.unshift File.expand_path('../../lib', __FILE__)
+require 'bloodinary'
+require 'optparse'
+require 'rainbow'
+
+options = {
+  format: :text,
+  output: nil,
+  ignore_paths: [],
+  exit_on_warn: false
+}
+
+OptionParser.new do |opts|
+  opts.banner = "Penggunaan: bloodinary [jalur] [opsi]"
+
+  opts.on("-f", "--format FORMAT", [:text, :json], "Pilih format laporan (text, json)") do |f|
+    options[:format] = f
+  end
+
+  opts.on("-o", "--output FILE", "Simpan laporan ke file") do |o|
+    options[:output] = o
+  end
+
+  opts.on("--ignore-path PATH", "Lewati folder/file tertentu (pisahkan dengan koma)") do |p|
+    options[:ignore_paths] = p.split(',').map(&:strip)
+  end
+
+  opts.on("--exit-on-warn", "Keluar dengan kode 1 jika ditemukan kerentanan") do
+    options[:exit_on_warn] = true
+  end
+
+  opts.on("-v", "--version", "Tampilkan versi") do
+    puts "Bloodinary v1.0.0"
+    exit
+  end
+
+  opts.on("-h", "--help", "Tampilkan bantuan") do
+    puts opts
+    exit
+  end
+end.parse!
+
+path = ARGV[0] || '.'
+
+unless File.exist?(path)
+  puts "Error: Jalur '#{path}' tidak ditemukan."
+  exit 1
+end
+
+# Brand message
+if options[:format] == :text
+  puts "\n" + Rainbow(" Bloodinary ").black.bg(:red).bold + " Sedang memindai target: " + Rainbow(path).underline
+  puts Rainbow(" (Mengabaikan: #{options[:ignore_paths].join(', ')})").faint unless options[:ignore_paths].empty?
+end
+
+# SCAN
+begin
+  scanner = Bloodinary::Scanner.new
+  result = scanner.scan(path, options[:ignore_paths])
+  
+  # REPORT
+  if options[:output]
+    File.open(options[:output], 'w') do |f|
+      # Temporarily redirect stdout for the reporter
+      original_stdout = $stdout
+      $stdout = f
+      Bloodinary::Reporter.report(result, options[:format])
+      $stdout = original_stdout
+    end
+    puts "\n" + Rainbow(" Laporan berhasil disimpan ke: ").green + Rainbow(options[:output]).underline if options[:format] == :text
+  else
+    Bloodinary::Reporter.report(result, options[:format])
+  end
+
+  # EXIT STATUS
+  if options[:exit_on_warn] && !result[:findings].empty?
+    exit 1
+  end
+rescue Interrupt
+  puts "\n" + Rainbow("Pemindaian dibatalkan oleh pengguna.").yellow
+  exit 1
+rescue StandardError => e
+  # If format is JSON, we should probably output JSON error
+  if options[:format] == :json
+    puts ({ error: e.message }).to_json
+  else
+    puts "\n" + Rainbow("Terjadi kesalahan sistem: #{e.message}").red
+  end
+  exit 1
+end

data/lib/bloodinary/processor.rb

@@ -0,0 +1,47 @@
+module Bloodinary
+  class Processor < Parser::AST::Processor
+    attr_reader :findings
+
+    def initialize(file, comments = [])
+      @file = file
+      @findings = []
+      @comments = comments
+      @rules = [
+        Rules::SQLInjectionRule.new,
+        Rules::XSSVulnerabilityRule.new,
+        Rules::CommandInjectionRule.new,
+        Rules::FileAccessRule.new,
+        Rules::InsecureRedirectRule.new,
+        Rules::WeakCryptoRule.new
+      ]
+    end
+
+    def ignore?(node)
+      return false unless node.loc && node.loc.expression
+      line = node.loc.line
+      @comments.any? { |c| c.location.line == line && c.text.include?('bloodinary:ignore') }
+    end
+
+    # on_send is called for method calls: object.method(args)
+    def on_send(node)
+      return super if ignore?(node)
+
+      @rules.each do |rule|
+        finding = rule.check(node, @file)
+        @findings << finding if finding
+      end
+      super
+    end
+
+    # on_xstr is called for backticks: `command`
+    def on_xstr(node)
+      return super if ignore?(node)
+
+      @rules.each do |rule|
+        finding = rule.check(node, @file)
+        @findings << finding if finding
+      end
+      super
+    end
+  end
+end

data/lib/bloodinary/reporter.rb

@@ -0,0 +1,78 @@
+module Bloodinary
+  class Reporter
+    def self.report(result, format = :text)
+      if format == :json
+        puts JSON.pretty_generate(result)
+      else
+        print_text_report(result)
+      end
+    end
+
+    def self.print_text_report(result)
+      findings = result[:findings]
+      metadata = result[:metadata]
+
+      # Header
+      header = " BLOODINARY SECURITY SCANNER "
+      puts "\n" + Rainbow(" " * 80).bg(:red)
+      puts Rainbow(header.center(80)).black.bg(:red).bold
+      puts Rainbow(" " * 80).bg(:red)
+      puts "\n"
+
+      if findings.empty?
+        puts Rainbow("  PASSED: Tidak ditemukan kerentanan keamanan yang mencolok. ✨").green.bold
+      else
+        puts Rainbow("  TERDETEKSI #{findings.size} KERENTANAN:").red.bold
+        puts "\n"
+        
+        findings.each_with_index do |f, i|
+          color = severity_color(f[:severity])
+          severity_text = " #{f[:severity]} "
+          print "  " + Rainbow(severity_text).black.bg(color).bold
+          print " " + Rainbow(f[:message]).bold
+          puts "\n"
+          puts Rainbow("  File:  ").bright + Rainbow("#{f[:file]}:#{f[:line]}").underline
+          puts Rainbow("  Kode:  ").bright + Rainbow("> #{f[:code].strip}").italic
+          puts "  " + Rainbow("-" * 76).faint
+        end
+      end
+      
+      print_summary(result)
+      
+      # Footer
+      puts "\n" + Rainbow(" Scan selesai pada #{metadata[:end_time].strftime('%H:%M:%S')} (Durasi: #{metadata[:duration].round(2)}s) ").faint.center(80)
+      puts "\n"
+    end
+
+    def self.print_summary(result)
+      findings = result[:findings]
+      metadata = result[:metadata]
+      
+      counts = Hash.new(0)
+      findings.each { |f| counts[f[:severity]] += 1 }
+
+      puts "\n" + Rainbow(" RINGKASAN TEMUAN ").black.bg(:white).bold
+      puts Rainbow(" ┌────────────────────┬──────────┐ ").faint
+      puts Rainbow(" │ Tingkat Keparahan  │ Jumlah   │ ").faint
+      puts Rainbow(" ├────────────────────┼──────────┤ ").faint
+      [:CRITICAL, :HIGH, :MEDIUM].each do |sev|
+        color = severity_color(sev)
+        label = sev.to_s.ljust(18)
+        count = counts[sev].to_s.rjust(8)
+        puts Rainbow(" │ ").faint + Rainbow(label).color(color) + Rainbow(" │ ").faint + Rainbow(count).bold + Rainbow(" │ ").faint
+      end
+      puts Rainbow(" ├────────────────────┼──────────┤ ").faint
+      puts Rainbow(" │ Total File Scan    │ ").faint + metadata[:file_count].to_s.rjust(8) + Rainbow(" │ ").faint
+      puts Rainbow(" └────────────────────┴──────────┘ ").faint
+    end
+
+    def self.severity_color(severity)
+      case severity
+      when :CRITICAL then :magenta
+      when :HIGH then :red
+      when :MEDIUM then :yellow
+      else :blue
+      end
+    end
+  end
+end

data/lib/bloodinary/rules/base_rule.rb

@@ -0,0 +1,29 @@
+module Bloodinary
+  module Rules
+    class BaseRule
+      def check(node, file)
+        # To be implemented by subclasses
+      end
+
+      def create_finding(node, file, severity, message)
+        {
+          file: file,
+          line: node.loc.line,
+          column: node.loc.column,
+          severity: severity,
+          message: message,
+          code: node.loc.expression.source
+        }
+      end
+
+      # Helper to check if a node is potentially dynamic/untrusted
+      def dynamic?(node)
+        return false unless node
+        # If it's a string literal, it's safe
+        return false if node.type == :str
+        # If it's a variable or interpolation, it's dynamic
+        true
+      end
+    end
+  end
+end

data/lib/bloodinary/rules/command_injection.rb

@@ -0,0 +1,37 @@
+require_relative 'base_rule'
+
+module Bloodinary
+  module Rules
+    class CommandInjectionRule < BaseRule
+      TARGET_METHODS = [:system, :exec, :spawn].freeze
+
+      def check(node, file)
+        # Handle method calls (system, exec, spawn)
+        if node.type == :send
+          method_name = node.children[1]
+          if TARGET_METHODS.include?(method_name)
+            arg = node.children[2]
+            if arg && dynamic_command?(arg)
+              return create_finding(node, file, :CRITICAL, "Pemanggilan perintah sistem '#{method_name}' dengan data dinamis. Risiko Command Injection!")
+            end
+          end
+        end
+
+        # Handle backticks (xstr)
+        if node.type == :xstr
+          if node.children.any? { |c| c.type == :begin } # Interpolation inside backticks
+            return create_finding(node, file, :CRITICAL, "Backticks dengan interpolasi variabel terdeteksi. Risiko Command Injection!")
+          end
+        end
+        nil
+      end
+
+      private
+
+      def dynamic_command?(node)
+        # Check if argument is dynamic
+        [:dstr, :lvar, :ivar, :send].include?(node.type)
+      end
+    end
+  end
+end

data/lib/bloodinary/rules/file_access.rb

@@ -0,0 +1,31 @@
+require_relative 'base_rule'
+
+module Bloodinary
+  module Rules
+    class FileAccessRule < BaseRule
+      TARGET_METHODS = [:read, :open, :readlines, :binread, :write, :delete, :unlink, :stat].freeze
+
+      def check(node, file)
+        return nil unless node.type == :send
+        
+        receiver = node.children[0]
+        method_name = node.children[1]
+        
+        # Mencari pola File.read, Dir.glob, IO.readlines, dll.
+        if receiver && receiver.type == :const
+          class_name = receiver.children[1]
+          
+          if [:File, :Dir, :IO].include?(class_name)
+            if TARGET_METHODS.include?(method_name) || method_name == :glob
+              arg = node.children[2]
+              if arg && dynamic?(arg)
+                return create_finding(node, file, :HIGH, "Akses file/direktori dengan parameter dinamis terdeteksi. Pastikan untuk mencegah Path Traversal.")
+              end
+            end
+          end
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/bloodinary/rules/insecure_redirect.rb

@@ -0,0 +1,23 @@
+require_relative 'base_rule'
+
+module Bloodinary
+  module Rules
+    class InsecureRedirectRule < BaseRule
+      def check(node, file)
+        return nil unless node.type == :send
+        
+        method_name = node.children[1]
+        
+        # redirect(params[:url]) atau redirect_to(url)
+        if [:redirect, :redirect_to].include?(method_name)
+          arg = node.children[2]
+          
+          if arg && dynamic?(arg)
+            return create_finding(node, file, :MEDIUM, "Pengalihan (redirect) menggunakan data dinamis tanpa validasi. Risiko Open Redirect ke situs berbahaya.")
+          end
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/bloodinary/rules/sql_injection.rb

@@ -0,0 +1,32 @@
+require_relative 'base_rule'
+
+module Bloodinary
+  module Rules
+    class SQLInjectionRule < BaseRule
+      TARGET_METHODS = [:where, :find_by, :execute, :query].freeze
+
+      def check(node, file)
+        method_name = node.children[1]
+        return nil unless TARGET_METHODS.include?(method_name)
+
+        # Check the first argument
+        arg = node.children[2]
+        return nil unless arg
+
+        if dynamic_query?(arg)
+          return create_finding(node, file, :HIGH, "Potensi SQL Injection terdeteksi pada pemanggilan metode '#{method_name}'.")
+        end
+        nil
+      end
+
+      private
+
+      def dynamic_query?(node)
+        # :dstr is a string with interpolation
+        # :lvar is a local variable
+        # :send is another method call
+        [:dstr, :lvar, :send, :ivar].include?(node.type)
+      end
+    end
+  end
+end

data/lib/bloodinary/rules/weak_crypto.rb

@@ -0,0 +1,24 @@
+require_relative 'base_rule'
+
+module Bloodinary
+  module Rules
+    class WeakCryptoRule < BaseRule
+      def check(node, file)
+        return nil unless node.type == :send
+        
+        receiver = node.children[0]
+        method_name = node.children[1]
+        
+        # Digest::MD5.hexdigest(data) -> node is hexdigest, receiver is Digest::MD5
+        # Digest::MD5 -> node is MD5, receiver is Digest
+        if method_name == :hexdigest || method_name == :new || method_name == :digest
+          if receiver && receiver.type == :const && [:MD5, :SHA1].include?(receiver.children[1])
+            algorithm = receiver.children[1]
+            return create_finding(node, file, :MEDIUM, "Algoritma hashing yang lemah (#{algorithm}) terdeteksi. Gunakan SHA256 atau lebih tinggi.")
+          end
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/bloodinary/rules/xss_vulnerability.rb

@@ -0,0 +1,52 @@
+require_relative 'base_rule'
+
+module Bloodinary
+  module Rules
+    class XSSVulnerabilityRule < BaseRule
+      def check(node, file)
+        method_name = node.children[1]
+        
+        # Check for ERB output: <%= data %>
+        if method_name == :_bloodinary_output
+          arg = node.children[2]
+          if arg && dynamic_and_unsafe?(arg)
+            return create_finding(node, file, :HIGH, "Output dinamis di dalam template terdeteksi tanpa pembersihan (XSS). Gunakan pembersihan atau pastikan data aman.")
+          end
+        end
+
+        # Check for raw(data)
+        if method_name == :raw
+          arg = node.children[2]
+          if arg && [:lvar, :ivar, :send, :dstr].include?(arg.type)
+            return create_finding(node, file, :MEDIUM, "Penggunaan 'raw' terdeteksi. Pastikan data sudah dibersihkan untuk mencegah XSS.")
+          end
+        end
+
+        # Check for data.html_safe
+        if method_name == :html_safe
+          receiver = node.children[0]
+          if receiver && [:lvar, :ivar, :send, :dstr].include?(receiver.type)
+            return create_finding(node, file, :MEDIUM, "Metode 'html_safe' dipanggil pada objek dinamis. Ini adalah risiko XSS.")
+          end
+        end
+        nil
+      end
+
+      private
+
+      def dynamic_and_unsafe?(node)
+        # Check if it's a variable, instance variable, method call, or interpolation
+        return false unless [:lvar, :ivar, :send, :dstr].include?(node.type)
+        
+        # Exception: if it's already wrapped in raw or html_safe, we don't flag the output tag itself
+        # (Though those will be flagged by their own rules anyway)
+        if node.type == :send
+          inner_method = node.children[1]
+          return false if [:raw, :html_safe].include?(inner_method)
+        end
+        
+        true
+      end
+    end
+  end
+end

data/lib/bloodinary/scanner.rb

@@ -0,0 +1,112 @@
+module Bloodinary
+  class Scanner
+    def initialize(options = {})
+      @options = options
+      @findings = []
+    end
+
+    TEMPLATE_EXTENSIONS = ['.erb', '.html', '.rhtml', '.haml', '.slim'].freeze
+
+    def scan(path, ignore_paths = [])
+      @start_time = Time.now
+      @file_count = 0
+      @findings = []
+
+      Find.find(path) do |f|
+        # Ignore logic (skip vendor, spec, etc if specified)
+        if ignore_paths.any? { |ignore| f.include?(ignore) }
+          Find.prune if File.directory?(f)
+          next
+        end
+
+        next if File.directory?(f)
+        
+        ext = File.extname(f).downcase
+        if ext == '.rb'
+          @file_count += 1
+          @findings.concat(scan_file(f))
+        elsif TEMPLATE_EXTENSIONS.include?(ext)
+          @file_count += 1
+          @findings.concat(scan_template_file(f))
+        end
+      end
+      
+      @end_time = Time.now
+      {
+        findings: @findings,
+        metadata: {
+          file_count: @file_count,
+          duration: @end_time - @start_time,
+          start_time: @start_time,
+          end_time: @end_time
+        }
+      }
+    end
+
+    def scan_file(file)
+      begin
+        source = File.read(file)
+        parse_and_process(source, file)
+      rescue StandardError => e
+        puts "Error scanning #{file}: #{e.message}"
+        []
+      end
+    end
+
+    def scan_template_file(file)
+      begin
+        content = File.read(file)
+        ruby_code = extract_ruby_from_erb(content)
+        parse_and_process(ruby_code, file)
+      rescue StandardError
+        # Fail silently for template noise
+        []
+      end
+    end
+
+    private
+
+    def parse_and_process(source, file)
+      parser = Parser::CurrentRuby.new
+      buffer = Parser::Source::Buffer.new(file)
+      buffer.source = source
+      ast, comments = parser.parse_with_comments(buffer)
+      
+      return [] unless ast
+      
+      processor = Processor.new(file, comments)
+      processor.process(ast)
+      processor.findings
+    end
+
+    def extract_ruby_from_erb(content)
+      output = ""
+      last_pos = 0
+      
+      content.scan(/<%([=-]?)\s*(.*?)\s*-?%>/m) do |type, code|
+        start_pos = Regexp.last_match.begin(0)
+        end_pos = Regexp.last_match.end(0)
+        
+        # Replace HTML with spaces to preserve line/column info
+        skipped = content[last_pos...start_pos]
+        output << skipped.gsub(/[^\n]/, ' ')
+        
+        # Output tags are wrapped in a helper
+        if type == '='
+          output << "_bloodinary_output(#{code})"
+        else
+          output << code
+        end
+        
+        last_pos = end_pos
+      end
+      
+      # Add the rest of the file as spaces
+      if last_pos < content.length
+        output << content[last_pos..-1].gsub(/[^\n]/, ' ')
+      end
+      
+      output
+    end
+  end
+end

data/lib/bloodinary.rb

@@ -0,0 +1,26 @@
+# Suppress parser version warning
+$VERBOSE, old_verbose = nil, $VERBOSE
+require 'parser/current'
+$VERBOSE = old_verbose
+
+require 'find'
+require 'rainbow'
+require 'json'
+
+# Core
+require_relative 'bloodinary/scanner'
+require_relative 'bloodinary/processor'
+require_relative 'bloodinary/reporter'
+
+# Rules
+require_relative 'bloodinary/rules/base_rule'
+require_relative 'bloodinary/rules/sql_injection'
+require_relative 'bloodinary/rules/xss_vulnerability'
+require_relative 'bloodinary/rules/command_injection'
+require_relative 'bloodinary/rules/file_access'
+require_relative 'bloodinary/rules/insecure_redirect'
+require_relative 'bloodinary/rules/weak_crypto'
+
+module Bloodinary
+  VERSION = "1.0.0"
+end

metadata

@@ -0,0 +1,113 @@
+--- !ruby/object:Gem::Specification
+name: bloodinary
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- IshikawaUta
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: parser
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rainbow
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+description: Bloodinary detects high-severity vulnerabilities like SQLi, XSS, and
+  RCE in any Ruby application, including custom frameworks.
+email:
+- komikers09@gmail.com
+executables:
+- bloodinary
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- assets/logo.webp
+- bin/bloodinary
+- lib/bloodinary.rb
+- lib/bloodinary/processor.rb
+- lib/bloodinary/reporter.rb
+- lib/bloodinary/rules/base_rule.rb
+- lib/bloodinary/rules/command_injection.rb
+- lib/bloodinary/rules/file_access.rb
+- lib/bloodinary/rules/insecure_redirect.rb
+- lib/bloodinary/rules/sql_injection.rb
+- lib/bloodinary/rules/weak_crypto.rb
+- lib/bloodinary/rules/xss_vulnerability.rb
+- lib/bloodinary/scanner.rb
+homepage: https://github.com/IshikawaUta/bloodinary
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: Premium static analysis security testing (SAST) for Ruby applications.
+test_files: []