dawnscanner 1.2.99

data/Rakefile

@@ -0,0 +1,250 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+# require "highline/import"
+
+require 'cucumber'
+require 'cucumber/rake/task'
+
+require 'fileutils'
+require "codesake/dawn/utils"
+require "codesake/dawn/knowledge_base"
+
+Cucumber::Rake::Task.new(:features) do |t|
+  t.cucumber_opts = "features --format pretty -x"
+  t.fork = false
+end
+
+RSpec::Core::RakeTask.new do |t|
+  t.rspec_opts = ["--color"]
+end
+
+
+task :default => [ :spec, :features, :kb ]
+task :test => :spec
+task :prepare => [:build, :'checksum:calculate', :'checksum:commit']
+task :release => [:prepare]
+
+# namespace :check do
+# desc "Create a dependency check"
+# task :dependency, :name do |t, args|
+# end
+
+# end
+desc "Create a new CVE test"
+task :cve, :name do |t,args|
+  name      = args.name
+  SRC_DIR   = "./lib/codesake/dawn/kb/"
+  SPEC_DIR  = "./spec/lib/kb/"
+
+  raise "### It seems that #{name} is already in Dawn knowledge base" unless Codesake::Dawn::KnowledgeBase.find(nil, name).nil?
+  raise "### Invalid CVE title: #{name}" if name.nil? or name.empty? or /CVE-\d{4}-\d{4}/.match(name).nil?
+  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
+  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
+
+  puts "Adding #{name} to knowledge base..."
+
+  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
+  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
+  class_name = name.gsub("-", "_")
+
+  open(rb_filename, "w") do |file|
+    file.puts "module Codesake"
+    file.puts "\tmodule Dawn"
+    file.puts "\t\tmodule Kb"
+    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
+    file.puts "\t\t\tclass #{class_name}"
+    file.puts "\t\t\t\t# Include the testing skeleton for this CVE"
+    file.puts "\t\t\t\t# include PatternMatchCheck"
+    file.puts "\t\t\t\t# include DependencyCheck"
+    file.puts "\t\t\t\t# include RubyVersionCheck"
+    file.puts ""
+    file.puts "\t\t\t\tdef initialize"
+    file.puts "\t\t\t\tend"
+    file.puts "\t\t\tend"
+    file.puts "\t\tend"
+    file.puts "\tend"
+    file.puts "end"
+  end
+  puts "#{rb_filename} created"
+
+  open(spec_filename, "w") do |file|
+    file.puts "require 'spec_helper'"
+
+    file.puts "describe \"The #{name} vulnerability\" do"
+    file.puts "\tbefore(:all) do"
+    file.puts "\t\t@check = Codesake::Dawn::Kb::#{class_name}.new"
+    file.puts "\t\t# @check.debug = true"
+    file.puts "\tend"
+    file.puts "\tit \"is reported when...\""
+    file.puts "end"
+  end
+  puts "#{spec_filename} created"
+
+  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
+  puts "*** PLEASE ADD THIS CODE IN lib/codesake/dawn/knowledge_base.rb in order to reflect changes"
+  puts "require \"codesake/dawn/kb/#{class_name.downcase}\""
+  puts "it \"must have test for #{name}\" do"
+  puts "  sc = kb.find(\"#{name}\")"
+  puts "  sc.should_not   be_nil"
+  puts "  sc.class.should == Codesake::Dawn::Kb::#{class_name}"
+  puts "end"
+
+
+end
+
+
+
+desc "Create a new Generic security check"
+task :check, :name do |t,args|
+  name      = args.name
+  SRC_DIR   = "./lib/codesake/dawn/kb/"
+  SPEC_DIR  = "./spec/lib/kb/"
+
+  raise "### It seems that #{name} is already in Dawn knowledge base" unless Codesake::Dawn::KnowledgeBase.find(nil, name).nil?
+  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
+  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
+
+  puts "Adding #{name} to knowledge base..."
+
+  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
+  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
+  class_name = name.gsub("-", "_")
+
+  open(rb_filename, "w") do |file|
+    file.puts "module Codesake"
+    file.puts "\tmodule Dawn"
+    file.puts "\t\tmodule Kb"
+    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
+    file.puts "\t\t\tclass #{class_name}"
+    file.puts "\t\t\t\t# Include the testing skeleton for this Security Check"
+    file.puts "\t\t\t\t# include PatternMatchCheck"
+    file.puts "\t\t\t\t# include DependencyCheck"
+    file.puts "\t\t\t\t# include RubyVersionCheck"
+    file.puts ""
+    file.puts "\t\t\t\tdef initialize"
+    file.puts "\t\t\t\tend"
+    file.puts "\t\t\tend"
+    file.puts "\t\tend"
+    file.puts "\tend"
+    file.puts "end"
+  end
+  puts "#{rb_filename} created"
+
+  open(spec_filename, "w") do |file|
+    file.puts "require 'spec_helper'"
+
+    file.puts "describe \"The #{name} vulnerability\" do"
+    file.puts "\tbefore(:all) do"
+    file.puts "\t\t@check = Codesake::Dawn::Kb::#{class_name}.new"
+    file.puts "\t\t# @check.debug = true"
+    file.puts "\tend"
+    file.puts "\tit \"is reported when...\""
+    file.puts "end"
+  end
+  puts "#{spec_filename} created"
+
+
+  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
+  puts "*** PLEASE ADD THIS CODE IN lib/codesake/dawn/knowledge_base.rb in order to reflect changes"
+  puts "require \"codesake/dawn/kb/#{class_name.downcase}\""
+  puts "it \"must have test for #{name}\" do"
+  puts "  sc = kb.find(\"#{name}\")"
+  puts "  sc.should_not   be_nil"
+  puts "  sc.class.should == Codesake::Dawn::Kb::#{class_name}"
+  puts "end"
+
+
+end
+
+namespace :kb do
+  desc 'Check information lint'
+  task :lint do
+    Codesake::Dawn::KnowledgeBase.new.all.each do |check|
+      l = check.lint
+      puts "check #{check.name} has this attribute(s) with a nil value: #{l.to_s}" unless l.size == 0
+    end
+
+  end
+desc 'Creates a KnowledgeBase.md file'
+task :create do
+  checks = Codesake::Dawn::KnowledgeBase.new.all
+  open("KnowledgeBase.md", "w") do |file|
+    file.puts "# Codesake::Dawn Knowledge base"
+    file.puts "\nThe knowledge base library for Codesake::Dawn version #{Codesake::Dawn::VERSION} contains #{checks.count} security checks."
+    file.puts "---"
+    checks.each do |c|
+      file.puts "* [#{c.name}](#{c.cve_link}): #{c.message}" if c.name.start_with?('CVE')
+      file.puts "* [#{c.name}](#{c.osvdb_link}): #{c.message}" if c.name.start_with?('OSVDB')
+      file.puts "* #{c.name}: #{c.message}" unless c.name.start_with?('CVE')
+    end
+
+    file.puts "\n\n_Last updated: #{Time.now.strftime("%a %d %b %T %Z %Y")}_"
+  end
+  puts "KnowledgeBase.md file successfully generated"
+
+end
+end
+
+require 'digest/sha2'
+namespace :checksum do
+
+desc 'Calculate gem checksum'
+task :calculate do
+  system 'mkdir -p checksum > /dev/null'
+  built_gem_path = "pkg/codesake-dawn-#{Codesake::Dawn::VERSION}.gem"
+  checksum = Digest::SHA512.new.hexdigest(File.read(built_gem_path))
+  checksum_path = "checksum/codesake-dawn-#{Codesake::Dawn::VERSION}.gem.sha512"
+  File.open(checksum_path, 'w' ) {|f| f.write(checksum) }
+
+  puts "#{checksum_path}: #{checksum}"
+end
+
+desc 'Add and commit latest checksum'
+task :commit do
+  checksum_path = "checksum/codesake-dawn-#{Codesake::Dawn::VERSION}.gem.sha512"
+  system "git add #{checksum_path}"
+  system "git commit -v #{checksum_path} -m \"Adding #{Codesake::Dawn::VERSION} checksum to repo\""
+end
+end
+
+###############################################################################
+# ruby-advisory-rb integration
+###############################################################################
+
+namespace :rubysec do
+  desc 'Find new CVE bulletins to add to Codesake::Dawn'
+  task :find do
+    git_url = 'git@github.com:rubysec/ruby-advisory-db.git'
+    target_dir = './tmp/'
+    system "mkdir -p #{target_dir}"
+    system "rm -rf #{target_dir}ruby-advisory-db"
+    system "git clone #{git_url} #{target_dir}ruby-advisory-db"
+    list = []
+    Dir.glob("#{target_dir}ruby-advisory-db/gems/*/*.yml") do |path|
+      advisory = YAML.load_file(path)
+      if advisory['cve']
+        cve = "CVE-"+advisory['cve']
+        # Exclusion
+        # CVE-2007-6183 is a vulnerability in gnome2 ruby binding. Not a gem, I don't care
+        # CVE-2013-1878 is a duplicate of CVE-2013-2617 that is in knowledge base
+        # CVE-2013-1876 is a duplicate of CVE-2013-2615 that is in knowledge base
+        exclusion = ["CVE-2007-6183", "CVE-2013-1876", "CVE-2013-1878"]
+        if exclusion.include?(cve) 
+          puts "#{cve} is in the exclusion list"
+        else
+          found = Codesake::Dawn::KnowledgeBase.find(nil, cve)
+          puts "#{cve} NOT in dawn v#{Codesake::Dawn::VERSION} knowledge base" unless found
+          list << cve unless found
+        end
+      end
+    end
+    unless list.empty?
+      File.open("missing_rubyadvisory_cvs_#{Time.now.strftime("%Y%m%d")}.txt", "w") do |f|
+        f.puts "Missing CVE bulletins - v#{Codesake::Dawn::VERSION} - #{Time.now.strftime("%d %B %Y")}"
+        f.puts list
+      end
+    end
+    system "rm -rf #{target_dir}ruby-advisory-db"
+
+  end
+end

data/Roadmap.md

@@ -0,0 +1,59 @@
+# Codesake Dawn - roadmap
+
+Codesake::Dawn is a static analysis security scanner for ruby written web applications.
+It supports [Sinatra](http://www.sinatrarb.com),
+[Padrino](http://www.padrinorb.com) and [Ruby on Rails](http://rubyonrails.org)
+frameworks.
+
+This is an ongoing roadmap for the Codesake::Dawn source code review tool.
+
+_latest update: Mon Mar 31 13:01:21 CEST 2014_
+
+## Version 1.2.0
+
+* create a task to check for new CVE in NVD website
+* SQLite3 integration for saving data. Each project will have its own SQLite
+  database containing reviews, findings and all. A table with Codesake::Dawn version it
+  created the database will be inserted as well
+* add a language check. It will handle a ruby script as input and a
+  ruby\_parser line as unsafe pattern. It will compile the ruby and look for
+  the unsafe pattern
+* Add preliminary Cross Site Scripting detection for Ruby on Rails.
+* Issue #7: Improving HTML output and let the user the capability to provide a
+  basic layout to customize report
+* Add a ruby deprecation check, accordingly to
+  https://bugs.ruby-lang.org/projects/ruby/wiki/ReleaseEngineering
+
+## Version 1.3.0
+
+* Add support for ERB for in detect\_views
+* Add preliminary javascript support
+* adding test for CVE-2011-4969  XSS in jquery < 1.6.2
+* add support for pure Rack applications
+* Cross Site Scripting detection: it must be done for all MVC frameworks
+  (including Rack) and it must cover either reflected than stored attack
+  patterns
+* Add a --github option to Codesake::Dawn to clone a remote repository, perform
+  a bundle install and do a code review.
+* Add support for github hooks
+* Add premilinary SQL injection detection for Ruby on Rails
+
+## Version 1.5.0
+
+* Add insecure direct object reference detection for all MVC frameworks (including Rack)
+* SQL Injection detection: it must be done for all MVC frameworks (including Rack)
+* Add automatic mitigation patch generation
+* Add support for Javascript
+
+# Spinoff projects
+
+Codesake::Dawn is a security scanner for ruby code. Modern web applications
+however are wrote in a plenty of great technologies deserving a good tool for
+security scan.
+
+Node.js and Go are very promising programming languages and a tool similiar to
+Codesake::Dawn can be wrote also to support them:
+
+Initially they were in the Codesake::Dawn roadmap for a 2.0.0 version. However
+we decide to drop this in the name of being focused on ruby programming
+language.

data/bin/dawn

@@ -0,0 +1,210 @@
+#!/usr/bin/env ruby
+
+require 'getoptlong'
+require 'json'
+require 'terminal-table'
+
+require 'justify'
+
+require 'codesake-commons'
+require 'codesake-dawn'
+
+APPNAME = File.basename($0)
+LIST_KNOWN_FRAMEWORK  = %w(rails sinatra padrino)
+VALID_OUTPUT_FORMAT   = %w(console json csv html)
+
+$logger  = Codesake::Commons::Logging.instance
+opts    = GetoptLong.new(
+  # report formatting options
+  [ '--ascii-tabular-report',   '-a',   GetoptLong::NO_ARGUMENT],
+  [ '--json',                   '-j',   GetoptLong::NO_ARGUMENT],
+  [ '--html',                   '-H',   GetoptLong::NO_ARGUMENT],
+
+  # MVC forcing
+  [ '--rails',                  '-r',   GetoptLong::NO_ARGUMENT],
+  [ '--sinatra',                '-s',   GetoptLong::NO_ARGUMENT],
+  [ '--padrino',                '-p',   GetoptLong::NO_ARGUMENT],
+
+  [ '--gem-lock',               '-G',   GetoptLong::REQUIRED_ARGUMENT],
+  [ '--count-only',             '-C',   GetoptLong::NO_ARGUMENT],
+  [ '--exit-on-warn',           '-z',   GetoptLong::NO_ARGUMENT],
+
+  # Disable checks by family type
+  [ '--disable-cve-bulletins',          GetoptLong::NO_ARGUMENT],
+  [ '--disable-code-quality',           GetoptLong::NO_ARGUMENT],
+  [ '--disable-code-style',             GetoptLong::NO_ARGUMENT],
+  [ '--disable-owasp-ror-cheatsheet',   GetoptLong::NO_ARGUMENT],
+  [ '--disable-owasp-top-10',           GetoptLong::NO_ARGUMENT],
+
+  # Search knowledge base
+  [ '--search-knowledge-base',  '-S',   GetoptLong::REQUIRED_ARGUMENT],
+  # List stuff
+  [ '--list-knowledge-base',            GetoptLong::NO_ARGUMENT],
+  [ '--list-known-framework',           GetoptLong::NO_ARGUMENT],
+  [ '--list-known-families',            GetoptLong::NO_ARGUMENT],
+  # please save output to file
+  [ '--file',                   '-F',   GetoptLong::REQUIRED_ARGUMENT],
+  # specify an alternate config file
+  [ '--config-file',            '-c',   GetoptLong::REQUIRED_ARGUMENT],
+
+  # service options
+  [ '--verbose',                '-V',   GetoptLong::NO_ARGUMENT],
+  [ '--debug',                  '-D',   GetoptLong::NO_ARGUMENT],
+  [ '--version',                '-v',   GetoptLong::NO_ARGUMENT],
+  [ '--help',                   '-h',   GetoptLong::NO_ARGUMENT]
+)
+opts.quiet=true
+
+engine  = nil
+
+
+options = Codesake::Dawn::Core.read_conf(Codesake::Dawn::Core.find_conf(true))
+check = ""
+guess = {:name=>"", :version=>"", :connected_gems=>[]}
+
+begin
+opts.each do |opt, val|
+  case opt
+  when '--version'
+    puts "#{Codesake::Dawn::VERSION} [#{Codesake::Dawn::CODENAME}]"
+    Kernel.exit(0)
+  when '--config-file'
+    options = Codesake::Dawn::Core.read_conf(val)
+  when '--disable-cve-bulletins'
+    options[:enabled_checks].delete(:cve_bulletin)
+  when '--disable-code-quality'
+    options[:enabled_checks].delete(:code_quality)
+  when '--disable-code-style'
+    options[:enabled_checks].delete(:code_style)
+  when '--disable-owasp-ror-cheatsheet'
+    options[:enabled_checks].delete(:owasp_ror_cheatsheet)
+  when '--disable-owasp-top-10'
+    options[:enabled_checks].delete(:owasp_top_10_1)
+    options[:enabled_checks].delete(:owasp_top_10_2)
+    options[:enabled_checks].delete(:owasp_top_10_3)
+    options[:enabled_checks].delete(:owasp_top_10_4)
+    options[:enabled_checks].delete(:owasp_top_10_5)
+    options[:enabled_checks].delete(:owasp_top_10_6)
+    options[:enabled_checks].delete(:owasp_top_10_7)
+    options[:enabled_checks].delete(:owasp_top_10_8)
+    options[:enabled_checks].delete(:owasp_top_10_9)
+    options[:enabled_checks].delete(:owasp_top_10_10)
+  when '--list-known-families'
+    printf "Codesake::Dawn supports following check families:\n\n"
+    puts Codesake::Dawn::Kb::BasicCheck.families
+    Kernel.exit(0)
+  when '--json'
+    options[:output] = "json"
+  when '--ascii-tabular-report'
+    options[:output] = "tabular"
+  when '--html'
+    options[:output] = "html"
+  when '--rails'
+    options[:mvc]=:rails
+  when '--sinatra'
+    options[:mvc]=:sinatra
+  when '--padrino'
+    options[:mvc]=:padrino
+  when '--file'
+    options[:filename] = val
+  when '--gem-lock'
+    options[:gemfile_scan] = true
+    unless val.empty?
+      options[:gemfile_name] = val
+      guess = Codesake::Dawn::Core.guess_mvc(val)
+    end
+  when '--verbose'
+    options[:verbose]=true
+  when '--count-only'
+    options[:output] = "count"
+  when '--debug'
+    options[:debug] = true
+  when '--exit-on-warn'
+    options[:exit_on_warn] = true
+
+  when '--search-knowledge-base'
+    found = Codesake::Dawn::KnowledgeBase.find(nil, val)
+    puts "#{val} found in knowledgebase." if found
+    puts "#{val} not found in knowledgebase" if ! found
+    Kernel.exit(0)
+
+  when '--list-knowledge-base'
+    puts Codesake::Dawn::Core.dump_knowledge_base(options[:verbose])
+    Kernel.exit(0)
+  when '--list-known-framework'
+    puts "Ruby MVC framework supported by #{APPNAME}:"
+    LIST_KNOWN_FRAMEWORK.each do |mvc|
+      puts "* #{mvc}"
+    end
+    Kernel.exit(0)
+  when '--help'
+    Kernel.exit(Codesake::Dawn::Core.help)
+  end
+end
+rescue GetoptLong::InvalidOption => e
+
+  $logger.helo APPNAME, Codesake::Dawn::VERSION
+  $logger.err e.message
+  Kernel.exit(Codesake::Dawn::Core.help)
+end
+
+target=ARGV.shift
+
+$logger.helo APPNAME, Codesake::Dawn::VERSION
+trap("INT")   { $logger.die('[INTERRUPTED]') }
+$logger.die("missing target") if target.nil? && options[:gemfile_name].empty?
+$logger.die("invalid directory (#{target})") if options[:gemfile_name].empty?  &&! Codesake::Dawn::Core.is_good_target?(target)
+$logger.die("if scanning Gemfile.lock file you must not force target MVC using one from -r, -s or -p flag") if ! options[:mvc].empty? && options[:gemfile_scan]
+$logger.log("security check enabled: #{options[:enabled_checks]}") if options[:debug]
+
+
+## MVC auto detect.
+# Skipping MVC autodetect if it's already been done by guess_mvc when choosing Gemfile.lock scan
+
+unless options[:gemfile_scan]
+  begin
+    if options[:mvc].empty?
+      engine = Codesake::Dawn::Core.detect_mvc(target)
+      $logger.log("using #{engine.class.name} engine via autodect") if options[:debug]
+    else
+      engine = Codesake::Dawn::Rails.new(target)      if options[:mvc] == :rails
+      engine = Codesake::Dawn::Sinatra.new(target)    if options[:mvc] == :sinatra
+      engine = Codesake::Dawn::Padrino.new(target)    if options[:mvc] == :padrino
+    end
+  rescue ArgumentError => e
+    $logger.die(e.message)
+  end
+else
+  engine = Codesake::Dawn::GemfileLock.new(target, options[:gemfile_name], guess) # if options[:gemfile_scan]
+end
+
+$logger.die("ruby framework auto detect failed. Please force if rails, sinatra or padrino with -r, -s or -p flags") if engine.nil?
+
+if options[:exit_on_warn]
+  Kernel.at_exit do
+    if engine.count_vulnerabilities != 0
+      Kernel.exit(engine.count_vulnerabilities)
+    end
+  end
+end
+
+if options[:debug]
+  $logger.warn "putting engine in debug mode"
+  engine.debug = true
+end
+
+$logger.die "missing target framework option" if engine.nil?
+$logger.warn "this is a development Codesake::Dawn version" if Codesake::Dawn::RELEASE == "(development)"
+$logger.die "nothing to do on #{target}" if ! options[:gemfile_scan] && ! engine.can_apply? 
+
+engine.load_knowledge_base(options[:enabled_checks])
+ret = engine.apply_all
+
+if options[:output] == "count" 
+  puts (ret)? engine.vulnerabilities.count : "-1" unless options[:output] == "json"
+  puts (ret)? {:status=>"OK", :vulnerabilities_count=>engine.count_vulnerabilities}.to_json : {:status=>"KO", :vulnerabilities_count=>-1}.to_json
+  Kernel.exit(0)
+end
+
+Codesake::Dawn::Reporter.new({:engine=>engine, :apply_all_code=>ret, :format=>options[:output].to_sym, :filename=>options[:filename]}).report
+$logger.bye