lint_fu 0.5.0

data/lib/lint_fu/source_control/git.rb

@@ -0,0 +1,53 @@
+module LintFu
+  module SourceControl
+    class Git < SourceControlProvider
+      BLAME_REGEXP = /^(.*) \((.+) [0-9]{4}-[0-9]{1,2}-[0-9]{1,2}\s+([0-9]+)\)/
+
+      def initialize(path)
+        super(path)
+
+        `git version`
+        raise ProviderNotInstalled, self unless $?.success?
+
+        dot_git = File.join(path, '.git')
+        raise ProviderError.new(self, path) unless File.directory?(dot_git)
+      end
+
+      # ==Return
+      #  An array containing [author, commit_ref]
+      def blame(file, line)
+        #commit, author, line_no,
+        output = `git blame --date=short -w -L #{line} #{file}`
+        match = BLAME_REGEXP.match(output)
+        if $?.success? && match && (match[3].to_i == line)
+          return [ match[1].strip, match[2].strip ]
+        else
+          raise ProviderError, output
+        end
+      end
+
+      def excerpt(file, range, options={})
+        blame   = options.has_key?(:blame)   ? options[:blame] : true
+
+        return super unless blame 
+
+        Dir.chdir(@root) do
+          start_line = range.first
+          end_line   = range.last
+          relative_path = File.relative_path(@root, file)
+
+          output = `git blame --date=short #{blame ? '' : '-s'} -w -L #{start_line},#{end_line} #{relative_path} 2> /dev/null`
+          return output if $?.success?
+
+          #HACK: if git blame failed, assume we need to bound according to end of file
+          file_length = `wc -l #{relative_path}`.split[0].to_i
+          end_line = file_length
+          output = `git blame --date=short #{blame ? '' : '-s'} -w -L #{start_line},#{end_line} #{relative_path}`
+          return output.split("\n") if $?.success?
+
+          raise ProviderError.new("'git blame' failed with code #{$?.exitstatus}: #{output}")
+        end
+      end
+    end
+  end
+end

data/lib/lint_fu/source_control_provider.rb

@@ -0,0 +1,58 @@
+module LintFu
+  class ProviderError < Exception
+    def initialize(*args)
+      if args.length == 2 && args[0].kind_of?(LintFu::SourceControlProvider)
+        provider = args[0]
+        path     = args[1]
+        super("The #{provider.class.name} source control provider does not recognize #{path} as a valid repository")
+      else
+        super(*args)
+      end
+    end
+  end
+
+  class ProviderNotInstalled < ProviderError
+    def initialize(provider)
+      super("The #{provider.name} source control provider does not seem to be installed on this system.")
+    end
+  end
+
+  class SourceControlProvider
+    @@subclasses = Set.new
+
+    # Inherited callback to ensure this base class knows about all derived classes.
+    def self.inherited(base)
+      @@subclasses << base
+    end
+
+    # Instantiate the appropriate Provider subclass for a given directory.
+    def self.for_directory(path)
+      @@subclasses.each do |provider|
+        begin
+          return provider.new(path)
+        rescue Exception => e
+          next
+        end
+      end
+
+      return nil
+    end
+    
+    def initialize(path)
+      @root = path
+    end
+
+    def excerpt(file, range, options={})
+      blame   = options.has_key?(:blame)   ? options[:blame] : true
+      raise ProviderError, "Blame is not supported for this source control provider" if blame
+
+      Dir.chdir(@root) do
+        start_line = range.first
+        end_line   = range.last
+        io         = File.open(File.relative_path(@root, file), 'r')
+        lines      = io.readlines
+        return lines[(start_line-1)..(end_line-1)]
+      end
+    end
+  end
+end

data/lib/lint_fu/visitor.rb

@@ -0,0 +1,36 @@
+module LintFu
+  class Visitor < SexpProcessor
+    attr_reader :observers
+    
+    def initialize
+      super
+      self.require_empty   = false
+      self.auto_shift_type = false
+      @observers      = []
+    end
+
+    def process(sexp)
+      tag = sexp[0]
+
+      begin_meth  = "observe_#{tag}_begin".to_sym
+      around_meth = "observe_#{tag}".to_sym
+      end_meth    = "observe_#{tag}_end".to_sym
+
+      observers.each do |o|
+        o.__send__(begin_meth, sexp) if o.respond_to?(begin_meth)
+      end
+
+      observers.each do |o|
+        o.__send__(around_meth, sexp) if o.respond_to?(around_meth)
+      end
+
+      result = super(sexp)
+
+      observers.each do |o|
+        o.__send__(end_meth, sexp) if o.respond_to?(end_meth)
+      end
+
+      return result
+    end
+  end
+end

data/lib/lint_fu.rb

@@ -0,0 +1,34 @@
+# Load Ruby std library classes we depend upon
+require 'set'
+require 'digest/md5'
+require 'digest/sha1'
+
+# Activate the various gems we depend on
+require 'active_support'
+require 'ruby_parser'
+require 'sexp_processor'
+require 'ruby2ruby'
+require 'builder'
+require 'redcloth'
+
+# Mixins for various Ruby builtins and classes defined by other gems
+require 'lint_fu/mixins'
+
+# Core lint-fu sources
+require 'lint_fu/parser'
+require 'lint_fu/model_element'
+require 'lint_fu/model_element_builder'
+require 'lint_fu/source_control_provider'
+require 'lint_fu/issue'
+require 'lint_fu/checker'
+require 'lint_fu/visitor'
+require 'lint_fu/scan'
+require 'lint_fu/report'
+
+# lint-fu source control providers
+require 'lint_fu/source_control/git'
+
+# lint-fu plugins
+require 'lint_fu/active_record'
+require 'lint_fu/action_pack'
+require 'lint_fu/rails'

data/lint_fu.gemspec

@@ -0,0 +1,35 @@
+# -*- encoding: utf-8 -*-
+
+require 'rubygems'
+
+spec = Gem::Specification.new do |s|
+  s.required_rubygems_version = nil if s.respond_to? :required_rubygems_version=
+  s.required_ruby_version = Gem::Requirement.new(">= 1.8.7")
+
+  s.name    = 'lint_fu'
+  s.version = '0.5.0'
+  s.date    = '2011-02-19'
+
+  s.authors = ['Tony Spataro']
+  s.email   = 'code@tracker.xeger.net'
+  s.homepage= 'http://github.com/xeger/lint_fu'
+  
+  s.summary = %q{Security scanner that performs static analysis of Ruby code.}
+  s.description = %q{This tool helps identify bugs in your code. It is Rails-centric but its modular design allows support for other application frameworks.}
+
+  s.add_runtime_dependency('ruby_parser', ["~> 2.0"])
+  s.add_runtime_dependency('ruby2ruby', ["~> 1.2"])
+  s.add_runtime_dependency('activesupport', ["~> 2.3"])
+
+  s.executables = ["lint_fu"]
+
+  candidates = ['lint_fu.gemspec', 'MIT-LICENSE', 'README.rdoc'] +
+               Dir['lib/**/*'] +
+               Dir['bin/*']  
+  s.files = candidates.sort
+end
+
+if $PROGRAM_NAME == __FILE__
+   Gem.manage_gems if Gem::RubyGemsVersion.to_f < 1.0
+   Gem::Builder.new(spec).build
+end

metadata

@@ -0,0 +1,144 @@
+--- !ruby/object:Gem::Specification 
+name: lint_fu
+version: !ruby/object:Gem::Version 
+  hash: 11
+  prerelease: false
+  segments: 
+  - 0
+  - 5
+  - 0
+  version: 0.5.0
+platform: ruby
+authors: 
+- Tony Spataro
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2011-02-19 00:00:00 -08:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: ruby_parser
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 2
+        - 0
+        version: "2.0"
+  type: :runtime
+  version_requirements: *id001
+- !ruby/object:Gem::Dependency 
+  name: ruby2ruby
+  prerelease: false
+  requirement: &id002 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 11
+        segments: 
+        - 1
+        - 2
+        version: "1.2"
+  type: :runtime
+  version_requirements: *id002
+- !ruby/object:Gem::Dependency 
+  name: activesupport
+  prerelease: false
+  requirement: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 5
+        segments: 
+        - 2
+        - 3
+        version: "2.3"
+  type: :runtime
+  version_requirements: *id003
+description: This tool helps identify bugs in your code. It is Rails-centric but its modular design allows support for other application frameworks.
+email: code@tracker.xeger.net
+executables: 
+- lint_fu
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- MIT-LICENSE
+- README.rdoc
+- bin/lint_fu
+- lib/lint_fu.rb
+- lib/lint_fu/action_pack.rb
+- lib/lint_fu/action_pack/model_controller.rb
+- lib/lint_fu/action_pack/model_controller_builder.rb
+- lib/lint_fu/active_record.rb
+- lib/lint_fu/active_record/model_model.rb
+- lib/lint_fu/active_record/model_model_builder.rb
+- lib/lint_fu/checker.rb
+- lib/lint_fu/issue.rb
+- lib/lint_fu/mixins.rb
+- lib/lint_fu/mixins/file_class_methods.rb
+- lib/lint_fu/mixins/sexp_instance_methods.rb
+- lib/lint_fu/mixins/symbol_instance_methods.rb
+- lib/lint_fu/model_element.rb
+- lib/lint_fu/model_element_builder.rb
+- lib/lint_fu/parser.rb
+- lib/lint_fu/rails.rb
+- lib/lint_fu/rails/buggy_eager_load_checker.rb
+- lib/lint_fu/rails/model_application.rb
+- lib/lint_fu/rails/model_application_builder.rb
+- lib/lint_fu/rails/scan_builder.rb
+- lib/lint_fu/rails/sql_injection_checker.rb
+- lib/lint_fu/rails/unsafe_find_checker.rb
+- lib/lint_fu/report.rb
+- lib/lint_fu/scan.rb
+- lib/lint_fu/source_control/git.rb
+- lib/lint_fu/source_control_provider.rb
+- lib/lint_fu/visitor.rb
+- lint_fu.gemspec
+has_rdoc: true
+homepage: http://github.com/xeger/lint_fu
+licenses: []
+
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 57
+      segments: 
+      - 1
+      - 8
+      - 7
+      version: 1.8.7
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.7
+signing_key: 
+specification_version: 3
+summary: Security scanner that performs static analysis of Ruby code.
+test_files: []
+