paraxial 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa19e78278421371d0e25cd1e387383676df44a7d09ec936520e6e2e9a4fa70f
-  data.tar.gz: 807b6b4401164502c8b38ea4b6ff861c667b0aee5fcd124d68a5f98c19ed5e38
+  metadata.gz: 2ef49572c0555fdaea4bc13d94f4faa2d771a9919ee54304d832b5b97306cc09
+  data.tar.gz: 3bd3f48e2517d1c309e8c57ec8814a6bf9077506c461904c5f38f1ecc7e35dd3
 SHA512:
-  metadata.gz: f99fc3adc1dab0e302e45b26b2a245055b2b03eac517e5640b7f18828de1a78d64362a37811be9221b4f5c560feff727324b171d1c9493609b513de43579780a
-  data.tar.gz: fbe25d2549601ab95b67934deda8dd1e070d7ced5cb0abf570f85b8650acc9700d35c4274f3460a25d434a6f09c67ad80b85927564da3ba78a1b1dfa9b9ed2d0
+  metadata.gz: 6ed1f565c95cffdc6e8940d2c92c1cee7c7cd6157fe5da9f304746a65c1687ca74141483add2ca13616cfe82371a27b396ae4fcb178dffb80cac014ace5ac152
+  data.tar.gz: aa3ab3d9ff75cd0ff804a859eebd847ca60d2be053dd004c963d7ed612296d7a574691accfdd26b2788126c94ad9d6311a0f77d9d4dc44d97cb169bd26f6d015

data/lib/paraxial/cli.rb

@@ -18,6 +18,15 @@ module Paraxial
 
     def scan
       puts '[Paraxial] Scan starting...'
+      if check_rubocop_configuration
+        puts '[Paraxial] .rubocop.yml is valid.'
+      else
+        puts '[Paraxial] .rubocop.yml is missing rubocop-erb. To scan embedded Ruby files for security problems, add:'
+        puts '.rubocop.yml'
+        puts 'require:'
+        puts '- rubocop-erb'
+      end
+
 
       if Paraxial::Helpers.get_api_key.nil?
         puts '[Paraxial] Environment variable PARAXIAL_API_KEY not found'
@@ -40,7 +49,7 @@ module Paraxial
         m = JSON.parse(response.body)
         findings = m['ok']['findings']
         puts
-        puts "[Paraxial] Scan count #{findings.length}"
+        puts "[Paraxial] Scan count: #{findings.length}"
         puts
         findings.each do |finding|
           puts finding
@@ -89,5 +98,21 @@ module Paraxial
       end
     end
 
+    private
+
+    def check_rubocop_configuration
+      rubocop_file = File.join(Dir.pwd, '.rubocop.yml')
+
+      return false unless File.exist?(rubocop_file)
+
+      config = YAML.load_file(rubocop_file)
+      required_key = 'require'
+
+      if config.is_a?(Hash) && config[required_key].is_a?(Array)
+        config[required_key].include?('rubocop-erb')
+      else
+        false
+      end
+    end
   end
 end

data/lib/paraxial/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paraxial
-  VERSION = '0.5.0'
+  VERSION = '0.6.0'
 end

data/lib/paraxial.rb

@@ -8,6 +8,7 @@ require_relative 'rubocop/cop/paraxial/system'
 require_relative 'rubocop/cop/paraxial/send'
 require_relative 'rubocop/cop/paraxial/constantize'
 require_relative 'rubocop/cop/paraxial/html_safe'
+require_relative 'rubocop/cop/paraxial/raw'
 require_relative 'rubocop/cop/paraxial/sql'
 require_relative 'paraxial/version'
 require_relative 'paraxial/cli'

data/lib/rubocop/cop/paraxial/raw.rb

@@ -0,0 +1,22 @@
+module RuboCop
+  module Cop
+    module Paraxial
+      class Raw < Base
+        MSG = '`raw` leads to XSS when called on user input'
+
+        def on_send(node)
+          method_name = node.method_name
+          return unless send_methods.include?(method_name)
+
+          add_offense(node, message: format(MSG, method: method_name))
+        end
+
+        private
+
+        def send_methods
+          [:raw]
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paraxial
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Michael Lubas
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-08-30 00:00:00.000000000 Z
+date: 2024-09-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -66,6 +66,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop-erb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description:
 email:
 - michael@paraxial.io
@@ -90,6 +104,7 @@ files:
 - lib/rubocop/cop/paraxial/constantize.rb
 - lib/rubocop/cop/paraxial/csrf.rb
 - lib/rubocop/cop/paraxial/html_safe.rb
+- lib/rubocop/cop/paraxial/raw.rb
 - lib/rubocop/cop/paraxial/send.rb
 - lib/rubocop/cop/paraxial/sql.rb
 - lib/rubocop/cop/paraxial/system.rb