paraxial 0.5.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa19e78278421371d0e25cd1e387383676df44a7d09ec936520e6e2e9a4fa70f
-  data.tar.gz: 807b6b4401164502c8b38ea4b6ff861c667b0aee5fcd124d68a5f98c19ed5e38
+  metadata.gz: ae07951f0f8acaa36743cf6262075828235520ddc3ffb2ff7f4a29643ddd6e1d
+  data.tar.gz: a865ff890ed5e9a802b9462e236a8efaa4b494d5b5973cf13720446c76174444
 SHA512:
-  metadata.gz: f99fc3adc1dab0e302e45b26b2a245055b2b03eac517e5640b7f18828de1a78d64362a37811be9221b4f5c560feff727324b171d1c9493609b513de43579780a
-  data.tar.gz: fbe25d2549601ab95b67934deda8dd1e070d7ced5cb0abf570f85b8650acc9700d35c4274f3460a25d434a6f09c67ad80b85927564da3ba78a1b1dfa9b9ed2d0
+  metadata.gz: 4cfda9292ce733e777a2198b97e30443a68d8348dd822ff60f680da43af6b47aa18c2318bcf01565689ba8961bc695a71fccf31814a46092c256f52ce7893810
+  data.tar.gz: e10ef61a321f57660a35d706cdab3b000852c68ca66c89299fe54a95daa785e008446ffa06d9ede8bca8a7ed6bd9e1a9e7c6e11ddaa78f79a8d25b5539edd48b

data/lib/paraxial/cli.rb

@@ -18,6 +18,15 @@ module Paraxial
 
     def scan
       puts '[Paraxial] Scan starting...'
+      if check_rubocop_configuration
+        puts '[Paraxial] .rubocop.yml is valid.'
+      else
+        puts '[Paraxial] .rubocop.yml is missing rubocop-erb. To scan embedded Ruby files for security problems, add:'
+        puts '.rubocop.yml'
+        puts 'require:'
+        puts '- rubocop-erb'
+      end
+
 
       if Paraxial::Helpers.get_api_key.nil?
         puts '[Paraxial] Environment variable PARAXIAL_API_KEY not found'
@@ -40,7 +49,7 @@ module Paraxial
         m = JSON.parse(response.body)
         findings = m['ok']['findings']
         puts
-        puts "[Paraxial] Scan count #{findings.length}"
+        puts "[Paraxial] Scan count: #{findings.length}"
         puts
         findings.each do |finding|
           puts finding
@@ -89,5 +98,21 @@ module Paraxial
       end
     end
 
+    private
+
+    def check_rubocop_configuration
+      rubocop_file = File.join(Dir.pwd, '.rubocop.yml')
+
+      return false unless File.exist?(rubocop_file)
+
+      config = YAML.load_file(rubocop_file)
+      required_key = 'require'
+
+      if config.is_a?(Hash) && config[required_key].is_a?(Array)
+        config[required_key].include?('rubocop-erb')
+      else
+        false
+      end
+    end
   end
 end

data/lib/paraxial/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paraxial
-  VERSION = '0.5.0'
+  VERSION = '0.7.0'
 end

data/lib/paraxial.rb

@@ -8,6 +8,7 @@ require_relative 'rubocop/cop/paraxial/system'
 require_relative 'rubocop/cop/paraxial/send'
 require_relative 'rubocop/cop/paraxial/constantize'
 require_relative 'rubocop/cop/paraxial/html_safe'
+require_relative 'rubocop/cop/paraxial/raw'
 require_relative 'rubocop/cop/paraxial/sql'
 require_relative 'paraxial/version'
 require_relative 'paraxial/cli'

data/lib/rubocop/cop/paraxial/html_safe.rb

@@ -2,7 +2,7 @@ module RuboCop
   module Cop
     module Paraxial
       class HTMLSafe < Base
-        MSG = '`html_safe` leads to XSS when called on user input'
+        MSG = '`html_safe` leads to XSS when called on user input.'
 
         def on_send(node)
           method_name = node.method_name

data/lib/rubocop/cop/paraxial/raw.rb

@@ -0,0 +1,22 @@
+module RuboCop
+  module Cop
+    module Paraxial
+      class Raw < Base
+        MSG = '`raw` leads to XSS when called on user input.'
+
+        def on_send(node)
+          method_name = node.method_name
+          return unless send_methods.include?(method_name)
+
+          add_offense(node, message: format(MSG, method: method_name))
+        end
+
+        private
+
+        def send_methods
+          [:raw]
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paraxial
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Michael Lubas
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-08-30 00:00:00.000000000 Z
+date: 2024-09-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -66,6 +66,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop-erb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description:
 email:
 - michael@paraxial.io
@@ -90,6 +104,7 @@ files:
 - lib/rubocop/cop/paraxial/constantize.rb
 - lib/rubocop/cop/paraxial/csrf.rb
 - lib/rubocop/cop/paraxial/html_safe.rb
+- lib/rubocop/cop/paraxial/raw.rb
 - lib/rubocop/cop/paraxial/send.rb
 - lib/rubocop/cop/paraxial/sql.rb
 - lib/rubocop/cop/paraxial/system.rb