paraxial 1.4.2 → 1.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90acf2bb0c21441d420b6433f1b0d378108d3c4042d6fda40116892877d535bb
-  data.tar.gz: 6edfae3d19b3e713ac41bcccf11c545ca479201f29da1fbe230bac4de8b796e5
+  metadata.gz: b3206160ed62f0ae982fa82322d02fb097be5261b245e889dc0e3252f1c60006
+  data.tar.gz: 2b2ba464bbfc69f37d680fe257cfa705827f222f126aab01eb0f5a49b9022162
 SHA512:
-  metadata.gz: 66c9b8fbc397de4bb01c5f0afa46ecf5198e88f171342324211c5e5f1401dc7ee6a3b05b9e4dcb41731113f9985ea0edfc6b4ffc7e156efa8697e1b113b2178c
-  data.tar.gz: e4c82f63baba03fcedd857ac7ac2dd6f16afff05f153982c26f3292077dc0f2879ff1266e46d2a8ad213e380178af521889293ad85cce10062574ec535e7b641
+  metadata.gz: 873b0f6c3d9347e02bac6aa040ed2343d2fec5ddb04eb1952a9fa9e4e94028dd8f4befa446bddc0dfba488c71a9db9a8d170f0510b6d91b24440168c144026f0
+  data.tar.gz: c14072cc7a5f02e6e6dfd1c8da1eb36fcc280d5aa5c65352ef12ff645762a93cdc6592ade346924a137233a91cae87fa43e0aac1abbddda49ffeb2ec2cbba002

data/lib/paraxial/cli.rb

@@ -23,12 +23,13 @@ module Paraxial
 
       case check_rubocop_configuration
       when :does_not_exist
-        puts '[Paraxial] .paraxial-rubocop.yml does not exist. This file is required for the scan to run, add:'
-        puts '.paraxial-rubocop.yml'
-        puts 'require:'
-        puts '- rubocop-erb'
-        puts ''
-        exit(1)
+        puts '[Paraxial] .paraxial-rubocop.yml does not exist. Creating file...'
+        rubocop_file = File.join(Dir.pwd, '.paraxial-rubocop.yml')
+        File.open(rubocop_file, "w") do |file|
+          file.puts "require:"
+          file.puts "- rubocop-erb"
+        end
+        puts '[Paraxial] .paraxial-rubocop.yml created.'
       when :found_no_erb
         puts '[Paraxial] .paraxial-rubocop.yml is missing rubocop-erb. To scan embedded Ruby files for security problems, add:'
         puts '.paraxial-rubocop.yml'

data/lib/paraxial/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paraxial
-  VERSION = '1.4.2'
+  VERSION = '1.4.4'
 end

data/lib/paraxial.rb

@@ -4,6 +4,7 @@ require 'thor'
 require 'paraxial/engine'
 require 'rubocop'
 require_relative 'rubocop/cop/paraxial/csrf'
+require_relative 'rubocop/cop/paraxial/csrf_skip'
 require_relative 'rubocop/cop/paraxial/system'
 require_relative 'rubocop/cop/paraxial/send'
 require_relative 'rubocop/cop/paraxial/constantize'

data/lib/rubocop/cop/paraxial/csrf.rb

@@ -2,21 +2,22 @@ module RuboCop
   module Cop
     module Paraxial
       class CSRF < Base
-        MSG = 'CSRF, no protect_from_forgery in ApplicationController.'
+        include RangeHelp
 
-        def_node_search :protect_from_forgery_call, <<~PATTERN
-          (send nil? :protect_from_forgery ...)
-        PATTERN
+        MSG = "CSRF, action_dispatch.cookies_same_site_protection set to `nil` or `:none`."
 
-        def on_class(node)
-          class_name = node.loc.name.source
+        def on_send(node)
+          return unless node.method_name == :cookies_same_site_protection=
 
-          return unless class_name == 'ApplicationController'
+          argument = node.arguments.first
 
-          protect_from_forgery = protect_from_forgery_call(node).first
-
-          add_offense(node) unless protect_from_forgery
+          if !argument.respond_to?(:value)
+            add_offense(node)
+          elsif argument.value == :none
+            add_offense(node)
+          end
         end
+
       end
     end
   end

data/lib/rubocop/cop/paraxial/csrf_skip.rb

@@ -0,0 +1,28 @@
+module RuboCop
+  module Cop
+    module Paraxial
+      class SkipAuthenticityToken < Base
+
+        MSG = "CSRF, skip_before_action :verify_authenticity_token in controller."
+
+        def on_send(node)
+          # Ensure that the cop only applies to controller files
+          return unless in_controller_file?
+
+          # Check if the node is `skip_before_action :verify_authenticity_token`
+          return unless node.method_name == :skip_before_action
+          return unless node.arguments.any? { |arg| arg.respond_to?(:value) && arg.value == :verify_authenticity_token }
+
+          add_offense(node)
+        end
+
+        private
+
+        def in_controller_file?
+          # Check the current file path to ensure it's a controller file
+          processed_source.file_path.include?('app/controllers')
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paraxial
 version: !ruby/object:Gem::Version
-  version: 1.4.2
+  version: 1.4.4
 platform: ruby
 authors:
 - Michael Lubas
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-01-14 00:00:00.000000000 Z
+date: 2025-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -104,6 +104,7 @@ files:
 - lib/paraxial/version.rb
 - lib/rubocop/cop/paraxial/constantize.rb
 - lib/rubocop/cop/paraxial/csrf.rb
+- lib/rubocop/cop/paraxial/csrf_skip.rb
 - lib/rubocop/cop/paraxial/html_safe.rb
 - lib/rubocop/cop/paraxial/raw.rb
 - lib/rubocop/cop/paraxial/send.rb