paraxial 1.4.5 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e50a89bbe7acfcde6a930484e7b5677610c32b362fdd637065dfe83a87cdb63a
-  data.tar.gz: 1704c13f2d06ba9acab0e9ebd4ff26a5e0921bd399adb23e1b85ee9116e9e1ec
+  metadata.gz: f24195885218479f2c0b5f6c8963d3ecacdcfa8e59e60bcb731a75750a63c891
+  data.tar.gz: e178051703824267b31bd7945e060272c6eada4029a03a5f35294dad5e68848b
 SHA512:
-  metadata.gz: ab969b9f63404b14bfa56ac8460edbaf28d0ecc82a540035538140a45edf1ad19b27dd641c78bad1dff3f8c5d8822ac60f91a8f2d9d164324106a803c5c8271e
-  data.tar.gz: 4fb2cb21157c34ec9bda2946dcd4fe05aab39d47a33aeb831e8c09b774f5cce70bfce40d4394c680ac69955d25ad53495095db4d6474ab058d256c1fc5de3db4
+  metadata.gz: db01f4a55e4ae5425d2e3493bc7a374d2922a0f3aa54ac63a7d4b783bd01ad698b5d2818eff2429355484fdba2195410f325b0c8b67a6fb87e5a58175a9b145e
+  data.tar.gz: 7482ae35903800d6c5b2c5a54b5ff8223b4d311117d41375914eb5edad35d6b4e548777395fceac31479739ad4479c0c788000ceb286f57645d53c8a4fa7393d

data/lib/paraxial/cli.rb

@@ -79,6 +79,7 @@ module Paraxial
         else
           rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json #{rubo_config}`
         end
+        rubocop = Paraxial::Severities.annotate(rubocop)
         lockfile = File.read('./Gemfile.lock')
         api_key = ENV['PARAXIAL_API_KEY']
         uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_scan')

data/lib/paraxial/severities.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module Paraxial
+  # The severity a cop's findings are reported at. The cop that produces a
+  # finding is the source of truth for how bad it is, so a new cop is a line
+  # here rather than a change to the backend.
+  module Severities
+    DEFAULT = 'medium'
+
+    SEVERITIES = {
+      'Paraxial/CSRF' => 'medium',
+      'Paraxial/Constantize' => 'high',
+      'Paraxial/DynamicRegexp' => 'high',
+      'Paraxial/HTMLSafe' => 'high',
+      'Paraxial/Raw' => 'high',
+      'Paraxial/SQL' => 'critical',
+      'Paraxial/Send' => 'critical',
+      'Paraxial/SkipAuthenticityToken' => 'medium',
+      'Paraxial/System' => 'critical',
+      'Security/Eval' => 'critical',
+      'Security/IoMethods' => 'medium',
+      'Security/JSONLoad' => 'medium',
+      'Security/MarshalLoad' => 'critical',
+      'Security/Open' => 'critical',
+      'Security/YAMLLoad' => 'medium'
+    }.freeze
+
+    def self.for_cop(cop_name)
+      SEVERITIES.fetch(cop_name, DEFAULT)
+    end
+
+    # Adds the severity to every offense in rubocop's JSON output, so that a
+    # finding is stored with the severity of the cop that reported it.
+    def self.annotate(rubocop_json)
+      scan = JSON.parse(rubocop_json)
+      files = scan['files']
+      return rubocop_json unless files.is_a?(Array)
+
+      files.each do |file|
+        offenses = file['offenses']
+        next unless offenses.is_a?(Array)
+
+        offenses.each do |offense|
+          offense['paraxial_severity'] = for_cop(offense['cop_name'])
+        end
+      end
+
+      JSON.generate(scan)
+    rescue JSON::ParserError
+      # rubocop exited before it wrote any JSON. Upload what it did print and
+      # let the backend report the failure, as the agent did before.
+      rubocop_json
+    end
+  end
+end

data/lib/paraxial/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paraxial
-  VERSION = '1.4.5'
+  VERSION = '1.5.0'
 end

data/lib/paraxial.rb

@@ -11,6 +11,8 @@ require_relative 'rubocop/cop/paraxial/constantize'
 require_relative 'rubocop/cop/paraxial/html_safe'
 require_relative 'rubocop/cop/paraxial/raw'
 require_relative 'rubocop/cop/paraxial/sql'
+require_relative 'rubocop/cop/paraxial/dynamic_regexp'
+require_relative 'paraxial/severities'
 require_relative 'paraxial/version'
 require_relative 'paraxial/cli'
 

data/lib/rubocop/cop/paraxial/dynamic_regexp.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Paraxial
+      # This cop checks for regular expressions that are compiled from a
+      # pattern computed at runtime. Ruby's regexp engine has memory safety
+      # bugs (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and
+      # CVE-2026-110264) that are only reachable when the pattern itself comes
+      # from user input. Neither `Regexp.timeout` nor limiting the length of
+      # the pattern is a mitigation, the fix is Ruby 4.0.9, 3.4.12, or 3.3.13.
+      #
+      # `Regexp.escape` neutralizes the metacharacters these bugs are reached
+      # through, so a pattern that is fully escaped is not reported.
+      #
+      # @example
+      #   # bad
+      #   Regexp.new(params[:query])
+      #   Regexp.compile(search_term)
+      #   Regexp.union(params[:tags])
+      #
+      #   # good
+      #   Regexp.new('\A[a-z]+\z')
+      #   Regexp.new(QUERY_PATTERN, Regexp::IGNORECASE)
+      #   Regexp.new(Regexp.escape(params[:query]))
+      #
+      # @example EnforcedStyle: params (default)
+      #   # bad
+      #   /#{params[:query]}/
+      #
+      #   # good
+      #   # Interpolation of a value that is not read from the request.
+      #   /\A#{PREFIX}-#{name}\z/
+      #
+      # @example EnforcedStyle: all
+      #   # bad
+      #   /#{params[:query]}/
+      #   # Every interpolation is reported, including false positives.
+      #   /\A#{PREFIX}-#{name}\z/
+      #
+      #   # good
+      #   /\A#{PREFIX}-[a-z]+\z/
+      class DynamicRegexp < Base
+        MSG = 'Regexp compiled from user input causes memory corruption in the regexp engine.'
+
+        RESTRICT_ON_SEND = %i[new compile union].freeze
+
+        # @!method regexp_constructor?(node)
+        def_node_matcher :regexp_constructor?, <<~'PATTERN'
+          (send (const {nil? cbase} :Regexp) _ ...)
+        PATTERN
+
+        # @!method regexp_escape?(node)
+        def_node_matcher :regexp_escape?, <<~'PATTERN'
+          (send (const {nil? cbase} :Regexp) {:escape :quote} ...)
+        PATTERN
+
+        # @!method user_input?(node)
+        def_node_matcher :user_input?, '(send nil? {:params :request :cookies})'
+
+        # Regexp.new, Regexp.compile and Regexp.union build a pattern from
+        # their arguments, so a non literal argument is always reported.
+        def on_send(node)
+          return unless regexp_constructor?(node)
+          return if node.arguments.empty?
+          return if node.arguments.all? { |argument| developer_controlled?(argument) }
+
+          add_offense(node)
+        end
+
+        # A regexp literal is only reported for the parts it interpolates.
+        def on_regexp(node)
+          interpolations = node.children.select(&:begin_type?)
+          return if interpolations.empty?
+          return if interpolations.all? { |interpolation| allowed_interpolation?(interpolation) }
+
+          add_offense(node)
+        end
+
+        private
+
+        def allowed_interpolation?(node)
+          if style == :all
+            developer_controlled?(node)
+          else
+            developer_controlled?(node) || !reads_user_input?(node)
+          end
+        end
+
+        # A literal, a constant, or a pattern that has been escaped. Regexp
+        # literals are left to `on_regexp`, which reports the interpolation
+        # itself rather than the constructor it is passed to.
+        def developer_controlled?(node)
+          case node.type
+          when :str, :sym, :int, :float, :regexp, :const
+            true
+          when :dstr, :begin, :array, :splat
+            node.children.all? { |child| developer_controlled?(child) }
+          when :send
+            regexp_escape?(node)
+          else
+            false
+          end
+        end
+
+        def reads_user_input?(node)
+          user_input?(node) || node.each_descendant(:send).any? { |send_node| user_input?(send_node) }
+        end
+
+        # `ConfigurableEnforcedStyle` raises when the cop has no configuration,
+        # which is the common case for an app that only runs `paraxial scan`.
+        def style
+          cop_config['EnforcedStyle'].to_s == 'all' ? :all : :params
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: paraxial
 version: !ruby/object:Gem::Version
-  version: 1.4.5
+  version: 1.5.0
 platform: ruby
 authors:
 - Michael Lubas
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-01-22 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -80,7 +79,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
 email:
 - michael@paraxial.io
 executables:
@@ -101,10 +99,12 @@ files:
 - lib/paraxial/helpers.rb
 - lib/paraxial/initializers/marshal_patch.rb
 - lib/paraxial/initializers/startup.rb
+- lib/paraxial/severities.rb
 - lib/paraxial/version.rb
 - lib/rubocop/cop/paraxial/constantize.rb
 - lib/rubocop/cop/paraxial/csrf.rb
 - lib/rubocop/cop/paraxial/csrf_skip.rb
+- lib/rubocop/cop/paraxial/dynamic_regexp.rb
 - lib/rubocop/cop/paraxial/html_safe.rb
 - lib/rubocop/cop/paraxial/raw.rb
 - lib/rubocop/cop/paraxial/send.rb
@@ -119,7 +119,6 @@ metadata:
   homepage_uri: https://paraxial.io/
   source_code_uri: https://paraxial.io/
   changelog_uri: https://paraxial.io/
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -134,8 +133,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.23
-signing_key:
+rubygems_version: 4.0.21
 specification_version: 4
 summary: Paraxial.io Ruby Agent
 test_files: []