railroader 4.3.4

data/lib/railroader/checks/check_weak_hash.rb

@@ -0,0 +1,148 @@
+require 'railroader/checks/base_check'
+
+class Railroader::CheckWeakHash < Railroader::BaseCheck
+  Railroader::Checks.add_optional self
+
+  @description = "Checks for use of weak hashes like MD5"
+
+  DIGEST_CALLS = [:base64digest, :digest, :hexdigest, :new]
+
+  def run_check
+    tracker.find_call(:targets => [:'Digest::MD5', :'Digest::SHA1', :'OpenSSL::Digest::MD5', :'OpenSSL::Digest::SHA1'], :nested => true).each do |result|
+      process_hash_result result
+    end
+
+    tracker.find_call(:target => :'Digest::HMAC', :methods => [:new, :hexdigest], :nested => true).each do |result|
+      process_hmac_result result
+    end
+
+    tracker.find_call(:targets => [:'OpenSSL::Digest::Digest', :'OpenSSL::Digest'], :method => :new).each do |result|
+      process_openssl_result result
+    end
+  end
+
+  def process_hash_result result
+    return unless original? result
+
+    input = nil
+    call = result[:call]
+
+    if DIGEST_CALLS.include? call.method
+      if input = user_input_as_arg?(call)
+        confidence = :high
+      elsif input = hashing_password?(call)
+        confidence = :high
+      else
+        confidence = :medium
+      end
+    else
+      confidence = :medium
+    end
+
+
+    alg = case call.target.last
+          when :MD5
+           " (MD5)"
+           when :SHA1
+            " (SHA1)"
+          else
+            ""
+          end
+
+    warn :result => result,
+      :warning_type => "Weak Hash",
+      :warning_code => :weak_hash_digest,
+      :message => "Weak hashing algorithm#{alg} used",
+      :confidence => confidence,
+      :user_input => input
+  end
+
+  def process_hmac_result result
+    return unless original? result
+
+    call = result[:call]
+
+    alg = case call.third_arg.last
+           when :MD5
+             'MD5'
+           when :SHA1
+             'SHA1'
+           else
+             return
+           end
+
+    warn :result => result,
+      :warning_type => "Weak Hash",
+      :warning_code => :weak_hash_hmac,
+      :message => "Weak hashing algorithm (#{alg}) used in HMAC",
+      :confidence => :medium
+  end
+
+  def process_openssl_result result
+    return unless original? result
+
+    arg = result[:call].first_arg
+
+    if string? arg
+      alg = arg.value.upcase
+
+      if alg == 'MD5' or alg == 'SHA1'
+        warn :result => result,
+          :warning_type => "Weak Hash",
+          :warning_code => :weak_hash_digest,
+          :message => "Weak hashing algorithm (#{alg}) used",
+          :confidence => :medium
+      end
+    end
+  end
+
+  def user_input_as_arg? call
+    call.each_arg do |arg|
+      if input = include_user_input?(arg)
+        return input
+      end
+    end
+
+    nil
+  end
+
+  def hashing_password? call
+    call.each_arg do |arg|
+      @has_password = false
+
+      process arg
+
+      if @has_password
+        return @has_password
+      end
+    end
+
+    nil
+  end
+
+  def process_call exp
+    if exp.method == :password
+      @has_password = exp
+    else
+      process_default exp
+    end
+
+    exp
+  end
+
+  def process_ivar exp
+    if exp.value == :@password
+      @has_password = exp
+    end
+
+    exp
+  end
+
+  def process_lvar exp
+    if exp.value == :password
+      @has_password = exp
+    end
+
+    exp
+  end
+end

data/lib/railroader/checks/check_without_protection.rb

@@ -0,0 +1,80 @@
+require 'railroader/checks/base_check'
+
+#Check for bypassing mass assignment protection
+#with without_protection => true
+#
+#Only for Rails 3.1
+class Railroader::CheckWithoutProtection < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Check for mass assignment using without_protection"
+
+  def run_check
+    if version_between? "0.0.0", "3.0.99"
+      return
+    end
+
+    return if active_record_models.empty?
+
+    Railroader.debug "Finding all mass assignments"
+    calls = tracker.find_call :targets => active_record_models.keys, :methods => [:new,
+      :attributes=, 
+      :update_attributes, 
+      :update_attributes!,
+      :create,
+      :create!]
+
+    Railroader.debug "Processing all mass assignments"
+    calls.each do |result|
+      process_result result
+    end
+  end
+
+  #All results should be Model.new(...) or Model.attributes=() calls
+  def process_result res
+    call = res[:call]
+    last_arg = call.last_arg
+
+    if hash? last_arg and not call.original_line and not duplicate? res
+
+      if value = hash_access(last_arg, :without_protection)
+        if true? value
+          add_result res
+
+          if input = include_user_input?(call.arglist)
+            confidence = :high
+          elsif all_literals? call
+            return
+          else
+            confidence = :medium
+          end
+
+          warn :result => res, 
+            :warning_type => "Mass Assignment", 
+            :warning_code => :mass_assign_without_protection,
+            :message => "Unprotected mass assignment",
+            :code => call, 
+            :user_input => input,
+            :confidence => confidence
+
+        end
+      end
+    end
+  end
+
+  def all_literals? call
+    call.each_arg do |arg|
+      if hash? arg
+        hash_iterate arg do |k, v|
+          unless node_type? k, :str, :lit, :false, :true and node_type? v, :str, :lit, :false, :true
+            return false
+          end
+        end
+      else
+        return false
+      end
+    end
+
+    true
+  end
+end

data/lib/railroader/checks/check_xml_dos.rb

@@ -0,0 +1,45 @@
+require 'railroader/checks/base_check'
+
+class Railroader::CheckXMLDoS < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Checks for XML denial of service (CVE-2015-3227)"
+
+  def run_check
+    version = rails_version
+
+    fix_version = case
+                  when version_between?("2.0.0", "3.2.21")
+                    "3.2.22"
+                  when version_between?("4.1.0", "4.1.10")
+                    "4.1.11"
+                  when version_between?("4.2.0", "4.2.1")
+                    "4.2.2"
+                  when version_between?("4.0.0", "4.0.99")
+                    "4.2.2"
+                  else
+                    return
+                  end
+
+    return if has_workaround?
+
+    message = "Rails #{version} is vulnerable to denial of service via XML parsing (CVE-2015-3227). Upgrade to Rails version #{fix_version}"
+
+    warn :warning_type => "Denial of Service",
+      :warning_code => :CVE_2015_3227,
+      :message => message,
+      :confidence => :medium,
+      :gem_info => gemfile_or_environment,
+      :link_path => "https://groups.google.com/d/msg/rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J"
+  end
+
+  def has_workaround?
+    tracker.check_initializers(:"ActiveSupport::XmlMini", :backend=).any? do |match|
+      arg = match.call.first_arg
+      if string? arg
+        value = arg.value
+        value == 'Nokogiri' or value == 'LibXML'
+      end
+    end
+  end
+end

data/lib/railroader/checks/check_yaml_parsing.rb

@@ -0,0 +1,121 @@
+require 'railroader/checks/base_check'
+
+class Railroader::CheckYAMLParsing < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Checks for YAML parsing vulnerabilities (CVE-2013-0156)"
+
+  def run_check
+    return unless version_between? "0.0.0", "2.3.14" or
+                  version_between? "3.0.0", "3.0.18" or
+                  version_between? "3.1.0", "3.1.9" or
+                  version_between? "3.2.0", "3.2.10"
+
+    unless disabled_xml_parser? or disabled_xml_dangerous_types?
+      new_version = if version_between? "0.0.0", "2.3.14"
+                      "2.3.15"
+                    elsif version_between? "3.0.0", "3.0.18"
+                      "3.0.19"
+                    elsif version_between? "3.1.0", "3.1.9"
+                      "3.1.10"
+                    elsif version_between? "3.2.0", "3.2.10"
+                      "3.2.11"
+                    end
+
+      message = "Rails #{rails_version} has a remote code execution vulnerability: upgrade to #{new_version} or disable XML parsing"
+
+      warn :warning_type => "Remote Code Execution",
+        :warning_code => :CVE_2013_0156,
+        :message => message,
+        :confidence => :high,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/61bkgvnSGTQ/discussion"
+    end
+
+    #Warn if app accepts YAML
+    if version_between?("0.0.0", "2.3.14") and enabled_yaml_parser?
+      message = "Parsing YAML request parameters enables remote code execution: disable YAML parser"
+
+      warn :warning_type => "Remote Code Execution",
+        :warning_code => :CVE_2013_0156,
+        :message => message,
+        :confidence => :high,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/61bkgvnSGTQ/discussion"
+    end
+  end
+
+  def disabled_xml_parser?
+    if version_between? "0.0.0", "2.3.14"
+      #Look for ActionController::Base.param_parsers.delete(Mime::XML)
+      params_parser = s(:call,
+                        s(:colon2, s(:const, :ActionController), :Base),
+                        :param_parsers)
+
+      matches = tracker.check_initializers(params_parser, :delete)
+    else
+      #Look for ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::XML)
+      matches = tracker.check_initializers(:"ActionDispatch::ParamsParser::DEFAULT_PARSERS", :delete)
+    end
+
+    unless matches.empty?
+      mime_xml = s(:colon2, s(:const, :Mime), :XML)
+
+      matches.each do |result|
+        if result.call.first_arg == mime_xml
+          return true
+        end
+      end
+    end
+
+    false
+  end
+
+  #Look for ActionController::Base.param_parsers[Mime::YAML] = :yaml
+  #in Rails 2.x apps
+  def enabled_yaml_parser?
+    param_parsers = s(:call,
+                      s(:colon2, s(:const, :ActionController), :Base),
+                      :param_parsers)
+
+    matches = tracker.check_initializers(param_parsers, :[]=)
+
+    mime_yaml = s(:colon2, s(:const, :Mime), :YAML)
+
+    matches.each do |result|
+      if result.call.first_arg == mime_yaml and
+        symbol? result.call.second_arg and
+        result.call.second_arg.value == :yaml
+
+        return true
+      end
+    end
+
+    false
+  end
+
+  def disabled_xml_dangerous_types?
+    if version_between? "0.0.0", "2.3.14"
+      matches = tracker.check_initializers(:"ActiveSupport::CoreExtensions::Hash::Conversions::XML_PARSING", :delete)
+    else
+      matches = tracker.check_initializers(:"ActiveSupport::XmlMini::PARSING", :delete)
+    end
+
+    symbols_off = false
+    yaml_off = false
+
+    matches.each do |result|
+      arg = result.call.first_arg
+
+      if string? arg
+        if arg.value == "yaml"
+          yaml_off = true
+        elsif arg.value == "symbol"
+          symbols_off = true
+        end
+      end
+    end
+
+    symbols_off and yaml_off
+  end
+end

data/lib/railroader/checks.rb

@@ -0,0 +1,209 @@
+require 'thread'
+require 'railroader/differ'
+
+#Collects up results from running different checks.
+#
+#Checks can be added with +Check.add(check_class)+
+#
+#All .rb files in checks/ will be loaded.
+class Railroader::Checks
+  @checks = []
+  @optional_checks = []
+
+  attr_reader :warnings, :controller_warnings, :model_warnings, :template_warnings, :checks_run
+
+  #Add a check. This will call +_klass_.new+ when running tests
+  def self.add klass
+    @checks << klass unless @checks.include? klass
+  end
+
+  #Add an optional check
+  def self.add_optional klass
+    @optional_checks << klass unless @checks.include? klass
+  end
+
+  def self.checks
+    @checks + @optional_checks
+  end
+
+  def self.optional_checks
+    @optional_checks
+  end
+
+  def self.initialize_checks check_directory = ""
+    #Load all files in check_directory
+    Dir.glob(File.join(check_directory, "*.rb")).sort.each do |f|
+      require f
+    end
+  end
+
+  def self.missing_checks included_checks, excluded_checks
+    included_checks = included_checks.map(&:to_s).to_set
+    excluded_checks = excluded_checks.map(&:to_s).to_set
+
+    if included_checks == Set['CheckNone']
+      return []
+    else
+      loaded = self.checks.map { |name| name.to_s.gsub('Railroader::', '') }.to_set
+      missing = (included_checks - loaded) + (excluded_checks - loaded)
+
+      unless missing.empty?
+        return missing
+      end
+    end
+
+    []
+  end
+
+  #No need to use this directly.
+  def initialize options = { }
+    if options[:min_confidence]
+      @min_confidence = options[:min_confidence]
+    else
+      @min_confidence = Railroader.get_defaults[:min_confidence]
+    end
+
+    @warnings = []
+    @template_warnings = []
+    @model_warnings = []
+    @controller_warnings = []
+    @checks_run = []
+  end
+
+  #Add Warning to list of warnings to report.
+  #Warnings are split into four different arrays
+  #for template, controller, model, and generic warnings.
+  #
+  #Will not add warnings which are below the minimum confidence level.
+  def add_warning warning
+    unless warning.confidence > @min_confidence
+      case warning.warning_set
+      when :template
+        @template_warnings << warning
+      when :warning
+        @warnings << warning
+      when :controller
+        @controller_warnings << warning
+      when :model
+        @model_warnings << warning
+      else
+        raise "Unknown warning: #{warning.warning_set}"
+      end
+    end
+  end
+
+  #Return a hash of arrays of new and fixed warnings
+  #
+  #    diff = checks.diff old_checks
+  #    diff[:fixed]  # [...]
+  #    diff[:new]    # [...]
+  def diff other_checks
+    my_warnings = self.all_warnings
+    other_warnings = other_checks.all_warnings
+    Railroader::Differ.new(my_warnings, other_warnings).diff
+  end
+
+  #Return an array of all warnings found.
+  def all_warnings
+    @warnings + @template_warnings + @controller_warnings + @model_warnings
+  end
+
+  #Run all the checks on the given Tracker.
+  #Returns a new instance of Checks with the results.
+  def self.run_checks(app_tree, tracker)
+    checks = self.checks_to_run(tracker)
+    check_runner = self.new :min_confidence => tracker.options[:min_confidence]
+    self.actually_run_checks(checks, check_runner, app_tree, tracker)
+  end
+
+  def self.actually_run_checks(checks, check_runner, app_tree, tracker)
+    threads = [] # Results for parallel
+    results = [] # Results for sequential
+    parallel = tracker.options[:parallel_checks]
+    error_mutex = Mutex.new
+
+    checks.each do |c|
+      check_name = get_check_name c
+      Railroader.notify " - #{check_name}"
+
+      if parallel
+        threads << Thread.new do
+          self.run_a_check(c, error_mutex, app_tree, tracker)
+        end
+      else
+        results << self.run_a_check(c, error_mutex, app_tree, tracker)
+      end
+
+      #Maintain list of which checks were run
+      #mainly for reporting purposes
+      check_runner.checks_run << check_name[5..-1]
+    end
+
+    threads.each { |t| t.join }
+
+    Railroader.notify "Checks finished, collecting results..."
+
+    if parallel
+      threads.each do |thread|
+        thread.value.each do |warning|
+          check_runner.add_warning warning
+        end
+      end
+    else
+      results.each do |warnings|
+        warnings.each do |warning|
+          check_runner.add_warning warning
+        end
+      end
+    end
+
+    check_runner
+  end
+
+  private
+
+  def self.get_check_name check_class
+    check_class.to_s.split("::").last
+  end
+
+  def self.checks_to_run tracker
+    to_run = if tracker.options[:run_all_checks] or tracker.options[:run_checks]
+               @checks + @optional_checks
+             else
+               @checks
+             end
+
+    self.filter_checks to_run, tracker
+  end
+
+  def self.filter_checks checks, tracker
+    skipped = tracker.options[:skip_checks]
+    explicit = tracker.options[:run_checks]
+
+    checks.reject do |c|
+      check_name = self.get_check_name(c)
+
+      skipped.include? check_name or
+        (explicit and not explicit.include? check_name)
+    end
+  end
+
+  def self.run_a_check klass, mutex, app_tree, tracker
+    check = klass.new(app_tree, tracker)
+
+    begin
+      check.run_check
+    rescue => e
+      mutex.synchronize do
+        tracker.error e
+      end
+    end
+
+    check.warnings
+  end
+end
+
+#Load all files in checks/ directory
+Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/checks/*.rb").sort.each do |f|
+  require f.match(/(railroader\/checks\/.*)\.rb$/)[0]
+end

data/lib/railroader/codeclimate/engine_configuration.rb

@@ -0,0 +1,97 @@
+require 'pathname'
+
+module Railroader
+  module Codeclimate
+    class EngineConfiguration
+
+      def initialize(engine_config = {})
+        @engine_config = engine_config
+      end
+
+      def options
+        default_options.merge(configured_options)
+      end
+
+      private
+
+      attr_reader :engine_config
+
+      def default_options
+        @default_options = {
+          :output_format => :codeclimate,
+          :quiet => true,
+          :pager => false,
+          :app_path => Dir.pwd
+        }
+        if system("test -w /dev/stdout")
+          @default_options[:output_files] = ["/dev/stdout"]
+        end
+        @default_options
+      end
+
+      def configured_options
+        @configured_options = {}
+        # ATM this gets parsed as a string instead of bool: "config":{ "debug":"true" }
+        if railroader_configuration["debug"] && railroader_configuration["debug"].to_s.downcase == "true"
+          @configured_options[:debug] = true
+          @configured_options[:report_progress] = false
+        end
+
+        if active_include_paths
+          @configured_options[:only_files] = active_include_paths
+        end
+
+        if railroader_configuration["app_path"]
+          @configured_options[:path_prefix] = railroader_configuration["app_path"]
+          path = Pathname.new(Dir.pwd) + railroader_configuration["app_path"]
+          @configured_options[:app_path] = path.to_s
+        end
+        @configured_options
+      end
+
+      def railroader_configuration
+        if engine_config["config"]
+          engine_config["config"]
+        else
+          {}
+        end
+      end
+
+      def active_include_paths
+        @active_include_paths ||=
+          if railroader_configuration["app_path"]
+            stripped_include_paths(railroader_configuration["app_path"])
+          else
+            engine_config["include_paths"] && engine_config["include_paths"].compact
+          end
+      end
+
+      def stripped_include_paths(prefix)
+        subprefixes = path_subprefixes(prefix)
+        engine_config["include_paths"] && engine_config["include_paths"].map do |path|
+          next unless path
+          stripped_include_path(prefix, subprefixes, path)
+        end.compact
+      end
+
+      def path_subprefixes(path)
+        Pathname.new(path).each_filename.inject([]) do |memo, piece|
+         memo <<
+           if memo.any?
+             File.join(memo.last, piece)
+           else
+             File.join(piece)
+           end
+        end
+      end
+
+      def stripped_include_path(prefix, subprefixes, path)
+        if path.start_with?(prefix)
+          path.sub(%r{^#{prefix}/?}, "/")
+        elsif subprefixes.any? { |subprefix| path =~ %r{^#{subprefix}/?$} }
+          "/"
+        end
+      end
+    end
+  end
+end