railroader 4.3.4

data/lib/railroader/commandline.rb

@@ -0,0 +1,179 @@
+require 'railroader/options'
+
+module Railroader
+
+  # Implements handling of running Railroader from the command line.
+  class Commandline
+    class << self
+
+      # Main method to run Railroader from the command line.
+      #
+      # If no options are provided, ARGV will be parsed and used instead.
+      # Otherwise, the options are expected to be a Hash like the one returned
+      # after ARGV is parsed.
+      def start options = nil, app_path = "."
+
+        unless options
+          options, app_path = parse_options ARGV
+        end
+
+        run options, app_path
+      end
+
+      # Runs everything:
+      #
+      # - `set_interrupt_handler`
+      # - `early_exit_options`
+      # - `set_options`
+      # - `check_latest`
+      # - `run_report`
+      def run options, default_app_path = "."
+        set_interrupt_handler options
+        early_exit_options options
+        set_options options, default_app_path
+        check_latest if options[:ensure_latest]
+        run_report options
+      end
+
+      # Check for the latest version.
+      #
+      # If the latest version is newer, quit with a message.
+      def check_latest
+        if error = Railroader.ensure_latest
+          quit Railroader::Not_Latest_Version_Exit_Code, error
+        end
+      end
+
+      # Runs a comparison report based on the options provided.
+      def compare_results options
+        require 'json'
+        vulns = Railroader.compare options.merge(:quiet => options[:quiet])
+
+        if options[:comparison_output_file]
+          File.open options[:comparison_output_file], "w" do |f|
+            f.puts JSON.pretty_generate(vulns)
+          end
+
+          Railroader.notify "Comparison saved in '#{options[:comparison_output_file]}'"
+        else
+          puts JSON.pretty_generate(vulns)
+        end
+
+        if options[:exit_on_warn] && vulns[:new].count > 0
+          quit Railroader::Warnings_Found_Exit_Code
+        end
+      end
+
+      # Handle options that exit without generating a report.
+      def early_exit_options options
+        if options[:list_checks] or options[:list_optional_checks]
+          Railroader.list_checks options
+          quit
+        elsif options[:create_config]
+          Railroader.dump_config options
+          quit
+        elsif options[:show_help]
+          puts Railroader::Options.create_option_parser({})
+          quit
+        elsif options[:show_version]
+          require 'railroader/version'
+          puts "railroader #{Railroader::Version}"
+          quit
+        end
+      end
+
+      # Parse ARGV-style array of options.
+      #
+      # Exits if options are invalid.
+      #
+      # Returns an option hash and the app_path.
+      def parse_options argv
+        begin
+          options, _ = Railroader::Options.parse! argv
+        rescue OptionParser::ParseError => e
+          $stderr.puts e.message
+          $stderr.puts "Please see `railroader --help` for valid options"
+          quit(-1)
+        end
+
+        if argv[-1]
+          app_path = argv[-1]
+        else
+          app_path = "."
+        end
+
+        return options, app_path
+      end
+
+      # Exits with the given exit code and prints out the message, if given.
+      #
+      # Override this method for different behavior.
+      def quit exit_code = 0, message = nil
+        warn message if message
+        exit exit_code
+      end
+
+      # Runs a regular report based on the options provided.
+      def regular_report options
+        tracker = run_railroader options 
+
+        if tracker.options[:exit_on_warn] and not tracker.filtered_warnings.empty?
+          quit Railroader::Warnings_Found_Exit_Code
+        end
+
+        if tracker.options[:exit_on_error] and tracker.errors.any?
+          quit Railroader::Errors_Found_Exit_Code
+        end
+      end
+
+      # Actually run Railroader.
+      #
+      # Returns a Tracker object.
+      def run_railroader options
+        Railroader.run options.merge(:print_report => true, :quiet => options[:quiet])
+      end
+
+      # Run either a comparison or regular report based on options provided.
+      def run_report options
+        begin
+          if options[:previous_results_json]
+            compare_results options
+          else
+            regular_report options
+          end
+        rescue Railroader::NoApplication => e
+          quit Railroader::No_App_Found_Exit_Code, e.message
+        rescue Railroader::MissingChecksError => e
+          quit Railroader::Missing_Checks_Exit_Code, e.message
+        end
+      end
+
+      # Sets interrupt handler to gracefully handle Ctrl+C
+      def set_interrupt_handler options
+        trap("INT") do
+          warn "\nInterrupted - exiting."
+
+          if options[:debug]
+            warn caller
+          end
+
+          exit!
+        end
+      end
+
+      # Modifies options, including setting the app_path
+      # if none is given in the options hash.
+      def set_options options, default_app_path = "."
+        unless options[:app_path]
+          options[:app_path] = default_app_path
+        end
+
+        if options[:quiet].nil?
+          options[:quiet] = :command_line
+        end
+
+        options
+      end
+    end
+  end
+end

data/lib/railroader/differ.rb

@@ -0,0 +1,66 @@
+# extracting the diff logic to it's own class for consistency. Currently handles
+# an array of Railroader::Warnings or plain hash representations.  
+class Railroader::Differ
+  DEFAULT_HASH = {:new => [], :fixed => []}
+  OLD_WARNING_KEYS = [:warning_type, :location, :code, :message, :file, :link, :confidence, :user_input]
+  attr_reader :old_warnings, :new_warnings
+
+  def initialize new_warnings, old_warnings
+    @new_warnings = new_warnings
+    @old_warnings = old_warnings
+  end
+
+  def diff
+    # get the type of elements
+    return DEFAULT_HASH if @new_warnings.empty?
+
+    warnings = {}
+    warnings[:new] = @new_warnings - @old_warnings
+    warnings[:fixed] = @old_warnings - @new_warnings
+
+    second_pass(warnings)
+  end
+
+  # second pass to cleanup any vulns which have changed in line number only.
+  # Given a list of new warnings, delete pairs of new/fixed vulns that differ
+  # only by line number.
+  # Horrible O(n^2) performance.  Keep n small :-/
+  def second_pass(warnings)
+    # keep track of the number of elements deleted because the index numbers
+    # won't update as the list is modified
+    elements_deleted_offset = 0
+
+    # dup this list since we will be deleting from it and the iterator gets confused.
+    # use _with_index for fast deletion as opposed to .reject!{|obj| obj == *_warning}
+    warnings[:new].dup.each_with_index do |new_warning, new_warning_id|
+      warnings[:fixed].each_with_index do |fixed_warning, fixed_warning_id|
+        if eql_except_line_number new_warning, fixed_warning
+          warnings[:new].delete_at(new_warning_id - elements_deleted_offset)
+          elements_deleted_offset += 1
+          warnings[:fixed].delete_at(fixed_warning_id)
+          break
+        end
+      end
+    end
+
+    warnings
+  end
+
+  def eql_except_line_number new_warning, fixed_warning
+    # can't do this ahead of time, as callers may be expecting a Railroader::Warning
+    if new_warning.is_a? Railroader::Warning 
+      new_warning = new_warning.to_hash
+      fixed_warning = fixed_warning.to_hash
+    end
+
+    if new_warning[:fingerprint] and fixed_warning[:fingerprint]
+      new_warning[:fingerprint] == fixed_warning[:fingerprint]
+    else
+     OLD_WARNING_KEYS.each do |attr|
+        return false if new_warning[attr] != fixed_warning[attr]
+      end
+
+      true
+    end
+  end
+end

data/lib/railroader/file_parser.rb

@@ -0,0 +1,54 @@
+module Railroader
+  ASTFile = Struct.new(:path, :ast)
+
+  # This class handles reading and parsing files.
+  class FileParser
+    attr_reader :file_list
+
+    def initialize tracker, app_tree
+      @tracker = tracker
+      @timeout = @tracker.options[:parser_timeout]
+      @app_tree = app_tree
+      @file_list = {}
+    end
+
+    def parse_files list, type
+      read_files list, type do |path, contents|
+        if ast = parse_ruby(contents, path)
+          ASTFile.new(path, ast)
+        end
+      end
+    end
+
+    def read_files list, type
+      @file_list[type] ||= []
+
+      list.each do |path|
+        result = yield path, read_path(path)
+        if result
+          @file_list[type] << result
+        end
+      end
+    end
+
+    def parse_ruby input, path
+      begin
+        Railroader.debug "Parsing #{path}"
+        RubyParser.new.parse input, path, @timeout
+      rescue Racc::ParseError => e
+        @tracker.error e, "Could not parse #{path}"
+        nil
+      rescue Timeout::Error => e
+        @tracker.error Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout"), caller
+        nil
+      rescue => e
+        @tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
+        nil
+      end
+    end
+
+    def read_path path
+      @app_tree.read_path path
+    end
+  end
+end

data/lib/railroader/format/style.css

@@ -0,0 +1,133 @@
+/* CSS style used for HTML reports */
+
+body {
+  font-family: sans-serif;
+  color: #161616;
+}
+
+a {
+  color: #161616;
+}
+
+p {
+  font-weight: bold;
+  font-size: 11pt;
+  color: #2D0200;
+ }
+
+ th {
+   background-color: #980905;
+   border-bottom: 5px solid #530200;
+   color: white;
+   font-size: 11pt;
+   padding: 1px 8px 1px 8px;
+ }
+
+ td {
+   border-bottom: 2px solid white;
+   font-family: monospace;
+   padding: 5px 8px 1px 8px;
+ }
+
+ table {
+   background-color: #FCF4D4;
+   border-collapse: collapse;
+ }
+
+ h1 {
+   color: #2D0200;
+   font-size: 14pt;
+ }
+
+ h2 {
+   color: #2D0200;
+   font-size: 12pt;
+ }
+
+ span.high-confidence {
+   font-weight:bold;
+   color: red;
+ }
+
+ span.med-confidence {
+ }
+
+ span.weak-confidence {
+   color:gray;
+ }
+
+ div.warning_message {
+   cursor: pointer;
+ }
+
+ div.warning_message:hover {
+   background-color: white;
+ }
+
+ table caption {
+   background-color: #FFE;
+   padding: 2px;
+ }
+
+ table.context {
+   margin-top: 5px;
+   margin-bottom: 5px;
+   border-left: 1px solid #90e960;
+   color: #212121;
+ }
+
+ tr.context {
+   background-color: white;
+ }
+
+ tr.first {
+   border-top: 1px solid #7ecc54;
+   padding-top: 2px;
+ }
+
+ tr.error {
+  background-color: #f4c1c1 !important
+ }
+
+ tr.near_error {
+  background-color: #f4d4d4 !important
+ }
+
+ tr.alt {
+   background-color: #e8f4d4;
+ }
+
+ td.context {
+   padding: 2px 10px 0px 6px;
+   border-bottom: none;
+ }
+
+ td.context_line {
+   padding: 2px 8px 0px 7px;
+   border-right: 1px solid #b3bda4;
+   border-bottom: none;
+   color: #6e7465;
+ }
+
+ pre.context {
+   margin-bottom: 1px;
+ }
+
+ .user_input {
+   background-color: #fcecab;
+ }
+
+ div.render_path {
+   display: none;
+   background-color: #ffe;
+   padding: 5px;
+   margin: 2px 0px 2px 0px;
+ }
+
+ div.template_name {
+   cursor: pointer;
+ }
+
+ div.template_name:hover {
+   background-color: white;
+ }