railroader 4.3.4

data/lib/railroader/processors/template_processor.rb

@@ -0,0 +1,85 @@
+require 'railroader/processors/base_processor'
+require 'railroader/tracker/template'
+
+#Base Processor for templates/views
+class Railroader::TemplateProcessor < Railroader::BaseProcessor
+
+  #Initializes template information.
+  def initialize tracker, template_name, called_from = nil, file_name = nil
+    super(tracker) 
+    @current_template = Railroader::Template.new template_name, called_from, file_name, tracker
+    @file_name = file_name
+
+    if called_from
+      template_name = (template_name.to_s + "." + called_from.to_s).to_sym
+    end
+
+    tracker.templates[template_name] = @current_template
+
+    @inside_concat = false
+  end
+
+  #Process the template Sexp.
+  def process exp
+    begin
+      super
+    rescue => e
+      except = e.exception("Error when processing #{@current_template.name}: #{e.message}")
+      except.set_backtrace(e.backtrace)
+      raise except
+    end
+  end
+
+  #Ignore initial variable assignment
+  def process_lasgn exp
+    if exp.lhs == :_erbout and exp.rhs.node_type == :str  #ignore
+      ignore
+    elsif exp.lhs == :_buf and exp.rhs.node_type == :str
+      ignore
+    else
+      exp.rhs = process exp.rhs
+      exp
+    end
+  end
+
+  #Adds output to the list of outputs.
+  def process_output exp
+    exp.value = process exp.value
+    @current_template.add_output exp unless exp.original_line
+    exp
+  end
+
+  def process_escaped_output exp
+    process_output exp
+  end
+
+  # Pull out actual output value from template
+  def normalize_output arg
+    if call? arg and [:to_s, :html_safe!, :freeze].include? arg.method
+      arg.target
+    elsif node_type? arg, :if
+      branches = [arg.then_clause, arg.else_clause].compact
+
+      if branches.empty?
+        s(:nil)
+      elsif branches.length == 2
+        Sexp.new(:or, *branches)
+      else
+        branches.first
+      end
+    else
+      arg
+    end
+  end
+
+  def add_escaped_output output
+    add_output output, :escaped_output
+  end
+
+  def add_output output, type = :output
+    s = Sexp.new(type, output)
+    s.line(output.line)
+    @current_template.add_output s
+    s
+  end
+end

data/lib/railroader/report/config/remediation.yml

@@ -0,0 +1,71 @@
+---
+basic_auth_password: 300000
+cross_site_scripting: 300000
+xss_content_tag: 300000
+CVE_2014_3514_call: 600000
+all_default_routes: 2000000
+unsafe_deserialize: 2000000
+local_request_config: 100000
+CVE_2012_3424: 4000000
+CVE_2011_2932: 8000000
+code_eval: 2000000
+command_injection: 2000000
+file_access: 2000000
+CVE_2014_7829: 4000000
+CVE_2011_2929: 4000000
+csrf_protection_disabled: 4000000
+CVE_2013_6414: 4000000
+CVE_2013_4491: 4000000
+CVE_2013_1856: 4000000
+CVE_2015_3226: 4000000
+CVE_2013_0333: 4000000
+xss_link_to: 300000
+xss_link_to_href: 300000
+CVE_2011_0446: 300000
+mass_assign_call: 2000000
+dangerous_attr_accessible: 2000000
+no_attr_accessible: 2000000
+CVE_2013_0277: 2000000
+CVE_2010_3933: 4000000
+CVE_2014_0081: 300000
+CVE_2011_2930: 600000
+open_redirect: 300000
+regex_dos: 600000
+dynamic_render_path: 4000000
+CVE_2014_0082: 4000000
+cross_site_scripting_inline: 600000
+CVE_2011_3186: 2000000
+safe_buffer_vuln: 4000000
+CVE_2013_1855: 4000000
+CVE_2013_1857: 4000000
+CVE_2012_3463: 600000
+select_options_vuln: 4000000
+dangerous_send: 600000
+session_key_manipulation: 600000
+http_cookies: 600000
+session_secret: 600000
+secure_cookies: 600000
+CVE_2013_6416: 600000
+CVE_2012_3464: 4000000
+csrf_blacklist: 300000
+auth_blacklist: 300000
+sql_injection: 1200000
+CVE-2012-2660: 4000000
+CVE-2012-2661: 4000000
+CVE-2012-2695: 4000000
+CVE-2012-5664: 4000000
+CVE-2013-0155: 4000000
+CVE-2013-6417: 4000000
+CVE-2014-3482: 4000000
+CVE-2014-3483: 4000000
+ssl_verification_bypass: 2500000
+CVE_2011_2931: 4000000
+unsafe_symbol_creation: 300000
+translate_vuln: 300000
+unsafe_constantize: 600000
+unscoped_find: 300000
+validation_regex: 300000
+mass_assign_without_protection: 600000
+CVE_2015_3227: 4000000
+CVE_2013_0156: 4000000
+weak_hash_digest: 800000

data/lib/railroader/report/ignore/config.rb

@@ -0,0 +1,153 @@
+require 'set'
+require 'json'
+
+module Railroader
+  class IgnoreConfig
+    attr_reader :shown_warnings, :ignored_warnings
+    attr_accessor :file
+
+    def initialize file, new_warnings
+      @file = file
+      @new_warnings = new_warnings
+      @already_ignored = []
+      @ignored_fingerprints = Set.new
+      @used_fingerprints = Set.new
+      @notes = {}
+      @shown_warnings = @ignored_warnings = nil
+      @changed = false
+    end
+
+    # Populate ignored_warnings and shown_warnings based on ignore
+    # configuration
+    def filter_ignored
+      @shown_warnings = []
+      @ignored_warnings = []
+
+      @new_warnings.each do |w|
+        if ignored? w
+          @ignored_warnings << w
+        else
+          @shown_warnings << w
+        end
+      end
+
+      @shown_warnings
+    end
+
+    # Remove warning from ignored list
+    def unignore warning
+      @ignored_fingerprints.delete warning.fingerprint
+      if @already_ignored.reject! { |w|w[:fingerprint] == warning.fingerprint }
+        @changed = true
+      end
+    end
+
+    # Determine if warning should be ignored
+    def ignored? warning
+      @used_fingerprints << warning.fingerprint
+      @ignored_fingerprints.include? warning.fingerprint
+    end
+
+    def ignore warning
+      @changed = true unless ignored? warning
+      @ignored_fingerprints << warning.fingerprint
+    end
+
+    # Add note for warning
+    def add_note warning, note
+      @changed = true
+      @notes[warning.fingerprint] = note
+    end
+
+    # Retrieve note for warning if it exists. Returns nil if no
+    # note is found
+    def note_for warning
+      if warning.is_a? Warning
+        fingerprint = warning.fingerprint
+      else
+        fingerprint = warning[:fingerprint]
+      end
+
+      @already_ignored.each do |w|
+        if fingerprint == w[:fingerprint]
+          return w[:note]
+        end
+      end
+
+      nil
+    end
+
+    # The set of unused ignore entries
+    def obsolete_fingerprints
+      (@ignored_fingerprints - @used_fingerprints).to_a
+    end
+
+    def prune_obsolete
+      obsolete = obsolete_fingerprints.to_set
+      @ignored_fingerprints -= obsolete
+
+      @already_ignored.reject! do |w|
+        if obsolete.include? w[:fingerprint]
+          @changed = true
+        end
+      end
+    end
+
+    # Read configuration to file
+    def read_from_file file = @file
+      if File.exist? file
+        @already_ignored = JSON.parse(File.read(file), :symbolize_names => true)[:ignored_warnings]
+      else
+        Railroader.notify "[Notice] Could not find ignore configuration in #{file}"
+        @already_ignored = []
+      end
+
+      @already_ignored.each do |w|
+        @ignored_fingerprints << w[:fingerprint]
+        @notes[w[:fingerprint]] = w[:note]
+      end
+    end
+
+    # Save configuration to file
+    def save_to_file warnings, file = @file
+      warnings = warnings.map do |w|
+        if w.is_a? Warning
+          w_hash = w.to_hash
+          w_hash[:file] = w.relative_path
+          w = w_hash
+        end
+
+        w[:note] = @notes[w[:fingerprint]] || ""
+        w
+      end.sort_by { |w| w[:fingerprint] }
+
+      output = {
+        :ignored_warnings => warnings,
+        :updated => Time.now.to_s,
+        :railroader_version => Railroader::Version
+      }
+
+      File.open file, "w" do |f|
+        f.puts JSON.pretty_generate(output)
+      end
+    end
+
+    # Save old ignored warnings and newly ignored ones
+    def save_with_old
+      warnings = @ignored_warnings.dup
+
+      # Only add ignored warnings not already ignored
+      @already_ignored.each do |w|
+        fingerprint = w[:fingerprint]
+
+        unless @ignored_warnings.find { |ignored_warning| ignored_warning.fingerprint == fingerprint }
+          warnings << w
+        end
+      end
+
+      if @changed
+        save_to_file warnings
+      end
+    end
+  end
+end

data/lib/railroader/report/ignore/interactive.rb

@@ -0,0 +1,362 @@
+Railroader.load_railroader_dependency 'highline'
+
+module Railroader
+  class InteractiveIgnorer
+    def initialize file, warnings
+      @ignore_config = Railroader::IgnoreConfig.new(file, warnings)
+      @new_warnings = warnings
+      @skip_ignored = false
+      @skip_rest = false
+      @ignore_rest = false
+      @quit = false
+      @restart = false
+    end
+
+    def start
+      file_menu
+      initial_menu
+
+      @ignore_config.filter_ignored
+
+      unless @quit
+        penultimate_menu
+        final_menu
+      end
+
+      if @restart
+        @restart = false
+        start
+      end
+
+      @ignore_config
+    end
+
+    private
+
+    def file_menu
+      loop do
+        @ignore_config.file = HighLine.new.ask "Input file: " do |q|
+          if @ignore_config.file and not @ignore_config.file.empty?
+            q.default = @ignore_config.file
+          else
+            q.default = "config/railroader.ignore"
+          end
+        end
+
+        if File.exist? @ignore_config.file
+          @ignore_config.read_from_file
+          return
+        else
+          if yes_or_no "No such file. Continue with empty config? "
+            return
+          end
+        end
+      end
+    end
+
+    def initial_menu
+      HighLine.new.choose do |m|
+        m.choice "Inspect all warnings" do
+          @skip_ignored = false
+          pre_show_help
+          process_warnings
+        end
+
+        m.choice "Hide previously ignored warnings" do
+          @skip_ignored = true
+          pre_show_help
+          process_warnings
+        end
+
+        m.choice "Prune obsolete ignored warnings" do
+          prune_obsolete
+        end
+
+        m.choice "Skip - use current ignore configuration" do
+          @quit = true
+          @ignore_config.filter_ignored
+        end
+      end
+    end
+
+    def warning_menu
+      HighLine.new.choose do |m|
+        m.prompt = "Action: "
+        m.layout = :one_line
+        m.list_option = ", "
+        m.select_by = :name
+
+        m.choice "i"
+        m.choice "n"
+        m.choice "k"
+        m.choice "u"
+        m.choice "a"
+        m.choice "s"
+        m.choice "q"
+        m.choice "?" do
+          show_help
+          "?"
+        end
+      end
+    end
+
+    def pre_show_help
+      say "-" * 30
+      say "Actions:", :cyan
+      show_help
+    end
+
+    def show_help
+      say <<-HELP
+i - Add warning to ignore list
+n - Add warning to ignore list and add note
+s - Skip this warning (will remain ignored or shown)
+u - Remove this warning from ignore list
+a - Ignore this warning and all remaining warnings
+k - Skip this warning and all remaining warnings
+q - Quit, do not update ignored warnings
+? - Display this help
+      HELP
+    end
+
+    def penultimate_menu
+      obsolete = @ignore_config.obsolete_fingerprints
+      return unless obsolete.any?
+
+      if obsolete.length > 1
+        plural = 's'
+        verb = 'are'
+      else
+        plural = ''
+        verb = 'is'
+      end
+
+      say "\n#{obsolete.length} fingerprint#{plural} #{verb} unused:", :green
+      obsolete.each do |obs|
+        say obs
+      end
+
+      if yes_or_no "\nRemove fingerprint#{plural}?"
+        @ignore_config.prune_obsolete
+      end
+    end
+
+    def prune_obsolete
+      @ignore_config.filter_ignored
+      obsolete = @ignore_config.obsolete_fingerprints
+      @ignore_config.prune_obsolete
+
+      say "Removed #{obsolete.length} obsolete fingerprint#{'s' if obsolete.length > 1} from ignore config.", :yellow
+    end
+
+    def final_menu
+      summarize_changes
+
+      HighLine.new.choose do |m|
+        m.choice "Save changes" do
+          save
+        end
+
+        m.choice "Start over" do
+          start_over
+        end
+
+        m.choice "Quit, do not save changes" do
+          quit
+        end
+      end
+    end
+
+    def save
+      @ignore_config.file = HighLine.new.ask "Output file: " do |q|
+        if @ignore_config.file and not @ignore_config.file.empty?
+          q.default = @ignore_config.file
+        else
+          q.default = "config/railroader.ignore"
+        end
+      end
+
+      @ignore_config.save_with_old
+    end
+
+    def start_over
+      reset_config
+      @restart = true
+    end
+
+    def reset_config
+      @ignore_config = Railroader::IgnoreConfig.new(@ignore_config.file, @new_warnings)
+    end
+
+    def process_warnings
+      @warning_count = @new_warnings.length
+
+      @new_warnings.each_with_index do |w, index|
+        @current_index = index
+
+        if skip_ignored? w or @skip_rest
+          next
+        elsif @ignore_rest
+          ignore w
+        elsif @quit or @restart
+          return
+        else
+          ask_about w
+        end
+      end
+    end
+
+    def ask_about warning
+      pretty_display warning
+      warning_action warning_menu, warning
+    end
+
+    def warning_action action, warning
+      case action
+      when "i"
+        ignore warning
+      when "n"
+        ignore_and_note warning
+      when "s"
+        # do nothing
+      when "u"
+        unignore warning
+      when "a"
+        ignore_rest warning
+      when "k"
+        skip_rest warning
+      when "q"
+        quit
+      when "?"
+        ask_about warning
+      else
+        raise "Unexpected action"
+      end
+    end
+
+    def ignore warning
+      @ignore_config.ignore warning
+    end
+
+    def ignore_and_note warning
+      note = HighLine.new.ask("Note: ")
+      @ignore_config.ignore warning
+      @ignore_config.add_note warning, note
+    end
+
+    def unignore warning
+      @ignore_config.unignore warning
+    end
+
+    def skip_rest warning
+      @skip_rest = true
+    end
+
+    def ignore_rest warning
+      ignore warning
+      @ignore_rest = true
+    end
+
+    def quit
+      reset_config
+      @ignore_config.read_from_file
+      @ignore_config.filter_ignored
+      @quit = true
+    end
+
+    def pretty_display warning
+      progress = "#{@current_index + 1}/#{@warning_count}"
+      say "-------- #{progress} #{"-" * (20 - progress.length)}", :cyan
+      show_confidence warning
+
+      label "Category"
+      say warning.warning_type
+
+      label "Message"
+      say warning.message
+
+      if warning.code
+        label "Code"
+        say warning.format_code
+      end
+
+      if warning.relative_path
+        label "File"
+        say warning.relative_path
+      end
+
+      if warning.line
+        label "Line"
+        say warning.line
+      end
+
+      if already_ignored? warning
+        show_note warning
+        say "Already ignored", :red
+      end
+
+      say ""
+    end
+
+    def already_ignored? warning
+      @ignore_config.ignored? warning
+    end
+
+    def skip_ignored? warning
+      @skip_ignored and already_ignored? warning
+    end
+
+    def summarize_changes
+      say "-" * 30
+
+      say "Ignoring #{@ignore_config.ignored_warnings.length} warnings", :yellow
+      say "Showing #{@ignore_config.shown_warnings.length} warnings", :green
+    end
+
+    def label name
+      say "#{name}: ", :green
+    end
+
+    def show_confidence warning
+      label "Confidence"
+
+      case warning.confidence
+      when 0
+        say "High", :red
+      when 1
+        say "Medium", :yellow
+      when 2
+        say "Weak", :cyan
+      else
+        say "Unknown"
+      end
+    end
+
+    def show_note warning
+      note = @ignore_config.note_for warning
+
+      if note
+        label "Note"
+        say note
+      end
+    end
+
+    def say text, color = nil
+      text = text.to_s
+
+      if color
+        HighLine.new.say HighLine.new.color(text, color)
+      else
+        HighLine.new.say text
+      end
+    end
+
+    def yes_or_no message
+      answer = HighLine.new.ask message do |q|
+        q.in = ["y", "n", "yes", "no"]
+      end
+
+      answer.match /^y/i
+    end
+  end
+end