RubyGems - railroader - Versions diffs - 4.3.4 - Mend

railroader 4.3.4

Files changed (165) hide show

checksums.yaml +7 -0
data/CHANGES.md +1091 -0
data/FEATURES +16 -0
data/README.md +174 -0
data/bin/railroader +8 -0
data/lib/railroader/app_tree.rb +191 -0
data/lib/railroader/call_index.rb +219 -0
data/lib/railroader/checks/base_check.rb +505 -0
data/lib/railroader/checks/check_basic_auth.rb +88 -0
data/lib/railroader/checks/check_basic_auth_timing_attack.rb +33 -0
data/lib/railroader/checks/check_content_tag.rb +200 -0
data/lib/railroader/checks/check_create_with.rb +74 -0
data/lib/railroader/checks/check_cross_site_scripting.rb +381 -0
data/lib/railroader/checks/check_default_routes.rb +86 -0
data/lib/railroader/checks/check_deserialize.rb +56 -0
data/lib/railroader/checks/check_detailed_exceptions.rb +55 -0
data/lib/railroader/checks/check_digest_dos.rb +38 -0
data/lib/railroader/checks/check_divide_by_zero.rb +42 -0
data/lib/railroader/checks/check_dynamic_finders.rb +48 -0
data/lib/railroader/checks/check_escape_function.rb +21 -0
data/lib/railroader/checks/check_evaluation.rb +35 -0
data/lib/railroader/checks/check_execute.rb +189 -0
data/lib/railroader/checks/check_file_access.rb +71 -0
data/lib/railroader/checks/check_file_disclosure.rb +35 -0
data/lib/railroader/checks/check_filter_skipping.rb +31 -0
data/lib/railroader/checks/check_forgery_setting.rb +81 -0
data/lib/railroader/checks/check_header_dos.rb +31 -0
data/lib/railroader/checks/check_i18n_xss.rb +48 -0
data/lib/railroader/checks/check_jruby_xml.rb +36 -0
data/lib/railroader/checks/check_json_encoding.rb +47 -0
data/lib/railroader/checks/check_json_parsing.rb +107 -0
data/lib/railroader/checks/check_link_to.rb +132 -0
data/lib/railroader/checks/check_link_to_href.rb +146 -0
data/lib/railroader/checks/check_mail_to.rb +49 -0
data/lib/railroader/checks/check_mass_assignment.rb +196 -0
data/lib/railroader/checks/check_mime_type_dos.rb +39 -0
data/lib/railroader/checks/check_model_attr_accessible.rb +55 -0
data/lib/railroader/checks/check_model_attributes.rb +119 -0
data/lib/railroader/checks/check_model_serialize.rb +67 -0
data/lib/railroader/checks/check_nested_attributes.rb +38 -0
data/lib/railroader/checks/check_nested_attributes_bypass.rb +58 -0
data/lib/railroader/checks/check_number_to_currency.rb +74 -0
data/lib/railroader/checks/check_permit_attributes.rb +43 -0
data/lib/railroader/checks/check_quote_table_name.rb +40 -0
data/lib/railroader/checks/check_redirect.rb +256 -0
data/lib/railroader/checks/check_regex_dos.rb +68 -0
data/lib/railroader/checks/check_render.rb +97 -0
data/lib/railroader/checks/check_render_dos.rb +37 -0
data/lib/railroader/checks/check_render_inline.rb +53 -0
data/lib/railroader/checks/check_response_splitting.rb +21 -0
data/lib/railroader/checks/check_route_dos.rb +42 -0
data/lib/railroader/checks/check_safe_buffer_manipulation.rb +31 -0
data/lib/railroader/checks/check_sanitize_methods.rb +112 -0
data/lib/railroader/checks/check_secrets.rb +40 -0
data/lib/railroader/checks/check_select_tag.rb +59 -0
data/lib/railroader/checks/check_select_vulnerability.rb +60 -0
data/lib/railroader/checks/check_send.rb +47 -0
data/lib/railroader/checks/check_send_file.rb +19 -0
data/lib/railroader/checks/check_session_manipulation.rb +35 -0
data/lib/railroader/checks/check_session_settings.rb +176 -0
data/lib/railroader/checks/check_simple_format.rb +58 -0
data/lib/railroader/checks/check_single_quotes.rb +101 -0
data/lib/railroader/checks/check_skip_before_filter.rb +60 -0
data/lib/railroader/checks/check_sql.rb +700 -0
data/lib/railroader/checks/check_sql_cves.rb +106 -0
data/lib/railroader/checks/check_ssl_verify.rb +48 -0
data/lib/railroader/checks/check_strip_tags.rb +89 -0
data/lib/railroader/checks/check_symbol_dos.rb +71 -0
data/lib/railroader/checks/check_symbol_dos_cve.rb +30 -0
data/lib/railroader/checks/check_translate_bug.rb +45 -0
data/lib/railroader/checks/check_unsafe_reflection.rb +50 -0
data/lib/railroader/checks/check_unscoped_find.rb +57 -0
data/lib/railroader/checks/check_validation_regex.rb +116 -0
data/lib/railroader/checks/check_weak_hash.rb +148 -0
data/lib/railroader/checks/check_without_protection.rb +80 -0
data/lib/railroader/checks/check_xml_dos.rb +45 -0
data/lib/railroader/checks/check_yaml_parsing.rb +121 -0
data/lib/railroader/checks.rb +209 -0
data/lib/railroader/codeclimate/engine_configuration.rb +97 -0
data/lib/railroader/commandline.rb +179 -0
data/lib/railroader/differ.rb +66 -0
data/lib/railroader/file_parser.rb +54 -0
data/lib/railroader/format/style.css +133 -0
data/lib/railroader/options.rb +339 -0
data/lib/railroader/parsers/rails2_erubis.rb +6 -0
data/lib/railroader/parsers/rails2_xss_plugin_erubis.rb +48 -0
data/lib/railroader/parsers/rails3_erubis.rb +81 -0
data/lib/railroader/parsers/template_parser.rb +108 -0
data/lib/railroader/processor.rb +102 -0
data/lib/railroader/processors/alias_processor.rb +1229 -0
data/lib/railroader/processors/base_processor.rb +295 -0
data/lib/railroader/processors/config_processor.rb +14 -0
data/lib/railroader/processors/controller_alias_processor.rb +278 -0
data/lib/railroader/processors/controller_processor.rb +249 -0
data/lib/railroader/processors/erb_template_processor.rb +77 -0
data/lib/railroader/processors/erubis_template_processor.rb +92 -0
data/lib/railroader/processors/gem_processor.rb +64 -0
data/lib/railroader/processors/haml_template_processor.rb +191 -0
data/lib/railroader/processors/lib/basic_processor.rb +37 -0
data/lib/railroader/processors/lib/call_conversion_helper.rb +90 -0
data/lib/railroader/processors/lib/find_all_calls.rb +224 -0
data/lib/railroader/processors/lib/find_call.rb +183 -0
data/lib/railroader/processors/lib/find_return_value.rb +166 -0
data/lib/railroader/processors/lib/module_helper.rb +111 -0
data/lib/railroader/processors/lib/processor_helper.rb +88 -0
data/lib/railroader/processors/lib/rails2_config_processor.rb +145 -0
data/lib/railroader/processors/lib/rails2_route_processor.rb +313 -0
data/lib/railroader/processors/lib/rails3_config_processor.rb +132 -0
data/lib/railroader/processors/lib/rails3_route_processor.rb +308 -0
data/lib/railroader/processors/lib/render_helper.rb +181 -0
data/lib/railroader/processors/lib/render_path.rb +107 -0
data/lib/railroader/processors/lib/route_helper.rb +68 -0
data/lib/railroader/processors/lib/safe_call_helper.rb +16 -0
data/lib/railroader/processors/library_processor.rb +74 -0
data/lib/railroader/processors/model_processor.rb +91 -0
data/lib/railroader/processors/output_processor.rb +144 -0
data/lib/railroader/processors/route_processor.rb +17 -0
data/lib/railroader/processors/slim_template_processor.rb +111 -0
data/lib/railroader/processors/template_alias_processor.rb +118 -0
data/lib/railroader/processors/template_processor.rb +85 -0
data/lib/railroader/report/config/remediation.yml +71 -0
data/lib/railroader/report/ignore/config.rb +153 -0
data/lib/railroader/report/ignore/interactive.rb +362 -0
data/lib/railroader/report/pager.rb +112 -0
data/lib/railroader/report/renderer.rb +24 -0
data/lib/railroader/report/report_base.rb +292 -0
data/lib/railroader/report/report_codeclimate.rb +79 -0
data/lib/railroader/report/report_csv.rb +55 -0
data/lib/railroader/report/report_hash.rb +23 -0
data/lib/railroader/report/report_html.rb +216 -0
data/lib/railroader/report/report_json.rb +45 -0
data/lib/railroader/report/report_markdown.rb +107 -0
data/lib/railroader/report/report_table.rb +117 -0
data/lib/railroader/report/report_tabs.rb +17 -0
data/lib/railroader/report/report_text.rb +198 -0
data/lib/railroader/report/templates/controller_overview.html.erb +22 -0
data/lib/railroader/report/templates/controller_warnings.html.erb +21 -0
data/lib/railroader/report/templates/error_overview.html.erb +29 -0
data/lib/railroader/report/templates/header.html.erb +58 -0
data/lib/railroader/report/templates/ignored_warnings.html.erb +25 -0
data/lib/railroader/report/templates/model_warnings.html.erb +21 -0
data/lib/railroader/report/templates/overview.html.erb +38 -0
data/lib/railroader/report/templates/security_warnings.html.erb +23 -0
data/lib/railroader/report/templates/template_overview.html.erb +21 -0
data/lib/railroader/report/templates/view_warnings.html.erb +34 -0
data/lib/railroader/report/templates/warning_overview.html.erb +17 -0
data/lib/railroader/report.rb +88 -0
data/lib/railroader/rescanner.rb +483 -0
data/lib/railroader/scanner.rb +321 -0
data/lib/railroader/tracker/collection.rb +93 -0
data/lib/railroader/tracker/config.rb +154 -0
data/lib/railroader/tracker/constants.rb +171 -0
data/lib/railroader/tracker/controller.rb +161 -0
data/lib/railroader/tracker/library.rb +17 -0
data/lib/railroader/tracker/model.rb +90 -0
data/lib/railroader/tracker/template.rb +33 -0
data/lib/railroader/tracker.rb +362 -0
data/lib/railroader/util.rb +503 -0
data/lib/railroader/version.rb +3 -0
data/lib/railroader/warning.rb +294 -0
data/lib/railroader/warning_codes.rb +117 -0
data/lib/railroader.rb +544 -0
data/lib/ruby_parser/bm_sexp.rb +626 -0
data/lib/ruby_parser/bm_sexp_processor.rb +116 -0
metadata +386 -0

data/lib/railroader/report/templates/controller_overview.html.erb ADDED Viewed

@@ -0,0 +1,22 @@
+<h2>Controllers</h2>
+<table>
+  <thead>
+    <tr>
+      <th>Name</th>
+      <th>Parent</th>
+      <th>Includes</th>
+      <th>Routes</th>
+    </tr>
+  </thead>
+  <tbody>
+  <% controller_rows.each do |row| %>
+    <tr>
+      <td><%= row['Name'] %></td>
+      <td><%= row['Parent'] %></td>
+      <td><%= row['Includes'] %></td>
+      <td><%= row['Routes'] %></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>

data/lib/railroader/report/templates/controller_warnings.html.erb ADDED Viewed

@@ -0,0 +1,21 @@
+<p>Controller Warnings</p>
+<table>
+  <thead>
+    <tr>
+      <th>Confidence</th>
+      <th>Controller</th>
+      <th>Warning Type</th>
+      <th>Message</th>
+    </tr>
+  </thead>
+  <tbody>
+  <% warnings.each do |warning| %>
+    <tr>
+      <td><%= warning['Confidence']%></td>
+      <td><%= warning['Controller']%></td>
+      <td><%= warning['Warning Type']%></td>
+      <td><%= warning['Message']%></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>

data/lib/railroader/report/templates/error_overview.html.erb ADDED Viewed

@@ -0,0 +1,29 @@
+<div onClick="toggle('errors_table');">  <h2>Exceptions raised during the analysis (click to see them)</h2 ></div>
+  <div>
+    <div id='errors_table' style='display:none'>
+      <table>
+        <thead>
+          <tr>
+            <th>Error</th>
+            <th>Location</th>
+          </tr>
+        </thead>
+        <tbody>
+        <% tracker.errors.each do |warning| %>
+          <tr>
+            <td><%= CGI.escapeHTML warning[:error] %></td>
+            <td>
+              <% if tracker.options[:debug] %>
+                <% warning[:backtrace].each do |line| %>
+                  <%= line %><br/>
+                <% end %>
+              <% else %>
+                <%= warning[:backtrace][0] %>
+              <% end %>
+            </td>
+          </tr>
+        <% end %>
+        </tbody>
+      </table>
+    </div>
+  </div>

data/lib/railroader/report/templates/header.html.erb ADDED Viewed

@@ -0,0 +1,58 @@
+<!DOCTYPE HTML SYSTEM>
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+<title>Railroader Report</title>
+  <script type="text/javascript" src="https://code.jquery.com/jquery-2.1.4.min.js"></script>
+  <script type="text/javascript" src="https://cdn.datatables.net/1.10.9/js/jquery.dataTables.min.js"></script>
+  <script type="text/javascript">
+    function toggle(context) {
+      var elem = document.getElementById(context);
+      if (elem.style.display != "block")
+        elem.style.display = "block";
+      else
+        elem.style.display = "none";
+      elem.parentNode.scrollIntoView();
+    }
+    $(document).ready(function() {
+      $('table').DataTable({
+        searching: false,
+        paging:    false,
+        info:      false
+      });
+    });
+  </script>
+  <style>
+    <%= css %>
+  </style>
+</head>
+<body>
+<h1>Railroader Report</h1>
+<table>
+  <thead>
+    <tr>
+      <th>Application Path</th>
+      <th>Rails Version</th>
+      <th>Railroader Version</th>
+      <th>Report Time</th>
+      <th>Checks Performed</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td><%= tracker.app_path %></td>
+      <td><%= rails_version %></td>
+      <td><%= railroader_version %>
+      <td>
+        <%= tracker.start_time %><br><br>
+        <%= tracker.duration %> seconds
+      </td>
+      <td><%= checks.checks_run.sort.join(", ") %></td>
+    </tr>
+  </tbody>
+</table>
+<br>

data/lib/railroader/report/templates/ignored_warnings.html.erb ADDED Viewed

@@ -0,0 +1,25 @@
+<div onClick="toggle('ignored_table');">  <h2><%= warnings.length %> Ignored Warnings (click to see them)</h2 ></div>
+<div>
+  <table style="display:none" id="ignored_table">
+    <thead>
+      <tr>
+        <th>Confidence</th>
+        <th>File</th>
+        <th>Warning Type</th>
+        <th>Message</th>
+        <th>Note</th>
+      </tr>
+    </thead>
+    <tbody>
+    <% warnings.each do |warning| %>
+      <tr>
+        <td><%= warning['Confidence']%></td>
+        <td><%= warning['File']%></td>
+        <td><%= warning['Warning Type']%></td>
+        <td><%= warning['Message']%></td>
+        <td><%= warning['Note']%></td>
+      </tr>
+    <% end %>
+    </tbody>
+  </table>
+</div>

data/lib/railroader/report/templates/model_warnings.html.erb ADDED Viewed

@@ -0,0 +1,21 @@
+<p>Model Warnings</p>
+<table>
+  <thead>
+    <tr>
+      <th>Confidence</th>
+      <th>Model</th>
+      <th>Warning Type</th>
+      <th>Message</th>
+    </tr>
+  </thead>
+  <tbody>
+  <% warnings.each do |warning| %>
+    <tr>
+      <td><%= warning['Confidence']%></td>
+      <td><%= warning['Model']%></td>
+      <td><%= warning['Warning Type']%></td>
+      <td><%= warning['Message']%></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>

data/lib/railroader/report/templates/overview.html.erb ADDED Viewed

@@ -0,0 +1,38 @@
+<h2 id='summary'>Summary</h2>
+<table>
+  <thead>
+    <tr>
+      <th>Scanned/Reported</th>
+      <th>Total</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>Controllers</td>
+      <td><%= tracker.controllers.length %></td>
+    </tr>
+    <tr>
+      <td>Models</td>
+      <td><%= tracker.models.length - 1 %></td>
+    </tr>
+    <tr>
+      <td>Templates</td>
+      <td><%= number_of_templates %></td>
+    </tr>
+    <tr>
+      <td>Errors</td>
+      <td><%= tracker.errors.length %></td>
+    </tr>
+    <tr>
+      <td>Security Warnings</td>
+      <td><%= warnings %> <span class='high-confidence'>(<%= warnings_summary[:high_confidence] %>)</span></td>
+    </tr>
+  <% if warnings_summary['Ignored Warnings'] %>
+    <tr>
+      <td>Ignored Warnings</td>
+      <td><%= ignored_warnings %></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>
+<br>

data/lib/railroader/report/templates/security_warnings.html.erb ADDED Viewed

@@ -0,0 +1,23 @@
+<h2>Security Warnings</h2>
+<table>
+  <thead>
+    <tr>
+      <th>Confidence</th>
+      <th>Class</th>
+      <th>Method</th>
+      <th>Warning Type</th>
+      <th>Message</th>
+    </tr>
+  </thead>
+  <tbody>
+  <% warnings.each do |warning| %>
+    <tr>
+      <td><%= warning['Confidence']%></td>
+      <td><%= warning['Class']%></td>
+      <td><%= warning['Method']%></td>
+      <td><%= warning['Warning Type']%></td>
+      <td><%= warning['Message']%></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>

data/lib/railroader/report/templates/template_overview.html.erb ADDED Viewed

@@ -0,0 +1,21 @@
+<h2>Templates</h2>
+<% template_rows.each do |template| %>
+<p><%= template[0] %></p>
+<table>
+  <thead>
+    <tr>
+      <th>Output</th>
+    </tr>
+  </thead>
+  <tbody>
+  <% template[1].each do |call| %>
+    <tr>
+      <td><%= call %></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>
+<% end %>

data/lib/railroader/report/templates/view_warnings.html.erb ADDED Viewed

@@ -0,0 +1,34 @@
+<p>View Warnings</p>
+<table>
+  <thead>
+    <tr>
+      <th>Confidence</th>
+      <th>Template</th>
+      <th>Warning Type</th>
+      <th>Message</th>
+    </tr>
+  </thead>
+  <tbody>
+  <% warnings.each_with_index do |warning, i| %>
+    <tr>
+      <td><%= warning['Confidence']%></td>
+      <td>
+        <% if warning['Called From'] and warning['Called From'].length > 1 %>
+          <div class="template_name" onClick="toggle('callers<%= i %>')" >
+            <div>
+              <%= warning['Template'] %>
+            </div>
+            <div class="render_path" id="callers<%= i %>" >
+              <%= warning['Called From'].join(' &rarr; ') %> &rarr; <%= warning['Template Name'] %>
+            </div>
+          </div>
+        <% else %>
+          <%= warning['Template']%>
+        <% end %>
+      </td>
+      <td><%= warning['Warning Type']%></td>
+      <td><%= warning['Message']%></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>

data/lib/railroader/report/templates/warning_overview.html.erb ADDED Viewed

@@ -0,0 +1,17 @@
+<table>
+  <thead>
+    <tr>
+      <th>Warning Type</th>
+      <th>Total</th>
+    </tr>
+  </thead>
+  <tbody>
+  <% types.sort.each do |warning_type| %>
+    <tr>
+      <td><%= warning_type %></td>
+      <td><%= warnings_summary[warning_type] %></td>
+    </tr>
+  <% end %>
+  </tbody>
+</table>
+<br>

data/lib/railroader/report.rb ADDED Viewed

@@ -0,0 +1,88 @@
+require 'railroader/report/report_base'
+#Generates a report based on the Tracker and the results of
+#Tracker#run_checks. Be sure to +run_checks+ before generating
+#a report.
+class Railroader::Report
+  attr_reader :tracker
+  VALID_FORMATS = [:to_html, :to_pdf, :to_csv, :to_json, :to_tabs, :to_hash, :to_s, :to_markdown, :to_codeclimate, :to_plain, :to_text]
+  def initialize app_tree, tracker
+    @app_tree = app_tree
+    @tracker = tracker
+  end
+  def format format
+    reporter = case format
+    when :to_codeclimate
+      require_report 'codeclimate'
+      Railroader::Report::CodeClimate
+    when :to_csv
+      require_report 'csv'
+      Railroader::Report::CSV
+    when :to_html
+      require_report 'html'
+      Railroader::Report::HTML
+    when :to_json
+      return self.to_json
+    when :to_tabs
+      require_report 'tabs'
+      Railroader::Report::Tabs
+    when :to_hash
+      require_report 'hash'
+      Railroader::Report::Hash
+    when :to_markdown
+      return self.to_markdown
+    when :to_plain, :to_text, :to_s
+      return self.to_plain
+    when :to_table
+      return self.to_table
+    when :to_pdf
+      raise "PDF output is not yet supported."
+    else
+      raise "Invalid format: #{format}. Should be one of #{VALID_FORMATS.inspect}"
+    end
+    generate(reporter)
+  end
+  def method_missing method, *args
+    if VALID_FORMATS.include? method
+      format method
+    else
+      super
+    end
+  end
+  def require_report type
+    require "railroader/report/report_#{type}"
+  end
+  def to_json
+    require_report 'json'
+    generate Railroader::Report::JSON
+  end
+  def to_table
+    require_report 'table'
+    generate Railroader::Report::Table
+  end
+  def to_markdown
+    require_report 'markdown'
+    generate Railroader::Report::Markdown
+  end
+  def to_text
+    require_report 'text'
+    generate Railroader::Report::Text
+  end
+  alias to_plain to_text
+  alias to_s to_text
+  def generate reporter
+    reporter.new(@app_tree, @tracker).generate_report
+  end
+end