railroader 4.3.4

data/lib/railroader/checks/check_permit_attributes.rb

@@ -0,0 +1,43 @@
+require 'railroader/checks/base_check'
+
+class Railroader::CheckPermitAttributes < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Warn on potentially dangerous attributes whitelisted via permit"
+
+  SUSPICIOUS_KEYS = {
+    admin: :high,
+    account_id: :high,
+    role: :medium,
+    banned: :medium,
+  }
+
+  def run_check
+    tracker.find_call(:method => :permit).each do |result|
+      check_permit result
+    end
+  end
+
+  def check_permit result
+    return unless original? result
+
+    call = result[:call]
+
+    call.each_arg do |arg|
+      if symbol? arg
+        if SUSPICIOUS_KEYS.key? arg.value
+          warn_on_permit_key result, arg
+        end
+      end
+    end
+  end
+
+  def warn_on_permit_key result, key, confidence = nil
+    warn :result => result,
+      :warning_type => "Mass Assignment",
+      :warning_code => :dangerous_permit_key,
+      :message => "Potentially dangerous key allowed for mass assignment",
+      :confidence => (confidence || SUSPICIOUS_KEYS[key.value]),
+      :user_input => key
+  end
+end

data/lib/railroader/checks/check_quote_table_name.rb

@@ -0,0 +1,40 @@
+require 'railroader/checks/base_check'
+
+#Check for uses of quote_table_name in Rails versions before 2.3.13 and 3.0.10
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b
+class Railroader::CheckQuoteTableName < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Checks for quote_table_name vulnerability in versions before 2.3.14 and 3.0.10"
+
+  def run_check
+    if (version_between?('2.0.0', '2.3.13') or 
+        version_between?('3.0.0', '3.0.9'))
+
+      if uses_quote_table_name?
+        confidence = :high
+      else
+        confidence = :medium
+      end
+
+      if rails_version =~ /^3/
+        message = "Versions before 3.0.10 have a vulnerability in quote_table_name: CVE-2011-2930"
+      else
+        message = "Versions before 2.3.14 have a vulnerability in quote_table_name: CVE-2011-2930"
+      end
+
+      warn :warning_type => "SQL Injection",
+        :warning_code => :CVE_2011_2930,
+        :message => message,
+        :confidence => confidence,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/ah5HN0S8OJs/discussion"
+    end
+  end
+
+  def uses_quote_table_name?
+    Railroader.debug "Finding calls to quote_table_name()"
+
+    not tracker.find_call(:target => false, :method => :quote_table_name).empty?
+  end
+end

data/lib/railroader/checks/check_redirect.rb

@@ -0,0 +1,256 @@
+require 'railroader/checks/base_check'
+
+#Reports any calls to +redirect_to+ which include parameters in the arguments.
+#
+#For example:
+#
+# redirect_to params.merge(:action => :elsewhere)
+class Railroader::CheckRedirect < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Looks for calls to redirect_to with user input as arguments"
+
+  def run_check
+    Railroader.debug "Finding calls to redirect_to()"
+
+    @model_find_calls = Set[:all, :create, :create!, :find, :find_by_sql, :first, :last, :new]
+
+    if tracker.options[:rails3]
+      @model_find_calls.merge [:from, :group, :having, :joins, :lock, :order, :reorder, :select, :where]
+    end
+
+    if version_between? "4.0.0", "9.9.9"
+      @model_find_calls.merge [:find_by, :find_by!, :take]
+    end
+
+    @tracker.find_call(:target => false, :method => :redirect_to).each do |res|
+      process_result res
+    end
+  end
+
+  def process_result result
+    return unless original? result
+
+    call = result[:call]
+    method = call.method
+
+    opt = call.first_arg
+
+    if method == :redirect_to and
+        not only_path?(call) and
+        not explicit_host?(opt) and
+        not slice_call?(opt) and
+        not safe_permit?(opt) and
+        res = include_user_input?(call)
+
+      if res.type == :immediate
+        confidence = :high
+      else
+        confidence = :weak
+      end
+
+      warn :result => result,
+        :warning_type => "Redirect",
+        :warning_code => :open_redirect,
+        :message => "Possible unprotected redirect",
+        :code => call,
+        :user_input => res,
+        :confidence => confidence
+    end
+  end
+
+  #Custom check for user input. First looks to see if the user input
+  #is being output directly. This is necessary because of tracker.options[:check_arguments]
+  #which can be used to enable/disable reporting output of method calls which use
+  #user input as arguments.
+  def include_user_input? call, immediate = :immediate
+    Railroader.debug "Checking if call includes user input"
+
+    arg = call.first_arg
+
+    # if the first argument is an array, rails assumes you are building a
+    # polymorphic route, which will never jump off-host
+    return false if array? arg
+
+    if tracker.options[:ignore_redirect_to_model]
+      if model_instance?(arg) or decorated_model?(arg)
+        return false
+      end
+    end
+
+    if res = has_immediate_model?(arg)
+      unless call? arg and arg.method.to_s =~ /_path/
+        return Match.new(immediate, res)
+      end
+    elsif call? arg
+      if request_value? arg
+        return Match.new(immediate, arg)
+      elsif request_value? arg.target
+        return Match.new(immediate, arg.target)
+      elsif arg.method == :url_for and include_user_input? arg
+        return Match.new(immediate, arg)
+        #Ignore helpers like some_model_url?
+      elsif arg.method.to_s =~ /_(url|path)\z/
+        return false
+      end
+    elsif request_value? arg
+      return Match.new(immediate, arg)
+    end
+
+    if tracker.options[:check_arguments] and call? arg
+      include_user_input? arg, false  #I'm doubting if this is really necessary...
+    else
+      false
+    end
+  end
+
+  #Checks +redirect_to+ arguments for +only_path => true+ which essentially
+  #nullifies the danger posed by redirecting with user input
+  def only_path? call
+    arg = call.first_arg
+
+    if hash? arg
+      return has_only_path? arg
+    elsif call? arg and arg.method == :url_for
+      return check_url_for(arg)
+    elsif call? arg and hash? arg.first_arg and use_unsafe_hash_method? arg
+      return has_only_path? arg.first_arg
+    end
+
+    false
+  end
+
+  def use_unsafe_hash_method? arg
+    return call_has_param(arg, :to_unsafe_hash) || call_has_param(arg, :to_unsafe_h)
+  end
+
+  def call_has_param arg, key
+    if call? arg and call? arg.target
+      target = arg.target
+      method = target.method
+
+      node_type? target.target, :params and method == key
+    else
+      false
+    end
+  end
+
+  def has_only_path? arg
+    if value = hash_access(arg, :only_path)
+      return true if true?(value)
+    end
+
+    false
+  end
+
+  def explicit_host? arg
+    return unless sexp? arg
+
+    if hash? arg
+      if value = hash_access(arg, :host)
+        return !has_immediate_user_input?(value)
+      end
+    elsif call? arg
+      target = arg.target
+
+      if hash? target and value = hash_access(target, :host)
+        return !has_immediate_user_input?(value)
+      elsif call? arg
+        return explicit_host? target
+      end
+    end
+
+    false
+  end
+
+  #+url_for+ is only_path => true by default. This checks to see if it is
+  #set to false for some reason.
+  def check_url_for call
+    arg = call.first_arg
+
+    if hash? arg
+      if value = hash_access(arg, :only_path)
+        return false if false?(value)
+      end
+    end
+
+    true
+  end
+
+  #Returns true if exp is (probably) a model instance
+  def model_instance? exp
+    if node_type? exp, :or
+      model_instance? exp.lhs or model_instance? exp.rhs
+    elsif call? exp
+      if model_target? exp and
+        (@model_find_calls.include? exp.method or exp.method.to_s.match(/^find_by_/))
+        true
+      else
+        association?(exp.target, exp.method)
+      end
+    end
+  end
+
+  def model_target? exp
+    return false unless call? exp
+    model_name? exp.target or
+    friendly_model? exp.target or
+    model_target? exp.target
+  end
+
+  #Returns true if exp is (probably) a friendly model instance
+  #using the FriendlyId gem
+  def friendly_model? exp
+    call? exp and model_name? exp.target and exp.method == :friendly
+  end
+  
+  #Returns true if exp is (probably) a decorated model instance
+  #using the Draper gem
+  def decorated_model? exp
+    if node_type? exp, :or
+      decorated_model? exp.lhs or decorated_model? exp.rhs
+    else
+      tracker.config.has_gem? :draper and
+      call? exp and
+      node_type?(exp.target, :const) and
+      exp.target.value.to_s.match(/Decorator$/) and
+      exp.method == :decorate
+    end
+  end
+
+  #Check if method is actually an association in a Model
+  def association? model_name, meth
+    if call? model_name
+      return association? model_name.target, meth
+    elsif model_name? model_name
+      model = tracker.models[class_name(model_name)]
+    else
+      return false
+    end
+
+    return false unless model
+
+    model.association? meth
+  end
+
+  def slice_call? exp
+    return unless call? exp
+    exp.method == :slice
+  end
+
+  DANGEROUS_KEYS = [:host, :subdomain, :domain, :port]
+
+  def safe_permit? exp
+    if call? exp and params? exp.target and exp.method == :permit
+      exp.each_arg do |opt|
+        if symbol? opt and DANGEROUS_KEYS.include? opt.value
+          return false 
+        end
+      end
+
+      return true
+    end
+
+    false
+  end
+end

data/lib/railroader/checks/check_regex_dos.rb

@@ -0,0 +1,68 @@
+require 'railroader/checks/base_check'
+
+#This check looks for regexes that include user input.
+class Railroader::CheckRegexDoS < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  ESCAPES = {
+    s(:const, :Regexp) => [
+      :escape,
+      :quote
+    ]
+  }
+
+  @description = "Searches regexes including user input"
+
+  #Process calls
+  def run_check
+    Railroader.debug "Finding dynamic regexes"
+    calls = tracker.find_call :method => [:railroader_regex_interp]
+
+    Railroader.debug "Processing dynamic regexes"
+    calls.each do |call|
+      process_result call
+    end
+  end
+
+  #Warns if regex includes user input
+  def process_result result
+    return unless original? result
+
+    call = result[:call]
+    components = call[1..-1]
+
+    components.any? do |component|
+      next unless sexp? component
+
+      if match = has_immediate_user_input?(component)
+        confidence = :high
+      elsif match = has_immediate_model?(component)
+        match = Match.new(:model, match)
+        confidence = :medium
+      elsif match = include_user_input?(component)
+        confidence = :weak
+      end
+
+      if match
+        message = "#{friendly_type_of(match).capitalize} used in regex"
+
+        warn :result => result,
+          :warning_type => "Denial of Service",
+          :warning_code => :regex_dos,
+          :message => message,
+          :confidence => confidence,
+          :user_input => match
+      end
+    end
+  end
+
+  def process_call(exp)
+    if escape_methods = ESCAPES[exp.target]
+      if escape_methods.include? exp.method
+        return exp
+      end
+    end
+
+    super
+  end
+end

data/lib/railroader/checks/check_render.rb

@@ -0,0 +1,97 @@
+require 'railroader/checks/base_check'
+
+#Check calls to +render()+ for dangerous values
+class Railroader::CheckRender < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Finds calls to render that might allow file access or code execution"
+
+  def run_check
+    tracker.find_call(:target => nil, :method => :render).each do |result|
+      process_render_result result
+    end
+  end
+
+  def process_render_result result
+    return unless node_type? result[:call], :render
+
+    case result[:call].render_type
+    when :partial, :template, :action, :file
+      check_for_rce(result) or
+        check_for_dynamic_path(result)
+    when :inline
+    when :js
+    when :json
+    when :text
+    when :update
+    when :xml
+    end
+  end
+
+  #Check if path to action or file is determined dynamically
+  def check_for_dynamic_path result
+    view = result[:call][2]
+
+    if sexp? view and original? result
+
+      if input = has_immediate_user_input?(view)
+        if string_interp? view
+          confidence = :medium
+        else
+          confidence = :high
+        end
+      elsif input = include_user_input?(view)
+        confidence = :weak
+      else
+        return
+      end
+
+      return if input.type == :model #skip models
+      return if safe_param? input.match
+
+      message = "Render path contains #{friendly_type_of input}"
+
+      warn :result => result,
+        :warning_type => "Dynamic Render Path",
+        :warning_code => :dynamic_render_path,
+        :message => message,
+        :user_input => input,
+        :confidence => confidence
+    end
+  end
+
+  def check_for_rce result
+    return unless version_between? "0.0.0", "3.2.22" or
+                  version_between? "4.0.0", "4.1.14" or
+                  version_between? "4.2.0", "4.2.5"
+
+
+    view = result[:call][2]
+    if sexp? view and not duplicate? result
+      if params? view
+        add_result result
+        return if safe_param? view
+
+        warn :result => result,
+          :warning_type => "Remote Code Execution",
+          :warning_code => :dynamic_render_path_rce,
+          :message => "Passing query parameters to render() is vulnerable in Rails #{rails_version} (CVE-2016-0752)",
+          :user_input => view,
+          :confidence => :high
+      end
+    end
+  end
+
+  def safe_param? exp
+    if params? exp and call? exp
+      method_name = exp.method
+
+      if method_name == :[]
+        arg = exp.first_arg
+        symbol? arg and [:controller, :action].include? arg.value
+      else
+        boolean_method? method_name
+      end
+    end
+  end
+end 

data/lib/railroader/checks/check_render_dos.rb

@@ -0,0 +1,37 @@
+require 'railroader/checks/base_check'
+
+class Railroader::CheckRenderDoS < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Warn about denial of service with render :text (CVE-2014-0082)"
+
+  def run_check
+    if version_between? "3.0.0", "3.0.20" or
+       version_between? "3.1.0", "3.1.12" or
+       version_between? "3.2.0", "3.2.16"
+
+      tracker.find_call(:target => nil, :method => :render).each do |result|
+        if text_render? result
+          warn_about_text_render
+          break
+        end
+      end
+    end
+  end
+
+  def text_render? result
+    node_type? result[:call], :render and
+    result[:call].render_type == :text
+  end
+
+  def warn_about_text_render
+    message = "Rails #{rails_version} has a denial of service vulnerability (CVE-2014-0082). Upgrade to Rails version 3.2.17"
+
+    warn :warning_type => "Denial of Service",
+      :warning_code => :CVE_2014_0082,
+      :message => message,
+      :confidence => :high,
+      :link_path => "https://groups.google.com/d/msg/rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ",
+      :gem_info => gemfile_or_environment
+  end
+end

data/lib/railroader/checks/check_render_inline.rb

@@ -0,0 +1,53 @@
+class Railroader::CheckRenderInline < Railroader::CheckCrossSiteScripting
+  Railroader::Checks.add self
+
+  @description = "Checks for cross-site scripting in render calls"
+
+  def run_check
+    setup
+
+    tracker.find_call(:target => nil, :method => :render).each do |result|
+      check_render result
+    end
+  end
+
+  def check_render result
+    return unless original? result
+
+    call = result[:call]
+
+    if node_type? call, :render and
+      (call.render_type == :text or call.render_type == :inline)
+
+      unless call.render_type == :text and content_type_set? call[3]
+        render_value = call[2]
+
+        if input = has_immediate_user_input?(render_value)
+          warn :result => result,
+            :warning_type => "Cross-Site Scripting",
+            :warning_code => :cross_site_scripting_inline,
+            :message => "Unescaped #{friendly_type_of input} rendered inline",
+            :user_input => input,
+            :confidence => :high
+        elsif input = has_immediate_model?(render_value)
+          warn :result => result,
+            :warning_type => "Cross-Site Scripting",
+            :warning_code => :cross_site_scripting_inline,
+            :message => "Unescaped model attribute rendered inline",
+            :user_input => input,
+            :confidence => :medium
+        end
+      end
+    end
+  end
+
+  CONTENT_TYPES = ["text/html", "text/javascript", "application/javascript"]
+
+  def content_type_set? opts
+    if hash? opts
+      content_type = hash_access(opts, :content_type)
+
+      string? content_type and not CONTENT_TYPES.include? content_type.value
+    end
+  end
+end

data/lib/railroader/checks/check_response_splitting.rb

@@ -0,0 +1,21 @@
+require 'railroader/checks/base_check'
+
+#Warn about response splitting in Rails versions before 2.3.13
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768
+class Railroader::CheckResponseSplitting < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Report response splitting in Rails 2.3.0 - 2.3.13"
+
+  def run_check
+    if version_between?('2.3.0', '2.3.13')
+
+      warn :warning_type => "Response Splitting",
+        :warning_code => :CVE_2011_3186,
+        :message => "Versions before 2.3.14 have a vulnerability content type handling allowing injection of headers: CVE-2011-3186",
+        :confidence => :medium,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/b_yTveAph2g/discussion"
+    end
+  end
+end

data/lib/railroader/checks/check_route_dos.rb

@@ -0,0 +1,42 @@
+require 'railroader/checks/base_check'
+
+class Railroader::CheckRouteDoS < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Checks for route DoS (CVE-2015-7581)"
+
+  def run_check
+    fix_version = case
+                  when version_between?("4.0.0", "4.1.14")
+                    "4.1.14.1"
+                  when version_between?("4.2.0", "4.2.5")
+                    "4.2.5.1"
+                  else
+                    return
+                  end
+
+    if controller_wildcards?
+      message = "Rails #{rails_version} has a denial of service vulnerability with :controller routes (CVE-2015-7581). Upgrade to Rails #{fix_version}"
+
+      warn :warning_type => "Denial of Service",
+        :warning_code => :CVE_2015_7581,
+        :message => message,
+        :confidence => :medium,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ"
+    end
+  end
+
+  def controller_wildcards?
+    tracker.routes.each do |name, actions|
+      if name == :':controllerController'
+        # awful hack for routes with :controller in them
+        return true
+      elsif string? actions and actions.value.include? ":controller"
+        return true
+      end
+    end
+
+    false
+  end
+end

data/lib/railroader/checks/check_safe_buffer_manipulation.rb

@@ -0,0 +1,31 @@
+require 'railroader/checks/base_check'
+
+#Check for unsafe manipulation of strings
+#Right now this is just a version check for
+#https://groups.google.com/group/rubyonrails-security/browse_thread/thread/edd28f1e3d04e913?pli=1
+class Railroader::CheckSafeBufferManipulation < Railroader::BaseCheck
+  Railroader::Checks.add self
+
+  @description = "Check for Rails versions with SafeBuffer bug"
+
+  def run_check
+
+    if version_between? "3.0.0", "3.0.11"
+      suggested_version = "3.0.12"
+    elsif version_between? "3.1.0", "3.1.3"
+      suggested_version = "3.1.4"
+    elsif version_between? "3.2.0", "3.2.1"
+      suggested_version = "3.2.2"
+    else
+      return
+    end
+
+    message = "Rails #{rails_version} has a vulnerabilty in SafeBuffer. Upgrade to #{suggested_version} or apply patches."
+
+    warn :warning_type => "Cross-Site Scripting",
+      :warning_code => :safe_buffer_vuln, 
+      :message => message,
+      :confidence => :medium,
+      :gem_info => gemfile_or_environment
+  end
+end