railroader 4.3.5 → 4.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +16 -0
  3. data/README.md +15 -0
  4. data/bin/railroader +1 -1
  5. data/lib/railroader/call_index.rb +11 -11
  6. data/lib/railroader/checks/base_check.rb +43 -43
  7. data/lib/railroader/checks/check_basic_auth.rb +3 -3
  8. data/lib/railroader/checks/check_content_tag.rb +9 -9
  9. data/lib/railroader/checks/check_create_with.rb +2 -2
  10. data/lib/railroader/checks/check_cross_site_scripting.rb +24 -24
  11. data/lib/railroader/checks/check_default_routes.rb +5 -5
  12. data/lib/railroader/checks/check_deserialize.rb +1 -1
  13. data/lib/railroader/checks/check_dynamic_finders.rb +1 -1
  14. data/lib/railroader/checks/check_escape_function.rb +3 -3
  15. data/lib/railroader/checks/check_evaluation.rb +4 -4
  16. data/lib/railroader/checks/check_execute.rb +8 -8
  17. data/lib/railroader/checks/check_file_access.rb +2 -2
  18. data/lib/railroader/checks/check_filter_skipping.rb +2 -2
  19. data/lib/railroader/checks/check_forgery_setting.rb +3 -3
  20. data/lib/railroader/checks/check_jruby_xml.rb +1 -1
  21. data/lib/railroader/checks/check_json_parsing.rb +2 -2
  22. data/lib/railroader/checks/check_link_to.rb +12 -12
  23. data/lib/railroader/checks/check_link_to_href.rb +9 -9
  24. data/lib/railroader/checks/check_mail_to.rb +4 -4
  25. data/lib/railroader/checks/check_mass_assignment.rb +5 -5
  26. data/lib/railroader/checks/check_model_attributes.rb +6 -6
  27. data/lib/railroader/checks/check_model_serialize.rb +2 -2
  28. data/lib/railroader/checks/check_nested_attributes.rb +2 -2
  29. data/lib/railroader/checks/check_nested_attributes_bypass.rb +1 -1
  30. data/lib/railroader/checks/check_quote_table_name.rb +3 -3
  31. data/lib/railroader/checks/check_redirect.rb +19 -19
  32. data/lib/railroader/checks/check_regex_dos.rb +3 -3
  33. data/lib/railroader/checks/check_render.rb +4 -4
  34. data/lib/railroader/checks/check_response_splitting.rb +2 -2
  35. data/lib/railroader/checks/check_safe_buffer_manipulation.rb +4 -4
  36. data/lib/railroader/checks/check_sanitize_methods.rb +2 -2
  37. data/lib/railroader/checks/check_select_tag.rb +4 -4
  38. data/lib/railroader/checks/check_select_vulnerability.rb +3 -3
  39. data/lib/railroader/checks/check_send.rb +1 -1
  40. data/lib/railroader/checks/check_send_file.rb +1 -1
  41. data/lib/railroader/checks/check_session_settings.rb +10 -10
  42. data/lib/railroader/checks/check_single_quotes.rb +8 -8
  43. data/lib/railroader/checks/check_skip_before_filter.rb +5 -5
  44. data/lib/railroader/checks/check_sql.rb +41 -41
  45. data/lib/railroader/checks/check_strip_tags.rb +6 -6
  46. data/lib/railroader/checks/check_symbol_dos_cve.rb +0 -1
  47. data/lib/railroader/checks/check_translate_bug.rb +4 -4
  48. data/lib/railroader/checks/check_unsafe_reflection.rb +1 -1
  49. data/lib/railroader/checks/check_validation_regex.rb +7 -7
  50. data/lib/railroader/checks/check_weak_hash.rb +1 -1
  51. data/lib/railroader/checks/check_without_protection.rb +9 -9
  52. data/lib/railroader/checks/check_yaml_parsing.rb +5 -5
  53. data/lib/railroader/checks.rb +18 -18
  54. data/lib/railroader/commandline.rb +1 -1
  55. data/lib/railroader/differ.rb +2 -2
  56. data/lib/railroader/options.rb +7 -7
  57. data/lib/railroader/parsers/rails2_erubis.rb +1 -1
  58. data/lib/railroader/parsers/rails2_xss_plugin_erubis.rb +4 -4
  59. data/lib/railroader/parsers/template_parser.rb +1 -1
  60. data/lib/railroader/processor.rb +17 -17
  61. data/lib/railroader/processors/alias_processor.rb +72 -72
  62. data/lib/railroader/processors/base_processor.rb +31 -31
  63. data/lib/railroader/processors/controller_alias_processor.rb +31 -31
  64. data/lib/railroader/processors/controller_processor.rb +29 -29
  65. data/lib/railroader/processors/erb_template_processor.rb +8 -8
  66. data/lib/railroader/processors/erubis_template_processor.rb +6 -6
  67. data/lib/railroader/processors/gem_processor.rb +1 -1
  68. data/lib/railroader/processors/haml_template_processor.rb +14 -14
  69. data/lib/railroader/processors/lib/call_conversion_helper.rb +1 -1
  70. data/lib/railroader/processors/lib/find_all_calls.rb +15 -15
  71. data/lib/railroader/processors/lib/find_call.rb +26 -26
  72. data/lib/railroader/processors/lib/find_return_value.rb +11 -11
  73. data/lib/railroader/processors/lib/module_helper.rb +1 -1
  74. data/lib/railroader/processors/lib/processor_helper.rb +4 -4
  75. data/lib/railroader/processors/lib/rails2_config_processor.rb +20 -20
  76. data/lib/railroader/processors/lib/rails2_route_processor.rb +38 -38
  77. data/lib/railroader/processors/lib/rails3_config_processor.rb +14 -14
  78. data/lib/railroader/processors/lib/rails3_route_processor.rb +16 -16
  79. data/lib/railroader/processors/lib/render_helper.rb +32 -32
  80. data/lib/railroader/processors/lib/route_helper.rb +12 -12
  81. data/lib/railroader/processors/library_processor.rb +1 -1
  82. data/lib/railroader/processors/model_processor.rb +9 -9
  83. data/lib/railroader/processors/output_processor.rb +3 -3
  84. data/lib/railroader/processors/slim_template_processor.rb +4 -4
  85. data/lib/railroader/processors/template_alias_processor.rb +10 -10
  86. data/lib/railroader/processors/template_processor.rb +7 -7
  87. data/lib/railroader/report/renderer.rb +1 -1
  88. data/lib/railroader/report/report_base.rb +12 -12
  89. data/lib/railroader/report/report_csv.rb +2 -2
  90. data/lib/railroader/report/report_html.rb +5 -5
  91. data/lib/railroader/report/report_markdown.rb +2 -2
  92. data/lib/railroader/report/report_table.rb +3 -3
  93. data/lib/railroader/report/report_tabs.rb +2 -2
  94. data/lib/railroader/report/report_text.rb +3 -4
  95. data/lib/railroader/report.rb +3 -3
  96. data/lib/railroader/rescanner.rb +36 -36
  97. data/lib/railroader/scanner.rb +23 -23
  98. data/lib/railroader/tracker/config.rb +3 -3
  99. data/lib/railroader/tracker/controller.rb +2 -2
  100. data/lib/railroader/tracker.rb +42 -42
  101. data/lib/railroader/util.rb +47 -47
  102. data/lib/railroader/version.rb +1 -1
  103. data/lib/railroader/warning.rb +9 -10
  104. data/lib/railroader.rb +32 -32
  105. data/lib/ruby_parser/bm_sexp.rb +63 -63
  106. data/lib/ruby_parser/bm_sexp_processor.rb +3 -3
  107. metadata +4 -4
@@ -1,23 +1,23 @@
1
1
  require 'thread'
2
2
  require 'railroader/differ'
3
3
 
4
- #Collects up results from running different checks.
4
+ # Collects up results from running different checks.
5
5
  #
6
- #Checks can be added with +Check.add(check_class)+
6
+ # Checks can be added with +Check.add(check_class)+
7
7
  #
8
- #All .rb files in checks/ will be loaded.
8
+ # All .rb files in checks/ will be loaded.
9
9
  class Railroader::Checks
10
10
  @checks = []
11
11
  @optional_checks = []
12
12
 
13
13
  attr_reader :warnings, :controller_warnings, :model_warnings, :template_warnings, :checks_run
14
14
 
15
- #Add a check. This will call +_klass_.new+ when running tests
15
+ # Add a check. This will call +_klass_.new+ when running tests
16
16
  def self.add klass
17
17
  @checks << klass unless @checks.include? klass
18
18
  end
19
19
 
20
- #Add an optional check
20
+ # Add an optional check
21
21
  def self.add_optional klass
22
22
  @optional_checks << klass unless @checks.include? klass
23
23
  end
@@ -31,7 +31,7 @@ class Railroader::Checks
31
31
  end
32
32
 
33
33
  def self.initialize_checks check_directory = ""
34
- #Load all files in check_directory
34
+ # Load all files in check_directory
35
35
  Dir.glob(File.join(check_directory, "*.rb")).sort.each do |f|
36
36
  require f
37
37
  end
@@ -55,7 +55,7 @@ class Railroader::Checks
55
55
  []
56
56
  end
57
57
 
58
- #No need to use this directly.
58
+ # No need to use this directly.
59
59
  def initialize options = { }
60
60
  if options[:min_confidence]
61
61
  @min_confidence = options[:min_confidence]
@@ -70,11 +70,11 @@ class Railroader::Checks
70
70
  @checks_run = []
71
71
  end
72
72
 
73
- #Add Warning to list of warnings to report.
74
- #Warnings are split into four different arrays
75
- #for template, controller, model, and generic warnings.
73
+ # Add Warning to list of warnings to report.
74
+ # Warnings are split into four different arrays
75
+ # for template, controller, model, and generic warnings.
76
76
  #
77
- #Will not add warnings which are below the minimum confidence level.
77
+ # Will not add warnings which are below the minimum confidence level.
78
78
  def add_warning warning
79
79
  unless warning.confidence > @min_confidence
80
80
  case warning.warning_set
@@ -92,7 +92,7 @@ class Railroader::Checks
92
92
  end
93
93
  end
94
94
 
95
- #Return a hash of arrays of new and fixed warnings
95
+ # Return a hash of arrays of new and fixed warnings
96
96
  #
97
97
  # diff = checks.diff old_checks
98
98
  # diff[:fixed] # [...]
@@ -103,13 +103,13 @@ class Railroader::Checks
103
103
  Railroader::Differ.new(my_warnings, other_warnings).diff
104
104
  end
105
105
 
106
- #Return an array of all warnings found.
106
+ # Return an array of all warnings found.
107
107
  def all_warnings
108
108
  @warnings + @template_warnings + @controller_warnings + @model_warnings
109
109
  end
110
110
 
111
- #Run all the checks on the given Tracker.
112
- #Returns a new instance of Checks with the results.
111
+ # Run all the checks on the given Tracker.
112
+ # Returns a new instance of Checks with the results.
113
113
  def self.run_checks(app_tree, tracker)
114
114
  checks = self.checks_to_run(tracker)
115
115
  check_runner = self.new :min_confidence => tracker.options[:min_confidence]
@@ -134,8 +134,8 @@ class Railroader::Checks
134
134
  results << self.run_a_check(c, error_mutex, app_tree, tracker)
135
135
  end
136
136
 
137
- #Maintain list of which checks were run
138
- #mainly for reporting purposes
137
+ # Maintain list of which checks were run
138
+ # mainly for reporting purposes
139
139
  check_runner.checks_run << check_name[5..-1]
140
140
  end
141
141
 
@@ -203,7 +203,7 @@ class Railroader::Checks
203
203
  end
204
204
  end
205
205
 
206
- #Load all files in checks/ directory
206
+ # Load all files in checks/ directory
207
207
  Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/checks/*.rb").sort.each do |f|
208
208
  require f.match(/(railroader\/checks\/.*)\.rb$/)[0]
209
209
  end
@@ -115,7 +115,7 @@ module Railroader
115
115
 
116
116
  # Runs a regular report based on the options provided.
117
117
  def regular_report options
118
- tracker = run_railroader options
118
+ tracker = run_railroader options
119
119
 
120
120
  if tracker.options[:exit_on_warn] and not tracker.filtered_warnings.empty?
121
121
  quit Railroader::Warnings_Found_Exit_Code
@@ -1,5 +1,5 @@
1
1
  # extracting the diff logic to it's own class for consistency. Currently handles
2
- # an array of Railroader::Warnings or plain hash representations.
2
+ # an array of Railroader::Warnings or plain hash representations.
3
3
  class Railroader::Differ
4
4
  DEFAULT_HASH = {:new => [], :fixed => []}
5
5
  OLD_WARNING_KEYS = [:warning_type, :location, :code, :message, :file, :link, :confidence, :user_input]
@@ -48,7 +48,7 @@ class Railroader::Differ
48
48
 
49
49
  def eql_except_line_number new_warning, fixed_warning
50
50
  # can't do this ahead of time, as callers may be expecting a Railroader::Warning
51
- if new_warning.is_a? Railroader::Warning
51
+ if new_warning.is_a? Railroader::Warning
52
52
  new_warning = new_warning.to_hash
53
53
  fixed_warning = fixed_warning.to_hash
54
54
  end
@@ -1,22 +1,22 @@
1
1
  require 'optparse'
2
2
  require 'set'
3
3
 
4
- #Parses command line arguments for Railroader
4
+ # Parses command line arguments for Railroader
5
5
  module Railroader::Options
6
6
 
7
7
  class << self
8
8
 
9
- #Parse argument array
9
+ # Parse argument array
10
10
  def parse args
11
11
  get_options args
12
12
  end
13
13
 
14
- #Parse arguments and remove them from the array as they are matched
14
+ # Parse arguments and remove them from the array as they are matched
15
15
  def parse! args
16
16
  get_options args, true
17
17
  end
18
18
 
19
- #Return hash of options and the parser
19
+ # Return hash of options and the parser
20
20
  def get_options args, destructive = false
21
21
  options = {}
22
22
 
@@ -55,7 +55,7 @@ module Railroader::Options
55
55
  options[:quiet] = quiet
56
56
  end
57
57
 
58
- opts.on( "-z", "--[no-]exit-on-warn", "Exit code is non-zero if warnings found (Default)") do |exit_on_warn|
58
+ opts.on("-z", "--[no-]exit-on-warn", "Exit code is non-zero if warnings found (Default)") do |exit_on_warn|
59
59
  options[:exit_on_warn] = exit_on_warn
60
60
  end
61
61
 
@@ -171,7 +171,7 @@ module Railroader::Options
171
171
 
172
172
  opts.on "-t", "--test Check1,Check2,etc", Array, "Only run the specified checks" do |checks|
173
173
  checks.each_with_index do |s, index|
174
- if s[0,5] != "Check"
174
+ if s[0, 5] != "Check"
175
175
  checks[index] = "Check" << s
176
176
  end
177
177
  end
@@ -182,7 +182,7 @@ module Railroader::Options
182
182
 
183
183
  opts.on "-x", "--except Check1,Check2,etc", Array, "Skip the specified checks" do |skip|
184
184
  skip.each do |s|
185
- if s[0,5] != "Check"
185
+ if s[0, 5] != "Check"
186
186
  s = "Check" << s
187
187
  end
188
188
 
@@ -1,6 +1,6 @@
1
1
  Railroader.load_railroader_dependency 'erubis'
2
2
 
3
- #Erubis processor which ignores any output which is plain text.
3
+ # Erubis processor which ignores any output which is plain text.
4
4
  class Railroader::ScannerErubis < Erubis::Eruby
5
5
  include Erubis::NoTextEnhancer
6
6
  end
@@ -1,12 +1,12 @@
1
1
  Railroader.load_railroader_dependency 'erubis'
2
2
 
3
- #This is from the rails_xss plugin for Rails 2
3
+ # This is from the rails_xss plugin for Rails 2
4
4
  class Railroader::Rails2XSSPluginErubis < ::Erubis::Eruby
5
5
  def add_preamble(src)
6
- #src << "@output_buffer = ActiveSupport::SafeBuffer.new;"
6
+ # src << "@output_buffer = ActiveSupport::SafeBuffer.new;"
7
7
  end
8
8
 
9
- #This is different from rails_xss - fixes some line number issues
9
+ # This is different from rails_xss - fixes some line number issues
10
10
  def add_text(src, text)
11
11
  if text == "\n"
12
12
  src << "\n"
@@ -43,6 +43,6 @@ class Railroader::Rails2XSSPluginErubis < ::Erubis::Eruby
43
43
  end
44
44
 
45
45
  def add_postamble(src)
46
- #src << '@output_buffer.to_s'
46
+ # src << '@output_buffer.to_s'
47
47
  end
48
48
  end
@@ -60,7 +60,7 @@ module Railroader
60
60
  require 'erb'
61
61
  src = if ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+
62
62
  ERB.new(text, trim_mode: path).src
63
- else
63
+ else
64
64
  ERB.new(text, nil, path).src
65
65
  end
66
66
  src.sub!(/^#.*\n/, '') if Railroader::Scanner::RUBY_1_9
@@ -1,14 +1,14 @@
1
- #Load all files in processors/
1
+ # Load all files in processors/
2
2
  Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/processors/*.rb").each { |f| require f.match(/railroader\/processors.*/)[0] }
3
3
  require 'railroader/tracker'
4
4
  require 'set'
5
5
  require 'pathname'
6
6
 
7
7
  module Railroader
8
- #Makes calls to the appropriate processor.
8
+ # Makes calls to the appropriate processor.
9
9
  #
10
- #The ControllerProcessor, TemplateProcessor, and ModelProcessor will
11
- #update the Tracker with information about what is parsed.
10
+ # The ControllerProcessor, TemplateProcessor, and ModelProcessor will
11
+ # update the Tracker with information about what is parsed.
12
12
  class Processor
13
13
  include Util
14
14
 
@@ -21,22 +21,22 @@ module Railroader
21
21
  @tracker
22
22
  end
23
23
 
24
- #Process configuration file source
24
+ # Process configuration file source
25
25
  def process_config src, file_name
26
26
  ConfigProcessor.new(@tracker).process_config src, file_name
27
27
  end
28
28
 
29
- #Process Gemfile
29
+ # Process Gemfile
30
30
  def process_gems gem_files
31
31
  GemProcessor.new(@tracker).process_gems gem_files
32
32
  end
33
33
 
34
- #Process route file source
34
+ # Process route file source
35
35
  def process_routes src
36
36
  RoutesProcessor.new(@tracker).process_routes src
37
37
  end
38
38
 
39
- #Process controller source. +file_name+ is used for reporting
39
+ # Process controller source. +file_name+ is used for reporting
40
40
  def process_controller src, file_name
41
41
  if contains_class? src
42
42
  ControllerProcessor.new(@app_tree, @tracker).process_controller src, file_name
@@ -45,19 +45,19 @@ module Railroader
45
45
  end
46
46
  end
47
47
 
48
- #Process variable aliasing in controller source and save it in the
49
- #tracker.
48
+ # Process variable aliasing in controller source and save it in the
49
+ # tracker.
50
50
  def process_controller_alias name, src, only_method = nil, file = nil
51
51
  ControllerAliasProcessor.new(@app_tree, @tracker, only_method).process_controller name, src, file
52
52
  end
53
53
 
54
- #Process a model source
54
+ # Process a model source
55
55
  def process_model src, file_name
56
56
  result = ModelProcessor.new(@tracker).process_model src, file_name
57
57
  AliasProcessor.new(@tracker).process result if result
58
58
  end
59
59
 
60
- #Process either an ERB or HAML template
60
+ # Process either an ERB or HAML template
61
61
  def process_template name, src, type, called_from = nil, file_name = nil
62
62
  case type
63
63
  when :erb
@@ -72,8 +72,8 @@ module Railroader
72
72
  abort "Unknown template type: #{type} (#{name})"
73
73
  end
74
74
 
75
- #Each template which is rendered is stored separately
76
- #with a new name.
75
+ # Each template which is rendered is stored separately
76
+ # with a new name.
77
77
  if called_from
78
78
  name = ("#{name}.#{called_from}").to_sym
79
79
  end
@@ -82,19 +82,19 @@ module Railroader
82
82
  @tracker.templates[name].type = type
83
83
  end
84
84
 
85
- #Process any calls to render() within a template
85
+ # Process any calls to render() within a template
86
86
  def process_template_alias template
87
87
  TemplateAliasProcessor.new(@tracker, template).process_safely template.src
88
88
  end
89
89
 
90
- #Process source for initializing files
90
+ # Process source for initializing files
91
91
  def process_initializer file_name, src
92
92
  res = BaseProcessor.new(@tracker).process_file src, file_name
93
93
  res = AliasProcessor.new(@tracker).process_safely res, nil, file_name
94
94
  @tracker.initializers[Pathname.new(file_name).basename.to_s] = res
95
95
  end
96
96
 
97
- #Process source for a library file
97
+ # Process source for a library file
98
98
  def process_lib src, file_name
99
99
  LibraryProcessor.new(@tracker).process_library src, file_name
100
100
  end