railroader 4.3.5 → 4.3.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGES.md +16 -0
- data/README.md +15 -0
- data/bin/railroader +1 -1
- data/lib/railroader/call_index.rb +11 -11
- data/lib/railroader/checks/base_check.rb +43 -43
- data/lib/railroader/checks/check_basic_auth.rb +3 -3
- data/lib/railroader/checks/check_content_tag.rb +9 -9
- data/lib/railroader/checks/check_create_with.rb +2 -2
- data/lib/railroader/checks/check_cross_site_scripting.rb +24 -24
- data/lib/railroader/checks/check_default_routes.rb +5 -5
- data/lib/railroader/checks/check_deserialize.rb +1 -1
- data/lib/railroader/checks/check_dynamic_finders.rb +1 -1
- data/lib/railroader/checks/check_escape_function.rb +3 -3
- data/lib/railroader/checks/check_evaluation.rb +4 -4
- data/lib/railroader/checks/check_execute.rb +8 -8
- data/lib/railroader/checks/check_file_access.rb +2 -2
- data/lib/railroader/checks/check_filter_skipping.rb +2 -2
- data/lib/railroader/checks/check_forgery_setting.rb +3 -3
- data/lib/railroader/checks/check_jruby_xml.rb +1 -1
- data/lib/railroader/checks/check_json_parsing.rb +2 -2
- data/lib/railroader/checks/check_link_to.rb +12 -12
- data/lib/railroader/checks/check_link_to_href.rb +9 -9
- data/lib/railroader/checks/check_mail_to.rb +4 -4
- data/lib/railroader/checks/check_mass_assignment.rb +5 -5
- data/lib/railroader/checks/check_model_attributes.rb +6 -6
- data/lib/railroader/checks/check_model_serialize.rb +2 -2
- data/lib/railroader/checks/check_nested_attributes.rb +2 -2
- data/lib/railroader/checks/check_nested_attributes_bypass.rb +1 -1
- data/lib/railroader/checks/check_quote_table_name.rb +3 -3
- data/lib/railroader/checks/check_redirect.rb +19 -19
- data/lib/railroader/checks/check_regex_dos.rb +3 -3
- data/lib/railroader/checks/check_render.rb +4 -4
- data/lib/railroader/checks/check_response_splitting.rb +2 -2
- data/lib/railroader/checks/check_safe_buffer_manipulation.rb +4 -4
- data/lib/railroader/checks/check_sanitize_methods.rb +2 -2
- data/lib/railroader/checks/check_select_tag.rb +4 -4
- data/lib/railroader/checks/check_select_vulnerability.rb +3 -3
- data/lib/railroader/checks/check_send.rb +1 -1
- data/lib/railroader/checks/check_send_file.rb +1 -1
- data/lib/railroader/checks/check_session_settings.rb +10 -10
- data/lib/railroader/checks/check_single_quotes.rb +8 -8
- data/lib/railroader/checks/check_skip_before_filter.rb +5 -5
- data/lib/railroader/checks/check_sql.rb +41 -41
- data/lib/railroader/checks/check_strip_tags.rb +6 -6
- data/lib/railroader/checks/check_symbol_dos_cve.rb +0 -1
- data/lib/railroader/checks/check_translate_bug.rb +4 -4
- data/lib/railroader/checks/check_unsafe_reflection.rb +1 -1
- data/lib/railroader/checks/check_validation_regex.rb +7 -7
- data/lib/railroader/checks/check_weak_hash.rb +1 -1
- data/lib/railroader/checks/check_without_protection.rb +9 -9
- data/lib/railroader/checks/check_yaml_parsing.rb +5 -5
- data/lib/railroader/checks.rb +18 -18
- data/lib/railroader/commandline.rb +1 -1
- data/lib/railroader/differ.rb +2 -2
- data/lib/railroader/options.rb +7 -7
- data/lib/railroader/parsers/rails2_erubis.rb +1 -1
- data/lib/railroader/parsers/rails2_xss_plugin_erubis.rb +4 -4
- data/lib/railroader/parsers/template_parser.rb +1 -1
- data/lib/railroader/processor.rb +17 -17
- data/lib/railroader/processors/alias_processor.rb +72 -72
- data/lib/railroader/processors/base_processor.rb +31 -31
- data/lib/railroader/processors/controller_alias_processor.rb +31 -31
- data/lib/railroader/processors/controller_processor.rb +29 -29
- data/lib/railroader/processors/erb_template_processor.rb +8 -8
- data/lib/railroader/processors/erubis_template_processor.rb +6 -6
- data/lib/railroader/processors/gem_processor.rb +1 -1
- data/lib/railroader/processors/haml_template_processor.rb +14 -14
- data/lib/railroader/processors/lib/call_conversion_helper.rb +1 -1
- data/lib/railroader/processors/lib/find_all_calls.rb +15 -15
- data/lib/railroader/processors/lib/find_call.rb +26 -26
- data/lib/railroader/processors/lib/find_return_value.rb +11 -11
- data/lib/railroader/processors/lib/module_helper.rb +1 -1
- data/lib/railroader/processors/lib/processor_helper.rb +4 -4
- data/lib/railroader/processors/lib/rails2_config_processor.rb +20 -20
- data/lib/railroader/processors/lib/rails2_route_processor.rb +38 -38
- data/lib/railroader/processors/lib/rails3_config_processor.rb +14 -14
- data/lib/railroader/processors/lib/rails3_route_processor.rb +16 -16
- data/lib/railroader/processors/lib/render_helper.rb +32 -32
- data/lib/railroader/processors/lib/route_helper.rb +12 -12
- data/lib/railroader/processors/library_processor.rb +1 -1
- data/lib/railroader/processors/model_processor.rb +9 -9
- data/lib/railroader/processors/output_processor.rb +3 -3
- data/lib/railroader/processors/slim_template_processor.rb +4 -4
- data/lib/railroader/processors/template_alias_processor.rb +10 -10
- data/lib/railroader/processors/template_processor.rb +7 -7
- data/lib/railroader/report/renderer.rb +1 -1
- data/lib/railroader/report/report_base.rb +12 -12
- data/lib/railroader/report/report_csv.rb +2 -2
- data/lib/railroader/report/report_html.rb +5 -5
- data/lib/railroader/report/report_markdown.rb +2 -2
- data/lib/railroader/report/report_table.rb +3 -3
- data/lib/railroader/report/report_tabs.rb +2 -2
- data/lib/railroader/report/report_text.rb +3 -4
- data/lib/railroader/report.rb +3 -3
- data/lib/railroader/rescanner.rb +36 -36
- data/lib/railroader/scanner.rb +23 -23
- data/lib/railroader/tracker/config.rb +3 -3
- data/lib/railroader/tracker/controller.rb +2 -2
- data/lib/railroader/tracker.rb +42 -42
- data/lib/railroader/util.rb +47 -47
- data/lib/railroader/version.rb +1 -1
- data/lib/railroader/warning.rb +9 -10
- data/lib/railroader.rb +32 -32
- data/lib/ruby_parser/bm_sexp.rb +63 -63
- data/lib/ruby_parser/bm_sexp_processor.rb +3 -3
- metadata +4 -4
data/lib/railroader/checks.rb
CHANGED
@@ -1,23 +1,23 @@
|
|
1
1
|
require 'thread'
|
2
2
|
require 'railroader/differ'
|
3
3
|
|
4
|
-
#Collects up results from running different checks.
|
4
|
+
# Collects up results from running different checks.
|
5
5
|
#
|
6
|
-
#Checks can be added with +Check.add(check_class)+
|
6
|
+
# Checks can be added with +Check.add(check_class)+
|
7
7
|
#
|
8
|
-
#All .rb files in checks/ will be loaded.
|
8
|
+
# All .rb files in checks/ will be loaded.
|
9
9
|
class Railroader::Checks
|
10
10
|
@checks = []
|
11
11
|
@optional_checks = []
|
12
12
|
|
13
13
|
attr_reader :warnings, :controller_warnings, :model_warnings, :template_warnings, :checks_run
|
14
14
|
|
15
|
-
#Add a check. This will call +_klass_.new+ when running tests
|
15
|
+
# Add a check. This will call +_klass_.new+ when running tests
|
16
16
|
def self.add klass
|
17
17
|
@checks << klass unless @checks.include? klass
|
18
18
|
end
|
19
19
|
|
20
|
-
#Add an optional check
|
20
|
+
# Add an optional check
|
21
21
|
def self.add_optional klass
|
22
22
|
@optional_checks << klass unless @checks.include? klass
|
23
23
|
end
|
@@ -31,7 +31,7 @@ class Railroader::Checks
|
|
31
31
|
end
|
32
32
|
|
33
33
|
def self.initialize_checks check_directory = ""
|
34
|
-
#Load all files in check_directory
|
34
|
+
# Load all files in check_directory
|
35
35
|
Dir.glob(File.join(check_directory, "*.rb")).sort.each do |f|
|
36
36
|
require f
|
37
37
|
end
|
@@ -55,7 +55,7 @@ class Railroader::Checks
|
|
55
55
|
[]
|
56
56
|
end
|
57
57
|
|
58
|
-
#No need to use this directly.
|
58
|
+
# No need to use this directly.
|
59
59
|
def initialize options = { }
|
60
60
|
if options[:min_confidence]
|
61
61
|
@min_confidence = options[:min_confidence]
|
@@ -70,11 +70,11 @@ class Railroader::Checks
|
|
70
70
|
@checks_run = []
|
71
71
|
end
|
72
72
|
|
73
|
-
#Add Warning to list of warnings to report.
|
74
|
-
#Warnings are split into four different arrays
|
75
|
-
#for template, controller, model, and generic warnings.
|
73
|
+
# Add Warning to list of warnings to report.
|
74
|
+
# Warnings are split into four different arrays
|
75
|
+
# for template, controller, model, and generic warnings.
|
76
76
|
#
|
77
|
-
#Will not add warnings which are below the minimum confidence level.
|
77
|
+
# Will not add warnings which are below the minimum confidence level.
|
78
78
|
def add_warning warning
|
79
79
|
unless warning.confidence > @min_confidence
|
80
80
|
case warning.warning_set
|
@@ -92,7 +92,7 @@ class Railroader::Checks
|
|
92
92
|
end
|
93
93
|
end
|
94
94
|
|
95
|
-
#Return a hash of arrays of new and fixed warnings
|
95
|
+
# Return a hash of arrays of new and fixed warnings
|
96
96
|
#
|
97
97
|
# diff = checks.diff old_checks
|
98
98
|
# diff[:fixed] # [...]
|
@@ -103,13 +103,13 @@ class Railroader::Checks
|
|
103
103
|
Railroader::Differ.new(my_warnings, other_warnings).diff
|
104
104
|
end
|
105
105
|
|
106
|
-
#Return an array of all warnings found.
|
106
|
+
# Return an array of all warnings found.
|
107
107
|
def all_warnings
|
108
108
|
@warnings + @template_warnings + @controller_warnings + @model_warnings
|
109
109
|
end
|
110
110
|
|
111
|
-
#Run all the checks on the given Tracker.
|
112
|
-
#Returns a new instance of Checks with the results.
|
111
|
+
# Run all the checks on the given Tracker.
|
112
|
+
# Returns a new instance of Checks with the results.
|
113
113
|
def self.run_checks(app_tree, tracker)
|
114
114
|
checks = self.checks_to_run(tracker)
|
115
115
|
check_runner = self.new :min_confidence => tracker.options[:min_confidence]
|
@@ -134,8 +134,8 @@ class Railroader::Checks
|
|
134
134
|
results << self.run_a_check(c, error_mutex, app_tree, tracker)
|
135
135
|
end
|
136
136
|
|
137
|
-
#Maintain list of which checks were run
|
138
|
-
#mainly for reporting purposes
|
137
|
+
# Maintain list of which checks were run
|
138
|
+
# mainly for reporting purposes
|
139
139
|
check_runner.checks_run << check_name[5..-1]
|
140
140
|
end
|
141
141
|
|
@@ -203,7 +203,7 @@ class Railroader::Checks
|
|
203
203
|
end
|
204
204
|
end
|
205
205
|
|
206
|
-
#Load all files in checks/ directory
|
206
|
+
# Load all files in checks/ directory
|
207
207
|
Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/checks/*.rb").sort.each do |f|
|
208
208
|
require f.match(/(railroader\/checks\/.*)\.rb$/)[0]
|
209
209
|
end
|
@@ -115,7 +115,7 @@ module Railroader
|
|
115
115
|
|
116
116
|
# Runs a regular report based on the options provided.
|
117
117
|
def regular_report options
|
118
|
-
tracker = run_railroader options
|
118
|
+
tracker = run_railroader options
|
119
119
|
|
120
120
|
if tracker.options[:exit_on_warn] and not tracker.filtered_warnings.empty?
|
121
121
|
quit Railroader::Warnings_Found_Exit_Code
|
data/lib/railroader/differ.rb
CHANGED
@@ -1,5 +1,5 @@
|
|
1
1
|
# extracting the diff logic to it's own class for consistency. Currently handles
|
2
|
-
# an array of Railroader::Warnings or plain hash representations.
|
2
|
+
# an array of Railroader::Warnings or plain hash representations.
|
3
3
|
class Railroader::Differ
|
4
4
|
DEFAULT_HASH = {:new => [], :fixed => []}
|
5
5
|
OLD_WARNING_KEYS = [:warning_type, :location, :code, :message, :file, :link, :confidence, :user_input]
|
@@ -48,7 +48,7 @@ class Railroader::Differ
|
|
48
48
|
|
49
49
|
def eql_except_line_number new_warning, fixed_warning
|
50
50
|
# can't do this ahead of time, as callers may be expecting a Railroader::Warning
|
51
|
-
if new_warning.is_a? Railroader::Warning
|
51
|
+
if new_warning.is_a? Railroader::Warning
|
52
52
|
new_warning = new_warning.to_hash
|
53
53
|
fixed_warning = fixed_warning.to_hash
|
54
54
|
end
|
data/lib/railroader/options.rb
CHANGED
@@ -1,22 +1,22 @@
|
|
1
1
|
require 'optparse'
|
2
2
|
require 'set'
|
3
3
|
|
4
|
-
#Parses command line arguments for Railroader
|
4
|
+
# Parses command line arguments for Railroader
|
5
5
|
module Railroader::Options
|
6
6
|
|
7
7
|
class << self
|
8
8
|
|
9
|
-
#Parse argument array
|
9
|
+
# Parse argument array
|
10
10
|
def parse args
|
11
11
|
get_options args
|
12
12
|
end
|
13
13
|
|
14
|
-
#Parse arguments and remove them from the array as they are matched
|
14
|
+
# Parse arguments and remove them from the array as they are matched
|
15
15
|
def parse! args
|
16
16
|
get_options args, true
|
17
17
|
end
|
18
18
|
|
19
|
-
#Return hash of options and the parser
|
19
|
+
# Return hash of options and the parser
|
20
20
|
def get_options args, destructive = false
|
21
21
|
options = {}
|
22
22
|
|
@@ -55,7 +55,7 @@ module Railroader::Options
|
|
55
55
|
options[:quiet] = quiet
|
56
56
|
end
|
57
57
|
|
58
|
-
opts.on(
|
58
|
+
opts.on("-z", "--[no-]exit-on-warn", "Exit code is non-zero if warnings found (Default)") do |exit_on_warn|
|
59
59
|
options[:exit_on_warn] = exit_on_warn
|
60
60
|
end
|
61
61
|
|
@@ -171,7 +171,7 @@ module Railroader::Options
|
|
171
171
|
|
172
172
|
opts.on "-t", "--test Check1,Check2,etc", Array, "Only run the specified checks" do |checks|
|
173
173
|
checks.each_with_index do |s, index|
|
174
|
-
if s[0,5] != "Check"
|
174
|
+
if s[0, 5] != "Check"
|
175
175
|
checks[index] = "Check" << s
|
176
176
|
end
|
177
177
|
end
|
@@ -182,7 +182,7 @@ module Railroader::Options
|
|
182
182
|
|
183
183
|
opts.on "-x", "--except Check1,Check2,etc", Array, "Skip the specified checks" do |skip|
|
184
184
|
skip.each do |s|
|
185
|
-
if s[0,5] != "Check"
|
185
|
+
if s[0, 5] != "Check"
|
186
186
|
s = "Check" << s
|
187
187
|
end
|
188
188
|
|
@@ -1,6 +1,6 @@
|
|
1
1
|
Railroader.load_railroader_dependency 'erubis'
|
2
2
|
|
3
|
-
#Erubis processor which ignores any output which is plain text.
|
3
|
+
# Erubis processor which ignores any output which is plain text.
|
4
4
|
class Railroader::ScannerErubis < Erubis::Eruby
|
5
5
|
include Erubis::NoTextEnhancer
|
6
6
|
end
|
@@ -1,12 +1,12 @@
|
|
1
1
|
Railroader.load_railroader_dependency 'erubis'
|
2
2
|
|
3
|
-
#This is from the rails_xss plugin for Rails 2
|
3
|
+
# This is from the rails_xss plugin for Rails 2
|
4
4
|
class Railroader::Rails2XSSPluginErubis < ::Erubis::Eruby
|
5
5
|
def add_preamble(src)
|
6
|
-
#src << "@output_buffer = ActiveSupport::SafeBuffer.new;"
|
6
|
+
# src << "@output_buffer = ActiveSupport::SafeBuffer.new;"
|
7
7
|
end
|
8
8
|
|
9
|
-
#This is different from rails_xss - fixes some line number issues
|
9
|
+
# This is different from rails_xss - fixes some line number issues
|
10
10
|
def add_text(src, text)
|
11
11
|
if text == "\n"
|
12
12
|
src << "\n"
|
@@ -43,6 +43,6 @@ class Railroader::Rails2XSSPluginErubis < ::Erubis::Eruby
|
|
43
43
|
end
|
44
44
|
|
45
45
|
def add_postamble(src)
|
46
|
-
#src << '@output_buffer.to_s'
|
46
|
+
# src << '@output_buffer.to_s'
|
47
47
|
end
|
48
48
|
end
|
@@ -60,7 +60,7 @@ module Railroader
|
|
60
60
|
require 'erb'
|
61
61
|
src = if ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+
|
62
62
|
ERB.new(text, trim_mode: path).src
|
63
|
-
|
63
|
+
else
|
64
64
|
ERB.new(text, nil, path).src
|
65
65
|
end
|
66
66
|
src.sub!(/^#.*\n/, '') if Railroader::Scanner::RUBY_1_9
|
data/lib/railroader/processor.rb
CHANGED
@@ -1,14 +1,14 @@
|
|
1
|
-
#Load all files in processors/
|
1
|
+
# Load all files in processors/
|
2
2
|
Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/processors/*.rb").each { |f| require f.match(/railroader\/processors.*/)[0] }
|
3
3
|
require 'railroader/tracker'
|
4
4
|
require 'set'
|
5
5
|
require 'pathname'
|
6
6
|
|
7
7
|
module Railroader
|
8
|
-
#Makes calls to the appropriate processor.
|
8
|
+
# Makes calls to the appropriate processor.
|
9
9
|
#
|
10
|
-
#The ControllerProcessor, TemplateProcessor, and ModelProcessor will
|
11
|
-
#update the Tracker with information about what is parsed.
|
10
|
+
# The ControllerProcessor, TemplateProcessor, and ModelProcessor will
|
11
|
+
# update the Tracker with information about what is parsed.
|
12
12
|
class Processor
|
13
13
|
include Util
|
14
14
|
|
@@ -21,22 +21,22 @@ module Railroader
|
|
21
21
|
@tracker
|
22
22
|
end
|
23
23
|
|
24
|
-
#Process configuration file source
|
24
|
+
# Process configuration file source
|
25
25
|
def process_config src, file_name
|
26
26
|
ConfigProcessor.new(@tracker).process_config src, file_name
|
27
27
|
end
|
28
28
|
|
29
|
-
#Process Gemfile
|
29
|
+
# Process Gemfile
|
30
30
|
def process_gems gem_files
|
31
31
|
GemProcessor.new(@tracker).process_gems gem_files
|
32
32
|
end
|
33
33
|
|
34
|
-
#Process route file source
|
34
|
+
# Process route file source
|
35
35
|
def process_routes src
|
36
36
|
RoutesProcessor.new(@tracker).process_routes src
|
37
37
|
end
|
38
38
|
|
39
|
-
#Process controller source. +file_name+ is used for reporting
|
39
|
+
# Process controller source. +file_name+ is used for reporting
|
40
40
|
def process_controller src, file_name
|
41
41
|
if contains_class? src
|
42
42
|
ControllerProcessor.new(@app_tree, @tracker).process_controller src, file_name
|
@@ -45,19 +45,19 @@ module Railroader
|
|
45
45
|
end
|
46
46
|
end
|
47
47
|
|
48
|
-
#Process variable aliasing in controller source and save it in the
|
49
|
-
#tracker.
|
48
|
+
# Process variable aliasing in controller source and save it in the
|
49
|
+
# tracker.
|
50
50
|
def process_controller_alias name, src, only_method = nil, file = nil
|
51
51
|
ControllerAliasProcessor.new(@app_tree, @tracker, only_method).process_controller name, src, file
|
52
52
|
end
|
53
53
|
|
54
|
-
#Process a model source
|
54
|
+
# Process a model source
|
55
55
|
def process_model src, file_name
|
56
56
|
result = ModelProcessor.new(@tracker).process_model src, file_name
|
57
57
|
AliasProcessor.new(@tracker).process result if result
|
58
58
|
end
|
59
59
|
|
60
|
-
#Process either an ERB or HAML template
|
60
|
+
# Process either an ERB or HAML template
|
61
61
|
def process_template name, src, type, called_from = nil, file_name = nil
|
62
62
|
case type
|
63
63
|
when :erb
|
@@ -72,8 +72,8 @@ module Railroader
|
|
72
72
|
abort "Unknown template type: #{type} (#{name})"
|
73
73
|
end
|
74
74
|
|
75
|
-
#Each template which is rendered is stored separately
|
76
|
-
#with a new name.
|
75
|
+
# Each template which is rendered is stored separately
|
76
|
+
# with a new name.
|
77
77
|
if called_from
|
78
78
|
name = ("#{name}.#{called_from}").to_sym
|
79
79
|
end
|
@@ -82,19 +82,19 @@ module Railroader
|
|
82
82
|
@tracker.templates[name].type = type
|
83
83
|
end
|
84
84
|
|
85
|
-
#Process any calls to render() within a template
|
85
|
+
# Process any calls to render() within a template
|
86
86
|
def process_template_alias template
|
87
87
|
TemplateAliasProcessor.new(@tracker, template).process_safely template.src
|
88
88
|
end
|
89
89
|
|
90
|
-
#Process source for initializing files
|
90
|
+
# Process source for initializing files
|
91
91
|
def process_initializer file_name, src
|
92
92
|
res = BaseProcessor.new(@tracker).process_file src, file_name
|
93
93
|
res = AliasProcessor.new(@tracker).process_safely res, nil, file_name
|
94
94
|
@tracker.initializers[Pathname.new(file_name).basename.to_s] = res
|
95
95
|
end
|
96
96
|
|
97
|
-
#Process source for a library file
|
97
|
+
# Process source for a library file
|
98
98
|
def process_lib src, file_name
|
99
99
|
LibraryProcessor.new(@tracker).process_library src, file_name
|
100
100
|
end
|