railroader 4.3.5 → 4.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (107) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +16 -0
  3. data/README.md +15 -0
  4. data/bin/railroader +1 -1
  5. data/lib/railroader/call_index.rb +11 -11
  6. data/lib/railroader/checks/base_check.rb +43 -43
  7. data/lib/railroader/checks/check_basic_auth.rb +3 -3
  8. data/lib/railroader/checks/check_content_tag.rb +9 -9
  9. data/lib/railroader/checks/check_create_with.rb +2 -2
  10. data/lib/railroader/checks/check_cross_site_scripting.rb +24 -24
  11. data/lib/railroader/checks/check_default_routes.rb +5 -5
  12. data/lib/railroader/checks/check_deserialize.rb +1 -1
  13. data/lib/railroader/checks/check_dynamic_finders.rb +1 -1
  14. data/lib/railroader/checks/check_escape_function.rb +3 -3
  15. data/lib/railroader/checks/check_evaluation.rb +4 -4
  16. data/lib/railroader/checks/check_execute.rb +8 -8
  17. data/lib/railroader/checks/check_file_access.rb +2 -2
  18. data/lib/railroader/checks/check_filter_skipping.rb +2 -2
  19. data/lib/railroader/checks/check_forgery_setting.rb +3 -3
  20. data/lib/railroader/checks/check_jruby_xml.rb +1 -1
  21. data/lib/railroader/checks/check_json_parsing.rb +2 -2
  22. data/lib/railroader/checks/check_link_to.rb +12 -12
  23. data/lib/railroader/checks/check_link_to_href.rb +9 -9
  24. data/lib/railroader/checks/check_mail_to.rb +4 -4
  25. data/lib/railroader/checks/check_mass_assignment.rb +5 -5
  26. data/lib/railroader/checks/check_model_attributes.rb +6 -6
  27. data/lib/railroader/checks/check_model_serialize.rb +2 -2
  28. data/lib/railroader/checks/check_nested_attributes.rb +2 -2
  29. data/lib/railroader/checks/check_nested_attributes_bypass.rb +1 -1
  30. data/lib/railroader/checks/check_quote_table_name.rb +3 -3
  31. data/lib/railroader/checks/check_redirect.rb +19 -19
  32. data/lib/railroader/checks/check_regex_dos.rb +3 -3
  33. data/lib/railroader/checks/check_render.rb +4 -4
  34. data/lib/railroader/checks/check_response_splitting.rb +2 -2
  35. data/lib/railroader/checks/check_safe_buffer_manipulation.rb +4 -4
  36. data/lib/railroader/checks/check_sanitize_methods.rb +2 -2
  37. data/lib/railroader/checks/check_select_tag.rb +4 -4
  38. data/lib/railroader/checks/check_select_vulnerability.rb +3 -3
  39. data/lib/railroader/checks/check_send.rb +1 -1
  40. data/lib/railroader/checks/check_send_file.rb +1 -1
  41. data/lib/railroader/checks/check_session_settings.rb +10 -10
  42. data/lib/railroader/checks/check_single_quotes.rb +8 -8
  43. data/lib/railroader/checks/check_skip_before_filter.rb +5 -5
  44. data/lib/railroader/checks/check_sql.rb +41 -41
  45. data/lib/railroader/checks/check_strip_tags.rb +6 -6
  46. data/lib/railroader/checks/check_symbol_dos_cve.rb +0 -1
  47. data/lib/railroader/checks/check_translate_bug.rb +4 -4
  48. data/lib/railroader/checks/check_unsafe_reflection.rb +1 -1
  49. data/lib/railroader/checks/check_validation_regex.rb +7 -7
  50. data/lib/railroader/checks/check_weak_hash.rb +1 -1
  51. data/lib/railroader/checks/check_without_protection.rb +9 -9
  52. data/lib/railroader/checks/check_yaml_parsing.rb +5 -5
  53. data/lib/railroader/checks.rb +18 -18
  54. data/lib/railroader/commandline.rb +1 -1
  55. data/lib/railroader/differ.rb +2 -2
  56. data/lib/railroader/options.rb +7 -7
  57. data/lib/railroader/parsers/rails2_erubis.rb +1 -1
  58. data/lib/railroader/parsers/rails2_xss_plugin_erubis.rb +4 -4
  59. data/lib/railroader/parsers/template_parser.rb +1 -1
  60. data/lib/railroader/processor.rb +17 -17
  61. data/lib/railroader/processors/alias_processor.rb +72 -72
  62. data/lib/railroader/processors/base_processor.rb +31 -31
  63. data/lib/railroader/processors/controller_alias_processor.rb +31 -31
  64. data/lib/railroader/processors/controller_processor.rb +29 -29
  65. data/lib/railroader/processors/erb_template_processor.rb +8 -8
  66. data/lib/railroader/processors/erubis_template_processor.rb +6 -6
  67. data/lib/railroader/processors/gem_processor.rb +1 -1
  68. data/lib/railroader/processors/haml_template_processor.rb +14 -14
  69. data/lib/railroader/processors/lib/call_conversion_helper.rb +1 -1
  70. data/lib/railroader/processors/lib/find_all_calls.rb +15 -15
  71. data/lib/railroader/processors/lib/find_call.rb +26 -26
  72. data/lib/railroader/processors/lib/find_return_value.rb +11 -11
  73. data/lib/railroader/processors/lib/module_helper.rb +1 -1
  74. data/lib/railroader/processors/lib/processor_helper.rb +4 -4
  75. data/lib/railroader/processors/lib/rails2_config_processor.rb +20 -20
  76. data/lib/railroader/processors/lib/rails2_route_processor.rb +38 -38
  77. data/lib/railroader/processors/lib/rails3_config_processor.rb +14 -14
  78. data/lib/railroader/processors/lib/rails3_route_processor.rb +16 -16
  79. data/lib/railroader/processors/lib/render_helper.rb +32 -32
  80. data/lib/railroader/processors/lib/route_helper.rb +12 -12
  81. data/lib/railroader/processors/library_processor.rb +1 -1
  82. data/lib/railroader/processors/model_processor.rb +9 -9
  83. data/lib/railroader/processors/output_processor.rb +3 -3
  84. data/lib/railroader/processors/slim_template_processor.rb +4 -4
  85. data/lib/railroader/processors/template_alias_processor.rb +10 -10
  86. data/lib/railroader/processors/template_processor.rb +7 -7
  87. data/lib/railroader/report/renderer.rb +1 -1
  88. data/lib/railroader/report/report_base.rb +12 -12
  89. data/lib/railroader/report/report_csv.rb +2 -2
  90. data/lib/railroader/report/report_html.rb +5 -5
  91. data/lib/railroader/report/report_markdown.rb +2 -2
  92. data/lib/railroader/report/report_table.rb +3 -3
  93. data/lib/railroader/report/report_tabs.rb +2 -2
  94. data/lib/railroader/report/report_text.rb +3 -4
  95. data/lib/railroader/report.rb +3 -3
  96. data/lib/railroader/rescanner.rb +36 -36
  97. data/lib/railroader/scanner.rb +23 -23
  98. data/lib/railroader/tracker/config.rb +3 -3
  99. data/lib/railroader/tracker/controller.rb +2 -2
  100. data/lib/railroader/tracker.rb +42 -42
  101. data/lib/railroader/util.rb +47 -47
  102. data/lib/railroader/version.rb +1 -1
  103. data/lib/railroader/warning.rb +9 -10
  104. data/lib/railroader.rb +32 -32
  105. data/lib/ruby_parser/bm_sexp.rb +63 -63
  106. data/lib/ruby_parser/bm_sexp_processor.rb +3 -3
  107. metadata +4 -4
@@ -1,23 +1,23 @@
1
1
  require 'thread'
2
2
  require 'railroader/differ'
3
3
 
4
- #Collects up results from running different checks.
4
+ # Collects up results from running different checks.
5
5
  #
6
- #Checks can be added with +Check.add(check_class)+
6
+ # Checks can be added with +Check.add(check_class)+
7
7
  #
8
- #All .rb files in checks/ will be loaded.
8
+ # All .rb files in checks/ will be loaded.
9
9
  class Railroader::Checks
10
10
  @checks = []
11
11
  @optional_checks = []
12
12
 
13
13
  attr_reader :warnings, :controller_warnings, :model_warnings, :template_warnings, :checks_run
14
14
 
15
- #Add a check. This will call +_klass_.new+ when running tests
15
+ # Add a check. This will call +_klass_.new+ when running tests
16
16
  def self.add klass
17
17
  @checks << klass unless @checks.include? klass
18
18
  end
19
19
 
20
- #Add an optional check
20
+ # Add an optional check
21
21
  def self.add_optional klass
22
22
  @optional_checks << klass unless @checks.include? klass
23
23
  end
@@ -31,7 +31,7 @@ class Railroader::Checks
31
31
  end
32
32
 
33
33
  def self.initialize_checks check_directory = ""
34
- #Load all files in check_directory
34
+ # Load all files in check_directory
35
35
  Dir.glob(File.join(check_directory, "*.rb")).sort.each do |f|
36
36
  require f
37
37
  end
@@ -55,7 +55,7 @@ class Railroader::Checks
55
55
  []
56
56
  end
57
57
 
58
- #No need to use this directly.
58
+ # No need to use this directly.
59
59
  def initialize options = { }
60
60
  if options[:min_confidence]
61
61
  @min_confidence = options[:min_confidence]
@@ -70,11 +70,11 @@ class Railroader::Checks
70
70
  @checks_run = []
71
71
  end
72
72
 
73
- #Add Warning to list of warnings to report.
74
- #Warnings are split into four different arrays
75
- #for template, controller, model, and generic warnings.
73
+ # Add Warning to list of warnings to report.
74
+ # Warnings are split into four different arrays
75
+ # for template, controller, model, and generic warnings.
76
76
  #
77
- #Will not add warnings which are below the minimum confidence level.
77
+ # Will not add warnings which are below the minimum confidence level.
78
78
  def add_warning warning
79
79
  unless warning.confidence > @min_confidence
80
80
  case warning.warning_set
@@ -92,7 +92,7 @@ class Railroader::Checks
92
92
  end
93
93
  end
94
94
 
95
- #Return a hash of arrays of new and fixed warnings
95
+ # Return a hash of arrays of new and fixed warnings
96
96
  #
97
97
  # diff = checks.diff old_checks
98
98
  # diff[:fixed] # [...]
@@ -103,13 +103,13 @@ class Railroader::Checks
103
103
  Railroader::Differ.new(my_warnings, other_warnings).diff
104
104
  end
105
105
 
106
- #Return an array of all warnings found.
106
+ # Return an array of all warnings found.
107
107
  def all_warnings
108
108
  @warnings + @template_warnings + @controller_warnings + @model_warnings
109
109
  end
110
110
 
111
- #Run all the checks on the given Tracker.
112
- #Returns a new instance of Checks with the results.
111
+ # Run all the checks on the given Tracker.
112
+ # Returns a new instance of Checks with the results.
113
113
  def self.run_checks(app_tree, tracker)
114
114
  checks = self.checks_to_run(tracker)
115
115
  check_runner = self.new :min_confidence => tracker.options[:min_confidence]
@@ -134,8 +134,8 @@ class Railroader::Checks
134
134
  results << self.run_a_check(c, error_mutex, app_tree, tracker)
135
135
  end
136
136
 
137
- #Maintain list of which checks were run
138
- #mainly for reporting purposes
137
+ # Maintain list of which checks were run
138
+ # mainly for reporting purposes
139
139
  check_runner.checks_run << check_name[5..-1]
140
140
  end
141
141
 
@@ -203,7 +203,7 @@ class Railroader::Checks
203
203
  end
204
204
  end
205
205
 
206
- #Load all files in checks/ directory
206
+ # Load all files in checks/ directory
207
207
  Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/checks/*.rb").sort.each do |f|
208
208
  require f.match(/(railroader\/checks\/.*)\.rb$/)[0]
209
209
  end
@@ -115,7 +115,7 @@ module Railroader
115
115
 
116
116
  # Runs a regular report based on the options provided.
117
117
  def regular_report options
118
- tracker = run_railroader options
118
+ tracker = run_railroader options
119
119
 
120
120
  if tracker.options[:exit_on_warn] and not tracker.filtered_warnings.empty?
121
121
  quit Railroader::Warnings_Found_Exit_Code
@@ -1,5 +1,5 @@
1
1
  # extracting the diff logic to it's own class for consistency. Currently handles
2
- # an array of Railroader::Warnings or plain hash representations.
2
+ # an array of Railroader::Warnings or plain hash representations.
3
3
  class Railroader::Differ
4
4
  DEFAULT_HASH = {:new => [], :fixed => []}
5
5
  OLD_WARNING_KEYS = [:warning_type, :location, :code, :message, :file, :link, :confidence, :user_input]
@@ -48,7 +48,7 @@ class Railroader::Differ
48
48
 
49
49
  def eql_except_line_number new_warning, fixed_warning
50
50
  # can't do this ahead of time, as callers may be expecting a Railroader::Warning
51
- if new_warning.is_a? Railroader::Warning
51
+ if new_warning.is_a? Railroader::Warning
52
52
  new_warning = new_warning.to_hash
53
53
  fixed_warning = fixed_warning.to_hash
54
54
  end
@@ -1,22 +1,22 @@
1
1
  require 'optparse'
2
2
  require 'set'
3
3
 
4
- #Parses command line arguments for Railroader
4
+ # Parses command line arguments for Railroader
5
5
  module Railroader::Options
6
6
 
7
7
  class << self
8
8
 
9
- #Parse argument array
9
+ # Parse argument array
10
10
  def parse args
11
11
  get_options args
12
12
  end
13
13
 
14
- #Parse arguments and remove them from the array as they are matched
14
+ # Parse arguments and remove them from the array as they are matched
15
15
  def parse! args
16
16
  get_options args, true
17
17
  end
18
18
 
19
- #Return hash of options and the parser
19
+ # Return hash of options and the parser
20
20
  def get_options args, destructive = false
21
21
  options = {}
22
22
 
@@ -55,7 +55,7 @@ module Railroader::Options
55
55
  options[:quiet] = quiet
56
56
  end
57
57
 
58
- opts.on( "-z", "--[no-]exit-on-warn", "Exit code is non-zero if warnings found (Default)") do |exit_on_warn|
58
+ opts.on("-z", "--[no-]exit-on-warn", "Exit code is non-zero if warnings found (Default)") do |exit_on_warn|
59
59
  options[:exit_on_warn] = exit_on_warn
60
60
  end
61
61
 
@@ -171,7 +171,7 @@ module Railroader::Options
171
171
 
172
172
  opts.on "-t", "--test Check1,Check2,etc", Array, "Only run the specified checks" do |checks|
173
173
  checks.each_with_index do |s, index|
174
- if s[0,5] != "Check"
174
+ if s[0, 5] != "Check"
175
175
  checks[index] = "Check" << s
176
176
  end
177
177
  end
@@ -182,7 +182,7 @@ module Railroader::Options
182
182
 
183
183
  opts.on "-x", "--except Check1,Check2,etc", Array, "Skip the specified checks" do |skip|
184
184
  skip.each do |s|
185
- if s[0,5] != "Check"
185
+ if s[0, 5] != "Check"
186
186
  s = "Check" << s
187
187
  end
188
188
 
@@ -1,6 +1,6 @@
1
1
  Railroader.load_railroader_dependency 'erubis'
2
2
 
3
- #Erubis processor which ignores any output which is plain text.
3
+ # Erubis processor which ignores any output which is plain text.
4
4
  class Railroader::ScannerErubis < Erubis::Eruby
5
5
  include Erubis::NoTextEnhancer
6
6
  end
@@ -1,12 +1,12 @@
1
1
  Railroader.load_railroader_dependency 'erubis'
2
2
 
3
- #This is from the rails_xss plugin for Rails 2
3
+ # This is from the rails_xss plugin for Rails 2
4
4
  class Railroader::Rails2XSSPluginErubis < ::Erubis::Eruby
5
5
  def add_preamble(src)
6
- #src << "@output_buffer = ActiveSupport::SafeBuffer.new;"
6
+ # src << "@output_buffer = ActiveSupport::SafeBuffer.new;"
7
7
  end
8
8
 
9
- #This is different from rails_xss - fixes some line number issues
9
+ # This is different from rails_xss - fixes some line number issues
10
10
  def add_text(src, text)
11
11
  if text == "\n"
12
12
  src << "\n"
@@ -43,6 +43,6 @@ class Railroader::Rails2XSSPluginErubis < ::Erubis::Eruby
43
43
  end
44
44
 
45
45
  def add_postamble(src)
46
- #src << '@output_buffer.to_s'
46
+ # src << '@output_buffer.to_s'
47
47
  end
48
48
  end
@@ -60,7 +60,7 @@ module Railroader
60
60
  require 'erb'
61
61
  src = if ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+
62
62
  ERB.new(text, trim_mode: path).src
63
- else
63
+ else
64
64
  ERB.new(text, nil, path).src
65
65
  end
66
66
  src.sub!(/^#.*\n/, '') if Railroader::Scanner::RUBY_1_9
@@ -1,14 +1,14 @@
1
- #Load all files in processors/
1
+ # Load all files in processors/
2
2
  Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/processors/*.rb").each { |f| require f.match(/railroader\/processors.*/)[0] }
3
3
  require 'railroader/tracker'
4
4
  require 'set'
5
5
  require 'pathname'
6
6
 
7
7
  module Railroader
8
- #Makes calls to the appropriate processor.
8
+ # Makes calls to the appropriate processor.
9
9
  #
10
- #The ControllerProcessor, TemplateProcessor, and ModelProcessor will
11
- #update the Tracker with information about what is parsed.
10
+ # The ControllerProcessor, TemplateProcessor, and ModelProcessor will
11
+ # update the Tracker with information about what is parsed.
12
12
  class Processor
13
13
  include Util
14
14
 
@@ -21,22 +21,22 @@ module Railroader
21
21
  @tracker
22
22
  end
23
23
 
24
- #Process configuration file source
24
+ # Process configuration file source
25
25
  def process_config src, file_name
26
26
  ConfigProcessor.new(@tracker).process_config src, file_name
27
27
  end
28
28
 
29
- #Process Gemfile
29
+ # Process Gemfile
30
30
  def process_gems gem_files
31
31
  GemProcessor.new(@tracker).process_gems gem_files
32
32
  end
33
33
 
34
- #Process route file source
34
+ # Process route file source
35
35
  def process_routes src
36
36
  RoutesProcessor.new(@tracker).process_routes src
37
37
  end
38
38
 
39
- #Process controller source. +file_name+ is used for reporting
39
+ # Process controller source. +file_name+ is used for reporting
40
40
  def process_controller src, file_name
41
41
  if contains_class? src
42
42
  ControllerProcessor.new(@app_tree, @tracker).process_controller src, file_name
@@ -45,19 +45,19 @@ module Railroader
45
45
  end
46
46
  end
47
47
 
48
- #Process variable aliasing in controller source and save it in the
49
- #tracker.
48
+ # Process variable aliasing in controller source and save it in the
49
+ # tracker.
50
50
  def process_controller_alias name, src, only_method = nil, file = nil
51
51
  ControllerAliasProcessor.new(@app_tree, @tracker, only_method).process_controller name, src, file
52
52
  end
53
53
 
54
- #Process a model source
54
+ # Process a model source
55
55
  def process_model src, file_name
56
56
  result = ModelProcessor.new(@tracker).process_model src, file_name
57
57
  AliasProcessor.new(@tracker).process result if result
58
58
  end
59
59
 
60
- #Process either an ERB or HAML template
60
+ # Process either an ERB or HAML template
61
61
  def process_template name, src, type, called_from = nil, file_name = nil
62
62
  case type
63
63
  when :erb
@@ -72,8 +72,8 @@ module Railroader
72
72
  abort "Unknown template type: #{type} (#{name})"
73
73
  end
74
74
 
75
- #Each template which is rendered is stored separately
76
- #with a new name.
75
+ # Each template which is rendered is stored separately
76
+ # with a new name.
77
77
  if called_from
78
78
  name = ("#{name}.#{called_from}").to_sym
79
79
  end
@@ -82,19 +82,19 @@ module Railroader
82
82
  @tracker.templates[name].type = type
83
83
  end
84
84
 
85
- #Process any calls to render() within a template
85
+ # Process any calls to render() within a template
86
86
  def process_template_alias template
87
87
  TemplateAliasProcessor.new(@tracker, template).process_safely template.src
88
88
  end
89
89
 
90
- #Process source for initializing files
90
+ # Process source for initializing files
91
91
  def process_initializer file_name, src
92
92
  res = BaseProcessor.new(@tracker).process_file src, file_name
93
93
  res = AliasProcessor.new(@tracker).process_safely res, nil, file_name
94
94
  @tracker.initializers[Pathname.new(file_name).basename.to_s] = res
95
95
  end
96
96
 
97
- #Process source for a library file
97
+ # Process source for a library file
98
98
  def process_lib src, file_name
99
99
  LibraryProcessor.new(@tracker).process_library src, file_name
100
100
  end