rails-guarddog 0.1.11 → 0.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 859dc0da3cfd03afa3ceea5be6d2feba0f3f49786f109fb82c0a5b1c379c0837
-  data.tar.gz: a0251fa578fb369a59316ff36e62e4409cbfb0b08bdc4c4be1d2d75b764c1411
+  metadata.gz: 97cdcd83511d9b89a1786584d4a21dcf403123b3ea3911e7341a85a3bda88446
+  data.tar.gz: e6634444d93c30e0ddf147cb51db25ee7f04f6f2ee9a17f09d9c1de7b59d7da0
 SHA512:
-  metadata.gz: 3394a5d46d8ed065003722151b6f5d74361fac8e9656a3c39760e02fc25e581c474cb3246aa9bb8337530a50f70d492dfc77127b1770f7fa82bc6d01460073e5
-  data.tar.gz: f52bea6bb7b20187c2ab4a1751267f5987116f1839657bda880dfb93e18a96a8840e4621fde4b490c4d4d318c9f42fbe453be04c6514aa0a42c26b4293a40840
+  metadata.gz: c1e72af9e429215d30599e42276ced36f320f052002274827beb6b4060adfa29f907c42af0a88da4a13eead365ef84e32cbb079994534084112e60151671a09f
+  data.tar.gz: 2af6a3569f894d95fc2e944ebe14bce13696bc89e0120f13aa5c3cdd9e305e44ecbaba77a6e212dc1911ae1bc2efba267c58093e141bb5c544e59c39979aa3d3

data/README.md

@@ -104,14 +104,16 @@ That's it! Scan your entire Rails app for security vulnerabilities.
 - **DoS/ReDoS** — Unbounded queries, dangerous regex patterns ⭐ ENHANCED in v0.1.8
 - **Supply Chain** — Typosquatted gems using Levenshtein distance ⭐ IMPROVED in v0.1.8
 
-> **False-positive protection (v0.1.10)**
-> - Patterns use word boundaries — `no_token:` or `reset_password_instructions:` in locale
+> **False-positive protection (v0.1.10 - v0.1.12)**
+> - **Secrets**: Patterns use word boundaries — `no_token:` or `reset_password_instructions:` in locale
 >   files will **not** trigger the secrets checker.
-> - Secret values must be space-free (`[^\s'"]{6,}`) — human-readable sentences like
+> - **Secrets**: Secret values must be space-free (`[^\s'"]{6,}`) — human-readable sentences like
 >   `"You can't access this page..."` are never flagged.
-> - `config/locales/` files are skipped entirely — i18n translations are not credentials.
-> - `spec/` and `test/` trees suppress the secrets checker by default (configurable via
+> - **Secrets**: `config/locales/` files are skipped entirely — i18n translations are not credentials.
+> - **Secrets**: `spec/` and `test/` trees suppress the secrets checker by default (configurable via
 >   `ignored_checks`).
+> - **DoS**: Smart multiline `.limit()` check detection (v0.1.12) — lookahead up to 3 lines handles chained
+>   `.limit()` calls on subsequent lines or reassignment to the same variable, e.g. `things = Thing.all; things = things.limit(100)` or `.limit(...)` on the next line.
 
 
 ## 📊 Example Output
@@ -119,7 +121,7 @@ That's it! Scan your entire Rails app for security vulnerabilities.
 ### Console Report
 ```
 ============================================================
-          Rails GuardDog Security Report v0.1.10
+          Rails GuardDog Security Report v0.1.12
 ============================================================
 
 [CRITICAL] (5 findings)
@@ -290,6 +292,6 @@ MIT License - Free to use and modify.
 
 ---
 
-**Rails GuardDog v0.1.10 — Production Ready**
+**Rails GuardDog v0.1.12 — Production Ready**
 
 *Beyond brakeman. Detect what others miss.* 🐕🔒

data/lib/rails/guarddog/checkers/dos_checker.rb

@@ -4,20 +4,19 @@ module Rails
       class DosChecker < BaseChecker
         # Matches .all only when it is the final call on an ActiveRecord-style
         # model class (PascalCase constant), e.g.:
-        #   User.all           => flagged
+        #   User.all            => flagged
         #   Post.where(...).all => flagged
         # But NOT:
-        #   current_user.permissions.track_manage.all  => NOT flagged (chained on object)
-        #   collection.all? { }                        => NOT flagged (.all? method)
-        #   track_manage.all                           => NOT flagged (lowercase receiver)
+        #   current_user.permissions.track_manage.all => NOT flagged (lowercase receiver)
+        #   collection.all? { }                       => NOT flagged (.all? method)
         UNBOUNDED_QUERY_PATTERN = /
           (?:
-            [A-Z][A-Za-z0-9_]*   # PascalCase model class  e.g. User, TrackItem
-            (?:\.[a-z_]+\(.*?\))* # optional chained scopes e.g. .where(...).order(...)
+            [A-Z][A-Za-z0-9_]*    # PascalCase model class  e.g. User, TrackItem
+            (?:\.[a-z_]+\(.*?\))*  # optional chained scopes e.g. .where(...).order(...)
           )
-          \.all                   # the .all call
-          (?!\?)                  # not .all? (Enumerable method, not AR query)
-          \s*(?:[,)\]#\n]|$)     # followed by end-of-expression
+          \.all                    # the .all call
+          (?!\?)                   # not .all? (Enumerable method, not AR query)
+          \s*(?:[,)\]#\n]|$)      # followed by end-of-expression (not .limit etc.)
         /x.freeze
 
         # Patterns known to be dangerous nested regex (ReDoS)
@@ -26,13 +25,18 @@ module Rails
           /match\?.*\(.+\*\+/
         ].freeze
 
+        # How many lines ahead to search for a .limit() call.
+        # Covers both chained-on-next-line and separate-assignment styles.
+        LOOKAHEAD_LINES = 3
+
         def run
           glob_files('app/**/*.rb').each do |file|
-            content = File.read(file) rescue next
-            content.each_line.with_index do |line, idx|
+            lines = File.readlines(file) rescue next
+
+            lines.each_with_index do |line, idx|
               next if line.strip.start_with?('#')
 
-              if line.match?(UNBOUNDED_QUERY_PATTERN)
+              if line.match?(UNBOUNDED_QUERY_PATTERN) && !limit_applied?(lines, idx, line)
                 add_finding(
                   severity: :high,
                   message: "Potential DoS: unbounded database query without limit",
@@ -57,6 +61,46 @@ module Rails
           end
           findings
         end
+
+        private
+
+        # Returns true if a .limit() call is found either:
+        #   1. On the same line as .all      (e.g. Thing.all.limit(100))
+        #   2. Chained on the very next line  (e.g. Thing.all\n  .limit(100))
+        #   3. Applied to the assigned variable within LOOKAHEAD_LINES lines
+        #      (e.g. things = Thing.all \n things = things.limit(100))
+        def limit_applied?(lines, current_idx, current_line)
+          # 1. Same-line limit (Thing.all.limit(100)) — already excluded by
+          #    UNBOUNDED_QUERY_PATTERN's end-of-expression anchor, but double-check.
+          return true if current_line.match?(/\.limit\s*\(/)
+
+          # Extract the variable being assigned, supporting local vars, instance
+          # vars (@foo) and class-instance vars (@@foo).
+          assigned_var = current_line.match(/([@]{0,2}\w+)\s*=\s*[A-Z]/)&.[](1)
+
+          lookahead = lines[(current_idx + 1), LOOKAHEAD_LINES] || []
+
+          lookahead.each do |next_line|
+            stripped = next_line.lstrip
+
+            # 2. Chained on next line: the continuation starts with .limit
+            return true if stripped.start_with?('.limit')
+
+            # 3. Assigned variable subsequently limited:
+            #      things   = things.limit(100)   => local var (word boundary ok)
+            #      @things  = @things.limit(100)  => instance var (@ is non-word, use look-behind)
+            #      things.limit(100)
+            if assigned_var
+              # Build an anchor that works for both `@var` and plain `var`:
+              # require that the var is preceded by start-of-line, whitespace or `=`.
+              anchor  = '(?:^|[\s=(])'
+              escaped = Regexp.escape(assigned_var)
+              return true if next_line.match?(/#{anchor}#{escaped}(?:\s*=\s*#{escaped})?\.limit\s*\(/)
+            end
+          end
+
+          false
+        end
       end
     end
   end

data/lib/rails/guarddog/version.rb

@@ -1,5 +1,5 @@
 module Rails
   module Guarddog
-    VERSION = "0.1.11"
+    VERSION = "0.1.12"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-guarddog
 version: !ruby/object:Gem::Version
-  version: 0.1.11
+  version: 0.1.12
 platform: ruby
 authors:
 - Security Team