rails-guarddog 0.1.12 → 0.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97cdcd83511d9b89a1786584d4a21dcf403123b3ea3911e7341a85a3bda88446
-  data.tar.gz: e6634444d93c30e0ddf147cb51db25ee7f04f6f2ee9a17f09d9c1de7b59d7da0
+  metadata.gz: 7c9e1e9aac1c7e2bf1e56d36ff7265b4ab1db06538f123ae5fa06c2914c6f02c
+  data.tar.gz: daefaec237fbe6a1fc0112082200bfda9a6745fff4c9d6381843ee03c5cb6fe1
 SHA512:
-  metadata.gz: c1e72af9e429215d30599e42276ced36f320f052002274827beb6b4060adfa29f907c42af0a88da4a13eead365ef84e32cbb079994534084112e60151671a09f
-  data.tar.gz: 2af6a3569f894d95fc2e944ebe14bce13696bc89e0120f13aa5c3cdd9e305e44ecbaba77a6e212dc1911ae1bc2efba267c58093e141bb5c544e59c39979aa3d3
+  metadata.gz: 2696caa1c34f51eff8b9fcfc7b2eae1048a8e4599414c2d928bd77397160a9e5ec043ff7424dd16576667ccd6371e34fe43e4a914f54869dd332b6089857e0e8
+  data.tar.gz: 44f71976bf0c41729c4a563ab0f493d3e43ad7d01a044792e27cddb4534ce5360f3fbbb5bede037c8fe51ce31bb1223993ae11184be5ef94e2f72676babeadcd

data/README.md

@@ -104,7 +104,7 @@ That's it! Scan your entire Rails app for security vulnerabilities.
 - **DoS/ReDoS** — Unbounded queries, dangerous regex patterns ⭐ ENHANCED in v0.1.8
 - **Supply Chain** — Typosquatted gems using Levenshtein distance ⭐ IMPROVED in v0.1.8
 
-> **False-positive protection (v0.1.10 - v0.1.12)**
+> **False-positive protection (v0.1.10 - v0.1.14)**
 > - **Secrets**: Patterns use word boundaries — `no_token:` or `reset_password_instructions:` in locale
 >   files will **not** trigger the secrets checker.
 > - **Secrets**: Secret values must be space-free (`[^\s'"]{6,}`) — human-readable sentences like
@@ -114,6 +114,9 @@ That's it! Scan your entire Rails app for security vulnerabilities.
 >   `ignored_checks`).
 > - **DoS**: Smart multiline `.limit()` check detection (v0.1.12) — lookahead up to 3 lines handles chained
 >   `.limit()` calls on subsequent lines or reassignment to the same variable, e.g. `things = Thing.all; things = things.limit(100)` or `.limit(...)` on the next line.
+> - **Ignore File**: Support for `.guarddogignore` (v0.1.13) — allows excluding complete files/directories or ignoring specific checkers for specific files/directories.
+> - **SQL Injection**: Precise argument-boundary matching (v0.1.14) — prevents false positives when string interpolation is used safely in query bind arguments (e.g. `where("column ILIKE ?", "#{value}%")`).
+> - **DoS**: Pagy pagination support (v0.1.14) — query calls inside `pagy(...)` or `pagy_countless(...)` helpers are recognized as paginated and are not flagged as unbounded.
 
 
 ## 📊 Example Output
@@ -121,7 +124,7 @@ That's it! Scan your entire Rails app for security vulnerabilities.
 ### Console Report
 ```
 ============================================================
-          Rails GuardDog Security Report v0.1.12
+          Rails GuardDog Security Report v0.1.14
 ============================================================
 
 [CRITICAL] (5 findings)
@@ -225,6 +228,22 @@ GuardDog already silences `secrets` in `spec/` and `test/` by default. To add
 more suppressions or override the defaults, set `ignored_checks` in your
 initializer (see example above).
 
+### Ignoring findings with `.guarddogignore`
+
+You can add a `.guarddogignore` file in the root of your Rails project to exclude entire files/directories or ignore specific checkers for specific files.
+
+- To exclude a file or directory completely (silence all checkers), list the path:
+  ```
+  db/seeds.rb
+  vendor/
+  ```
+
+- To skip only specific checkers for certain files or directories, separate the path and the comma-separated list of checkers with a `:`:
+  ```
+  db/seeds.rb: secrets
+  app/controllers/admin/*: sql_injection, csrf
+  ```
+
 ---
 
 
@@ -292,6 +311,6 @@ MIT License - Free to use and modify.
 
 ---
 
-**Rails GuardDog v0.1.12 — Production Ready**
+**Rails GuardDog v0.1.14 — Production Ready**
 
 *Beyond brakeman. Detect what others miss.* 🐕🔒

data/lib/rails/guarddog/checkers/base_checker.rb

@@ -43,9 +43,10 @@ module Rails
 
           ignored = @configuration.ignored_checks || {}
           name    = checker_identifier
+          rel_file = relative_path(file)
 
           ignored.any? do |path_pattern, checker_names|
-            file.include?(path_pattern.to_s) &&
+            rel_file.include?(path_pattern.to_s) &&
               checker_names.map(&:to_s).include?(name)
           end
         end
@@ -63,9 +64,24 @@ module Rails
         def glob_files(pattern)
           excluded = @configuration&.excluded_paths || []
           Dir.glob(File.join(@root, pattern)).reject do |file|
-            excluded.any? { |path| file.include?(path) }
+            rel_file = relative_path(file)
+            excluded.any? { |path| rel_file.include?(path) }
           end
         end
+
+        private
+
+        def relative_path(file)
+          file_normalized = file.to_s.gsub('\\', '/')
+          root_normalized = @root.to_s.gsub('\\', '/')
+          
+          if file_normalized.start_with?(root_normalized)
+            file_normalized.sub(/\A#{Regexp.escape(root_normalized)}\/?/, '')
+          else
+            file_normalized
+          end
+        end
+
       end
     end
   end

data/lib/rails/guarddog/checkers/dos_checker.rb

@@ -74,6 +74,12 @@ module Rails
           #    UNBOUNDED_QUERY_PATTERN's end-of-expression anchor, but double-check.
           return true if current_line.match?(/\.limit\s*\(/)
 
+          # Ignore queries wrapped inside pagy pagination helper calls (single or multi-line)
+          return true if current_line.match?(/\bpagy(?:_countless)?\s*\(/)
+          if current_idx > 0
+            return true if lines[current_idx - 1].match?(/\bpagy(?:_countless)?\b/)
+          end
+
           # Extract the variable being assigned, supporting local vars, instance
           # vars (@foo) and class-instance vars (@@foo).
           assigned_var = current_line.match(/([@]{0,2}\w+)\s*=\s*[A-Z]/)&.[](1)

data/lib/rails/guarddog/checkers/sql_injection_checker.rb

@@ -1,26 +1,29 @@
-module Rails
-  module Guarddog
-    module Checkers
-      class SqlInjectionChecker < BaseChecker
-        def run
-          glob_files('app/**/*.rb').each do |file|
-            content = File.read(file)
-            content.each_line.with_index do |line, idx|
-              if line.match?(/\.where\s*\(\s*['"].*#\{/) || line.match?(/\.find_by_sql\s*\(/)
-                add_finding(
-                  severity: :high,
-                  message: "Potential SQL injection: using string interpolation in queries",
-                  file: file,
-                  line: idx + 1,
-                  snippet: line.strip,
-                  remediation: "Use parameterized queries: .where('column = ?', value)"
-                )
-              end
-            end
-          end
-          findings
-        end
-      end
-    end
-  end
-end
+module Rails
+  module Guarddog
+    module Checkers
+      class SqlInjectionChecker < BaseChecker
+        def run
+          glob_files('app/**/*.rb').each do |file|
+            content = File.read(file)
+            content.each_line.with_index do |line, idx|
+              # Matches string interpolation ONLY in the first argument (the SQL template string).
+              # We check that #{ is reached before the closing quote of the first string argument.
+              if line.match?(/\.where\s*\(\s*(?:"[^"]*#\{|'[^']*#\{)/) ||
+                 line.match?(/\.find_by_sql\s*\(\s*(?:"[^"]*#\{|'[^']*#\{)/)
+                add_finding(
+                  severity: :high,
+                  message: "Potential SQL injection: using string interpolation in queries",
+                  file: file,
+                  line: idx + 1,
+                  snippet: line.strip,
+                  remediation: "Use parameterized queries: .where('column = ?', value)"
+                )
+              end
+            end
+          end
+          findings
+        end
+      end
+    end
+  end
+end

data/lib/rails/guarddog/scanner.rb

@@ -4,11 +4,12 @@ module Rails
       attr_accessor :configuration, :findings
 
       def initialize(config = nil)
-        @configuration = config || Configuration.new
+        @configuration = config || default_configuration
         @findings = []
       end
 
       def run
+        load_ignore_file
         load_checkers.each do |checker_class|
           checker = checker_class.new(@configuration)
           checker.run
@@ -19,6 +20,41 @@ module Rails
 
       private
 
+      def default_configuration
+        if defined?(Rails) && Rails.application && Rails.application.config.respond_to?(:guarddog)
+          Rails.application.config.guarddog
+        else
+          Configuration.new
+        end
+      end
+
+      def load_ignore_file
+        ignore_file_path = File.join(@configuration.root, '.guarddogignore')
+        return unless File.exist?(ignore_file_path)
+
+        @configuration.ignored_checks ||= {}
+        @configuration.excluded_paths ||= []
+
+        File.foreach(ignore_file_path).each_with_index do |line, idx|
+          line = line.strip
+          next if line.empty? || line.start_with?('#')
+
+          if line.include?(':')
+            path_pattern, checkers_str = line.split(':', 2)
+            path_pattern = path_pattern.strip.gsub('\\', '/')
+            checkers = checkers_str.split(',').map { |c| c.strip.downcase }
+
+            @configuration.ignored_checks[path_pattern] ||= []
+            @configuration.ignored_checks[path_pattern].concat(checkers)
+            @configuration.ignored_checks[path_pattern].uniq!
+          else
+            path_pattern = line.gsub('\\', '/')
+            @configuration.excluded_paths << path_pattern
+            @configuration.excluded_paths.uniq!
+          end
+        end
+      end
+
       def load_checkers
         checker_map = {
           'sql_injection'  => Checkers::SqlInjectionChecker,

data/lib/rails/guarddog/version.rb

@@ -1,5 +1,5 @@
 module Rails
   module Guarddog
-    VERSION = "0.1.12"
+    VERSION = "0.1.14"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-guarddog
 version: !ruby/object:Gem::Version
-  version: 0.1.12
+  version: 0.1.14
 platform: ruby
 authors:
 - Security Team
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-13 00:00:00.000000000 Z
+date: 2026-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties