rails-guarddog 0.1.2 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +23 -42
  3. data/lib/rails/guarddog/configuration.rb +8 -3
  4. data/lib/rails/guarddog/version.rb +1 -1
  5. data/lib/tasks/guarddog.rake +1 -1
  6. metadata +1 -1
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: c9472aed0e8374f8079c457fe7204dce4c9e5c04ba2786001e66cf91f21b3056
4
- data.tar.gz: 4d6e0fb2300f1d59db5d5eb4f7317f7ea75ee8108b097a5d3647199ac3f678a9
3
+ metadata.gz: 26aae5812cc6e3fe686bd6779e3f05bcda5da9a627a6adb1200e987a734b99c5
4
+ data.tar.gz: 9847f4711ad1d091b7b943e5fb8ca9bf39f562f0d2abc03e68ecb5037870bff8
5
5
  SHA512:
6
- metadata.gz: 2c9b3be2b5f0eee82275e6d90825e8a53b6affc20df8072510f792506fbe6360ce5ccb87bc09e10eec13b18b070567ccb738af5a3f0694b3b1e7b35c5363bc47
7
- data.tar.gz: 602b46b229533605b28cba2416104982fe7b8acbb5da16783f8b5e500aec40657c1157b043702de1c8af2c0876d3295523ce0d10293da25f4efa96298a07356f
6
+ metadata.gz: 41f53f16b7807761c56821130429016ba4e11a7295811985309d54d25fc08f84915eb2d819dd5c5599e04a5cb1ccb5c122790f96f42c156d6f6faba0cce60106
7
+ data.tar.gz: 3c49be284b9fc6ccb2ae7d948594499e032b3a650da01c2c87b55a0dab7d0422f8f11470528812a5f7aaf594501c75e2fa16983aba8eae06ea5abc951646edaa
data/README.md CHANGED
@@ -1,12 +1,12 @@
1
- # Rails GuardDog 🐕 v0.1.0
1
+ # Rails GuardDog 🐕
2
2
 
3
3
  [![Gem Version](https://badge.fury.io/rb/rails-guarddog.svg)](https://badge.fury.io/rb/rails-guarddog)
4
4
  [![Downloads](https://img.shields.io/gem/dt/rails-guarddog.svg)](https://rubygems.org/gems/rails-guarddog)
5
- [![GitHub Stars](https://img.shields.io/github/stars/sghani001/rails-guarddog.svg)](https://github.com/sghani001/rails-guarddog)
5
+ [![GitHub Stars](https://img.shields.io/github/stars/sghani001/rails-guarddog.svg)](https://github.com/sghani001/rails-guarddog/stargazers)
6
6
  [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
7
- [![Ruby Version](https://img.shields.io/badge/ruby-%3E%3D2.7-red.svg)](https://www.ruby-lang.org/)
7
+ [![Ruby Version](https://img.shields.io/badge/ruby-%3E%3D3.0-red.svg)](https://www.ruby-lang.org/)
8
8
  [![Rails Version](https://img.shields.io/badge/rails-%3E%3D6.0-red.svg)](https://rubyonrails.org/)
9
- [![Code Quality](https://img.shields.io/badge/code%20quality-A-brightgreen.svg)](https://github.com/sghani001/rails-guarddog)
9
+ [![Issues](https://img.shields.io/github/issues/sghani001/rails-guarddog.svg)](https://github.com/sghani001/rails-guarddog/issues)
10
10
  ![Status](https://img.shields.io/badge/status-Production%20Ready-brightgreen.svg)
11
11
 
12
12
  Production-grade security scanner for Rails applications. **Beyond brakeman** — detects AI injection, DoS patterns, supply chain attacks, GraphQL authorization gaps, and more.
@@ -34,12 +34,12 @@ Production-grade security scanner for Rails applications. **Beyond brakeman**
34
34
 
35
35
  | Metric | Value |
36
36
  |--------|-------|
37
- | **Version** | 1.0.0 |
37
+ | **Version** | [![Gem Version](https://badge.fury.io/rb/rails-guarddog.svg)](https://badge.fury.io/rb/rails-guarddog) |
38
+ | **Total Downloads** | [![Downloads](https://img.shields.io/gem/dt/rails-guarddog.svg)](https://rubygems.org/gems/rails-guarddog) |
38
39
  | **Security Checkers** | 12 |
39
40
  | **Report Formats** | 3 (Console, HTML, JSON) |
40
41
  | **Dependencies** | 2 (parser, ast) |
41
42
  | **Lines of Code** | ~2,000 |
42
- | **Test Coverage** | Ready for RSpec |
43
43
  | **License** | MIT |
44
44
 
45
45
  ---
@@ -78,7 +78,7 @@ rake guarddog:ci
78
78
  ### Authentication & Authorization
79
79
  - **IDOR Detection** — Object access without ownership verification
80
80
  - **GraphQL Authorization** — Missing field-level auth checks
81
- - **Open Redirect** — User input in redirect_to without validation
81
+ - **Open Redirect** — User input in `redirect_to` without validation
82
82
  - **Rate Limiting Audit** — Missing rack-attack configuration
83
83
 
84
84
  ### Injection Attacks
@@ -88,7 +88,7 @@ rake guarddog:ci
88
88
 
89
89
  ### Data Protection
90
90
  - **CSRF Protection** — Disabled without documented reason
91
- - **Mass Assignment** — `permit!` vulnerabilities (FIXES BRAKEMAN BUG)
91
+ - **Mass Assignment** — `permit!` vulnerabilities
92
92
  - **Hardcoded Secrets** — API keys, tokens, passwords in code (ALWAYS-ON)
93
93
 
94
94
  ### Resource Management
@@ -101,19 +101,19 @@ rake guarddog:ci
101
101
 
102
102
  ### Console Report
103
103
  ```
104
- ====================================================================
105
- Rails GuardDog Security Report v0.1.0
106
- ====================================================================
104
+ ============================================================
105
+ Rails GuardDog Security Report
106
+ ============================================================
107
107
 
108
108
  [CRITICAL] (5 findings)
109
109
  Mass Assignment — permit! allows ALL parameters
110
110
  app/controllers/users_controller.rb:15
111
111
  Fix: Use permit(:name, :email, :age) for specific fields
112
-
112
+
113
113
  AI Injection — User input in LLM prompt
114
114
  app/services/chat_service.rb:42
115
115
  Fix: Sanitize: prompt = 'Template: ' + sanitize(params[:text])
116
-
116
+
117
117
  Hardcoded Secret — API Key detected
118
118
  config/initializers/api.rb:3
119
119
  Fix: Move to Rails.application.credentials
@@ -122,14 +122,14 @@ Rails GuardDog Security Report v0.1.0
122
122
  DoS: Unbounded query without limit
123
123
  app/controllers/posts_controller.rb:5
124
124
  Fix: Add .limit(100) or use pagination
125
-
125
+
126
126
  ReDoS: Dangerous regex pattern
127
127
  app/models/validator.rb:22
128
128
  Fix: Simplify regex or add timeout
129
129
 
130
- ====================================================================
130
+ ============================================================
131
131
  Total findings: 15 | Critical: 5 | High: 8
132
- ====================================================================
132
+ ============================================================
133
133
  ```
134
134
 
135
135
  ### HTML Report
@@ -261,7 +261,7 @@ skip_before_action :verify_authenticity_token, if: :json_request?
261
261
  ```
262
262
  **CWE:** 352 | **OWASP:** A01:2021
263
263
 
264
- ### 4. Mass Assignment ⭐ (FIXES BRAKEMAN BUG)
264
+ ### 4. Mass Assignment
265
265
  ```ruby
266
266
  # ❌ CRITICAL
267
267
  params.permit!
@@ -271,7 +271,7 @@ params.require(:user).permit(:name, :email, :age)
271
271
  ```
272
272
  **CWE:** 915 | **OWASP:** A01:2021
273
273
 
274
- ### 5. Hardcoded Secrets ⭐ (FIXES BRAKEMAN BUG #1989)
274
+ ### 5. Hardcoded Secrets
275
275
  ```ruby
276
276
  # ❌ CRITICAL
277
277
  API_KEY = "sk_live_abc123def456"
@@ -282,7 +282,7 @@ Rails.application.credentials.api_key
282
282
  ```
283
283
  **CWE:** 798 | **OWASP:** A02:2021
284
284
 
285
- ### 6. DoS/ReDoS ⭐ NEW
285
+ ### 6. DoS/ReDoS
286
286
  ```ruby
287
287
  # ❌ HIGH RISK
288
288
  User.all
@@ -294,7 +294,7 @@ User.limit(100)
294
294
  ```
295
295
  **CWE:** 400, 1333 | **OWASP:** A05:2021
296
296
 
297
- ### 7. IDOR ⭐ NEW
297
+ ### 7. IDOR
298
298
  ```ruby
299
299
  # ❌ CRITICAL
300
300
  @post = Post.find(params[:id])
@@ -305,7 +305,7 @@ authorize @post
305
305
  ```
306
306
  **CWE:** 639 | **OWASP:** A01:2021
307
307
 
308
- ### 8. AI/LLM Prompt Injection ⭐ ORIGINAL
308
+ ### 8. AI/LLM Prompt Injection
309
309
  ```ruby
310
310
  # ❌ CRITICAL
311
311
  response = client.messages.create(
@@ -342,21 +342,13 @@ Contributions welcome! Areas for enhancement:
342
342
  - Advanced AST analysis
343
343
  - Machine learning pattern detection
344
344
 
345
- [GitHub Issues](https://github.com/sghani001/rails-guarddog/issues)
346
- [GitHub Discussions](https://github.com/sghani001/rails-guarddog/discussions)
345
+ [GitHub Issues](https://github.com/sghani001/rails-guarddog/issues) | [GitHub Discussions](https://github.com/sghani001/rails-guarddog/discussions)
347
346
 
348
347
  ---
349
348
 
350
349
  ## 📄 License
351
350
 
352
- MIT License - Free to use and modify
353
-
354
- ```
355
- Copyright (c) 2026 Rails GuardDog Contributors
356
-
357
- Permission is hereby granted, free of charge, to any person obtaining a copy
358
- of this software and associated documentation files (the "Software")...
359
- ```
351
+ MIT License - Free to use and modify. See [LICENSE](LICENSE) for details.
360
352
 
361
353
  ---
362
354
 
@@ -369,15 +361,4 @@ of this software and associated documentation files (the "Software")...
369
361
 
370
362
  ---
371
363
 
372
- ## 👋 Support
373
-
374
- - 📖 [Full Documentation](README.md)
375
- - 🚀 [Quick Start Guide](QUICK_START.md)
376
- - 🔒 [Security Details](SECURITY_COVERAGE.md)
377
- - 💬 [GitHub Discussions](https://github.com/sghani001/rails-guarddog/discussions)
378
-
379
- ---
380
-
381
- **v0.1.0** | **Production Ready** | **MIT License** | ⭐ [Star on GitHub](https://github.com/sghani001/rails-guarddog)
382
-
383
364
  *Beyond brakeman. Detect what others miss.* 🐕🔒
data/lib/rails/guarddog/configuration.rb CHANGED
@@ -1,15 +1,20 @@
1
1
  module Rails
2
2
  module Guarddog
3
3
  class Configuration
4
- attr_accessor :root, :enabled_checkers, :excluded_paths, :output_format
4
+ attr_writer :root
5
+ attr_accessor :enabled_checkers, :excluded_paths, :output_format
5
6
 
6
7
  def initialize
7
- @root = Rails.root.to_s
8
+ @root = nil
8
9
  @enabled_checkers = all_checkers
9
10
  @excluded_paths = %w[vendor spec test node_modules]
10
11
  @output_format = :console
11
12
  end
12
13
 
14
+ def root
15
+ @root || Rails.root.to_s
16
+ end
17
+
13
18
  def all_checkers
14
19
  %w[
15
20
  sql_injection xss csrf mass_assignment open_redirect secrets
@@ -18,4 +23,4 @@ module Rails
18
23
  end
19
24
  end
20
25
  end
21
- end
26
+ end
data/lib/rails/guarddog/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  module Rails
2
2
  module Guarddog
3
- VERSION = "0.1.2"
3
+ VERSION = "0.1.4"
4
4
  end
5
5
  end
data/lib/tasks/guarddog.rake CHANGED
@@ -1,5 +1,5 @@
1
1
  namespace :guarddog do
2
- task :scan do
2
+ task :scan => :environment do
3
3
  require 'rails/guarddog'
4
4
 
5
5
  scanner = Rails::Guarddog::Scanner.new
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rails-guarddog
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.2
4
+ version: 0.1.4
5
5
  platform: ruby
6
6
  authors:
7
7
  - Security Team