rails-guarddog 0.1.5 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2acad8e1d8ad0d89f3a9fdacd63342b7a9a5334b7293a342616efa89eb89e2f1
-  data.tar.gz: 5ba612e9e3f74796ec8cb75b23f780de1919630c06cecc5a63b5112dcd0049d1
+  metadata.gz: 92c763b8e850ec9df964d0723a218f1801ce5ed0f9e0793976facac66c492205
+  data.tar.gz: c7d7d91d85c82f585ff1f3d0f04b05dd3c863124b5db0f927067080317d7340c
 SHA512:
-  metadata.gz: 991c125af5ffdc8c91d6ecfe1ede15eb27aaff2d61ece5a0a6b3a843bc439c772596faea8147784a9cb3da143cfe674fb095e633b5049ebb05ac3236a89ea2de
-  data.tar.gz: 5ac713bb2444572a63f0b61c4187b71dfb8851318974d206391880e5cc51a7d1055c65c3dbfe45f9951c4400c70018dc42b01a23b2add13f63eb066e011ce670
+  metadata.gz: cdef99a6784a17bfac825a9c2877e4905a232ffc0ec949ac624dd6bd2493a3fff69261b2831aa81ac08750c425eafcb4d29421f32d569f282a3b9f7247663b6f
+  data.tar.gz: fea6fbb432a20662f3b45e996381b4e58a11a39222daeca42d9dc7e6b51f81a584b9da0bd46e6f4f26b18abc88b8ffee017dc96aaef324bec63de817151b16fb

data/lib/rails/guarddog/checkers/xss_checker.rb

@@ -1,26 +1,44 @@
-module Rails
-  module Guarddog
-    module Checkers
-      class XssChecker < BaseChecker
-        def run
-          glob_files('app/views/**/*.erb').each do |file|
-            content = File.read(file)
-            content.each_line.with_index do |line, idx|
-              if line.include?('<%=') && (line.include?('params') || line.include?('@')) && !line.include?('sanitize') && !line.include?('h(')
-                add_finding(
-                  severity: :high,
-                  message: "Potential XSS vulnerability: unsanitized user input in view",
-                  file: file,
-                  line: idx + 1,
-                  snippet: line.strip,
-                  remediation: "Use <%= h() %> or sanitize() helper"
-                )
-              end
-            end
-          end
-          findings
-        end
-      end
-    end
-  end
-end
+module Rails
+  module Guarddog
+    module Checkers
+      class XssChecker < BaseChecker
+        def run
+          glob_files('app/views/**/*.erb').each do |file|
+            content = File.read(file)
+            content.each_line.with_index do |line, idx|
+              if xss_vulnerable?(line)
+                add_finding(
+                  severity: :high,
+                  message: "Potential XSS vulnerability: unescaped output detected",
+                  file: file,
+                  line: idx + 1,
+                  snippet: line.strip,
+                  remediation: "Use <%= h() %> or sanitize() instead of raw/html_safe"
+                )
+              end
+            end
+          end
+          findings
+        end
+
+        private
+
+        def xss_vulnerable?(line)
+          # <%== is Rails' raw output (alias for raw())
+          return true if line.match?(/<%==/)
+
+          # raw() helper explicitly disables escaping
+          return true if line.match?(/<%=.*\braw\s*\(/)
+
+          # .html_safe bypasses escaping
+          return true if line.match?(/<%=.*\.html_safe/)
+
+          # concat with raw content
+          return true if line.match?(/<%=.*content_tag.*html_safe/)
+
+          false
+        end
+      end
+    end
+  end
+end

data/lib/rails/guarddog/scanner.rb

@@ -1,37 +1,44 @@
-module Rails
-  module Guarddog
-    class Scanner
-      attr_accessor :configuration, :findings
-
-      def initialize(config = nil)
-        @configuration = config || Configuration.new
-        @findings = []
-      end
-
-      def run
-        checkers = load_checkers
-        checkers.each do |checker|
-          checker_instance = checker.new(@configuration.root)
-          checker_instance.run
-          @findings.concat(checker_instance.findings)
-        end
-        @findings.sort_by { |f| severity_order(f.severity) }
-      end
-
-      private
-
-      def load_checkers
-        checkers_dir = File.expand_path('../guarddog/checkers', __FILE__)
-        Dir.glob("#{checkers_dir}/*_checker.rb").reject { |f| f.include?('base_checker') }.map do |file|
-          require file
-          class_name = File.basename(file, '.rb').camelize
-          Checkers.const_get(class_name)
-        end.compact
-      end
-
-      def severity_order(severity)
-        { critical: 0, high: 1, medium: 2, low: 3 }[severity] || 4
-      end
-    end
-  end
-end
+module Rails
+  module Guarddog
+    class Scanner
+      attr_accessor :configuration, :findings
+
+      def initialize(config = nil)
+        @configuration = config || Configuration.new
+        @findings = []
+      end
+
+      def run
+        load_checkers.each do |checker_class|
+          checker = checker_class.new(@configuration.root)
+          checker.run
+          @findings.concat(checker.findings)
+        end
+        @findings.sort_by { |f| severity_order(f.severity) }
+      end
+
+      private
+
+      def load_checkers
+        [
+          Checkers::SqlInjectionChecker,
+          Checkers::XssChecker,
+          Checkers::CsrfChecker,
+          Checkers::MassAssignmentChecker,
+          Checkers::OpenRedirectChecker,
+          Checkers::SecretsChecker,
+          Checkers::DosChecker,
+          Checkers::IdorChecker,
+          Checkers::AiInjectionChecker,
+          Checkers::RateLimitChecker,
+          Checkers::DependencyChecker,
+          Checkers::GraphqlChecker
+        ]
+      end
+
+      def severity_order(severity)
+        { critical: 0, high: 1, medium: 2, low: 3 }[severity] || 4
+      end
+    end
+  end
+end

data/lib/rails/guarddog/version.rb

@@ -1,5 +1,5 @@
 module Rails
   module Guarddog
-    VERSION = "0.1.5"
+    VERSION = "0.1.7"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-guarddog
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.7
 platform: ruby
 authors:
 - Security Team