rails-guarddog 0.1.6 → 0.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7dea85a7698050fcc823251f4acc49373742804ae43daadc1c4a378f9ce04b01
-  data.tar.gz: 35f0fdca94c23a451631ab027711b10fae077aefe4d4653f70a432a45089d465
+  metadata.gz: 2214ac72da2f5e00107d39f0a22a48279d260fdc7d8c29ac20db5cf392436e8a
+  data.tar.gz: 286b44e6837ea09fcd2225b7078cb97e7dcd5cd84a41fc6effec47a279508eee
 SHA512:
-  metadata.gz: 40b498fc485ed0217c8e96c3214ae8c74c9dd748cca4907956242ebd65d55366fb978e9fb926b28255bd2d7231982e226d3d3985bf7e28fbe65fee5bbd578c3a
-  data.tar.gz: 2ada4498720b9dbdd6e2e11d664e8a68da5a136026570a647df717734c2c5d05d448d11c45e6ac96e1b801a1fb8d1cb2eee4b5f54bb644b8ec2c512701d82018
+  metadata.gz: f3e990671a743b74bc4e27debe6b20555f69680859f61afda97fd1908e1dcc4138920a7a54a55e04aba3beca88819b9e2a682506e02b5541939b537c9a8c6aad
+  data.tar.gz: b18391be117c2be514e7d00f32cf8d90407c1aa12201718fb4ec4572845cf910620ae71fd14f8005d5e4f404e6dd5077d5028dbc205c30dd944fb0cdaafd5928

data/lib/rails/guarddog/checkers/xss_checker.rb

@@ -1,26 +1,44 @@
-module Rails
-  module Guarddog
-    module Checkers
-      class XssChecker < BaseChecker
-        def run
-          glob_files('app/views/**/*.erb').each do |file|
-            content = File.read(file)
-            content.each_line.with_index do |line, idx|
-              if line.include?('<%=') && (line.include?('params') || line.include?('@')) && !line.include?('sanitize') && !line.include?('h(')
-                add_finding(
-                  severity: :high,
-                  message: "Potential XSS vulnerability: unsanitized user input in view",
-                  file: file,
-                  line: idx + 1,
-                  snippet: line.strip,
-                  remediation: "Use <%= h() %> or sanitize() helper"
-                )
-              end
-            end
-          end
-          findings
-        end
-      end
-    end
-  end
-end
+module Rails
+  module Guarddog
+    module Checkers
+      class XssChecker < BaseChecker
+        def run
+          glob_files('app/views/**/*.erb').each do |file|
+            content = File.read(file)
+            content.each_line.with_index do |line, idx|
+              if xss_vulnerable?(line)
+                add_finding(
+                  severity: :high,
+                  message: "Potential XSS vulnerability: unescaped output detected",
+                  file: file,
+                  line: idx + 1,
+                  snippet: line.strip,
+                  remediation: "Use <%= h() %> or sanitize() instead of raw/html_safe"
+                )
+              end
+            end
+          end
+          findings
+        end
+
+        private
+
+        def xss_vulnerable?(line)
+          # <%== is Rails' raw output (alias for raw())
+          return true if line.match?(/<%==/)
+
+          # raw() helper explicitly disables escaping
+          return true if line.match?(/<%=.*\braw\s*\(/)
+
+          # .html_safe bypasses escaping
+          return true if line.match?(/<%=.*\.html_safe/)
+
+          # concat with raw content
+          return true if line.match?(/<%=.*content_tag.*html_safe/)
+
+          false
+        end
+      end
+    end
+  end
+end

data/lib/rails/guarddog/version.rb

@@ -1,5 +1,5 @@
 module Rails
   module Guarddog
-    VERSION = "0.1.6"
+    VERSION = "0.1.8"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-guarddog
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.8
 platform: ruby
 authors:
 - Security Team
@@ -88,7 +88,7 @@ files:
 - lib/rails/guarddog/scanner.rb
 - lib/rails/guarddog/version.rb
 - lib/tasks/guarddog.rake
-homepage: https://github.com/example/rails-guarddog
+homepage: https://github.com/sghani001/rails-guarddog
 licenses:
 - MIT
 metadata: {}