rails-guarddog 0.1.9 → 0.1.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae20382e818b53d7afdb3344fdd95711edd8c8890441ec4212231ccea489c41f
-  data.tar.gz: a0ff9456c95b09c64983d80165ebbc6b59868dd4e6aef6b56aef3d1b21e7d467
+  metadata.gz: 859dc0da3cfd03afa3ceea5be6d2feba0f3f49786f109fb82c0a5b1c379c0837
+  data.tar.gz: a0251fa578fb369a59316ff36e62e4409cbfb0b08bdc4c4be1d2d75b764c1411
 SHA512:
-  metadata.gz: cd08bde46e4cd0125ee004805cac926cc053fc66ddf655b58ddfa9d1bb5dd534ed02cf498c8695a44b51a4b96ad5321398b9a49dcad4771da544d2cc4b7c9760
-  data.tar.gz: 78adf464a90b83119d33bcd54c652497da03125fa9356f3820df37d5405186601808522e03b5f7e789a0f8633a1fe6b530290cd0f0df55404b71d2452618d4c8
+  metadata.gz: 3394a5d46d8ed065003722151b6f5d74361fac8e9656a3c39760e02fc25e581c474cb3246aa9bb8337530a50f70d492dfc77127b1770f7fa82bc6d01460073e5
+  data.tar.gz: f52bea6bb7b20187c2ab4a1751267f5987116f1839657bda880dfb93e18a96a8840e4621fde4b490c4d4d318c9f42fbe453be04c6514aa0a42c26b4293a40840

data/README.md

@@ -98,20 +98,28 @@ That's it! Scan your entire Rails app for security vulnerabilities.
 ### Data Protection
 - **CSRF Protection** — Disabled without documented reason
 - **Mass Assignment** — `permit!` vulnerabilities ⭐ IMPROVED in v0.1.8
-- **Hardcoded Secrets** — API keys, tokens, passwords in code (ALWAYS-ON)
+- **Hardcoded Secrets** — API keys, tokens, passwords in code (ALWAYS-ON, false-positive-safe)
 
 ### Resource Management
 - **DoS/ReDoS** — Unbounded queries, dangerous regex patterns ⭐ ENHANCED in v0.1.8
 - **Supply Chain** — Typosquatted gems using Levenshtein distance ⭐ IMPROVED in v0.1.8
 
----
+> **False-positive protection (v0.1.10)**
+> - Patterns use word boundaries — `no_token:` or `reset_password_instructions:` in locale
+>   files will **not** trigger the secrets checker.
+> - Secret values must be space-free (`[^\s'"]{6,}`) — human-readable sentences like
+>   `"You can't access this page..."` are never flagged.
+> - `config/locales/` files are skipped entirely — i18n translations are not credentials.
+> - `spec/` and `test/` trees suppress the secrets checker by default (configurable via
+>   `ignored_checks`).
+
 
 ## 📊 Example Output
 
 ### Console Report
 ```
 ============================================================
-          Rails GuardDog Security Report v0.1.8
+          Rails GuardDog Security Report v0.1.10
 ============================================================
 
 [CRITICAL] (5 findings)
@@ -165,25 +173,23 @@ Create `config/initializers/guarddog.rb`:
 
 ```ruby
 Rails.application.config.after_initialize do
-  # Enable only specific checkers
+  # --- Option A: Enable only specific checkers ---
   Rails.application.config.guarddog.enabled_checkers = %w[
     sql_injection xss csrf mass_assignment secrets
     ai_injection idor dos rate_limit supply_chain
   ]
 
+  # --- Option B: Disable only specific checkers (keep everything else) ---
+  # Easier when you want "all but a couple". Takes priority over enabled_checkers.
+  Rails.application.config.guarddog.disabled_checkers = %w[dos rate_limit]
+
   # Directories to skip entirely (all checks silenced).
   # Default: %w[vendor node_modules]
   Rails.application.config.guarddog.excluded_paths = %w[vendor node_modules]
 
   # Suppress specific checkers for files under certain path substrings.
   # Keys are path fragments; values are arrays of checker names.
-  # This is useful to avoid false positives in test/spec trees where
-  # dummy passwords and tokens are intentional.
-  #
-  # Default (built-in):
-  #   { "spec" => %w[secrets], "test" => %w[secrets] }
-  #
-  # Override or extend:
+  # Default: { "spec" => %w[secrets], "test" => %w[secrets] }
   Rails.application.config.guarddog.ignored_checks = {
     "spec"     => %w[secrets],          # no secrets alerts in spec/
     "test"     => %w[secrets],          # no secrets alerts in test/
@@ -198,16 +204,20 @@ Rails.application.config.after_initialize do
 end
 ```
 
+### Disabling specific checkers
 
-### Suppressing checks per directory
-
-If you see false positives like dummy passwords flagged in test/spec files:
+If you want to keep all checkers **except a couple**, use `disabled_checkers`
+instead of maintaining a long `enabled_checkers` list:
 
+```ruby
+# All 12 checkers run, except dos and rate_limit
+Rails.application.config.guarddog.disabled_checkers = %w[dos rate_limit]
 ```
-Secrets — Hardcoded secret detected
-  /app/spec/controllers/api/v1/users_controller_spec.rb:1975
-  Fix: Use ENV variables or Rails credentials
-```
+
+This is the recommended approach when you hit false positives in one checker
+but still want full coverage from all others.
+
+### Suppressing checks per directory
 
 GuardDog already silences `secrets` in `spec/` and `test/` by default. To add
 more suppressions or override the defaults, set `ignored_checks` in your
@@ -215,6 +225,7 @@ initializer (see example above).
 
 ---
 
+
 ## 🔄 CI/CD Integration
 
 ### GitHub Actions
@@ -279,6 +290,6 @@ MIT License - Free to use and modify.
 
 ---
 
-**Rails GuardDog v0.1.8 — Production Ready**
+**Rails GuardDog v0.1.10 — Production Ready**
 
 *Beyond brakeman. Detect what others miss.* 🐕🔒

data/lib/rails/guarddog/checkers/dos_checker.rb

@@ -1,38 +1,63 @@
-module Rails
-  module Guarddog
-    module Checkers
-      class DosChecker < BaseChecker
-        def run
-          glob_files('app/**/*.rb').each do |file|
-            content = File.read(file)
-            content.each_line.with_index do |line, idx|
-              # Check for unbounded queries
-              if line.match?(/\.where\(.*\)\.all/) || line.match?(/\.all\s*$/)
-                add_finding(
-                  severity: :high,
-                  message: "Potential DoS: unbounded database query without limit",
-                  file: file,
-                  line: idx + 1,
-                  snippet: line.strip,
-                  remediation: "Add .limit() to control result size"
-                )
-              end
-              # Check for regex vulnerabilities
-              if line.match?(/\/.+\*\+.*\*\+.+\//) || line.match?(/match\?.*\(.+\*\+/)
-                add_finding(
-                  severity: :high,
-                  message: "Potential ReDoS vulnerability: dangerous regex pattern",
-                  file: file,
-                  line: idx + 1,
-                  snippet: line.strip,
-                  remediation: "Simplify regex or use timeout mechanisms"
-                )
-              end
-            end
-          end
-          findings
-        end
-      end
-    end
-  end
-end
+module Rails
+  module Guarddog
+    module Checkers
+      class DosChecker < BaseChecker
+        # Matches .all only when it is the final call on an ActiveRecord-style
+        # model class (PascalCase constant), e.g.:
+        #   User.all           => flagged
+        #   Post.where(...).all => flagged
+        # But NOT:
+        #   current_user.permissions.track_manage.all  => NOT flagged (chained on object)
+        #   collection.all? { }                        => NOT flagged (.all? method)
+        #   track_manage.all                           => NOT flagged (lowercase receiver)
+        UNBOUNDED_QUERY_PATTERN = /
+          (?:
+            [A-Z][A-Za-z0-9_]*   # PascalCase model class  e.g. User, TrackItem
+            (?:\.[a-z_]+\(.*?\))* # optional chained scopes e.g. .where(...).order(...)
+          )
+          \.all                   # the .all call
+          (?!\?)                  # not .all? (Enumerable method, not AR query)
+          \s*(?:[,)\]#\n]|$)     # followed by end-of-expression
+        /x.freeze
+
+        # Patterns known to be dangerous nested regex (ReDoS)
+        REDOS_PATTERNS = [
+          /\/.+\*\+.*\*\+.+\//,
+          /match\?.*\(.+\*\+/
+        ].freeze
+
+        def run
+          glob_files('app/**/*.rb').each do |file|
+            content = File.read(file) rescue next
+            content.each_line.with_index do |line, idx|
+              next if line.strip.start_with?('#')
+
+              if line.match?(UNBOUNDED_QUERY_PATTERN)
+                add_finding(
+                  severity: :high,
+                  message: "Potential DoS: unbounded database query without limit",
+                  file: file,
+                  line: idx + 1,
+                  snippet: line.strip,
+                  remediation: "Add .limit() to control result size"
+                )
+              end
+
+              if REDOS_PATTERNS.any? { |pat| line.match?(pat) }
+                add_finding(
+                  severity: :high,
+                  message: "Potential ReDoS vulnerability: dangerous regex pattern",
+                  file: file,
+                  line: idx + 1,
+                  snippet: line.strip,
+                  remediation: "Simplify regex or use timeout mechanisms"
+                )
+              end
+            end
+          end
+          findings
+        end
+      end
+    end
+  end
+end

data/lib/rails/guarddog/checkers/secrets_checker.rb

@@ -2,20 +2,33 @@ module Rails
   module Guarddog
     module Checkers
       class SecretsChecker < BaseChecker
+        # Paths whose files should never be checked for secrets.
+        # Locale/i18n YAML files contain human-readable strings, not credentials.
+        SKIP_PATH_FRAGMENTS = %w[config/locales].freeze
+
+        # Each pattern uses:
+        #   \b / \w*     — boundary/prefix so compound names like AUTH_TOKEN,
+        #                  access_token, devise_token are all caught.
+        #   [^\s'"]{N,}  — secret value must be space-free and at least N chars;
+        #                  this eliminates human-readable sentences (false positives)
+        #                  e.g. no_token: "You can't access this page..." won't match.
         PATTERNS = [
-          /api[_-]?key\s*[=:]\s*['"][^'"]+['"]/i,
-          /secret[_-]?key\s*[=:]\s*['"][^'"]+['"]/i,
-          /password\s*[=:]\s*['"][^'"]+['"]/i,
-          /token\s*[=:]\s*['"][^'"]+['"]/i
-        ]
+          /\bapi[_-]?key\s*[=:]\s*['"][^\s'"]{6,}['"]/i,
+          /\bsecret[_-]?key\s*[=:]\s*['"][^\s'"]{6,}['"]/i,
+          /\bpassword\s*[=:]\s*['"][^\s'"]{4,}['"]/i,
+          # Matches: token, AUTH_TOKEN, access_token, devise_token, reset_token, etc.
+          /\b\w*token\w*\s*[=:]\s*['"][^\s'"]{6,}['"]/i
+        ].freeze
 
         def run
-          %w[*.rb *.yml .env .env.local].each do |pattern|
-            glob_files("**/{#{pattern}}").each do |file|
+          %w[*.rb *.yml .env .env.local].each do |file_pattern|
+            glob_files("**/{#{file_pattern}}").each do |file|
+              next if skip_file?(file)
+
               content = File.read(file) rescue next
               content.each_line.with_index do |line, idx|
-                PATTERNS.each do |pattern|
-                  if line.match?(pattern) && !line.strip.start_with?('#')
+                PATTERNS.each do |pat|
+                  if line.match?(pat) && !line.strip.start_with?('#')
                     add_finding(
                       severity: :critical,
                       message: "Hardcoded secret detected",
@@ -30,6 +43,12 @@ module Rails
           end
           findings
         end
+
+        private
+
+        def skip_file?(file)
+          SKIP_PATH_FRAGMENTS.any? { |fragment| file.include?(fragment) }
+        end
       end
     end
   end

data/lib/rails/guarddog/configuration.rb

@@ -2,11 +2,16 @@ module Rails
   module Guarddog
     class Configuration
       attr_writer :root
-      attr_accessor :enabled_checkers, :excluded_paths, :output_format, :ignored_checks
+      attr_accessor :enabled_checkers, :disabled_checkers, :excluded_paths, :output_format, :ignored_checks
 
       def initialize
         @root = nil
         @enabled_checkers = all_checkers
+        # Checkers to turn off without having to list every other checker in
+        # enabled_checkers. Takes priority over enabled_checkers.
+        # Example: disable just dos and rate_limit:
+        #   config.disabled_checkers = %w[dos rate_limit]
+        @disabled_checkers = []
         @excluded_paths = %w[vendor node_modules]
         # Per-directory checker suppression: keys are path substrings, values are
         # arrays of checker names (same format as enabled_checkers).
@@ -19,6 +24,12 @@ module Rails
         @output_format = :console
       end
 
+      # The final resolved list of checkers to run:
+      # enabled_checkers minus anything in disabled_checkers.
+      def active_checkers
+        enabled_checkers - Array(@disabled_checkers).map(&:to_s)
+      end
+
       def root
         @root || Rails.root.to_s
       end

data/lib/rails/guarddog/scanner.rb

@@ -20,20 +20,21 @@ module Rails
       private
 
       def load_checkers
-        [
-          Checkers::SqlInjectionChecker,
-          Checkers::XssChecker,
-          Checkers::CsrfChecker,
-          Checkers::MassAssignmentChecker,
-          Checkers::OpenRedirectChecker,
-          Checkers::SecretsChecker,
-          Checkers::DosChecker,
-          Checkers::IdorChecker,
-          Checkers::AiInjectionChecker,
-          Checkers::RateLimitChecker,
-          Checkers::DependencyChecker,
-          Checkers::GraphqlChecker
-        ]
+        checker_map = {
+          'sql_injection'  => Checkers::SqlInjectionChecker,
+          'xss'            => Checkers::XssChecker,
+          'csrf'           => Checkers::CsrfChecker,
+          'mass_assignment'=> Checkers::MassAssignmentChecker,
+          'open_redirect'  => Checkers::OpenRedirectChecker,
+          'secrets'        => Checkers::SecretsChecker,
+          'dos'            => Checkers::DosChecker,
+          'idor'           => Checkers::IdorChecker,
+          'ai_injection'   => Checkers::AiInjectionChecker,
+          'rate_limit'     => Checkers::RateLimitChecker,
+          'dependency'     => Checkers::DependencyChecker,
+          'graphql'        => Checkers::GraphqlChecker
+        }
+        @configuration.active_checkers.filter_map { |name| checker_map[name] }
       end
 
       def severity_order(severity)

data/lib/rails/guarddog/version.rb

@@ -1,5 +1,5 @@
 module Rails
   module Guarddog
-    VERSION = "0.1.9"
+    VERSION = "0.1.11"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-guarddog
 version: !ruby/object:Gem::Version
-  version: 0.1.9
+  version: 0.1.11
 platform: ruby
 authors:
 - Security Team
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-12 00:00:00.000000000 Z
+date: 2026-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties