rails-guarddog 0.1.13 → 0.1.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7c9e1e9aac1c7e2bf1e56d36ff7265b4ab1db06538f123ae5fa06c2914c6f02c
|
|
4
|
+
data.tar.gz: daefaec237fbe6a1fc0112082200bfda9a6745fff4c9d6381843ee03c5cb6fe1
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 2696caa1c34f51eff8b9fcfc7b2eae1048a8e4599414c2d928bd77397160a9e5ec043ff7424dd16576667ccd6371e34fe43e4a914f54869dd332b6089857e0e8
|
|
7
|
+
data.tar.gz: 44f71976bf0c41729c4a563ab0f493d3e43ad7d01a044792e27cddb4534ce5360f3fbbb5bede037c8fe51ce31bb1223993ae11184be5ef94e2f72676babeadcd
|
data/README.md
CHANGED
|
@@ -104,7 +104,7 @@ That's it! Scan your entire Rails app for security vulnerabilities.
|
|
|
104
104
|
- **DoS/ReDoS** — Unbounded queries, dangerous regex patterns ⭐ ENHANCED in v0.1.8
|
|
105
105
|
- **Supply Chain** — Typosquatted gems using Levenshtein distance ⭐ IMPROVED in v0.1.8
|
|
106
106
|
|
|
107
|
-
> **False-positive protection (v0.1.10 - v0.1.
|
|
107
|
+
> **False-positive protection (v0.1.10 - v0.1.14)**
|
|
108
108
|
> - **Secrets**: Patterns use word boundaries — `no_token:` or `reset_password_instructions:` in locale
|
|
109
109
|
> files will **not** trigger the secrets checker.
|
|
110
110
|
> - **Secrets**: Secret values must be space-free (`[^\s'"]{6,}`) — human-readable sentences like
|
|
@@ -115,6 +115,8 @@ That's it! Scan your entire Rails app for security vulnerabilities.
|
|
|
115
115
|
> - **DoS**: Smart multiline `.limit()` check detection (v0.1.12) — lookahead up to 3 lines handles chained
|
|
116
116
|
> `.limit()` calls on subsequent lines or reassignment to the same variable, e.g. `things = Thing.all; things = things.limit(100)` or `.limit(...)` on the next line.
|
|
117
117
|
> - **Ignore File**: Support for `.guarddogignore` (v0.1.13) — allows excluding complete files/directories or ignoring specific checkers for specific files/directories.
|
|
118
|
+
> - **SQL Injection**: Precise argument-boundary matching (v0.1.14) — prevents false positives when string interpolation is used safely in query bind arguments (e.g. `where("column ILIKE ?", "#{value}%")`).
|
|
119
|
+
> - **DoS**: Pagy pagination support (v0.1.14) — query calls inside `pagy(...)` or `pagy_countless(...)` helpers are recognized as paginated and are not flagged as unbounded.
|
|
118
120
|
|
|
119
121
|
|
|
120
122
|
## 📊 Example Output
|
|
@@ -122,7 +124,7 @@ That's it! Scan your entire Rails app for security vulnerabilities.
|
|
|
122
124
|
### Console Report
|
|
123
125
|
```
|
|
124
126
|
============================================================
|
|
125
|
-
Rails GuardDog Security Report v0.1.
|
|
127
|
+
Rails GuardDog Security Report v0.1.14
|
|
126
128
|
============================================================
|
|
127
129
|
|
|
128
130
|
[CRITICAL] (5 findings)
|
|
@@ -309,6 +311,6 @@ MIT License - Free to use and modify.
|
|
|
309
311
|
|
|
310
312
|
---
|
|
311
313
|
|
|
312
|
-
**Rails GuardDog v0.1.
|
|
314
|
+
**Rails GuardDog v0.1.14 — Production Ready**
|
|
313
315
|
|
|
314
316
|
*Beyond brakeman. Detect what others miss.* 🐕🔒
|
|
@@ -74,6 +74,12 @@ module Rails
|
|
|
74
74
|
# UNBOUNDED_QUERY_PATTERN's end-of-expression anchor, but double-check.
|
|
75
75
|
return true if current_line.match?(/\.limit\s*\(/)
|
|
76
76
|
|
|
77
|
+
# Ignore queries wrapped inside pagy pagination helper calls (single or multi-line)
|
|
78
|
+
return true if current_line.match?(/\bpagy(?:_countless)?\s*\(/)
|
|
79
|
+
if current_idx > 0
|
|
80
|
+
return true if lines[current_idx - 1].match?(/\bpagy(?:_countless)?\b/)
|
|
81
|
+
end
|
|
82
|
+
|
|
77
83
|
# Extract the variable being assigned, supporting local vars, instance
|
|
78
84
|
# vars (@foo) and class-instance vars (@@foo).
|
|
79
85
|
assigned_var = current_line.match(/([@]{0,2}\w+)\s*=\s*[A-Z]/)&.[](1)
|
|
@@ -1,26 +1,29 @@
|
|
|
1
|
-
module Rails
|
|
2
|
-
module Guarddog
|
|
3
|
-
module Checkers
|
|
4
|
-
class SqlInjectionChecker < BaseChecker
|
|
5
|
-
def run
|
|
6
|
-
glob_files('app/**/*.rb').each do |file|
|
|
7
|
-
content = File.read(file)
|
|
8
|
-
content.each_line.with_index do |line, idx|
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
end
|
|
1
|
+
module Rails
|
|
2
|
+
module Guarddog
|
|
3
|
+
module Checkers
|
|
4
|
+
class SqlInjectionChecker < BaseChecker
|
|
5
|
+
def run
|
|
6
|
+
glob_files('app/**/*.rb').each do |file|
|
|
7
|
+
content = File.read(file)
|
|
8
|
+
content.each_line.with_index do |line, idx|
|
|
9
|
+
# Matches string interpolation ONLY in the first argument (the SQL template string).
|
|
10
|
+
# We check that #{ is reached before the closing quote of the first string argument.
|
|
11
|
+
if line.match?(/\.where\s*\(\s*(?:"[^"]*#\{|'[^']*#\{)/) ||
|
|
12
|
+
line.match?(/\.find_by_sql\s*\(\s*(?:"[^"]*#\{|'[^']*#\{)/)
|
|
13
|
+
add_finding(
|
|
14
|
+
severity: :high,
|
|
15
|
+
message: "Potential SQL injection: using string interpolation in queries",
|
|
16
|
+
file: file,
|
|
17
|
+
line: idx + 1,
|
|
18
|
+
snippet: line.strip,
|
|
19
|
+
remediation: "Use parameterized queries: .where('column = ?', value)"
|
|
20
|
+
)
|
|
21
|
+
end
|
|
22
|
+
end
|
|
23
|
+
end
|
|
24
|
+
findings
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
end
|
|
28
|
+
end
|
|
29
|
+
end
|