rubocop-gitlab-security 0.0.2 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0df0bdbc8d95c279e3efb8eafbebada37c239175
-  data.tar.gz: 84457ddbb4749bcedf241ce8b4eb634ce6473e7f
+  metadata.gz: 07583650e709307d9bef8cf66f06ae194d8c9016
+  data.tar.gz: 80e18df385a8682121b0bf064e827a48336bd6fe
 SHA512:
-  metadata.gz: b98c83920653896642ed811ef53c9962e0b43e6f1b6c1c656ba95c437f9f19c5030315ff3ae23833385020350c20960891a9b0cc6b780ecf00e3814d75961d15
-  data.tar.gz: 47255a332d585b3bfa5f063e252c9c6a80acb8319378e9d4d74e28dc8d839d2a6f3d0bc0a81ff2bf0e57a25122b9b67e68861f12dd9562ba74f4641ba41b35cc
+  metadata.gz: 447ce7bd7c92f5753a682a67e15b94b869237e0da9180a2edda0a8a4da20dd6b90f1f488c9c56713ca49d99c87c5f0b7833e4043cbb2532b0a9f891683227d5b
+  data.tar.gz: 2a3f5f2f545b1ef07b044b7b1dc7e359251f9abeac925188552ab2d018fe855e809bb36ceda6c134193a1ad658058e0a5fb024e43e0520b38dd2e6ef5edd34da

data/MIT-LICENSE.md

@@ -1,7 +1,7 @@
 The MIT License (MIT)
 =====================
 
-Copyright (c) 2014 Ian MacLeod <ian@nevir.net>
+Copyright (c) 2017 GitLab B.V.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
@@ -19,4 +19,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.

data/README.md

@@ -2,7 +2,7 @@ This is an early attempt at creating Rubocop rules, similar to Rubocop-RSpec, fo
 blocking dangerous code. This code is based heavily upon the [Rubocop-RSpec](https://github.com/backus/rubocop-rspec)
 code released under the MIT License.
 
-Installation is the same as with Rubocop-RSpec.
+## Installation
 
 Just install the `rubocop-gitlab-security` gem
 
@@ -54,17 +54,17 @@ By default, `rubocop-gitlab-security` inspects all files. You can override this
 ```yaml
 # Inspect all files
 AllCops:
-  RSpec:
+  GitlabSecurity:
     Patterns:
     - '.+'
 ```
 
 ```yaml
-# Inspect only files ending with `_test.rb`
+# Inspect only controller files.
 AllCops:
-  RSpec:
+  GitlabSecurity:
     Patterns:
-    - '_test.rb$'
+    - app/controllers/**/*.rb
 ```
 
 ## The Cops

data/config/default.yml

@@ -8,3 +8,9 @@ AllCops:
 GitlabSecurity/PublicSend:
   Description: Check for use of send()/public_send()
   Enabled: true
+GitlabSecurity/RedirectToParamsUpdate:
+  Description: Check for use of redirect_to(params.update())
+  Enabled: true
+GitlabSecurity/SendFileParams:
+  Description: Check for passing of params hash to send_file()
+  Enabled: true

data/lib/rubocop-gitlab-security.rb

@@ -20,3 +20,5 @@ require 'rubocop/cop/gitlab-security/cop'
 RuboCop::GitlabSecurity::Inject.defaults!
 
 require 'rubocop/cop/gitlab-security/public_send'
+require 'rubocop/cop/gitlab-security/redirect_to_params_update'
+require 'rubocop/cop/gitlab-security/send_file_params'

data/lib/rubocop/cop/gitlab-security/redirect_to_params_update.rb

@@ -0,0 +1,31 @@
+module RuboCop
+  module Cop
+    module GitlabSecurity
+      # Check for use of redirect_to(params.update())
+      #
+      # Passing user params to the redirect_to method provides an open redirect
+      # 
+      # @example
+      #
+      #   # bad
+      #   redirect_to(params.update(action:'main'))
+      # 
+      #   # good
+      #   redirect_to(whitelist(params))
+      #
+      class RedirectToParamsUpdate < RuboCop::Cop::Cop
+        MSG = 'Avoid using redirect_to(params.update()). Only pass whitelisted arguments into redirect_to() (e.g. not including `host`)'
+
+        def_node_matcher :redirect_to_params_update_node, <<-PATTERN
+           (send nil :redirect_to (send (send nil :params) ${:update :merge} ...))
+        PATTERN
+
+        def on_send(node)
+          return unless redirect_to_params_update_node(node)
+
+          add_offense(node, :selector)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/gitlab-security/send_file_params.rb

@@ -0,0 +1,36 @@
+module RuboCop
+  module Cop
+    module GitlabSecurity
+      # Check for use of send_file(..., params[], ...)
+      #
+      # Passing user params to the send_file() method allows directory traversal
+      # 
+      # @example
+      #
+      #   # bad
+      #   send_file("/tmp/myproj/" + params[:filename])
+      # 
+      #   # good (verify directory)
+      
+      #   basename = File.expand_path("/tmp/myproj")
+      #   filename = File.expand_path(File.join(basename, @file.public_filename))
+      #   raise if basename != filename
+      #   send_file filename, disposition: 'inline'
+      #
+      class SendFileParams < RuboCop::Cop::Cop
+        MSG = 'Do not pass user provided params directly to send_file(), verify the path with file.expand_path() first.'
+
+        def_node_search :params_node?, <<-PATTERN
+           (send (send nil :params) ... )
+        PATTERN
+
+        def on_send(node)
+          return unless node.command?(:send_file)
+          return unless node.method_args.any? { |e| params_node?(e) }
+
+          add_offense(node, :selector)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/gitlab-security/version.rb

@@ -4,7 +4,7 @@ module RuboCop
   module GitlabSecurity
     # Version information for the GitlabSecurity Rubocop  plugin.
     module Version
-      STRING = '0.0.2'.freeze
+      STRING = '0.0.4'.freeze
     end
   end
 end

data/rubocop-gitlab-security.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |spec|
     Basic security checking for Ruby files.
     A plugin for the RuboCop code style enforcing & linting tool.
   end_description
-  spec.homepage = 'http://gitlab.com/briann/rubocop-gitlab-security'
+  spec.homepage = 'https://gitlab.com/gitlab-org/rubocop-gitlab-security'
   spec.authors = ['Brian Neel']
   spec.email = [
     'brian@gitlab.com'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-gitlab-security
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.4
 platform: ruby
 authors:
 - Brian Neel
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-14 00:00:00.000000000 Z
+date: 2017-06-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop
@@ -55,6 +55,8 @@ files:
 - lib/rubocop-gitlab-security.rb
 - lib/rubocop/cop/gitlab-security/cop.rb
 - lib/rubocop/cop/gitlab-security/public_send.rb
+- lib/rubocop/cop/gitlab-security/redirect_to_params_update.rb
+- lib/rubocop/cop/gitlab-security/send_file_params.rb
 - lib/rubocop/gitlab-security.rb
 - lib/rubocop/gitlab-security/concept.rb
 - lib/rubocop/gitlab-security/config_formatter.rb
@@ -70,7 +72,7 @@ files:
 - lib/rubocop/gitlab-security/version.rb
 - lib/rubocop/gitlab-security/wording.rb
 - rubocop-gitlab-security.gemspec
-homepage: http://gitlab.com/briann/rubocop-gitlab-security
+homepage: https://gitlab.com/gitlab-org/rubocop-gitlab-security
 licenses:
 - MIT
 metadata: {}