scanny 0.1.0

data/spec/support/matchers/check_matcher.rb

@@ -0,0 +1,43 @@
+RSpec::Matchers.define :check do |input|
+  chain :without_issues do
+    @type = :no_issues
+  end
+
+  chain :with_n_issues do |count|
+    @type = :issue_count
+    @count = count
+  end
+
+  chain :with_issue do |issue|
+    @type = :issue
+    @issue = issue
+  end
+
+  chain :with_issues do |*issues|
+    @type = :issues
+    @issues = issues.flatten
+  end
+
+  match do |scanny|
+    check_data = scanny.check("scanned_file.rb", input)
+
+    case @type
+      when :no_issues
+        check_data[:issues].should be_empty
+
+      when :issue_count
+        check_data[:issues].size.should == @count
+
+      when :issue
+        check_data[:issues].size.should == 1
+        check_data[:issues][0].should == @issue
+
+      when :issues
+        check_data[:issues].size.should == @issues.size
+        check_data[:issues].should =~ @issues
+
+      else
+        raise "Unknown check type: #{type.inspect}."
+    end
+  end
+end

data/spec/support/matchers/xpath_matcher.rb

@@ -0,0 +1,30 @@
+# Code taken from http://blog.wolfman.com/articles/2008/1/2/xpath-matchers-for-rspec
+
+require 'rexml/document'
+require 'rexml/element'
+
+RSpec::Matchers.define :have_xml do |xpath, text|
+  match do |body|
+    doc = REXML::Document.new body
+    nodes = REXML::XPath.match(doc, xpath)
+    nodes.empty?.should be_false
+    if text
+      nodes.each do |node|
+        node.text.should == text
+      end
+    end
+    true
+  end
+
+  failure_message_for_should do |body|
+    "expected to find xml tag #{xpath} in:\n#{body}"
+  end
+
+  failure_message_for_should_not do |response|
+    "expected not to find xml tag #{xpath} in:\n#{body}"
+  end
+
+  description do
+    "have xml tag #{xpath}"
+  end
+end

data/spec/support/mock_task.rb

@@ -0,0 +1,43 @@
+module Scanny
+  class MockTask
+    class << self
+      attr_accessor :last_instance, :last_cmd
+    end
+
+    def self.tasks
+      @tasks ||= {}
+    end
+
+    def self.reset_tasks
+      @tasks = {}
+    end
+
+    def self.task(name)
+      tasks[name]
+    end
+
+    def self.register_task(name, block)
+      tasks[name] = block
+    end
+
+    def initialize(name, &block)
+      MockTask.register_task(name, block)
+      MockTask.last_instance = block
+    end
+
+    def self.create_task(name, &block)
+      new(name, &block)
+    end
+  end
+
+  class RakeTask
+    def task(name, &block)
+      MockTask.create_task(name, &block)
+    end
+
+    def system(cmd)
+      MockTask.last_cmd = cmd
+      true
+    end
+  end
+end

metadata

@@ -0,0 +1,242 @@
+--- !ruby/object:Gem::Specification 
+name: scanny
+version: !ruby/object:Gem::Version 
+  hash: 1322991910812937300
+  prerelease: 
+  segments: 
+  - 0
+  - 1
+  - 0
+  version: 0.1.0
+platform: ruby
+authors: 
+- Thomas Biege
+- Flavio Castelli
+- David Majda
+- "Piotr Nie\xC5\x82acny"
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2012-08-19 00:00:00 Z
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: machete
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - "="
+      - !ruby/object:Gem::Version 
+        hash: 1694540110752149318
+        segments: 
+        - 0
+        - 5
+        - 0
+        version: 0.5.0
+  type: :runtime
+  version_requirements: *id001
+- !ruby/object:Gem::Dependency 
+  name: docopt
+  prerelease: false
+  requirement: &id002 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - "="
+      - !ruby/object:Gem::Version 
+        hash: 2495673787400639531
+        segments: 
+        - 0
+        - 0
+        - 4
+        version: 0.0.4
+  type: :runtime
+  version_requirements: *id002
+description: Find all security issues affecting your code.
+email: 
+- thomas@suse.de
+- fcastelli@novell.com
+- dmajda@suse.cz
+- piotr.nielacny@gmail.com
+executables: 
+- scanny
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- .gitignore
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- bin/scanny
+- lib/scanny.rb
+- lib/scanny/checks/access_control_check.rb
+- lib/scanny/checks/backticks_check.rb
+- lib/scanny/checks/before_filters_check.rb
+- lib/scanny/checks/check.rb
+- lib/scanny/checks/csrf_check.rb
+- lib/scanny/checks/denial_of_service_check.rb
+- lib/scanny/checks/file_open_check.rb
+- lib/scanny/checks/frameworks_check.rb
+- lib/scanny/checks/helpers.rb
+- lib/scanny/checks/http_basic_auth_check.rb
+- lib/scanny/checks/http_header/header_injection_check.rb
+- lib/scanny/checks/http_redirect_check.rb
+- lib/scanny/checks/http_request_check.rb
+- lib/scanny/checks/http_usage_check.rb
+- lib/scanny/checks/information_leak_check.rb
+- lib/scanny/checks/input_filtering_check.rb
+- lib/scanny/checks/insecure_config/set_rails_env_check.rb
+- lib/scanny/checks/insecure_config/set_secret_check.rb
+- lib/scanny/checks/insecure_config/set_session_key_check.rb
+- lib/scanny/checks/insecure_method/eval_method_check.rb
+- lib/scanny/checks/insecure_method/marshal_check.rb
+- lib/scanny/checks/insecure_method/system_method_check.rb
+- lib/scanny/checks/mass_assignment_check.rb
+- lib/scanny/checks/random_numbers_check.rb
+- lib/scanny/checks/redirect_with_params_check.rb
+- lib/scanny/checks/regexp_check.rb
+- lib/scanny/checks/reset_session_check.rb
+- lib/scanny/checks/session/access_to_session_check.rb
+- lib/scanny/checks/session/session_secure_check.rb
+- lib/scanny/checks/shell_expanding_methods_check.rb
+- lib/scanny/checks/skip_before_filters_check.rb
+- lib/scanny/checks/sql_injection/find_method_check.rb
+- lib/scanny/checks/sql_injection/find_method_with_dynamic_string_check.rb
+- lib/scanny/checks/sql_injection/find_method_with_params_check.rb
+- lib/scanny/checks/sql_injection/sanitize_sql_check.rb
+- lib/scanny/checks/sql_injection/sql_check.rb
+- lib/scanny/checks/sql_injection/string_interpolation_with_params_check.rb
+- lib/scanny/checks/ssl/verify_check.rb
+- lib/scanny/checks/ssl/verify_peer_check.rb
+- lib/scanny/checks/system_tools/gpg_usage_check.rb
+- lib/scanny/checks/system_tools/sudo_check.rb
+- lib/scanny/checks/system_tools/tar_check.rb
+- lib/scanny/checks/system_tools/tar_commands_check.rb
+- lib/scanny/checks/system_tools/unzip_check.rb
+- lib/scanny/checks/temp_file_open_check.rb
+- lib/scanny/checks/user_find_check.rb
+- lib/scanny/checks/validates_check.rb
+- lib/scanny/checks/verify_check.rb
+- lib/scanny/checks/xss/xss_flash_check.rb
+- lib/scanny/checks/xss/xss_logger_check.rb
+- lib/scanny/checks/xss/xss_mark_check.rb
+- lib/scanny/checks/xss/xss_send_check.rb
+- lib/scanny/cli.rb
+- lib/scanny/issue.rb
+- lib/scanny/rake_task.rb
+- lib/scanny/reporters.rb
+- lib/scanny/reporters/reporter.rb
+- lib/scanny/reporters/simple_reporter.rb
+- lib/scanny/reporters/xml_reporter.rb
+- lib/scanny/ruby_version_check.rb
+- lib/scanny/runner.rb
+- scanny.gemspec
+- spec/scanny/check_spec.rb
+- spec/scanny/checks/access_control_check_spec.rb
+- spec/scanny/checks/backticks_check_spec.rb
+- spec/scanny/checks/before_filters_check_spec.rb
+- spec/scanny/checks/csrf_check_spec.rb
+- spec/scanny/checks/denial_of_service_check_spec.rb
+- spec/scanny/checks/file_open_check_spec.rb
+- spec/scanny/checks/frameworks_check_spec.rb
+- spec/scanny/checks/http_basic_auth_check_spec.rb
+- spec/scanny/checks/http_header/header_injection_check_spec.rb
+- spec/scanny/checks/http_redirect_check_spec.rb
+- spec/scanny/checks/http_request_check_spec.rb
+- spec/scanny/checks/http_usage_check_spec.rb
+- spec/scanny/checks/information_leak_check_spec.rb
+- spec/scanny/checks/input_filtering_check_spec.rb
+- spec/scanny/checks/insecure_config/set_rails_env_check_spec.rb
+- spec/scanny/checks/insecure_config/set_secret_check_spec.rb
+- spec/scanny/checks/insecure_config/set_session_key_check_spec.rb
+- spec/scanny/checks/insecure_method/eval_method_check_spec.rb
+- spec/scanny/checks/insecure_method/marshal_check_spec.rb
+- spec/scanny/checks/insecure_method/system_method_check_spec.rb
+- spec/scanny/checks/mass_assignment_check_spec.rb
+- spec/scanny/checks/random_numbers_check_spec.rb
+- spec/scanny/checks/redirect_with_params_check_spec.rb
+- spec/scanny/checks/regexp_check_spec.rb
+- spec/scanny/checks/reset_session_check_spec.rb
+- spec/scanny/checks/session/access_to_session_check_spec.rb
+- spec/scanny/checks/session/session_secure_check_spec.rb
+- spec/scanny/checks/shell_expanding_methods_check_spec.rb
+- spec/scanny/checks/skip_before_filters_check_spec.rb
+- spec/scanny/checks/sql_injection/find_method_check_spec.rb
+- spec/scanny/checks/sql_injection/find_method_with_dynamic_string_check_spec.rb
+- spec/scanny/checks/sql_injection/find_method_with_params_check_spec.rb
+- spec/scanny/checks/sql_injection/sanitize_sql_check_spec.rb
+- spec/scanny/checks/sql_injection/string_interpolation_with_params_check_spec.rb
+- spec/scanny/checks/ssl/verify_check_spec.rb
+- spec/scanny/checks/ssl/verify_peer_check_spec.rb
+- spec/scanny/checks/system_tools/gpg_usage_check_spec.rb
+- spec/scanny/checks/system_tools/sudo_check_spec.rb
+- spec/scanny/checks/system_tools/tar_check_spec.rb
+- spec/scanny/checks/system_tools/tar_commands_check_spec.rb
+- spec/scanny/checks/system_tools/unizp_check_spec.rb
+- spec/scanny/checks/temp_file_open_check_spec.rb
+- spec/scanny/checks/user_find_check_spec.rb
+- spec/scanny/checks/validates_check_spec.rb
+- spec/scanny/checks/verify_check_spec.rb
+- spec/scanny/checks/xss/xss_flash_check_spec.rb
+- spec/scanny/checks/xss/xss_logger_check_spec.rb
+- spec/scanny/checks/xss/xss_mark_check_spec.rb
+- spec/scanny/checks/xss/xss_send_check_spec.rb
+- spec/scanny/cli_spec.rb
+- spec/scanny/issue_spec.rb
+- spec/scanny/rake_taks_spec.rb
+- spec/scanny/reporters/reporter_spec.rb
+- spec/scanny/reporters/simple_reporter_spec.rb
+- spec/scanny/reporters/xml_reporter_spec.rb
+- spec/scanny/ruby_version_check_spec.rb
+- spec/scanny/runner_spec.rb
+- spec/spec_helper.rb
+- spec/support/aruba.rb
+- spec/support/check_spec_helpers.rb
+- spec/support/checks/extend_test_check.rb
+- spec/support/checks/test_check.rb
+- spec/support/checks/test_strict_check.rb
+- spec/support/const_spec_helpers.rb
+- spec/support/matchers/check_matcher.rb
+- spec/support/matchers/xpath_matcher.rb
+- spec/support/mock_task.rb
+homepage: https://github.com/openSUSE/scanny
+licenses: []
+
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 2002549777813010636
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 2387630629434237851
+      segments: 
+      - 1
+      - 3
+      - 6
+      version: 1.3.6
+requirements: []
+
+rubyforge_project: scanny
+rubygems_version: 1.8.23
+signing_key: 
+specification_version: 3
+summary: Ruby security scanner
+test_files: []
+
+has_rdoc: