scanny 0.1.0

data/lib/scanny/checks/csrf_check.rb

@@ -0,0 +1,19 @@
+module Scanny
+  module Checks
+    # Checks for use of the "protect_from_forgery" method.
+    class CSRFCheck < Check
+      # protect_from_forgery
+      def pattern
+        "Send<receiver = Self, name = :protect_from_forgery>"
+      end
+
+      def check(node)
+        issue :info, "The \"protect_from_forgery\" method is used.", :cwe => 352
+      end
+
+      def strict?
+        true
+      end
+    end
+  end
+end

data/lib/scanny/checks/denial_of_service_check.rb

@@ -0,0 +1,42 @@
+module Scanny
+  module Checks
+    class DenialOfServiceCheck < Check
+      def pattern
+        pattern_find_with_like
+      end
+
+      def check(node)
+        issue :medium, warning_message, :cwe => 400
+      end
+
+      private
+
+      def warning_message
+        "Using \"LIKE\" in queries may lead to " +
+        "the unavailability of the application"
+      end
+
+      # User.find(:first, :conditions => "user LIKE %pattern%")
+      def pattern_find_with_like
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                any+,
+                HashLiteral<
+                  array = [
+                    any{even},
+                    SymbolLiteral<value = :limit | :conditions>,
+                    StringLiteral<string *= 'LIKE'>,
+                    any{even}
+                  ]
+                >
+              ]
+            >,
+            name *= /^find/
+          >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/file_open_check.rb

@@ -0,0 +1,46 @@
+module Scanny
+  module Checks
+    class FileOpenCheck < Check
+      def pattern
+        [
+          pattern_file_open,
+          pattern_fileutils
+        ].join("|")
+      end
+
+      def check(node)
+        issue :info, warning_message
+      end
+
+      def strict?
+        true
+      end
+
+      private
+
+      def warning_message
+        "Operations on files in code can lead to" +
+        "unauthorized access to data"
+      end
+
+      # File.open
+      def pattern_file_open
+        <<-EOT
+          SendWithArguments<
+            receiver = ConstantAccess<name = :File>,
+            name = :open
+          >
+        EOT
+      end
+
+      # FileUtils.any_method
+      def pattern_fileutils
+        <<-EOT
+          SendWithArguments<
+            receiver = ConstantAccess<name = :FileUtils>
+          >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/frameworks_check.rb

@@ -0,0 +1,24 @@
+module Scanny
+  module Checks
+    class FrameworksCheck < Check
+      def pattern
+        pattern_http_username
+      end
+
+      def check(node)
+        issue :info, warning_message
+      end
+
+      private
+
+      def warning_message
+        "Using the methods from frameworks can lead to security problems"
+      end
+
+      # env["HTTP_X_USERNAME"]
+      def pattern_http_username
+        "StringLiteral<string *= 'HTTP_X_USERNAME'>"
+      end
+    end
+  end
+end

data/lib/scanny/checks/helpers.rb

@@ -0,0 +1,28 @@
+module Scanny
+  module Checks
+    module Helpers
+      # system("command")
+      # `command`
+      def build_pattern_exec_command(command)
+        command = command.to_s if command.is_a?(Symbol)
+        result  = command.inspect
+
+        <<-EOT
+            SendWithArguments
+            <
+              name = :system | :exec | :spawn,
+              arguments = ActualArguments<
+                array = [
+                  any*,
+                  StringLiteral<string *= #{result}>,
+                  any*
+                ]
+              >
+            >
+            |
+            ExecuteString<string *= #{result}>
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/http_basic_auth_check.rb

@@ -0,0 +1,39 @@
+module Scanny
+  module Checks
+    class HTTPBasicAuthCheck < Check
+      def pattern
+        [
+          pattern_basic_auth,
+          pattern_http_authentication
+        ].join("|")
+      end
+
+      def check(node)
+        issue :info, warning_message, :cwe => [301, 718]
+      end
+
+      private
+
+      def warning_message
+        "Basic HTTP authentication can lead to security problems"
+      end
+
+      # Net::HTTPHeader.basic_auth('user', 'password')
+      def pattern_basic_auth
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [any{2}]
+            >,
+            name = :basic_auth
+          >
+        EOT
+      end
+
+      # HttpAuthentication
+      def pattern_http_authentication
+        "ConstantAccess<name = :HttpAuthentication>"
+      end
+    end
+  end
+end

data/lib/scanny/checks/http_header/header_injection_check.rb

@@ -0,0 +1,38 @@
+module Scanny
+  module Checks
+    module HttpHeader
+      class HeaderInjectionCheck < Check
+        def pattern
+          pattern_environment_params
+        end
+
+        def check(node)
+          issue :medium, warning_message, :cwe => [20, 113]
+        end
+
+        private
+
+        def warning_message
+          "Directly use of the HTTP_* headers in code. " +
+          "Possible injection vulnerabilities"
+        end
+
+        # env["HTTP_HEADER"]
+        # headers["HTTP_HEADER"]
+        def pattern_environment_params
+          <<-EOT
+            SendWithArguments<
+              arguments = ActualArguments<
+                array = [
+                  StringLiteral<string ^= "HTTP_">
+                ]
+              >,
+              name = :[],
+              receiver = Send<name = :env | :headers>
+            >
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/http_redirect_check.rb

@@ -0,0 +1,37 @@
+module Scanny
+  module Checks
+    class HTTPRedirectCheck < Check
+      def pattern
+        pattern_open_uri
+      end
+
+      def check(node)
+        issue :medium, warning_message, :cwe => 441
+      end
+
+      def strict?
+        true
+      end
+
+      private
+
+      def warning_message
+        "HTTP redirects can be emitted by the Application"
+      end
+
+      # require 'open-uri'
+      def pattern_open_uri
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                StringLiteral<string = 'open-uri'>
+              ]
+            >,
+            name = :require
+          >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/http_request_check.rb

@@ -0,0 +1,74 @@
+module Scanny
+  module Checks
+    class HTTPRequestCheck < Check
+      def pattern
+        [
+          pattern_net_http,
+          pattern_net_http_method,
+          pattern_net_http_proxy
+        ].join("|")
+      end
+
+      def check(node)
+        issue :low, warning_message, :cwe => 441
+      end
+
+      def strict?
+        true
+      end
+
+      private
+
+      def warning_message
+        "Connecting to the server without encryption " +
+        "can facilitate sniffing traffic"
+      end
+
+      # Net::HTTP.new
+      def pattern_net_http
+        <<-EOT
+          SendWithArguments<
+            receiver = ScopedConstant<
+              name = :HTTP,
+              parent = ConstantAccess<name = :Net>
+            >,
+            name = :new
+          >
+        EOT
+      end
+
+      def pattern_net_http_method
+        <<-EOT
+          SendWithArguments<
+            receiver = ScopedConstant<
+              name = any,
+              parent = ScopedConstant<
+                name = :HTTP,
+                parent = ConstantAccess<
+                  name = :Net
+                >
+              >
+            >,
+            name = :new
+          >
+        EOT
+      end
+
+      # Net::HTTP::Proxy('proxy.example.com', 8080)
+      def pattern_net_http_proxy
+        <<-EOT
+          SendWithArguments
+          <
+            receiver = ScopedConstant<
+              parent = ConstantAccess<
+                name = :Net
+              >,
+              name = :HTTP
+            >,
+            name = :Proxy
+          >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/http_usage_check.rb

@@ -0,0 +1,31 @@
+module Scanny
+  module Checks
+    class HTTPUsageCheck < Check
+      def pattern
+        pattern_http_url
+      end
+
+      def check(node)
+        issue :low, warning_message, :cwe => 319
+      end
+
+      def strict?
+        true
+      end
+
+      private
+
+      def warning_message
+        "Connecting to the server without encryption " +
+        "can facilitate sniffing traffic"
+      end
+
+      # "http://example.com"
+      def pattern_http_url
+        <<-EOT
+          StringLiteral<string *= "http://">
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/information_leak_check.rb

@@ -0,0 +1,55 @@
+module Scanny
+  module Checks
+    class InformationLeakCheck < Check
+      def pattern
+        [
+          pattern_logger_filter,
+          pattern_find
+        ].join("|")
+      end
+
+      def check(node)
+        issue :medium, warning_message, :cwe => 200
+      end
+
+      private
+
+      def warning_message
+        "There is a possibility of data leakage"
+      end
+
+      # filter_parameter_logging()
+      def pattern_logger_filter
+        <<-EOT
+          Send<name = :filter_parameter_logging>
+          |
+          SendWithArguments<name = :filter_parameter_logging>
+        EOT
+      end
+
+      # find_by_id(params[:input])
+      def pattern_find
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                any*,
+                SendWithArguments<
+                  arguments = ActualArguments<
+                    array = [
+                      SymbolLiteral<value = :id>
+                    ]
+                  >,
+                  name = :[],
+                  receiver = Send<name = :params>
+                >,
+                any*
+              ]
+            >,
+            name *= /^find/
+          >
+        EOT
+      end
+    end
+  end
+end