scanny 0.1.0

data/lib/scanny/checks/input_filtering_check.rb

@@ -0,0 +1,39 @@
+module Scanny
+  module Checks
+    class InputFilteringCheck < Check
+      def pattern
+        [
+          pattern_terminal_escape_sequences,
+          pattern_params
+        ].join("|")
+      end
+
+      def check(node)
+        issue :low, warning_message, :cwe => 20
+      end
+
+      private
+
+      def warning_message
+        "Possible injection vulnerabilities"
+      end
+
+      # params[:input]
+      def pattern_params
+        <<-EOT
+          SendWithArguments<
+            name = :[],
+            receiver = Send<name = :params>
+          >
+        EOT
+      end
+
+      # system("\033]30;command\007")
+      def pattern_terminal_escape_sequences
+        <<-EOT
+          StringLiteral<string *= /\\033\]30;.*\\007/>
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/insecure_config/set_rails_env_check.rb

@@ -0,0 +1,24 @@
+module Scanny
+  module Checks
+    # Checks for places where ENV["RAILS_ENV"] is set.
+    class SetRailsEnvCheck < Check
+      # ENV["RAILS_ENV"] = "test"
+      def pattern
+        <<-EOT
+          ElementAssignment<
+            receiver  = ConstantAccess<name = :ENV>,
+            arguments = ActualArguments<
+              array = [StringLiteral<string = "RAILS_ENV">, any]
+            >
+          >
+        EOT
+      end
+
+      def check(node)
+        issue :info,
+          "Setting ENV[\"RAILS_ENV\"] can indicate insecure configuration.",
+          :cwe => 209
+      end
+    end
+  end
+end

data/lib/scanny/checks/insecure_config/set_secret_check.rb

@@ -0,0 +1,25 @@
+module Scanny
+  module Checks
+    # Checks for places where :secret hash key is set.
+    class SetSecretCheck < Check
+      # :secret
+      def pattern
+        <<-EOT
+          HashLiteral<
+            array = [any{even}, SymbolLiteral<value = :secret>, any{odd}]
+          >
+        EOT
+      end
+
+      def check(node)
+        issue :info,
+          "Setting :secret can indicate using hard-coded cryptographic key.",
+          :cwe => 321
+      end
+
+      def strict?
+        true
+      end
+    end
+  end
+end

data/lib/scanny/checks/insecure_config/set_session_key_check.rb

@@ -0,0 +1,23 @@
+module Scanny
+  module Checks
+    # Checks for places where :session_key hash key is set.
+    class SetSessionKeyCheck < Check
+      # :session_key
+      def pattern
+        <<-EOT
+          HashLiteral<
+            array = [any{even}, SymbolLiteral<value = :session_key>, any{odd}]
+          >
+        EOT
+      end
+
+      def check(node)
+        issue :info, "Setting :session_key."
+      end
+
+      def strict?
+        true
+      end
+    end
+  end
+end

data/lib/scanny/checks/insecure_method/eval_method_check.rb

@@ -0,0 +1,26 @@
+module Scanny
+  module Checks
+    module InsecureMethod
+      class EvalMethodCheck < Check
+        def pattern
+          pattern_eval_call
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => 95
+        end
+
+        private
+
+        def warning_message
+          "Execute eval method can lead the ruby interpreter to run dangerous code"
+        end
+
+        # eval("ruby_code")
+        def pattern_eval_call
+          "SendWithArguments<name = :eval>"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/insecure_method/marshal_check.rb

@@ -0,0 +1,33 @@
+module Scanny
+  module Checks
+    module InsecureMethod
+      class MarshalCheck < Check
+        def pattern
+          pattern_load_call
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => 502
+        end
+
+        private
+
+        def warning_message
+          "Execute deserialize method can load to memory dangerous object"
+        end
+
+        # Marshal.load(object)
+        def pattern_load_call
+          <<-EOT
+            SendWithArguments<
+              name = :load | :restore,
+              receiver = ConstantAccess<
+                name = :Marshal
+              >
+            >
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/insecure_method/system_method_check.rb

@@ -0,0 +1,46 @@
+module Scanny
+  module Checks
+    module InsecureMethod
+      class SystemMethodCheck < Check
+        def pattern
+          [
+            pattern_system_calls,
+            pattern_execute_string,
+            pattern_popen
+          ].join("|")
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => [88, 78]
+        end
+
+        private
+
+        def warning_message
+          "Execute system commands can lead the system to run dangerous code"
+        end
+
+        # system("rm -rf /")
+        def pattern_system_calls
+          <<-EOT
+            SendWithArguments
+              <
+                name =  :system         |
+                        :spawn          |
+                        :exec
+              >
+          EOT
+        end
+
+        def pattern_popen
+          "SendWithArguments<name ^= :popen>"
+        end
+
+        # `system_command`
+        def pattern_execute_string
+          "ExecuteString"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/mass_assignment_check.rb

@@ -0,0 +1,48 @@
+module Scanny
+  module Checks
+    class MassAssignmentCheck < Check
+      def pattern
+        pattern_create_object_from_params
+      end
+
+      def check(node)
+        issue :high, warning_message, :cwe => 642
+      end
+
+      private
+
+      def warning_message
+        "Create objects without defense against mass assignment" +
+        "can cause dangerous errors in the database"
+      end
+
+      # User.new(params[:user])
+      def pattern_create_object_from_params
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                SendWithArguments<
+                  name = :[],
+                  receiver = Send<name = :params>
+                >
+                |
+                HashLiteral<
+                array = [
+                  any{odd},
+                  SendWithArguments<
+                    name = :[],
+                    receiver = Send<name = :params>
+                  >,
+                  any{even}
+                ]
+                >
+              ]
+            >,
+            name = :new | :create | :update_attributes
+          >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/random_numbers_check.rb

@@ -0,0 +1,54 @@
+module Scanny
+  module Checks
+    # Checks for indication that a low-entropy random number generator is used.
+    class RandomNumbersCheck < Check
+      def pattern
+        [
+          pattern_rand,
+          pattern_seed,
+          pattern_urandom
+        ].join("|")
+      end
+
+      def check(node)
+        issue :medium, warning_message, :cwe => 331
+      end
+
+      private
+
+      def warning_message
+        "This action indicates using low-entropy random number generator"
+      end
+
+      # Kernel.srand
+      # Kernel.rand
+      def pattern_rand
+        <<-EOT
+          Send<
+            receiver = Self | ConstantAccess<name = :Kernel>,
+            name = :rand | :srand
+          >
+          |
+          SendWithArguments<
+            receiver = Self | ConstantAccess<name = :Kernel>,
+            name = :rand | :srand
+          >
+        EOT
+      end
+
+      # seed()
+      def pattern_seed
+        <<-EOT
+          Send<name = :seed>
+          |
+          SendWithArguments<name = :seed>
+        EOT
+      end
+
+      # File.open("/dev/urandom", "r").read(100)
+      def pattern_urandom
+        "StringLiteral<string *= 'urandom'>"
+      end
+    end
+  end
+end

data/lib/scanny/checks/redirect_with_params_check.rb

@@ -0,0 +1,48 @@
+module Scanny
+  module Checks
+    class RedirectWithParamsCheck < Check
+      def pattern
+        pattern_redirect
+      end
+
+      def check(node)
+        issue :medium, warning_message, :cwe => [79, 113, 601, 698]
+      end
+
+      private
+
+      def warning_message
+        "Use of external parameters in redirect_to method" +
+        "can lead to unauthorized redirects"
+      end
+
+      # redirect_to params[:input]
+      def pattern_redirect
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                HashLiteral<
+                  array = [
+                    any{odd},
+                    SendWithArguments<
+                      name = :[],
+                      receiver = Send<name = :params>
+                    >,
+                    any{even}
+                  ]
+                >
+                |
+                SendWithArguments<
+                  name = :[],
+                  receiver = Send<name = :params>
+                >
+              ]
+            >,
+            name = :redirect_to
+          >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/regexp_check.rb

@@ -0,0 +1,23 @@
+module Scanny
+  module Checks
+    # Checks for possible improper regular expression usage.
+    class RegexpCheck < Check
+      def pattern
+        <<-EOT
+          RegexLiteral<source ^= "^">
+          |
+          RegexLiteral<source $= "$">
+          |
+          DynamicRegex<string ^= "^">
+          |
+          DynamicRegex<array = [any*, StringLiteral<string $= "$">]>
+        EOT
+      end
+
+      def check(node)
+        issue :low, "Possible improper regular expression usage.",
+          :cwe => [185, 625, 791]
+      end
+    end
+  end
+end

data/lib/scanny/checks/reset_session_check.rb

@@ -0,0 +1,24 @@
+module Scanny
+  module Checks
+    class ResetSessionCheck < Check
+      def pattern
+        pattern_reset_session
+      end
+
+      def check(node)
+        issue :info, warning_message, :cwe => 384
+      end
+
+      private
+
+      def warning_message
+        "Improper resetting the session may lead to security problems"
+      end
+
+      # reset_session()
+      def pattern_reset_session
+        "Send<name = :reset_session>"
+      end
+    end
+  end
+end

data/lib/scanny/checks/session/access_to_session_check.rb

@@ -0,0 +1,49 @@
+module Scanny
+  module Checks
+    module Session
+      class AccessToSessionCheck < Check
+        def pattern
+          [
+              pattern_session_access,
+              pattern_session_assignment
+          ].join("|")
+        end
+
+        def check(node)
+          issue :info, warning_message
+        end
+
+        def strict?
+          true
+        end
+
+        private
+
+        def warning_message
+          "Referring to a session in the wrong way" +
+          "can lead to errors that reduce security level"
+        end
+
+        # session[:password]
+        def pattern_session_access
+          <<-EOT
+          SendWithArguments<
+            name = :[],
+            receiver = Send<name = :session | :cookie>
+          >
+          EOT
+        end
+
+        # session[:admin] = true
+        def pattern_session_assignment
+          <<-EOT
+          ElementAssignment<
+            name = :[]=,
+            receiver = Send<name = :session | :cookie>
+          >
+          EOT
+        end
+      end
+    end
+  end
+end