scanny 0.1.0

data/lib/scanny/checks/session/session_secure_check.rb

@@ -0,0 +1,47 @@
+module Scanny
+  module Checks
+    module Session
+      class SessionSecureCheck < Check
+        def pattern
+          pattern_session_settings
+        end
+
+        def check(node)
+          issue :info, warning_message, :cwe => 614
+        end
+
+        def strict?
+          true
+        end
+
+        private
+
+        def warning_message
+          "Bad session security setting can cause problems"
+        end
+
+        # ActionController::Base.session_options[:session_secure]
+        def pattern_session_settings
+          <<-EOT
+            ElementAssignment<
+              arguments = ActualArguments<
+                array = [
+                  SymbolLiteral<value = :session_secure | :secure>,
+                  any
+                ]
+              >,
+              name = :[]=,
+              receiver = Send<
+                name = :session_options,
+                receiver = ScopedConstant<
+                  name = :Base,
+                  parent = ConstantAccess<name = :ActionController>
+                >
+              >
+            >
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/shell_expanding_methods_check.rb

@@ -0,0 +1,54 @@
+module Scanny
+  module Checks
+    # Checks for methods executing external commands that pass the command
+    # through shell expansion. This can cause unwanted code execution if the
+    # command includes unescaped input.
+    class ShellExpandingMethodsCheck < Check
+      def pattern
+        [
+          pattern_shell_expanding,
+          pattern_popen,
+          pattern_execute_string
+        ].join("|")
+      end
+
+      def check(node)
+        # The command goes through shell expansion only if it is passed as one
+        # argument.
+        issue :high, warning_message(node), :cwe => [88, 78]
+      end
+
+      def warning_message(node = nil)
+        name = node.respond_to?(:name) ? node.name : "`"
+        "The \"#{name}\" method passes the executed command through shell expansion."
+      end
+
+      # system("rm -rf /")
+      def pattern_shell_expanding
+        <<-EOT
+          SendWithArguments<
+            receiver  = Self | ConstantAccess<name = :Kernel>,
+            name      = :` | :exec | :system | :spawn,
+            arguments = ActualArguments<array = [any]>
+          >
+        EOT
+      end
+
+      # IO.popen
+      # IO.popen3
+      def pattern_popen
+        <<-EOT
+          SendWithArguments<
+            name ^= :popen,
+            arguments = ActualArguments<array = [any]>
+          >
+        EOT
+      end
+
+      # `system_command`
+      def pattern_execute_string
+        "ExecuteString"
+      end
+    end
+  end
+end

data/lib/scanny/checks/skip_before_filters_check.rb

@@ -0,0 +1,41 @@
+module Scanny
+  module Checks
+    # Checks for use of the "before_filter" method with certain filters.
+    class SkipBeforeFiltersCheck < Check
+      FILTERS = [
+        :login_required,
+        :admin_required,
+        :verify_authenticity_token,
+        :authenticate
+      ]
+
+      # skip_before_filer :login_required
+      def pattern
+        <<-EOT
+          SendWithArguments<
+            receiver  = Self,
+            name      = :skip_before_filter,
+            arguments = ActualArguments<
+              array = [
+                any*,
+                SymbolLiteral<value = #{FILTERS.map(&:inspect).join(' | ')}>,
+                any*
+              ]
+            >
+          >
+        EOT
+      end
+
+      def check(node)
+        filter_node = node.arguments.array.find do |argument|
+          argument.is_a?(Rubinius::AST::SymbolLiteral) &&
+            FILTERS.include?(argument.value)
+        end
+
+        issue :info,
+          "The \"skip_before_filter\" method with :#{filter_node.value} filter is used.",
+          :cwe => [285, 288, 425]
+      end
+    end
+  end
+end

data/lib/scanny/checks/sql_injection/find_method_check.rb

@@ -0,0 +1,81 @@
+require_relative "sql_check"
+
+module Scanny
+  module Checks
+    module Sql
+      # Check for methods executing external params on
+      # database engine
+      class FindMethodCheck < SqlCheck
+        def pattern
+          [
+            pattern_find_by_sql_and_execute_on_models,
+            pattern_find_by_with_params,
+            pattern_find_by_with_conditions
+          ].join("|")
+        end
+
+        def check(node)
+          issue :low, warning_message, :cwe => 89
+        end
+
+        private
+
+        # User.find_by_sql
+        # @collection.paginate(options)
+        def pattern_find_by_sql_and_execute_on_models
+          <<-EOT
+            Send<name = :paginate>
+            |
+            SendWithArguments<
+              name = :execute | :find_by_sql | :paginate
+            >
+          EOT
+        end
+
+        # find_by_id(params[:search])
+        def pattern_find_by_with_params
+          <<-EOT
+            SendWithArguments<
+              arguments = ActualArguments<
+                array = [
+                  any*,
+                  SendWithArguments<
+                    name = :[],
+                    receiver = Send<
+                      name = :params
+                    >
+                  >,
+                  any*
+                ]
+              >,
+              name ^= :find_by
+            >
+          EOT
+        end
+
+        # find(:first, :conditions => "string")
+        def pattern_find_by_with_conditions
+          <<-EOT
+            SendWithArguments<
+              arguments = ActualArguments<
+                array = [
+                  any+,
+                  HashLiteral<
+                    array = [
+                      any{even},
+                      SymbolLiteral<
+                        value = :conditions
+                      >,
+                      any{odd}
+                    ]
+                  >
+                ]
+              >,
+              name = :find
+            >
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/sql_injection/find_method_with_dynamic_string_check.rb

@@ -0,0 +1,43 @@
+require_relative "sql_check"
+
+module Scanny
+  module Checks
+    module Sql
+      # Check for methods executing external params on
+      # database engine with dynamic string
+      class FindMethodWithDynamicStringCheck < SqlCheck
+        def pattern
+          pattern_find_by_with_conditions_dynamic_string
+        end
+
+        def check(node)
+          issue :medium, warning_message, :cwe => 89
+        end
+
+        private
+
+        # find(:first, :conditions => "#{string}")
+        def pattern_find_by_with_conditions_dynamic_string
+          <<-EOT
+            SendWithArguments<
+              arguments = ActualArguments<
+                array = [
+                  any+,
+                  HashLiteral<
+                    array = [
+                      any{even},
+                      SymbolLiteral<value = :conditions>,
+                      DynamicString,
+                      any{even}
+                    ]
+                  >
+                ]
+              >,
+              name = :find
+            >
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/sql_injection/find_method_with_params_check.rb

@@ -0,0 +1,80 @@
+require_relative "sql_check"
+
+module Scanny
+  module Checks
+    module Sql
+      # Check for methods executing external parameters on
+      # database engine with params attribute
+      class FindMethodWithParamsCheck < SqlCheck
+        def pattern
+          [
+            pattern_find_by_sql_and_execute_on_models_with_params,
+            pattern_find_with_conditions_and_params_or_limit
+          ].join("|")
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => 89
+        end
+
+        private
+
+        # User.execute(params[:input])
+        def pattern_find_by_sql_and_execute_on_models_with_params
+          <<-EOT
+            SendWithArguments<
+              arguments = ActualArguments<
+                array = [
+                  any*,
+                  SendWithArguments<
+                    name = :[],
+                    receiver = Send<name = :params>
+                  >
+                  |
+                  DynamicString<
+                    array = [
+                      any*,
+                      ToString<
+                        value = SendWithArguments<
+                          name = :[],
+                          receiver = Send<name = :params>
+                        >
+                      >,
+                      any*
+                  ]
+                  >,
+                  any*
+                ]
+              >,
+              name = :execute | :find_by_sql | :paginate
+            >
+          EOT
+        end
+
+        # find(:first, :conditions => params[:password])
+        def pattern_find_with_conditions_and_params_or_limit
+          <<-EOT
+            SendWithArguments<
+              arguments = ActualArguments<
+                array = [
+                  any+,
+                  HashLiteral<
+                    array = [
+                      any{even},
+                      SymbolLiteral<value = :limit | :conditions>,
+                      SendWithArguments<
+                        name = :[],
+                        receiver = Send<name = :params | :session>
+                      >,
+                      any{even}
+                    ]
+                  >
+                ]
+              >,
+              name = :find>
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/sql_injection/sanitize_sql_check.rb

@@ -0,0 +1,25 @@
+require_relative "sql_check"
+
+module Scanny
+  module Checks
+    module Sql
+      # Check for use of the "sanitize_sql" method
+      class SanitizeCheck < SqlCheck
+        def pattern
+          pattern_sanitize_sql
+        end
+
+        def check(node)
+          issue :info, warning_message, :cwe => 89
+        end
+
+        private
+
+        # sanitize_sql()
+        def pattern_sanitize_sql
+          "SendWithArguments<name = :sanitize_sql>"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/sql_injection/sql_check.rb

@@ -0,0 +1,14 @@
+module Scanny
+  module Checks
+    module Sql
+      class SqlCheck < Check
+        private
+
+        def warning_message
+          "Use of external parameters in queries to the database " +
+          "can lead to SQL injection issue"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/sql_injection/string_interpolation_with_params_check.rb

@@ -0,0 +1,39 @@
+require_relative "sql_check"
+
+module Scanny
+  module Checks
+    module Sql
+      # Checks for use of dynamic strings in when creating an SQL query
+      class StringInterpolationWithParamsCheck < SqlCheck
+        def pattern
+          pattern_params_in_select
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => 89
+        end
+
+        private
+
+        # "SELECT params[:input] FROM users"
+        def pattern_params_in_select
+          <<-EOT
+            DynamicString<
+              array = [
+                any*,
+                ToString<
+                  value = SendWithArguments<
+                    name = :[],
+                    receiver = Send<name = :params>
+                  >
+                >,
+                any*
+              ],
+              string ^= "SELECT"
+            >
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/ssl/verify_check.rb

@@ -0,0 +1,53 @@
+module Scanny
+  module Checks
+    module SSL
+      class VerifyCheck < Check
+        def pattern
+          [
+            pattern_ssl_verify_none,
+            pattern_ca_file
+          ].join("|")
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => [296, 297, 298, 299, 300, 599]
+        end
+
+        private
+
+        def warning_message
+          "Disable certificate verification can " +
+          "lead to connect to an unauthorized server"
+        end
+
+        # OpenSSL::SSL::VERIFY_NONE
+        def pattern_ssl_verify_none
+          <<-EOT
+          ScopedConstant<
+            name = :VERIFY_NONE,
+            parent = ScopedConstant<
+              name = :SSL,
+              parent = ConstantAccess<name = :OpenSSL>
+            >
+          >
+          EOT
+        end
+
+
+        # ssl_context.ca_file = nil
+        def pattern_ca_file
+          <<-EOT
+          AttributeAssignment<
+            arguments = ActualArguments<
+              array = [
+                NilLiteral
+              ]
+            >,
+            name = :ca_path= | :ca_file=
+          >
+          EOT
+        end
+      end
+    end
+  end
+end