scanny 0.1.0

data/lib/scanny/checks/ssl/verify_peer_check.rb

@@ -0,0 +1,37 @@
+module Scanny
+  module Checks
+    module SSL
+      class VerifyPeerCheck < Check
+        def pattern
+          pattern_ssl_verify_peer
+        end
+
+        def check(node)
+          issue :info, warning_message
+        end
+
+        private
+
+        def warning_message
+          "Change the value of of VERIFY_PEER" +
+          "can lead to faulty accepted certificate"
+        end
+
+        # OpenSSL::SSL::VERIFY_PEER
+        def pattern_ssl_verify_peer
+          <<-EOT
+          ConstantAssignment<
+            constant = ScopedConstant<
+              name = :VERIFY_PEER,
+              parent = ScopedConstant<
+                name = :SSL,
+                parent = ConstantAccess<name = :OpenSSL>
+              >
+            >
+          >
+          EOT
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/system_tools/gpg_usage_check.rb

@@ -0,0 +1,51 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class GpgUsageCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          [
+            pattern_gpg_class,
+            pattern_gpg_method,
+            build_pattern_exec_command('gpg')
+          ].join("|")
+        end
+
+        def check(node)
+          issue :info, warning_message
+        end
+
+        private
+
+        def warning_message
+          "Using gpg tool in the wrong way can lead to security problems"
+        end
+
+        # GPG.method
+        def pattern_gpg_class
+          <<-EOT
+          Send
+          <
+            receiver = ConstantAccess<
+              name *= /gpg/i
+            >
+          >
+          |
+          SendWithArguments
+          <
+            receiver = ConstantAccess<
+              name *= /gpg/i
+            >
+          >
+          EOT
+        end
+
+        # gpg()
+        def pattern_gpg_method
+          "Send<name *= 'gpg'> | SendWithArguments<name *= 'gpg'>"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/system_tools/sudo_check.rb

@@ -0,0 +1,24 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class SudoCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          build_pattern_exec_command('sudo')
+        end
+
+        def check(node)
+          issue :info, warning_message
+        end
+
+        private
+
+        def warning_message
+          "Using sudo can lead to the execution" +
+          "of programs on root administrator rights"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/system_tools/tar_check.rb

@@ -0,0 +1,24 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class TarCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          build_pattern_exec_command(/tar\s+/)
+        end
+
+        def check(node)
+          issue :medium, warning_message, :cwe => 88
+        end
+
+        private
+
+        def warning_message
+          "Tar command can execute dangerous operations on files" +
+          "and can travel through directories"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/system_tools/tar_commands_check.rb

@@ -0,0 +1,27 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class TarCommandsCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          [
+            build_pattern_exec_command(/tar.*\-\-to\-command/),
+            build_pattern_exec_command(/tar.*\-\-rmt\-command/),
+            build_pattern_exec_command(/tar.*\-\-rsh\-command/)
+          ].join("|")
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => 88
+        end
+
+        private
+
+        def warning_message
+          "Tar command has an option that allows to run external programs"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/system_tools/unzip_check.rb

@@ -0,0 +1,30 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class UnzipCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          [
+            build_pattern_exec_command(/unzip\s+[^(=|&)]/),
+            build_pattern_exec_command(/unzip.*-:/)
+          ].join("|")
+        end
+
+        def check(node)
+          if Machete.matches?(node, build_pattern_exec_command(/unzip.*-:/))
+            issue :high, warning_message, :cwe => [23, 88]
+          elsif Machete.matches?(node, build_pattern_exec_command(/unzip\s+[^(=|&)]/))
+            issue :medium, warning_message, :cwe => [23, 88]
+          end
+        end
+
+        private
+
+        def warning_message
+          "Unzip option allows '../' in archived file path, dir traversal"
+        end
+      end
+    end
+  end
+end

data/lib/scanny/checks/temp_file_open_check.rb

@@ -0,0 +1,57 @@
+module Scanny
+  module Checks
+    class TempFileOpenCheck < Check
+      def pattern
+        [
+          pattern_temp,
+          pattern_file_open,
+          pattern_mkdir_p
+        ].join("|")
+      end
+
+      def check(node)
+        issue :medium, warning_message, :cwe => 377
+      end
+
+      private
+
+      def warning_message
+        "Access to the temporary files can lead to" +
+        "unauthorized access to data"
+      end
+
+      # File.open("/app/path/tmp_file")
+      def pattern_file_open
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                StringLiteral<string *= "tmp">
+              ]
+            >,
+            receiver = ConstantAccess<name = :File>,
+            name = :open
+          >
+        EOT
+      end
+
+      # mkdir_p("long/path/tmp/file")
+      def pattern_mkdir_p
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                StringLiteral<string *= "tmp">
+              ]
+            >,
+            name = :mkdir_p
+          >
+        EOT
+      end
+
+      def pattern_temp
+        'StringLiteral<string *= /\/tmp\//>'
+      end
+    end
+  end
+end

data/lib/scanny/checks/user_find_check.rb

@@ -0,0 +1,40 @@
+module Scanny
+  module Checks
+    class UserFindCheck < Check
+      def pattern
+        pattern_user_find
+      end
+
+      def check(node)
+        issue :medium, warning_message, :cwe => [89, 592]
+      end
+
+      private
+
+      def warning_message
+        "Create a user object using the " +
+        "parameters can cause security problems"
+      end
+
+      # User.find(params[:input])
+      def pattern_user_find
+      <<-EOT
+        SendWithArguments<
+          arguments = ActualArguments<
+            array = [
+              any*,
+              SendWithArguments<
+                name = :[],
+                receiver = Send<name = :params>
+              >,
+              any*
+            ]
+          >,
+          name = :find,
+          receiver = ConstantAccess<name = :User>
+        >
+      EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/validates_check.rb

@@ -0,0 +1,32 @@
+module Scanny
+  module Checks
+    class ValidatesCheck < Check
+      def pattern
+        pattern_validates
+      end
+
+      def check(node)
+        issue :info, warning_message
+      end
+
+      def strict?
+        true
+      end
+
+      private
+
+      def warning_message
+        "Incorrect validations may allow malicious data transmission"
+      end
+
+      # validates_presence_of :email
+      def pattern_validates
+        <<-EOT
+        SendWithArguments<
+          name *= /validates_[\\w]*_of/
+        >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/verify_check.rb

@@ -0,0 +1,44 @@
+module Scanny
+  module Checks
+    class VerifyMethodCheck < Check
+      def pattern
+        pattern_verify
+      end
+
+      def check(node)
+        issue :info, warning_message
+      end
+
+      def strict?
+        true
+      end
+
+      private
+
+      def warning_message
+        "Incorrect to use the verify method can lead to " +
+        "accept additional parameters from request"
+      end
+
+      # verify :method => :get
+      def pattern_verify
+        <<-EOT
+          SendWithArguments<
+            arguments = ActualArguments<
+              array = [
+                HashLiteral<
+                  array = [
+                    any{even},
+                    SymbolLiteral<value = :method>,
+                    any{odd}
+                  ]
+                >
+              ]
+            >,
+            name = :verify
+          >
+        EOT
+      end
+    end
+  end
+end

data/lib/scanny/checks/xss/xss_flash_check.rb

@@ -0,0 +1,70 @@
+module Scanny
+  module Checks
+    # Check for flash methods that are called with request params or
+    # dynamic a string. This allows us to avoid showing dangerous
+    # HTML code to users
+    class XssFlashCheck < Check
+      def pattern
+        [
+          pattern_params,
+          pattern_dynamic_string
+        ].join("|")
+      end
+
+      def check(node)
+        if Machete.matches?(node, pattern_params)
+          issue :high, warning_message, :cwe => 79
+        elsif Machete.matches?(node, pattern_dynamic_string)
+          issue :medium, warning_message, :cwe => 79
+        end
+      end
+
+      private
+
+      def warning_message
+        "Assigning request parameters into flash can lead to XSS issues."
+      end
+
+      # flash[:warning] = params[:password]
+      def pattern_params
+        <<-EOT
+          ElementAssignment<
+            arguments = ActualArguments<
+              array = [
+                SymbolLiteral<value = :warning>,
+                SendWithArguments<
+                  name = :[],
+                  receiver = Send<name = :params>
+                >
+              ]
+            >,
+            name = :[]=,
+            receiver = Send<name = :flash>
+          >
+        EOT
+      end
+
+      # flash[:warning] = "#{secure_data}"
+      def pattern_dynamic_string
+        <<-EOT
+          ElementAssignment<
+            arguments = ActualArguments<
+              array = [
+                SymbolLiteral<value = :warning>,
+                DynamicString<
+                  array = [
+                    any*,
+                    ToString,
+                    any*
+                  ]
+                >
+              ]
+            >,
+            name = :[]=,
+            receiver = Send<name = :flash>
+          >
+        EOT
+      end
+    end
+  end
+end