scryer 0.1.0

data/lib/scryer/rules/csrf_protection_rule.rb

@@ -0,0 +1,89 @@
+module Scryer
+  module Rules
+    # Flags a controller class named *Controller that calls
+    # `skip_before_action :verify_authenticity_token` without that same file
+    # (or, best-effort, without any `protect_from_forgery` call visible in it)
+    # — skipping CSRF verification on a controller that isn't clearly API-only
+    # (no `< ActionController::API` / `ActionController::Base` used alongside
+    # explicit null_session) is a common way to accidentally disable CSRF
+    # protection app-wide for that controller's actions.
+    class CsrfProtectionRule < Rule
+      self.rule_id = "csrf_protection_disabled"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "CSRF protection skipped without safeguards"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          skip_node = find_skip_verify(body)
+          next unless skip_node
+
+          has_null_session_pattern = each_descendant_call_names(body).any? do |name|
+            name == "protect_from_forgery"
+          end
+          next if has_null_session_pattern # they've explicitly configured an alternative
+
+          line = Ast.line_of(skip_node)
+          findings << finding(
+            line: line,
+            message: "`#{class_name}` skips CSRF token verification (`skip_before_action " \
+                      ":verify_authenticity_token`) without declaring its own " \
+                      "`protect_from_forgery` policy — if this controller renders any HTML forms " \
+                      "or is reachable with a browser session cookie, this leaves it open to " \
+                      "cross-site request forgery.",
+            suggested_fix: "If this is a true JSON/API-only controller, make that explicit with " \
+                            "`protect_from_forgery with: :null_session` (or inherit from a base " \
+                            "class that does) rather than bypassing verification silently. If it's " \
+                            "not API-only, remove the `skip_before_action` and let the app's normal " \
+                            "CSRF handling apply."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def find_skip_verify(node)
+        Ast.each_node(node).find do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name_pair = Ast.call_name(inner)
+          next false unless name_pair && name_pair[1] == "skip_before_action"
+
+          args = Ast.call_arguments(n)
+          args.any? { |a| symbol_value(a) == "verify_authenticity_token" }
+        end
+      end
+
+      def each_descendant_call_names(node)
+        Ast.each_node(node).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last
+        end
+      end
+
+      def symbol_value(node)
+        return nil unless Ast.tagged?(node, :symbol_literal, :dyna_symbol)
+
+        # symbol_literal wraps [:symbol, [:@ident, "name", pos]] — one more
+        # level of unwrapping than a bare @ident node.
+        inner = node[1]
+        return nil unless Ast.tagged?(inner, :symbol)
+
+        Ast.ident_text(inner[1])
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_secret_rule.rb

@@ -0,0 +1,96 @@
+module Scryer
+  module Rules
+    # Flags plain string literals assigned to a constant/variable/hash-key
+    # whose name looks secret-ish (API_KEY, secret, token, password, ...),
+    # OR that match a known cloud-provider key format (AWS access key,
+    # generic high-entropy-looking tokens), regardless of variable name.
+    class HardcodedSecretRule < Rule
+      self.rule_id = "hardcoded_secret"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Hardcoded credential or API key"
+
+      NAME_PATTERN = /(api[_-]?key|secret|token|password|passwd|access[_-]?key|private[_-]?key|auth)/i.freeze
+
+      # High-precision patterns: distinctive enough prefixes/formats that a
+      # match alone (regardless of variable name) is worth flagging.
+      KNOWN_KEY_PATTERNS = {
+        "AWS Access Key ID" => /\bAKIA[0-9A-Z]{16}\b/,
+        "Stripe API Key" => /\bsk_(live|test)_[0-9a-zA-Z]{16,}\b/,
+        "GitHub Token" => /\bgh[pousr]_[0-9a-zA-Z]{20,}\b/,
+        "Slack Token" => /\bxox[baprs]-[0-9a-zA-Z-]{10,}\b/,
+        "Private Key block" => /-----BEGIN (RSA |EC )?PRIVATE KEY-----/
+      }.freeze
+
+      # Low-precision heuristics: only meaningful when ALSO paired with a
+      # suspicious variable/constant name (a bare 40-char base64-ish string
+      # is just as likely to be a git SHA, a hash, or a test fixture id).
+      WEAK_KEY_PATTERNS = {
+        "AWS Secret Access Key (heuristic)" => /\A[A-Za-z0-9\/+=]{40}\z/
+      }.freeze
+
+      # Placeholders/examples that should never be flagged even if they match
+      # a pattern above or a suspicious name — avoids noisy false positives on
+      # obviously-fake sample values.
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?(api[_-]?)?key|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          value_node = node[2]
+          value = Ast.plain_string_value(value_node)
+          next unless value
+          next if value.strip.empty? || value.length < 6
+          next if PLACEHOLDER_VALUES.match?(value.strip)
+
+          name = target_name(target)
+          matched_known = KNOWN_KEY_PATTERNS.find { |_label, pattern| pattern.match?(value) }
+          matched_weak = WEAK_KEY_PATTERNS.find { |_label, pattern| pattern.match?(value.strip) }
+          suspicious_name = name && NAME_PATTERN.match?(name)
+
+          next unless matched_known || suspicious_name || (matched_weak && suspicious_name)
+
+          line = Ast.line_of(node)
+          reason =
+            if matched_known
+              "matches the format of a #{matched_known[0]}"
+            elsif matched_weak && suspicious_name
+              "matches the format of a #{matched_weak[0]} and is assigned to `#{name}`"
+            else
+              "is assigned to `#{name}`, a name that suggests a credential"
+            end
+          findings << finding(
+            line: line,
+            message: "A literal string #{reason} — secrets committed to source control end up " \
+                      "in git history permanently, even if removed later.",
+            suggested_fix: "Move this value out of the codebase: use `ENV.fetch(\"#{env_name(name)}\")` " \
+                            "or Rails encrypted credentials (`Rails.application.credentials.dig(...)`), " \
+                            "set the real value via your deploy environment / secrets manager, and " \
+                            "rotate this specific key since it's likely already exposed in git history."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def target_name(node)
+        Ast.each_node(node).each do |n|
+          next unless n.is_a?(Array) && n[0].is_a?(Symbol)
+
+          return n[1] if %i[@const @ident @ivar @gvar @label].include?(n[0]) && n[1].is_a?(String)
+        end
+        nil
+      end
+
+      def env_name(name)
+        (name || "SECRET").to_s.gsub(/[^a-zA-Z0-9]+/, "_").upcase.sub(/\A_+|_+\z/, "")
+      end
+    end
+  end
+end

data/lib/scryer/rules/mass_assignment_rule.rb

@@ -0,0 +1,103 @@
+module Scryer
+  module Rules
+    # Flags `Model.new(params[...])` / `Model.new(params)` / `.update(params[...])`
+    # / `.assign_attributes(params)` where the argument is `params` (or a
+    # subscript of it) with no `.permit(...)` anywhere in the same argument
+    # expression — i.e. attributes are being mass-assigned straight from the
+    # request with no allow-list.
+    class MassAssignmentRule < Rule
+      self.rule_id = "mass_assignment"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Unpermitted mass assignment from params"
+
+      ASSIGNMENT_METHODS = %w[new create create! update update! assign_attributes attributes=].freeze
+
+      # Common stdlib/gem constants with their own `.new`/`.create`-style
+      # factory methods that have nothing to do with ActiveRecord mass
+      # assignment (e.g. `BCrypt::Password.create(params[:password])` is
+      # hashing a single value, not setting a hash of model attributes).
+      # Excluding these — plus anything referenced through a namespaced
+      # `A::B` path, which real Rails models are less commonly called via at
+      # the exact call site — cuts down false positives significantly.
+      NON_MODEL_RECEIVERS = %w[
+        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
+        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless ASSIGNMENT_METHODS.include?(method_name)
+          next unless likely_model_receiver?(receiver)
+
+          args = Ast.call_arguments(node)
+          next if args.empty?
+
+          arg = args.first
+          next unless references_raw_params?(arg)
+
+          line = Ast.line_of(arg) || Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{method_name}` receives `params` (or a subscript of it) directly, " \
+                      "with no `.permit(...)` call — every attribute in the request can be " \
+                      "set, including ones the form/API was never meant to expose (e.g. `admin`, `role_id`).",
+            suggested_fix: "Wrap the params in a strong-parameters method, e.g. " \
+                            "`#{method_name}(order_params)` with `def order_params; " \
+                            "params.require(:order).permit(:status, :total); end` — only the " \
+                            "explicitly permitted keys get through."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      # true for an implicit receiver (bare `create(...)` inside the model
+      # itself) or a plain unnamespaced constant reference (`Order`) that
+      # isn't a known non-model stdlib/gem constant; false for namespaced
+      # constant paths (`BCrypt::Password`) or anything else.
+      def likely_model_receiver?(receiver)
+        return true if receiver.nil?
+        return false unless Ast.tagged?(receiver, :var_ref)
+
+        const_node = receiver[1]
+        return false unless const_node.is_a?(Array) && const_node[0] == :@const
+
+        !NON_MODEL_RECEIVERS.include?(const_node[1])
+      end
+
+      # True if `node` is `params`, `params[:x]`, or contains such a reference
+      # without a `.permit`/`.permit!` call wrapping it (permit! is itself
+      # flagged as unsafe too, so it doesn't count as "safe").
+      def references_raw_params?(node)
+        return false unless node.is_a?(Array)
+        return false if has_permit_call?(node)
+
+        Ast.each_node(node).any? do |n|
+          Ast.tagged?(n, :vcall, :var_ref, :fcall) && Ast.ident_text(n[1]) == "params"
+        end
+      end
+
+      def has_permit_call?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :call, :method_add_arg)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name = Ast.call_name(inner)&.last
+          %w[permit permit!].include?(name)
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/open_redirect_rule.rb

@@ -0,0 +1,57 @@
+module Scryer
+  module Rules
+    # Flags `redirect_to` called with `params[...]` (or plain `params`)
+    # directly as the destination — an attacker can craft a link to your own
+    # site that redirects the victim onward to an attacker-controlled domain
+    # (a classic phishing enabler), unless the value is validated against an
+    # allow-list first.
+    class OpenRedirectRule < Rule
+      self.rule_id = "open_redirect"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Possible open redirect via unvalidated params"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && name_pair[1] == "redirect_to"
+
+          args = Ast.call_arguments(node)
+          next if args.empty?
+
+          target = args.first
+          next unless references_raw_params?(target)
+
+          line = Ast.line_of(target) || Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`redirect_to` receives `params` (or a subscript of it) directly as the " \
+                      "destination — a crafted link can redirect users from your domain to an " \
+                      "attacker-controlled site, which is commonly used for phishing.",
+            suggested_fix: "Validate the destination against an allow-list before redirecting, " \
+                            "e.g. `redirect_to params[:next] if ALLOWED_PATHS.include?(params[:next])`, " \
+                            "or only allow relative paths on your own host " \
+                            "(`URI.parse(params[:next]).host.nil?`), falling back to a safe default otherwise."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def references_raw_params?(node)
+        return false unless node.is_a?(Array)
+
+        Ast.each_node(node).any? do |n|
+          Ast.tagged?(n, :vcall, :var_ref, :fcall) && Ast.ident_text(n[1]) == "params"
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/sql_injection_rule.rb

@@ -0,0 +1,63 @@
+module Scryer
+  module Rules
+    # Flags ActiveRecord finder/query methods called with a string argument
+    # that contains interpolation (#{...}) — the classic Rails SQL injection
+    # pattern, e.g. `Order.where("status = '#{params[:status]}'")`.
+    # Parameterized/hash forms (`where(status: params[:status])`,
+    # `where("status = ?", params[:status])`) are safe and not flagged.
+    class SqlInjectionRule < Rule
+      self.rule_id = "sql_injection"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Possible SQL injection via string interpolation"
+
+      QUERY_METHODS = %w[
+        where find_by find_by! order pluck select group having
+        find_by_sql calculate exists? count
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          receiver_and_name = Ast.call_name(inner_call_node(node))
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless QUERY_METHODS.include?(method_name)
+
+          args = Ast.call_arguments(node)
+          next if args.empty?
+
+          first_arg = args.first
+          next unless Ast.string_literal_has_interpolation?(first_arg)
+
+          line = Ast.line_of(first_arg) || Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{method_name}` is called with a string built via interpolation, " \
+                     "which lets user-controlled input change the SQL executed.",
+            suggested_fix: "Use a parameterized form instead, e.g. " \
+                            "`#{method_name}(\"column = ?\", value)` or the hash form " \
+                            "`#{method_name}(column: value)` — both let Active Record escape " \
+                            "the value safely instead of interpolating it directly into SQL."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      # method_add_arg wraps [call_or_fcall_node, args_node] — call_name needs
+      # the inner call/fcall/vcall node, not the method_add_arg wrapper itself.
+      def inner_call_node(node)
+        return node unless Ast.tagged?(node, :method_add_arg)
+
+        node[1]
+      end
+    end
+  end
+end

data/lib/scryer/rules/unsafe_deserialization_rule.rb

@@ -0,0 +1,71 @@
+module Scryer
+  module Rules
+    # Flags `Marshal.load`, `YAML.load` (as opposed to `YAML.safe_load`), and
+    # `JSON.load` (as opposed to `JSON.parse`) — all three can instantiate
+    # arbitrary Ruby objects from untrusted input, a known RCE vector in Rails
+    # apps (several real-world CVEs trace back to exactly this).
+    class UnsafeDeserializationRule < Rule
+      self.rule_id = "unsafe_deserialization"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Unsafe deserialization of untrusted data"
+
+      UNSAFE_CALLS = {
+        %w[Marshal load] => "Marshal.load can instantiate arbitrary Ruby objects, including ones " \
+                              "that execute code as a side effect of being constructed — never call " \
+                              "it on data that came from a user, request, or external service.",
+        %w[YAML load] => "YAML.load (unlike YAML.safe_load) can instantiate arbitrary Ruby objects " \
+                           "from the document, which is a known remote-code-execution vector when " \
+                           "the YAML source isn't fully trusted.",
+        %w[JSON load] => "JSON.load can invoke arbitrary `create_id`-tagged object construction, " \
+                           "unlike the safer JSON.parse."
+      }.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          # Only match the method_add_arg wrapper (call + its parenthesized
+          # args) — the :call node it wraps would otherwise also match this
+          # loop on its own and double-count every finding.
+          next unless Ast.tagged?(node, :method_add_arg)
+
+          inner = node[1]
+          next unless Ast.tagged?(inner, :call)
+
+          receiver = inner[1]
+          method_name = Ast.ident_text(inner[3])
+          receiver_name = Ast.ident_text(receiver.is_a?(Array) ? receiver[1] : nil) if Ast.tagged?(receiver, :var_ref)
+
+          match = UNSAFE_CALLS.keys.find { |(recv, meth)| recv == receiver_name && meth == method_name }
+          next unless match
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: UNSAFE_CALLS[match],
+            suggested_fix: safe_alternative(match)
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def safe_alternative(match)
+        case match
+        when %w[Marshal load]
+          "Avoid deserializing untrusted data with Marshal at all. If you must, verify a " \
+          "signature/HMAC over the payload first, or switch to a safe format like JSON."
+        when %w[YAML load]
+          "Use `YAML.safe_load(input, permitted_classes: [...])` instead, explicitly listing " \
+          "which classes are allowed to be instantiated."
+        when %w[JSON load]
+          "Use `JSON.parse(input)` instead — it only produces plain Hash/Array/String/Numeric/" \
+          "boolean values, never arbitrary objects."
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/weak_crypto_rule.rb

@@ -0,0 +1,66 @@
+module Scryer
+  module Rules
+    # Flags `Digest::MD5`/`Digest::SHA1` used in a context that looks like
+    # password/credential hashing (method or nearby variable name contains
+    # "password"/"passwd") — both are cryptographically broken for that use
+    # case; a fast general-purpose hash lets an attacker who steals the DB
+    # brute-force passwords far faster than a proper password hash
+    # (bcrypt/scrypt/argon2, which are deliberately slow).
+    class WeakCryptoRule < Rule
+      self.rule_id = "weak_crypto"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Weak hash algorithm used for password/credential hashing"
+
+      WEAK_DIGESTS = %w[MD5 SHA1].freeze
+      PASSWORD_HINT = /password|passwd|credential/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :top_const_ref, :const_path_ref, :var_ref)
+
+          digest_name = digest_algorithm_name(node)
+          next unless digest_name
+
+          # Only flag when something nearby (same statement/line) mentions
+          # password-ish naming — Digest::MD5/SHA1 have plenty of legitimate
+          # non-credential uses (cache keys, ETags, checksums) that shouldn't
+          # be flagged as a crypto weakness.
+          line = Ast.line_of(node)
+          context_line = Ast.source_line(source, line).to_s
+          next unless PASSWORD_HINT.match?(context_line)
+
+          findings << finding(
+            line: line,
+            message: "`Digest::#{digest_name}` is used near what looks like password/credential " \
+                      "handling — #{digest_name} is fast and unsalted by default, making stolen " \
+                      "hashes practical to brute-force.",
+            suggested_fix: "Use `bcrypt` via Rails' `has_secure_password` for password storage " \
+                            "instead of a general-purpose digest — it's deliberately slow and " \
+                            "handles salting automatically. Reserve Digest::#{digest_name} for " \
+                            "non-credential uses (cache keys, checksums)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      # Matches `Digest::MD5` / `Digest::SHA1` referenced as a constant path.
+      def digest_algorithm_name(node)
+        text = Ast.each_node(node)
+                         .filter_map { |n| n.is_a?(Array) && n[0] == :@const ? n[1] : nil }
+                         .join("::")
+
+        WEAK_DIGESTS.find { |name| text == "Digest::#{name}" || text == name && sexp_mentions_digest?(node) }
+      end
+
+      def sexp_mentions_digest?(node)
+        Ast.each_node(node).any? { |n| n.is_a?(Array) && n[0] == :@const && n[1] == "Digest" }
+      end
+    end
+  end
+end

data/lib/scryer/rules/xss_unsafe_html_rule.rb

@@ -0,0 +1,70 @@
+module Scryer
+  module Rules
+    # Flags `.html_safe` and `raw(...)` calls on anything that isn't an
+    # obviously-static string literal — both tell Rails to skip HTML-escaping,
+    # so calling them on user-influenced data is a stored/reflected XSS risk.
+    # A call on a plain string literal with no interpolation (`"<br>".html_safe`)
+    # is far more likely to be intentional/safe, so it's not flagged.
+    class XssUnsafeHtmlRule < Rule
+      self.rule_id = "xss_unsafe_html"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Unescaped HTML output (possible XSS)"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          if Ast.tagged?(node, :call)
+            method_name = Ast.ident_text(node[3])
+            next unless method_name == "html_safe"
+
+            receiver = node[1]
+            next if safe_literal?(receiver)
+
+            line = Ast.line_of(node)
+            findings << finding(
+              line: line,
+              message: "`.html_safe` is called on a value that isn't a plain static string — " \
+                        "if it can contain user input, this disables Rails' automatic HTML escaping " \
+                        "for it, allowing injected `<script>`/attribute-based XSS.",
+              suggested_fix: "Only mark content `.html_safe` after sanitizing it yourself " \
+                              "(e.g. `sanitize(value)` or `ActionController::Base.helpers.sanitize`), " \
+                              "or better, avoid `.html_safe` and let Rails escape the value normally, " \
+                              "using `content_tag`/safe helpers to build any HTML that's actually needed."
+            )
+          elsif Ast.tagged?(node, :method_add_arg, :command, :fcall, :vcall)
+            inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+            name_pair = Ast.call_name(inner)
+            next unless name_pair && name_pair[1] == "raw"
+
+            args = Ast.call_arguments(node)
+            next if args.any? && safe_literal?(args.first)
+            next if args.empty? # bare `raw` with no args isn't this pattern
+
+            line = Ast.line_of(node)
+            findings << finding(
+              line: line,
+              message: "`raw(...)` disables HTML escaping for its argument — if that value can " \
+                        "contain user input, this is a direct XSS vector.",
+              suggested_fix: "Avoid `raw()` for anything derived from user input or the database. " \
+                              "If some HTML really needs to pass through unescaped, sanitize it first " \
+                              "with `sanitize(value, tags: %w[b i em strong])` restricted to an explicit allow-list."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def safe_literal?(node)
+        return true if node.nil?
+        return true if Ast.tagged?(node, :string_literal) && !Ast.string_literal_has_interpolation?(node)
+
+        false
+      end
+    end
+  end
+end