scryer 0.2.0 → 1.0.0

data/lib/scryer/rules/mass_assignment_rule.rb

@@ -77,16 +77,13 @@ module Scryer
         !NON_MODEL_RECEIVERS.include?(const_node[1])
       end
 
-      # True if `node` is `params`, `params[:x]`, or contains such a reference
+      # True if `node` references `params` (see Ast.references_params?)
       # without a `.permit`/`.permit!` call wrapping it (permit! is itself
       # flagged as unsafe too, so it doesn't count as "safe").
       def references_raw_params?(node)
-        return false unless node.is_a?(Array)
         return false if has_permit_call?(node)
 
-        Ast.each_node(node).any? do |n|
-          Ast.tagged?(n, :vcall, :var_ref, :fcall) && Ast.ident_text(n[1]) == "params"
-        end
+        Ast.references_params?(node)
       end
 
       def has_permit_call?(node)

data/lib/scryer/rules/path_traversal_rule.rb

@@ -0,0 +1,89 @@
+module Scryer
+  module Rules
+    # Flags a filesystem operation (`File.join/read/open/new/write/delete`,
+    # `Dir.glob/entries`, `send_file`) where an argument references `params`
+    # directly — without sanitization, `../../etc/passwd`-style path
+    # segments in the request let an attacker read (or write/delete) files
+    # outside whatever directory the code intended to restrict access to.
+    class PathTraversalRule < Rule
+      self.rule_id = "path_traversal"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Possible path traversal"
+
+      DANGEROUS_CALLS = {
+        "File" => %w[join read open new write delete binread binwrite],
+        "Dir" => %w[glob entries]
+      }.freeze
+      BARE_METHODS = %w[send_file send_data].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless dangerous_call?(receiver, method_name)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.references_params?(a) && !sanitized_via_basename?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{describe_call(receiver, method_name)}` is called with a path/argument " \
+                      "that references `params` — a value like `../../config/master.key` reaches " \
+                      "the filesystem unchanged, letting an attacker read or write files outside " \
+                      "whatever directory this was meant to be scoped to.",
+            suggested_fix: "Reduce the input to a safe basename before using it " \
+                            "(`File.basename(params[:name])`), and/or verify the resolved path " \
+                            "stays inside the intended directory (compare " \
+                            "`File.expand_path(...)` against the allowed root) before touching " \
+                            "the filesystem."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def dangerous_call?(receiver, method_name)
+        return true if receiver.nil? && BARE_METHODS.include?(method_name)
+
+        DANGEROUS_CALLS[receiver_name(receiver)]&.include?(method_name) || false
+      end
+
+      def describe_call(receiver, method_name)
+        name = receiver_name(receiver)
+        name ? "#{name}.#{method_name}" : method_name
+      end
+
+      def receiver_name(node)
+        return nil unless Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+
+        node[1][1]
+      end
+
+      # True if `File.basename(...)` appears anywhere in the argument's
+      # subtree — the standard way to strip directory-traversal segments
+      # before using a request-controlled filename. Same "does the guard
+      # appear anywhere in this expression" looseness as
+      # MassAssignmentRule#has_permit_call? — doesn't verify it wraps
+      # *exactly* the params reference, just that it's present.
+      def sanitized_via_basename?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last == "basename"
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/security_headers_rule.rb

@@ -0,0 +1,130 @@
+module Scryer
+  module Rules
+    # Flags an explicit insecure override of Rails' default security
+    # headers/config — NOT absence of a header, which would require knowing
+    # every environment file and initializer in the app (too noisy/
+    # environment-dependent for a per-file static rule). Only the explicit
+    # opt-out is a reliable, low-noise signal on its own — same reasoning as
+    # ForceSslRule.
+    #
+    #   config.action_dispatch.default_headers['X-Frame-Options'] = 'ALLOWALL' (or false)
+    #   config.action_dispatch.default_headers['X-Content-Type-Options'] = false
+    #   config.action_dispatch.default_headers.merge!('X-Frame-Options' => 'ALLOWALL', ...)
+    #   config.content_security_policy = nil
+    class SecurityHeadersRule < Rule
+      self.rule_id = "security_headers_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Rails default security header explicitly disabled"
+
+      HEADERS = ["X-Frame-Options", "X-Content-Type-Options"].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          if Ast.tagged?(node, :assign)
+            scan_assign(findings, node)
+          elsif Ast.tagged?(node, :method_add_arg)
+            scan_merge_bang(findings, node)
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def scan_assign(findings, node)
+        target = node[1]
+        value = node[2]
+
+        if Ast.tagged?(target, :aref_field) && default_headers_receiver?(target[1])
+          key = Ast.unwrap_args(target[2]).first
+          header = Ast.plain_string_value(key)
+          add_header_finding(findings, header, value, Ast.line_of(node)) if header
+        elsif Ast.tagged?(target, :field) && Ast.ident_text(target[3]) == "content_security_policy"
+          return unless Ast.kw_literal?(value) == "nil"
+
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "`config.content_security_policy = nil` explicitly disables Content-Security-Policy — " \
+                      "a header that mitigates XSS/data-injection by restricting which sources scripts, " \
+                      "styles, and other resources can load from.",
+            suggested_fix: "Configure an actual policy instead of nil-ing it out — see " \
+                            "`config.content_security_policy do |policy| ... end` in " \
+                            "config/initializers/content_security_policy.rb."
+          )
+        end
+      end
+
+      def scan_merge_bang(findings, node)
+        inner = node[1]
+        name_pair = Ast.call_name(inner)
+        return unless name_pair && name_pair[1] == "merge!"
+        return unless default_headers_receiver?(name_pair[0])
+
+        each_assoc_pair(node).each do |key_node, value_node|
+          header = Ast.plain_string_value(key_node)
+          add_header_finding(findings, header, value_node, Ast.line_of(node)) if header
+        end
+      end
+
+      def add_header_finding(findings, header, value_node, line)
+        return unless HEADERS.include?(header)
+        return unless disabling_value?(header, value_node)
+
+        findings << finding(
+          line: line,
+          message: header_message(header),
+          suggested_fix: header_fix(header)
+        )
+      end
+
+      def disabling_value?(header, value_node)
+        return true if Ast.false_literal?(value_node) || Ast.kw_literal?(value_node) == "nil"
+
+        header == "X-Frame-Options" && Ast.plain_string_value(value_node).to_s.upcase == "ALLOWALL"
+      end
+
+      def header_message(header)
+        case header
+        when "X-Frame-Options"
+          "The `X-Frame-Options` header is explicitly overridden to allow framing (`ALLOWALL`/falsy) — " \
+            "this removes Rails' default clickjacking protection, letting this app be embedded in an " \
+            "attacker-controlled `<iframe>`."
+        when "X-Content-Type-Options"
+          "The `X-Content-Type-Options` header is explicitly disabled — this removes Rails' default " \
+            "MIME-sniffing protection, letting browsers reinterpret a response's content type (e.g. " \
+            "executing an uploaded file as script)."
+        end
+      end
+
+      def header_fix(header)
+        case header
+        when "X-Frame-Options"
+          "Remove this override (Rails defaults to `SAMEORIGIN`), or set an explicit safe value if " \
+            "framing from a specific trusted origin is actually needed."
+        when "X-Content-Type-Options"
+          "Remove this override — leave `X-Content-Type-Options` at Rails' default (`nosniff`)."
+        end
+      end
+
+      # True if `node` is a call chain ending in `.default_headers` (any
+      # receiver — usually `config.action_dispatch`, but the receiver chain
+      # itself isn't verified, same looseness as WeakSessionCookieRule not
+      # verifying its receiver is really `config`).
+      def default_headers_receiver?(node)
+        Ast.call_name(node)&.last == "default_headers"
+      end
+
+      def each_assoc_pair(call_node)
+        Ast.call_arguments(call_node).each_with_object([]) do |arg, acc|
+          next unless Ast.tagged?(arg, :bare_assoc_hash) && arg[1].is_a?(Array)
+
+          arg[1].each { |p| acc << [p[1], p[2]] if Ast.tagged?(p, :assoc_new) }
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/ssrf_rule.rb

@@ -0,0 +1,85 @@
+module Scryer
+  module Rules
+    # Flags an outbound HTTP call (`Net::HTTP`, `URI.open`/bare `open`
+    # via open-uri, `HTTParty`, `Faraday`, `RestClient`) where an argument
+    # references `params` directly — the request's destination is
+    # user-controlled, which lets an attacker make the server issue requests
+    # to internal services, cloud metadata endpoints, or anywhere else on
+    # its network (server-side request forgery).
+    class SsrfRule < Rule
+      self.rule_id = "ssrf"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Possible server-side request forgery (SSRF)"
+
+      DANGEROUS_CALLS = {
+        "Net::HTTP" => %w[get get_response post post_form],
+        "URI" => %w[open],
+        "HTTParty" => %w[get post put delete],
+        "Faraday" => %w[get post put delete],
+        "RestClient" => %w[get post put delete]
+      }.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless dangerous_call?(receiver, method_name)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.references_params?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{describe_call(receiver, method_name)}` is called with a URL/argument " \
+                      "that references `params` — the server can be made to issue a request to " \
+                      "any host an attacker chooses, including internal services and cloud " \
+                      "metadata endpoints (e.g. `169.254.169.254`) that aren't meant to be " \
+                      "reachable from outside.",
+            suggested_fix: "Validate the destination against an allowlist of known-safe hosts " \
+                            "before making the request, rather than passing the user-supplied " \
+                            "value straight through — and reject internal/link-local IP ranges " \
+                            "explicitly if the allowlist is host-based (DNS can still resolve to one)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def dangerous_call?(receiver, method_name)
+        return true if receiver.nil? && method_name == "open"
+
+        DANGEROUS_CALLS[const_receiver_name(receiver)]&.include?(method_name) || false
+      end
+
+      def describe_call(receiver, method_name)
+        name = const_receiver_name(receiver)
+        name ? "#{name}.#{method_name}" : method_name
+      end
+
+      # Textual name of a (possibly namespaced) constant receiver —
+      # "URI" for `[:var_ref, [:@const, "URI", pos]]`, "Net::HTTP" for the
+      # `[:const_path_ref, ...]` chain `Net::HTTP` parses into. nil for
+      # anything else (a variable, a method call, ...).
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = const_receiver_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/weak_session_cookie_rule.rb

@@ -0,0 +1,48 @@
+module Scryer
+  module Rules
+    # Flags `config.session_store :cookie_store, ...` with no `secure: true`
+    # in its options — without it, the session cookie can be sent over plain
+    # HTTP, not just HTTPS. Only `:cookie_store` is checked (the default and
+    # most common store); other stores (`:redis_session_store`, ...) don't
+    # carry the same cookie-content risk and are out of scope here.
+    class WeakSessionCookieRule < Rule
+      self.rule_id = "weak_session_cookie"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Session cookie missing the secure flag"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :command, :command_call, :method_add_arg)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless method_name == "session_store"
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.literal_text(a) == "cookie_store" }
+          next if Ast.true_literal?(Ast.keyword_arg(args, "secure"))
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`session_store :cookie_store` has no `secure: true` — the session cookie " \
+                      "can be transmitted over plain HTTP, where it's exposed to network " \
+                      "eavesdropping (e.g. on shared/untrusted Wi-Fi).",
+            suggested_fix: "Add `secure: true` to the session_store options (typically only in " \
+                            "production, since local HTTP development doesn't have TLS): " \
+                            "`config.session_store :cookie_store, key: '_app_session', secure: " \
+                            "Rails.env.production?`."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "0.2.0"
+  VERSION = "1.0.0"
 end

data/lib/tasks/scryer.rake

@@ -8,7 +8,7 @@ require "fileutils"
 # ActiveSupport methods (`.presence`/`.blank?`) for the same reason — plain
 # Ruby nil-or-empty checks only.
 namespace :scryer do
-  desc "Run Scryer and write a report. Args are any mix of json/html/csv (which formats " \
+  desc "Run Scryer and write a report. Args are any mix of json/html/csv/sarif (which formats " \
        "to write — default json,html), the token 'nodeps' (skip the dependency audit — OSV.dev " \
        "vulnerable gems + insecure git/http sources — that otherwise runs by default; use for a " \
        "fast, fully offline run), plus at most one path (a directory when writing more than one " \
@@ -16,7 +16,7 @@ namespace :scryer do
        "so pass each token as its own item rather than one comma-joined string. " \
        "e.g. rails scryer:report, rails 'scryer:report[html]', " \
        "rails 'scryer:report[json,doc/security.json]', rails 'scryer:report[json,html]', " \
-       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]'"
+       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]', rails 'scryer:report[sarif]'"
   task :report, [:format] do |_, args|
     root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
     dirs = Scryer.configuration.dirs
@@ -38,7 +38,8 @@ namespace :scryer do
     dependency_findings = []
     if run_deps
       puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
-      dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root)
+      dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root) +
+                             Scryer::DependencyAudit.ruby_eol_check(root) + Scryer::DependencyAudit.credentials_exposure_check(root)
     end
 
     if Scryer.configuration.ai_client
@@ -63,6 +64,7 @@ namespace :scryer do
       content = case format
                 when "json" then renderer.as_json
                 when "csv" then renderer.as_csv
+                when "sarif" then renderer.as_sarif
                 else renderer.as_html
                 end
       File.write(path, content)
@@ -92,20 +94,23 @@ namespace :scryer do
 
     puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
     vulnerable = Scryer::DependencyAudit.vulnerable_gems(root)
+    ruby_eol = Scryer::DependencyAudit.ruby_eol_check(root)
+    credentials_exposure = Scryer::DependencyAudit.credentials_exposure_check(root)
 
-    (insecure + vulnerable).each do |f|
-      label = f.kind == "insecure_source" ? "[#{f.severity.upcase}] #{f.message}" : "[#{f.severity.upcase}] #{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}"
-      puts label
+    (insecure + vulnerable + ruby_eol + credentials_exposure).each do |f|
+      puts "[#{f.severity.upcase}] #{ScryerTasks.dependency_label(f)}"
       puts "  fix: #{f.suggested_fix}"
     end
 
-    total = insecure.size + vulnerable.size
-    puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, #{vulnerable.size} vulnerable gem)."
+    total = insecure.size + vulnerable.size + ruby_eol.size + credentials_exposure.size
+    puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, " \
+         "#{vulnerable.size} vulnerable gem, #{ruby_eol.size} Ruby EOL, " \
+         "#{credentials_exposure.size} credentials exposure)."
     abort("Scryer: dependency audit failed.") if total.positive?
   end
 
-  VALID_FORMATS = %w[json html csv].freeze
-  EXTENSION_FOR_FORMAT = { "json" => "json", "html" => "html", "csv" => "csv" }.freeze
+  VALID_FORMATS = %w[json html csv sarif].freeze
+  EXTENSION_FOR_FORMAT = { "json" => "json", "html" => "html", "csv" => "csv", "sarif" => "sarif" }.freeze
   NO_DEPS_TOKEN = "nodeps".freeze
 
   # tokens is every bracket arg Rake was given, e.g. %w[json doc/security.json] or
@@ -178,6 +183,13 @@ module ScryerTasks
     nil
   end
 
+  def dependency_label(f)
+    return f.message if f.kind == "insecure_source"
+    return "#{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}" if f.advisory_id
+
+    "#{f.gem_name} #{f.installed_version}: #{f.title}"
+  end
+
   # The "one audit command" summary — a single scan's worth of every
   # category Scryer covers (security, performance, duplicate/smelly code,
   # dependencies), the same categories usually split across RuboCop +

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scryer
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Ram Laxman Yadav
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-11 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -70,14 +70,31 @@ files:
 - lib/scryer/report_renderer.rb
 - lib/scryer/rule.rb
 - lib/scryer/rule_set.rb
+- lib/scryer/rules/action_cable_forgery_protection_rule.rb
+- lib/scryer/rules/active_storage_inline_disposition_rule.rb
+- lib/scryer/rules/active_storage_missing_content_type_validation_rule.rb
+- lib/scryer/rules/authentication_bypass_rule.rb
 - lib/scryer/rules/command_injection_rule.rb
+- lib/scryer/rules/cors_misconfiguration_rule.rb
 - lib/scryer/rules/csrf_protection_rule.rb
+- lib/scryer/rules/force_ssl_rule.rb
+- lib/scryer/rules/graphql_missing_query_limits_rule.rb
+- lib/scryer/rules/hardcoded_basic_auth_rule.rb
+- lib/scryer/rules/hardcoded_secret_key_base_rule.rb
 - lib/scryer/rules/hardcoded_secret_rule.rb
+- lib/scryer/rules/idor_rule.rb
+- lib/scryer/rules/insecure_cookie_serializer_rule.rb
+- lib/scryer/rules/job_raw_params_rule.rb
+- lib/scryer/rules/jwt_insecure_rule.rb
 - lib/scryer/rules/mass_assignment_rule.rb
 - lib/scryer/rules/open_redirect_rule.rb
+- lib/scryer/rules/path_traversal_rule.rb
+- lib/scryer/rules/security_headers_rule.rb
 - lib/scryer/rules/sql_injection_rule.rb
+- lib/scryer/rules/ssrf_rule.rb
 - lib/scryer/rules/unsafe_deserialization_rule.rb
 - lib/scryer/rules/weak_crypto_rule.rb
+- lib/scryer/rules/weak_session_cookie_rule.rb
 - lib/scryer/rules/xss_unsafe_html_rule.rb
 - lib/scryer/scanner.rb
 - lib/scryer/style_rules/frozen_string_literal_rule.rb