scryer 0.3.0 → 1.0.0

data/lib/scryer/rules/idor_rule.rb

@@ -0,0 +1,111 @@
+module Scryer
+  module Rules
+    # Flags `Model.find(params[...])` / `Model.find_by(...params...)` inside
+    # a controller where the receiver is a bare, unnamespaced constant (not
+    # scoped through e.g. `current_user.things.find(...)`) and no
+    # authorization call (`authorize`, `authorize!`, `policy_scope`, `can?`,
+    # `cannot?` — the common Pundit/CanCanCan method names) appears anywhere
+    # else in the same controller class.
+    #
+    # This is the least precise rule in the gem, by nature of the problem:
+    # whether a given `find` is actually scoped to the current user is a
+    # question about the whole app's authorization model, not something
+    # visible from one file's AST. Expect real false positives — e.g. an
+    # admin-only controller already gated by a class-level `before_action`,
+    # or a genuinely global/unowned model (`Country.find(params[:id])`).
+    # Treat every finding as "worth a second look," not a confirmed bug —
+    # same spirit as CsrfProtectionRule's class-wide safeguard check, applied
+    # to a harder problem.
+    class IdorRule < Rule
+      self.rule_id = "idor"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Possible insecure direct object reference (IDOR)"
+
+      FINDER_METHODS = %w[find find_by find_by!].freeze
+
+      # Same reasoning as MassAssignmentRule::NON_MODEL_RECEIVERS: common
+      # stdlib/gem constants with their own `.find`-style methods that have
+      # nothing to do with an ActiveRecord model lookup.
+      NON_MODEL_RECEIVERS = %w[
+        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
+        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
+        Enumerable File Dir
+      ].freeze
+
+      AUTHORIZATION_METHODS = %w[authorize authorize! policy_scope can? cannot?].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| AUTHORIZATION_METHODS.include?(name) }
+
+          each_unscoped_find(body).each do |find_node, method_name|
+            line = Ast.line_of(find_node)
+            findings << finding(
+              line: line,
+              message: "`#{method_name}` looks up a record directly from `params`, and " \
+                        "`#{class_name}` has no visible authorization check (no `authorize`, " \
+                        "`policy_scope`, or `can?`/`cannot?` anywhere in it) — if this record " \
+                        "belongs to a specific user/account, another user may be able to view or " \
+                        "modify it just by changing the id in the request.",
+              suggested_fix: "Scope the lookup to the current actor instead of the bare model, " \
+                              "e.g. `current_user.things.#{method_name}(params[:id])`, or add an " \
+                              "explicit authorization check (`authorize @thing` for Pundit, " \
+                              "`authorize! :show, @thing` for CanCanCan) before using the record."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_call_names(node)
+        Ast.each_node(node).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last
+        end
+      end
+
+      def each_unscoped_find(body)
+        Ast.each_node(body).filter_map do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless FINDER_METHODS.include?(method_name)
+          next unless likely_model_receiver?(receiver)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.references_params?(a) }
+
+          [node, method_name]
+        end
+      end
+
+      def likely_model_receiver?(receiver)
+        return false if receiver.nil? # bare find(...) inside the model itself, not a controller lookup
+        return false unless Ast.tagged?(receiver, :var_ref)
+
+        const_node = receiver[1]
+        return false unless const_node.is_a?(Array) && const_node[0] == :@const
+
+        !NON_MODEL_RECEIVERS.include?(const_node[1])
+      end
+    end
+  end
+end

data/lib/scryer/rules/insecure_cookie_serializer_rule.rb

@@ -0,0 +1,44 @@
+module Scryer
+  module Rules
+    # Flags `config.action_dispatch.cookies_serializer = :marshal`. Rails
+    # defaults to `:json` since Rails 4.1 specifically because deserializing
+    # a `Marshal`-encoded cookie can be turned into remote code execution if
+    # the cookie's secret is ever compromised (the same class of bug
+    # `UnsafeDeserializationRule` flags for `Marshal.load` directly) — only
+    # an explicit opt back into `:marshal` is flagged, never the (safe)
+    # default of not setting this at all.
+    class InsecureCookieSerializerRule < Rule
+      self.rule_id = "insecure_cookie_serializer"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Marshal cookie serializer enabled"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "cookies_serializer"
+          next unless Ast.literal_text(node[2]) == "marshal"
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`cookies_serializer = :marshal` deserializes every cookie with " \
+                      "`Marshal.load` — if the app's `secret_key_base` is ever leaked (or brute " \
+                      "forced), a forged cookie deserialized this way can lead to remote code " \
+                      "execution, not just a spoofed session.",
+            suggested_fix: "Use the default `:json` serializer instead (remove this line, or set " \
+                            "`config.action_dispatch.cookies_serializer = :json` explicitly) — it " \
+                            "can only produce plain data structures, never arbitrary objects."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/job_raw_params_rule.rb

@@ -0,0 +1,98 @@
+module Scryer
+  module Rules
+    # Flags `SomeJob.perform_async(...)` / `.perform_later(...)` /
+    # `.perform_now(...)` (or the bare form inside the job's own class) where
+    # an argument references `params` more broadly than a single-key
+    # subscript — see raw_params_reference? below for exactly what's exempt
+    # (`params[:id]` and friends) versus what isn't.
+    #
+    # Sidekiq stores job arguments in Redis in plaintext and displays them in
+    # its web UI; both Sidekiq and ActiveJob log job arguments by default.
+    # Passing a raw `params` hash risks leaking whatever it contains —
+    # passwords, tokens, full user-submitted fields — into logs, Redis, and
+    # the Sidekiq UI, instead of passing just the specific id/value the job
+    # actually needs. This is a distinct, well-documented Sidekiq/ActiveJob
+    # concern from mass assignment (which is about writing untrusted params
+    # to a model, not about where params end up once queued).
+    class JobRawParamsRule < Rule
+      self.rule_id = "job_raw_params"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Raw params passed to a background job"
+
+      PERFORM_METHODS = %w[perform_async perform_later perform_now].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless PERFORM_METHODS.include?(method_name)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| raw_params_reference?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{method_name}` is called with an argument that references `params` — " \
+                      "Sidekiq stores job arguments in Redis in plaintext (visible in its web UI), " \
+                      "and both Sidekiq and ActiveJob log job arguments by default, so anything in " \
+                      "the raw params hash (passwords, tokens, other sensitive fields) can end up " \
+                      "somewhere it wasn't meant to be readable.",
+            suggested_fix: "Extract only the specific id/value(s) the job actually needs into " \
+                            "local variables before enqueuing (e.g. `id = params[:id]; " \
+                            "#{method_name}(id)`), instead of passing `params` (or a subscript of " \
+                            "it) straight through, and have the job re-fetch/re-derive anything " \
+                            "else it needs from that id."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      # True if `node`'s subtree references `params` in a way broader than a
+      # single-key subscript (`params[:id]`) — a bare `params` value, or
+      # `params` as the receiver of anything other than `[]` (`.to_json`,
+      # `.permit`, `.to_h`, `.dig`, ...). `params[:id]` (and chained scalar
+      # coercion on the result, like `params[:id].to_i`) is the extremely
+      # common, safe idiom of pulling one field out — flagging every such
+      # call would make this rule useless noise. Anything else risks the
+      # raw/broad params data actually reaching Sidekiq's log/Redis/UI.
+      def raw_params_reference?(node)
+        found = false
+
+        walk = lambda do |n|
+          next if found || !n.is_a?(Array)
+
+          if Ast.tagged?(n, :aref) && bare_params?(n[1])
+            walk.call(n[2]) if n[2].is_a?(Array)
+            next
+          end
+
+          if bare_params?(n)
+            found = true
+            next
+          end
+
+          n.each { |c| walk.call(c) if c.is_a?(Array) }
+        end
+
+        walk.call(node)
+        found
+      end
+
+      def bare_params?(node)
+        Ast.tagged?(node, :vcall, :var_ref, :fcall) && Ast.ident_text(node[1]) == "params"
+      end
+    end
+  end
+end

data/lib/scryer/rules/jwt_insecure_rule.rb

@@ -0,0 +1,120 @@
+module Scryer
+  module Rules
+    # Flags insecure usage of the `jwt` gem's `JWT.decode`/`JWT.encode`:
+    #   - `JWT.decode(token, secret, false, ...)` — the third positional arg
+    #     literal `false` disables signature verification entirely, so any
+    #     caller can forge a token that decodes successfully.
+    #   - `algorithm: 'none'` / `'alg' => 'none'` — the "none" algorithm
+    #     means the token isn't signed at all.
+    #   - A plain string literal passed directly as the secret/key argument
+    #     — distinct from HardcodedSecretRule, which only matches
+    #     `x = "literal"` assignment targets, not a literal inline in a call
+    #     argument.
+    class JwtInsecureRule < Rule
+      self.rule_id = "jwt_insecure_usage"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Insecure JWT.decode/JWT.encode usage"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?(secret|key)|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless const_receiver_name(receiver) == "JWT" && %w[decode encode].include?(method_name)
+
+          args = Ast.call_arguments(node)
+          line = Ast.line_of(node)
+
+          findings << verify_bypass_finding(line) if method_name == "decode" && Ast.false_literal?(args[2])
+          findings << algorithm_none_finding(method_name, line) if algorithm_none?(node)
+          findings.concat(inline_secret_finding(method_name, args, line))
+        end
+
+        findings
+      end
+
+      private
+
+      def verify_bypass_finding(line)
+        finding(
+          line: line,
+          message: "`JWT.decode` is called with `false` for `verify` — signature verification is " \
+                    "disabled entirely, so any caller can hand this code a forged token with " \
+                    "arbitrary claims and it will be accepted as valid.",
+          suggested_fix: "Pass `true` for `verify` and supply the correct `algorithm:` option, e.g. " \
+                          "`JWT.decode(token, secret, true, algorithm: 'HS256')`."
+        )
+      end
+
+      def algorithm_none?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :assoc_new)
+
+          key = assoc_key_text(n[1])
+          next false unless key && %w[algorithm alg].include?(key.downcase)
+
+          value = assoc_value_text(n[2])
+          value&.downcase == "none"
+        end
+      end
+
+      def algorithm_none_finding(method_name, line)
+        finding(
+          line: line,
+          message: "`JWT.#{method_name}` is called with `algorithm: 'none'` — the \"none\" " \
+                    "algorithm means the token carries no signature at all, so its claims can be " \
+                    "freely modified/forged by anyone.",
+          suggested_fix: "Use a real signing algorithm (e.g. `algorithm: 'HS256'` or `'RS256'`) and " \
+                          "never accept `'none'` from user/client input when choosing it."
+        )
+      end
+
+      def inline_secret_finding(method_name, args, line)
+        secret_arg = args[1]
+        secret = secret_arg && Ast.plain_string_value(secret_arg)
+        return [] unless secret && !secret.strip.empty? && !PLACEHOLDER_VALUES.match?(secret.strip)
+
+        [
+          finding(
+            line: line,
+            message: "`JWT.#{method_name}` is called with a literal string as the signing " \
+                      "secret/key — anyone with read access to this source (including git " \
+                      "history) can forge or verify tokens with it.",
+            suggested_fix: "Move the secret out of source (`ENV.fetch(\"JWT_SECRET\")` or Rails " \
+                            "encrypted credentials) and rotate this value since it's likely " \
+                            "already exposed in git history."
+          )
+        ]
+      end
+
+      def assoc_key_text(key_node)
+        return key_node[1].to_s.delete_suffix(":") if key_node.is_a?(Array) && key_node[0] == :@label
+
+        Ast.plain_string_value(key_node) || Ast.literal_text(key_node)
+      end
+
+      def assoc_value_text(value_node)
+        Ast.plain_string_value(value_node) || Ast.literal_text(value_node)
+      end
+
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = const_receiver_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/mass_assignment_rule.rb

@@ -77,16 +77,13 @@ module Scryer
         !NON_MODEL_RECEIVERS.include?(const_node[1])
       end
 
-      # True if `node` is `params`, `params[:x]`, or contains such a reference
+      # True if `node` references `params` (see Ast.references_params?)
       # without a `.permit`/`.permit!` call wrapping it (permit! is itself
       # flagged as unsafe too, so it doesn't count as "safe").
       def references_raw_params?(node)
-        return false unless node.is_a?(Array)
         return false if has_permit_call?(node)
 
-        Ast.each_node(node).any? do |n|
-          Ast.tagged?(n, :vcall, :var_ref, :fcall) && Ast.ident_text(n[1]) == "params"
-        end
+        Ast.references_params?(node)
       end
 
       def has_permit_call?(node)

data/lib/scryer/rules/path_traversal_rule.rb

@@ -0,0 +1,89 @@
+module Scryer
+  module Rules
+    # Flags a filesystem operation (`File.join/read/open/new/write/delete`,
+    # `Dir.glob/entries`, `send_file`) where an argument references `params`
+    # directly — without sanitization, `../../etc/passwd`-style path
+    # segments in the request let an attacker read (or write/delete) files
+    # outside whatever directory the code intended to restrict access to.
+    class PathTraversalRule < Rule
+      self.rule_id = "path_traversal"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Possible path traversal"
+
+      DANGEROUS_CALLS = {
+        "File" => %w[join read open new write delete binread binwrite],
+        "Dir" => %w[glob entries]
+      }.freeze
+      BARE_METHODS = %w[send_file send_data].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless dangerous_call?(receiver, method_name)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.references_params?(a) && !sanitized_via_basename?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{describe_call(receiver, method_name)}` is called with a path/argument " \
+                      "that references `params` — a value like `../../config/master.key` reaches " \
+                      "the filesystem unchanged, letting an attacker read or write files outside " \
+                      "whatever directory this was meant to be scoped to.",
+            suggested_fix: "Reduce the input to a safe basename before using it " \
+                            "(`File.basename(params[:name])`), and/or verify the resolved path " \
+                            "stays inside the intended directory (compare " \
+                            "`File.expand_path(...)` against the allowed root) before touching " \
+                            "the filesystem."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def dangerous_call?(receiver, method_name)
+        return true if receiver.nil? && BARE_METHODS.include?(method_name)
+
+        DANGEROUS_CALLS[receiver_name(receiver)]&.include?(method_name) || false
+      end
+
+      def describe_call(receiver, method_name)
+        name = receiver_name(receiver)
+        name ? "#{name}.#{method_name}" : method_name
+      end
+
+      def receiver_name(node)
+        return nil unless Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+
+        node[1][1]
+      end
+
+      # True if `File.basename(...)` appears anywhere in the argument's
+      # subtree — the standard way to strip directory-traversal segments
+      # before using a request-controlled filename. Same "does the guard
+      # appear anywhere in this expression" looseness as
+      # MassAssignmentRule#has_permit_call? — doesn't verify it wraps
+      # *exactly* the params reference, just that it's present.
+      def sanitized_via_basename?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last == "basename"
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/security_headers_rule.rb

@@ -0,0 +1,130 @@
+module Scryer
+  module Rules
+    # Flags an explicit insecure override of Rails' default security
+    # headers/config — NOT absence of a header, which would require knowing
+    # every environment file and initializer in the app (too noisy/
+    # environment-dependent for a per-file static rule). Only the explicit
+    # opt-out is a reliable, low-noise signal on its own — same reasoning as
+    # ForceSslRule.
+    #
+    #   config.action_dispatch.default_headers['X-Frame-Options'] = 'ALLOWALL' (or false)
+    #   config.action_dispatch.default_headers['X-Content-Type-Options'] = false
+    #   config.action_dispatch.default_headers.merge!('X-Frame-Options' => 'ALLOWALL', ...)
+    #   config.content_security_policy = nil
+    class SecurityHeadersRule < Rule
+      self.rule_id = "security_headers_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Rails default security header explicitly disabled"
+
+      HEADERS = ["X-Frame-Options", "X-Content-Type-Options"].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          if Ast.tagged?(node, :assign)
+            scan_assign(findings, node)
+          elsif Ast.tagged?(node, :method_add_arg)
+            scan_merge_bang(findings, node)
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def scan_assign(findings, node)
+        target = node[1]
+        value = node[2]
+
+        if Ast.tagged?(target, :aref_field) && default_headers_receiver?(target[1])
+          key = Ast.unwrap_args(target[2]).first
+          header = Ast.plain_string_value(key)
+          add_header_finding(findings, header, value, Ast.line_of(node)) if header
+        elsif Ast.tagged?(target, :field) && Ast.ident_text(target[3]) == "content_security_policy"
+          return unless Ast.kw_literal?(value) == "nil"
+
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "`config.content_security_policy = nil` explicitly disables Content-Security-Policy — " \
+                      "a header that mitigates XSS/data-injection by restricting which sources scripts, " \
+                      "styles, and other resources can load from.",
+            suggested_fix: "Configure an actual policy instead of nil-ing it out — see " \
+                            "`config.content_security_policy do |policy| ... end` in " \
+                            "config/initializers/content_security_policy.rb."
+          )
+        end
+      end
+
+      def scan_merge_bang(findings, node)
+        inner = node[1]
+        name_pair = Ast.call_name(inner)
+        return unless name_pair && name_pair[1] == "merge!"
+        return unless default_headers_receiver?(name_pair[0])
+
+        each_assoc_pair(node).each do |key_node, value_node|
+          header = Ast.plain_string_value(key_node)
+          add_header_finding(findings, header, value_node, Ast.line_of(node)) if header
+        end
+      end
+
+      def add_header_finding(findings, header, value_node, line)
+        return unless HEADERS.include?(header)
+        return unless disabling_value?(header, value_node)
+
+        findings << finding(
+          line: line,
+          message: header_message(header),
+          suggested_fix: header_fix(header)
+        )
+      end
+
+      def disabling_value?(header, value_node)
+        return true if Ast.false_literal?(value_node) || Ast.kw_literal?(value_node) == "nil"
+
+        header == "X-Frame-Options" && Ast.plain_string_value(value_node).to_s.upcase == "ALLOWALL"
+      end
+
+      def header_message(header)
+        case header
+        when "X-Frame-Options"
+          "The `X-Frame-Options` header is explicitly overridden to allow framing (`ALLOWALL`/falsy) — " \
+            "this removes Rails' default clickjacking protection, letting this app be embedded in an " \
+            "attacker-controlled `<iframe>`."
+        when "X-Content-Type-Options"
+          "The `X-Content-Type-Options` header is explicitly disabled — this removes Rails' default " \
+            "MIME-sniffing protection, letting browsers reinterpret a response's content type (e.g. " \
+            "executing an uploaded file as script)."
+        end
+      end
+
+      def header_fix(header)
+        case header
+        when "X-Frame-Options"
+          "Remove this override (Rails defaults to `SAMEORIGIN`), or set an explicit safe value if " \
+            "framing from a specific trusted origin is actually needed."
+        when "X-Content-Type-Options"
+          "Remove this override — leave `X-Content-Type-Options` at Rails' default (`nosniff`)."
+        end
+      end
+
+      # True if `node` is a call chain ending in `.default_headers` (any
+      # receiver — usually `config.action_dispatch`, but the receiver chain
+      # itself isn't verified, same looseness as WeakSessionCookieRule not
+      # verifying its receiver is really `config`).
+      def default_headers_receiver?(node)
+        Ast.call_name(node)&.last == "default_headers"
+      end
+
+      def each_assoc_pair(call_node)
+        Ast.call_arguments(call_node).each_with_object([]) do |arg, acc|
+          next unless Ast.tagged?(arg, :bare_assoc_hash) && arg[1].is_a?(Array)
+
+          arg[1].each { |p| acc << [p[1], p[2]] if Ast.tagged?(p, :assoc_new) }
+        end
+      end
+    end
+  end
+end