scryer 0.3.0 → 1.0.0

data/lib/scryer/rules/ssrf_rule.rb

@@ -0,0 +1,85 @@
+module Scryer
+  module Rules
+    # Flags an outbound HTTP call (`Net::HTTP`, `URI.open`/bare `open`
+    # via open-uri, `HTTParty`, `Faraday`, `RestClient`) where an argument
+    # references `params` directly — the request's destination is
+    # user-controlled, which lets an attacker make the server issue requests
+    # to internal services, cloud metadata endpoints, or anywhere else on
+    # its network (server-side request forgery).
+    class SsrfRule < Rule
+      self.rule_id = "ssrf"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Possible server-side request forgery (SSRF)"
+
+      DANGEROUS_CALLS = {
+        "Net::HTTP" => %w[get get_response post post_form],
+        "URI" => %w[open],
+        "HTTParty" => %w[get post put delete],
+        "Faraday" => %w[get post put delete],
+        "RestClient" => %w[get post put delete]
+      }.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless dangerous_call?(receiver, method_name)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.references_params?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{describe_call(receiver, method_name)}` is called with a URL/argument " \
+                      "that references `params` — the server can be made to issue a request to " \
+                      "any host an attacker chooses, including internal services and cloud " \
+                      "metadata endpoints (e.g. `169.254.169.254`) that aren't meant to be " \
+                      "reachable from outside.",
+            suggested_fix: "Validate the destination against an allowlist of known-safe hosts " \
+                            "before making the request, rather than passing the user-supplied " \
+                            "value straight through — and reject internal/link-local IP ranges " \
+                            "explicitly if the allowlist is host-based (DNS can still resolve to one)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def dangerous_call?(receiver, method_name)
+        return true if receiver.nil? && method_name == "open"
+
+        DANGEROUS_CALLS[const_receiver_name(receiver)]&.include?(method_name) || false
+      end
+
+      def describe_call(receiver, method_name)
+        name = const_receiver_name(receiver)
+        name ? "#{name}.#{method_name}" : method_name
+      end
+
+      # Textual name of a (possibly namespaced) constant receiver —
+      # "URI" for `[:var_ref, [:@const, "URI", pos]]`, "Net::HTTP" for the
+      # `[:const_path_ref, ...]` chain `Net::HTTP` parses into. nil for
+      # anything else (a variable, a method call, ...).
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = const_receiver_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/weak_session_cookie_rule.rb

@@ -0,0 +1,48 @@
+module Scryer
+  module Rules
+    # Flags `config.session_store :cookie_store, ...` with no `secure: true`
+    # in its options — without it, the session cookie can be sent over plain
+    # HTTP, not just HTTPS. Only `:cookie_store` is checked (the default and
+    # most common store); other stores (`:redis_session_store`, ...) don't
+    # carry the same cookie-content risk and are out of scope here.
+    class WeakSessionCookieRule < Rule
+      self.rule_id = "weak_session_cookie"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Session cookie missing the secure flag"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :command, :command_call, :method_add_arg)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless method_name == "session_store"
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.literal_text(a) == "cookie_store" }
+          next if Ast.true_literal?(Ast.keyword_arg(args, "secure"))
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`session_store :cookie_store` has no `secure: true` — the session cookie " \
+                      "can be transmitted over plain HTTP, where it's exposed to network " \
+                      "eavesdropping (e.g. on shared/untrusted Wi-Fi).",
+            suggested_fix: "Add `secure: true` to the session_store options (typically only in " \
+                            "production, since local HTTP development doesn't have TLS): " \
+                            "`config.session_store :cookie_store, key: '_app_session', secure: " \
+                            "Rails.env.production?`."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "0.3.0"
+  VERSION = "1.0.0"
 end

data/lib/tasks/scryer.rake

@@ -8,7 +8,7 @@ require "fileutils"
 # ActiveSupport methods (`.presence`/`.blank?`) for the same reason — plain
 # Ruby nil-or-empty checks only.
 namespace :scryer do
-  desc "Run Scryer and write a report. Args are any mix of json/html/csv (which formats " \
+  desc "Run Scryer and write a report. Args are any mix of json/html/csv/sarif (which formats " \
        "to write — default json,html), the token 'nodeps' (skip the dependency audit — OSV.dev " \
        "vulnerable gems + insecure git/http sources — that otherwise runs by default; use for a " \
        "fast, fully offline run), plus at most one path (a directory when writing more than one " \
@@ -16,7 +16,7 @@ namespace :scryer do
        "so pass each token as its own item rather than one comma-joined string. " \
        "e.g. rails scryer:report, rails 'scryer:report[html]', " \
        "rails 'scryer:report[json,doc/security.json]', rails 'scryer:report[json,html]', " \
-       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]'"
+       "rails 'scryer:report[html,nodeps]', rails 'scryer:report[csv]', rails 'scryer:report[sarif]'"
   task :report, [:format] do |_, args|
     root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
     dirs = Scryer.configuration.dirs
@@ -38,7 +38,8 @@ namespace :scryer do
     dependency_findings = []
     if run_deps
       puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
-      dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root)
+      dependency_findings = Scryer::DependencyAudit.insecure_sources(root) + Scryer::DependencyAudit.vulnerable_gems(root) +
+                             Scryer::DependencyAudit.ruby_eol_check(root) + Scryer::DependencyAudit.credentials_exposure_check(root)
     end
 
     if Scryer.configuration.ai_client
@@ -63,6 +64,7 @@ namespace :scryer do
       content = case format
                 when "json" then renderer.as_json
                 when "csv" then renderer.as_csv
+                when "sarif" then renderer.as_sarif
                 else renderer.as_html
                 end
       File.write(path, content)
@@ -92,20 +94,23 @@ namespace :scryer do
 
     puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
     vulnerable = Scryer::DependencyAudit.vulnerable_gems(root)
+    ruby_eol = Scryer::DependencyAudit.ruby_eol_check(root)
+    credentials_exposure = Scryer::DependencyAudit.credentials_exposure_check(root)
 
-    (insecure + vulnerable).each do |f|
-      label = f.kind == "insecure_source" ? "[#{f.severity.upcase}] #{f.message}" : "[#{f.severity.upcase}] #{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}"
-      puts label
+    (insecure + vulnerable + ruby_eol + credentials_exposure).each do |f|
+      puts "[#{f.severity.upcase}] #{ScryerTasks.dependency_label(f)}"
       puts "  fix: #{f.suggested_fix}"
     end
 
-    total = insecure.size + vulnerable.size
-    puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, #{vulnerable.size} vulnerable gem)."
+    total = insecure.size + vulnerable.size + ruby_eol.size + credentials_exposure.size
+    puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, " \
+         "#{vulnerable.size} vulnerable gem, #{ruby_eol.size} Ruby EOL, " \
+         "#{credentials_exposure.size} credentials exposure)."
     abort("Scryer: dependency audit failed.") if total.positive?
   end
 
-  VALID_FORMATS = %w[json html csv].freeze
-  EXTENSION_FOR_FORMAT = { "json" => "json", "html" => "html", "csv" => "csv" }.freeze
+  VALID_FORMATS = %w[json html csv sarif].freeze
+  EXTENSION_FOR_FORMAT = { "json" => "json", "html" => "html", "csv" => "csv", "sarif" => "sarif" }.freeze
   NO_DEPS_TOKEN = "nodeps".freeze
 
   # tokens is every bracket arg Rake was given, e.g. %w[json doc/security.json] or
@@ -178,6 +183,13 @@ module ScryerTasks
     nil
   end
 
+  def dependency_label(f)
+    return f.message if f.kind == "insecure_source"
+    return "#{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}" if f.advisory_id
+
+    "#{f.gem_name} #{f.installed_version}: #{f.title}"
+  end
+
   # The "one audit command" summary — a single scan's worth of every
   # category Scryer covers (security, performance, duplicate/smelly code,
   # dependencies), the same categories usually split across RuboCop +

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scryer
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Ram Laxman Yadav
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-11 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -70,14 +70,31 @@ files:
 - lib/scryer/report_renderer.rb
 - lib/scryer/rule.rb
 - lib/scryer/rule_set.rb
+- lib/scryer/rules/action_cable_forgery_protection_rule.rb
+- lib/scryer/rules/active_storage_inline_disposition_rule.rb
+- lib/scryer/rules/active_storage_missing_content_type_validation_rule.rb
+- lib/scryer/rules/authentication_bypass_rule.rb
 - lib/scryer/rules/command_injection_rule.rb
+- lib/scryer/rules/cors_misconfiguration_rule.rb
 - lib/scryer/rules/csrf_protection_rule.rb
+- lib/scryer/rules/force_ssl_rule.rb
+- lib/scryer/rules/graphql_missing_query_limits_rule.rb
+- lib/scryer/rules/hardcoded_basic_auth_rule.rb
+- lib/scryer/rules/hardcoded_secret_key_base_rule.rb
 - lib/scryer/rules/hardcoded_secret_rule.rb
+- lib/scryer/rules/idor_rule.rb
+- lib/scryer/rules/insecure_cookie_serializer_rule.rb
+- lib/scryer/rules/job_raw_params_rule.rb
+- lib/scryer/rules/jwt_insecure_rule.rb
 - lib/scryer/rules/mass_assignment_rule.rb
 - lib/scryer/rules/open_redirect_rule.rb
+- lib/scryer/rules/path_traversal_rule.rb
+- lib/scryer/rules/security_headers_rule.rb
 - lib/scryer/rules/sql_injection_rule.rb
+- lib/scryer/rules/ssrf_rule.rb
 - lib/scryer/rules/unsafe_deserialization_rule.rb
 - lib/scryer/rules/weak_crypto_rule.rb
+- lib/scryer/rules/weak_session_cookie_rule.rb
 - lib/scryer/rules/xss_unsafe_html_rule.rb
 - lib/scryer/scanner.rb
 - lib/scryer/style_rules/frozen_string_literal_rule.rb