scryer 0.3.0 → 1.1.1

data/lib/scryer/rules/security_headers_rule.rb

@@ -0,0 +1,133 @@
+module Scryer
+  module Rules
+    # Flags an explicit insecure override of Rails' default security
+    # headers/config — NOT absence of a header, which would require knowing
+    # every environment file and initializer in the app (too noisy/
+    # environment-dependent for a per-file static rule). Only the explicit
+    # opt-out is a reliable, low-noise signal on its own — same reasoning as
+    # ForceSslRule.
+    #
+    #   config.action_dispatch.default_headers['X-Frame-Options'] = 'ALLOWALL' (or false)
+    #   config.action_dispatch.default_headers['X-Content-Type-Options'] = false
+    #   config.action_dispatch.default_headers.merge!('X-Frame-Options' => 'ALLOWALL', ...)
+    #   config.content_security_policy = nil
+    class SecurityHeadersRule < Rule
+      self.rule_id = "security_headers_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Rails default security header explicitly disabled"
+      self.cwe = "CWE-1021"
+      self.owasp_category = "A05:2021-Security Misconfiguration"
+      self.confidence = "high"
+
+      HEADERS = ["X-Frame-Options", "X-Content-Type-Options"].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          if Ast.tagged?(node, :assign)
+            scan_assign(findings, node)
+          elsif Ast.tagged?(node, :method_add_arg)
+            scan_merge_bang(findings, node)
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def scan_assign(findings, node)
+        target = node[1]
+        value = node[2]
+
+        if Ast.tagged?(target, :aref_field) && default_headers_receiver?(target[1])
+          key = Ast.unwrap_args(target[2]).first
+          header = Ast.plain_string_value(key)
+          add_header_finding(findings, header, value, Ast.line_of(node)) if header
+        elsif Ast.tagged?(target, :field) && Ast.ident_text(target[3]) == "content_security_policy"
+          return unless Ast.kw_literal?(value) == "nil"
+
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "`config.content_security_policy = nil` explicitly disables Content-Security-Policy — " \
+                      "a header that mitigates XSS/data-injection by restricting which sources scripts, " \
+                      "styles, and other resources can load from.",
+            suggested_fix: "Configure an actual policy instead of nil-ing it out — see " \
+                            "`config.content_security_policy do |policy| ... end` in " \
+                            "config/initializers/content_security_policy.rb."
+          )
+        end
+      end
+
+      def scan_merge_bang(findings, node)
+        inner = node[1]
+        name_pair = Ast.call_name(inner)
+        return unless name_pair && name_pair[1] == "merge!"
+        return unless default_headers_receiver?(name_pair[0])
+
+        each_assoc_pair(node).each do |key_node, value_node|
+          header = Ast.plain_string_value(key_node)
+          add_header_finding(findings, header, value_node, Ast.line_of(node)) if header
+        end
+      end
+
+      def add_header_finding(findings, header, value_node, line)
+        return unless HEADERS.include?(header)
+        return unless disabling_value?(header, value_node)
+
+        findings << finding(
+          line: line,
+          message: header_message(header),
+          suggested_fix: header_fix(header)
+        )
+      end
+
+      def disabling_value?(header, value_node)
+        return true if Ast.false_literal?(value_node) || Ast.kw_literal?(value_node) == "nil"
+
+        header == "X-Frame-Options" && Ast.plain_string_value(value_node).to_s.upcase == "ALLOWALL"
+      end
+
+      def header_message(header)
+        case header
+        when "X-Frame-Options"
+          "The `X-Frame-Options` header is explicitly overridden to allow framing (`ALLOWALL`/falsy) — " \
+            "this removes Rails' default clickjacking protection, letting this app be embedded in an " \
+            "attacker-controlled `<iframe>`."
+        when "X-Content-Type-Options"
+          "The `X-Content-Type-Options` header is explicitly disabled — this removes Rails' default " \
+            "MIME-sniffing protection, letting browsers reinterpret a response's content type (e.g. " \
+            "executing an uploaded file as script)."
+        end
+      end
+
+      def header_fix(header)
+        case header
+        when "X-Frame-Options"
+          "Remove this override (Rails defaults to `SAMEORIGIN`), or set an explicit safe value if " \
+            "framing from a specific trusted origin is actually needed."
+        when "X-Content-Type-Options"
+          "Remove this override — leave `X-Content-Type-Options` at Rails' default (`nosniff`)."
+        end
+      end
+
+      # True if `node` is a call chain ending in `.default_headers` (any
+      # receiver — usually `config.action_dispatch`, but the receiver chain
+      # itself isn't verified, same looseness as WeakSessionCookieRule not
+      # verifying its receiver is really `config`).
+      def default_headers_receiver?(node)
+        Ast.call_name(node)&.last == "default_headers"
+      end
+
+      def each_assoc_pair(call_node)
+        Ast.call_arguments(call_node).each_with_object([]) do |arg, acc|
+          next unless Ast.tagged?(arg, :bare_assoc_hash) && arg[1].is_a?(Array)
+
+          arg[1].each { |p| acc << [p[1], p[2]] if Ast.tagged?(p, :assoc_new) }
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/sql_injection_rule.rb

@@ -10,6 +10,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Possible SQL injection via string interpolation"
+      self.cwe = "CWE-89"
+      self.owasp_category = "A03:2021-Injection"
+      self.confidence = "high"
 
       QUERY_METHODS = %w[
         where find_by find_by! order pluck select group having

data/lib/scryer/rules/ssrf_rule.rb

@@ -0,0 +1,139 @@
+module Scryer
+  module Rules
+    # Flags an outbound HTTP call (`Net::HTTP`, `URI.open`/bare `open`
+    # via open-uri, `HTTParty`, `Faraday`, `RestClient`) where an argument
+    # references `params` directly — the request's destination is
+    # user-controlled, which lets an attacker make the server issue requests
+    # to internal services, cloud metadata endpoints, or anywhere else on
+    # its network (server-side request forgery).
+    class SsrfRule < Rule
+      self.rule_id = "ssrf"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Possible server-side request forgery (SSRF)"
+      self.cwe = "CWE-918"
+      self.owasp_category = "A10:2021-Server-Side Request Forgery"
+      self.confidence = "medium"
+
+      DANGEROUS_CALLS = {
+        "Net::HTTP" => %w[get get_response post post_form],
+        "URI" => %w[open],
+        "HTTParty" => %w[get post put delete],
+        "Faraday" => %w[get post put delete],
+        "RestClient" => %w[get post put delete]
+      }.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless dangerous_call?(receiver, method_name)
+
+          args = Ast.call_arguments(node)
+          matched_arg = args.find { |a| Ast.references_params?(a) }
+          next unless matched_arg
+
+          line = Ast.line_of(node)
+          if (fixed_host = fixed_host_with_dynamic_path(matched_arg))
+            findings << finding(
+              line: line,
+              severity: "warning",
+              message: "`#{describe_call(receiver, method_name)}` is called with a URL whose host " \
+                        "(`#{fixed_host}`) is a fixed literal — only a path/query segment is " \
+                        "`params`-derived, so this can't redirect the request to an arbitrary " \
+                        "attacker-chosen host the way a fully dynamic URL could. Still worth a " \
+                        "look: a params-derived path segment can enumerate/probe endpoints on " \
+                        "that fixed host, or (if the target app doesn't validate it either) reach " \
+                        "unintended paths there.",
+              suggested_fix: "If the path segment is meant to be one of a known set of values " \
+                              "(an id, an enum), validate/allowlist it rather than interpolating " \
+                              "`params` straight into the URL — a stray `/` or `..` segment can " \
+                              "still change which path on #{fixed_host} gets requested."
+            )
+          else
+            findings << finding(
+              line: line,
+              message: "`#{describe_call(receiver, method_name)}` is called with a URL/argument " \
+                        "that references `params` — the server can be made to issue a request to " \
+                        "any host an attacker chooses, including internal services and cloud " \
+                        "metadata endpoints (e.g. `169.254.169.254`) that aren't meant to be " \
+                        "reachable from outside.",
+              suggested_fix: "Validate the destination against an allowlist of known-safe hosts " \
+                              "before making the request, rather than passing the user-supplied " \
+                              "value straight through — and reject internal/link-local IP ranges " \
+                              "explicitly if the allowlist is host-based (DNS can still resolve to one)."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def dangerous_call?(receiver, method_name)
+        return true if receiver.nil? && method_name == "open"
+
+        DANGEROUS_CALLS[const_receiver_name(receiver)]&.include?(method_name) || false
+      end
+
+      def describe_call(receiver, method_name)
+        name = const_receiver_name(receiver)
+        name ? "#{name}.#{method_name}" : method_name
+      end
+
+      # A URL's host is fully attacker-controlled the moment `params` reaches
+      # any part of it — but a `params` reference confined to the *path* of
+      # an otherwise-literal URL (`"https://api.example.com/users/#{params[:id]}"`)
+      # can't redirect the request to a different host at all, which is the
+      # actual SSRF risk (reaching internal services / cloud metadata
+      # endpoints). Distinguishing the two isn't possible in general — a URL
+      # built via string concatenation, a helper method, `URI.join`, or a
+      # variable can put `params` anywhere including the host, and this rule
+      # has no way to trace that. This only recognizes the one shape where
+      # it's unambiguous: a direct string_literal argument whose *first*
+      # literal chunk (everything before the first interpolation) already
+      # spells out a complete `scheme://host/` — meaning every `params`
+      # reference in the string necessarily lands after that fixed host, in
+      # the path/query. Returns the literal host text for the message, or
+      # nil if this argument doesn't match that exact shape (in which case
+      # the call is treated with full SSRF severity, same as before this
+      # existed — this only *adds* a more precise, lower-severity message
+      # for the case that's provably narrower, it never suppresses the
+      # finding).
+      def fixed_host_with_dynamic_path(node)
+        return nil unless Ast.tagged?(node, :string_literal)
+
+        content = node[1]
+        return nil unless Ast.tagged?(content, :string_content)
+
+        first_chunk = content[1]
+        return nil unless Ast.tagged?(first_chunk, :@tstring_content)
+
+        match = /\A(https?:\/\/[^\/\s{}]+)\//.match(first_chunk[1])
+        match && match[1]
+      end
+
+      # Textual name of a (possibly namespaced) constant receiver —
+      # "URI" for `[:var_ref, [:@const, "URI", pos]]`, "Net::HTTP" for the
+      # `[:const_path_ref, ...]` chain `Net::HTTP` parses into. nil for
+      # anything else (a variable, a method call, ...).
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = const_receiver_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/unsafe_deserialization_rule.rb

@@ -9,6 +9,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Unsafe deserialization of untrusted data"
+      self.cwe = "CWE-502"
+      self.owasp_category = "A08:2021-Software and Data Integrity Failures"
+      self.confidence = "high"
 
       UNSAFE_CALLS = {
         %w[Marshal load] => "Marshal.load can instantiate arbitrary Ruby objects, including ones " \

data/lib/scryer/rules/verbose_production_log_level_rule.rb

@@ -0,0 +1,53 @@
+module Scryer
+  module Rules
+    # Flags `config.log_level = :debug` specifically in
+    # config/environments/production.rb. Debug-level Rails logging can write
+    # full request parameters (including anything not filtered by
+    # `config.filter_parameters`) and raw SQL bind values to the production
+    # log — wherever that log ends up (a shared file, a log-aggregation
+    # service), that's a broader-than-intended audience for potentially
+    # sensitive data. `:debug` is Rails' own default in development.rb, so
+    # it's only flagged in production.rb; other levels (`:info`, `:warn`)
+    # aren't flagged at all — those don't carry this risk.
+    class VerboseProductionLogLevelRule < Rule
+      self.rule_id = "verbose_production_log_level"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Debug-level logging enabled in production"
+      self.cwe = "CWE-532"
+      self.owasp_category = "A09:2021-Security Logging and Monitoring Failures"
+      self.confidence = "medium"
+
+      PRODUCTION_ENV_FILE = "config/environments/production.rb"
+
+      def scan
+        return [] unless file.to_s.end_with?(PRODUCTION_ENV_FILE)
+
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "log_level"
+          next unless Ast.literal_text(node[2]) == "debug"
+
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "`config.log_level = :debug` in #{PRODUCTION_ENV_FILE} logs full request " \
+                      "parameters and raw SQL bind values in production — anything not covered " \
+                      "by `config.filter_parameters` (e.g. a param name added after that list was " \
+                      "last updated) ends up in the log verbatim.",
+            suggested_fix: "Use `:info` (Rails' own production default) or higher in production, " \
+                            "and confirm `config.filter_parameters` covers every sensitive param " \
+                            "name this app actually receives if verbose logging is genuinely needed " \
+                            "for debugging."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/weak_crypto_rule.rb

@@ -11,9 +11,21 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Weak hash algorithm used for password/credential hashing"
+      self.cwe = "CWE-327"
+      self.owasp_category = "A02:2021-Cryptographic Failures"
+      self.confidence = "medium"
 
       WEAK_DIGESTS = %w[MD5 SHA1].freeze
-      PASSWORD_HINT = /password|passwd|credential/i.freeze
+
+      # `(?!less)` after "password" excludes "passwordless" (and
+      # "passwordlessly") specifically — a real identifier that means the
+      # *opposite* of what this heuristic is looking for (e.g. a magic-link
+      # or passwordless-auth token, `Digest::SHA1.hexdigest(passwordless_token)`),
+      # not a credential. It doesn't affect any legitimate match: every other
+      # "password"-containing identifier this heuristic cares about
+      # (`password`, `user_password`, `password_reset_token`, `hashed_password`,
+      # ...) is never immediately followed by the literal substring "less".
+      PASSWORD_HINT = /password(?!less)|passwd|credential/i.freeze
 
       def scan
         findings = []
@@ -29,7 +41,7 @@ module Scryer
           # non-credential uses (cache keys, ETags, checksums) that shouldn't
           # be flagged as a crypto weakness.
           line = Ast.line_of(node)
-          context_line = Ast.source_line(source, line).to_s
+          context_line = strip_trailing_comment(Ast.source_line(source, line).to_s)
           next unless PASSWORD_HINT.match?(context_line)
 
           findings << finding(
@@ -49,6 +61,29 @@ module Scryer
 
       private
 
+      # Strips a trailing `# ...` line comment before running PASSWORD_HINT
+      # against the raw source line. Without this, a defensive comment that
+      # *disclaims* password use (`Digest::SHA1.hexdigest(file_content) #
+      # cache key, not a password hash` — a natural thing to write specifically
+      # to preempt this exact kind of static-analysis false positive) still
+      # contains the substring "password" and would trip the heuristic just
+      # as hard as a genuine mention. This does give up the (much rarer) case
+      # where a comment is the *only* signal — e.g. an unnamed argument whose
+      # only password-ish hint is a comment describing it — but real
+      # password-hashing call sites almost always also have a password-ish
+      # identifier in the actual code (`password`, `user.password`, ...),
+      # which stays visible on the line after stripping the comment.
+      #
+      # Deliberately simple rather than a full tokenizer: finds the first `#`
+      # that isn't the start of a `#{` string interpolation and treats
+      # everything from there as comment. This means a literal `#` inside a
+      # string argument on the same line (e.g. `hexdigest("score: #1")`) would
+      # be mistaken for a comment start too — an accepted limitation of a
+      # same-line text heuristic, not a full parse.
+      def strip_trailing_comment(line)
+        line.sub(/#(?!\{).*\z/, "")
+      end
+
       # Matches `Digest::MD5` / `Digest::SHA1` referenced as a constant path.
       def digest_algorithm_name(node)
         text = Ast.each_node(node)

data/lib/scryer/rules/weak_session_cookie_rule.rb

@@ -0,0 +1,51 @@
+module Scryer
+  module Rules
+    # Flags `config.session_store :cookie_store, ...` with no `secure: true`
+    # in its options — without it, the session cookie can be sent over plain
+    # HTTP, not just HTTPS. Only `:cookie_store` is checked (the default and
+    # most common store); other stores (`:redis_session_store`, ...) don't
+    # carry the same cookie-content risk and are out of scope here.
+    class WeakSessionCookieRule < Rule
+      self.rule_id = "weak_session_cookie"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Session cookie missing the secure flag"
+      self.cwe = "CWE-614"
+      self.owasp_category = "A05:2021-Security Misconfiguration"
+      self.confidence = "high"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :command, :command_call, :method_add_arg)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless method_name == "session_store"
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.literal_text(a) == "cookie_store" }
+          next if Ast.true_literal?(Ast.keyword_arg(args, "secure"))
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`session_store :cookie_store` has no `secure: true` — the session cookie " \
+                      "can be transmitted over plain HTTP, where it's exposed to network " \
+                      "eavesdropping (e.g. on shared/untrusted Wi-Fi).",
+            suggested_fix: "Add `secure: true` to the session_store options (typically only in " \
+                            "production, since local HTTP development doesn't have TLS): " \
+                            "`config.session_store :cookie_store, key: '_app_session', secure: " \
+                            "Rails.env.production?`."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/xss_unsafe_html_rule.rb

@@ -10,6 +10,33 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Unescaped HTML output (possible XSS)"
+      self.cwe = "CWE-79"
+      self.owasp_category = "A03:2021-Injection"
+      self.confidence = "high"
+
+      # Rails helpers whose whole job is to hand back HTML that's already
+      # safe to render unescaped, so a `.html_safe` immediately wrapped
+      # around a call to one of these isn't the same risk as calling it on
+      # raw user input:
+      #   - `sanitize(x)` strips to an explicit allow-list of tags/attrs —
+      #     it's the standard sanitize-then-mark-safe idiom this rule exists
+      #     to steer people *toward*, so flagging it would contradict our
+      #     own suggested fix.
+      #   - `strip_tags(x)` removes all markup, so there's no HTML left to
+      #     inject.
+      #   - `simple_format(x)` runs the text through `sanitize` internally by
+      #     default (it only skips that when called with an explicit
+      #     `sanitize: false` option, which we don't special-case here).
+      #   - `t(...)`/`translate(...)` pulls from the app's own locale files,
+      #     not attacker-controlled request data — translators, not users,
+      #     write that content, so this is Rails' own common "trusted copy"
+      #     idiom rather than a raw-input passthrough.
+      # This says nothing about the *argument* passed to these methods being
+      # safe on its own — it's specifically the combination of "wrapped in
+      # one of these calls, then marked html_safe" that's the recognized
+      # pattern. A bare `params[:bio].html_safe` or an interpolated string
+      # marked safe still flags, since neither goes through any of these.
+      SANITIZING_METHODS = %w[sanitize strip_tags simple_format t translate].freeze
 
       def scan
         findings = []
@@ -62,9 +89,23 @@ module Scryer
       def safe_literal?(node)
         return true if node.nil?
         return true if Ast.tagged?(node, :string_literal) && !Ast.string_literal_has_interpolation?(node)
+        return true if sanitizing_call?(node)
 
         false
       end
+
+      # True if `node` is a call (parenthesized or bare) to one of
+      # SANITIZING_METHODS — see that constant's comment for why those
+      # specific methods are exempt.
+      def sanitizing_call?(node)
+        inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+        return false unless Ast.tagged?(inner, :call, :command_call, :vcall, :fcall, :command)
+
+        name_pair = Ast.call_name(inner)
+        return false unless name_pair
+
+        SANITIZING_METHODS.include?(name_pair[1])
+      end
     end
   end
 end

data/lib/scryer/style_rules/frozen_string_literal_rule.rb

@@ -12,6 +12,7 @@ module Scryer
       self.category = "style"
       self.default_severity = "info"
       self.title = "Missing `frozen_string_literal` magic comment"
+      self.confidence = "high"
 
       MAGIC_COMMENT = /\A#\s*frozen_string_literal:\s*(true|false)\s*\z/i.freeze
 

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "0.3.0"
+  VERSION = "1.1.1"
 end

data/lib/scryer.rb

@@ -10,7 +10,9 @@ require "scryer/duplicate_detector"
 require "scryer/scanner"
 require "scryer/report_renderer"
 require "scryer/dependency_audit"
+require "scryer/baseline"
 require "scryer/ai_client"
+require "scryer/fix_verifier"
 require "scryer/ai_fix_suggester"
 
 Dir[File.join(__dir__, "scryer", "rules", "*.rb")].sort.each { |f| require f }
@@ -53,6 +55,19 @@ module Scryer
     def configuration
       @configuration ||= Configuration.new
     end
+
+    # Runs the static scan with the current configuration (or explicit
+    # overrides) applied, without needing to know Scanner's own constructor
+    # shape. Exists mainly so the RSpec/Minitest test helpers (see
+    # lib/scryer/rspec.rb / lib/scryer/minitest.rb) — and any other future
+    # caller that just wants "the result of a normal scan" — don't each
+    # duplicate `Scanner.new(root:, dirs:, skip_rules:).call`. The CLI/rake
+    # task aren't changed to use this (they also handle dependency auditing,
+    # baselines, and report writing inline) — this is for callers that only
+    # need the static-scan Result itself.
+    def scan(root:, dirs: configuration.dirs, skip_rules: configuration.skip_rules)
+      Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: skip_rules).call
+    end
   end
 end