scryer 0.3.0 → 1.1.1

data/lib/generators/scryer/USAGE

@@ -28,13 +28,21 @@ Description:
                          useful. Leave unset to use the actual checked-out
                          branch.
 
-    Two more things ship in this gem but aren't controlled by the
-    initializer — see the README for both:
+    A few more things ship in this gem but aren't controlled by the
+    initializer — see the README for each:
 
       - Scryer::QueryWatcher: an opt-in runtime instrumentation for N+1
         queries and unused eager loading (README: "Runtime query watcher").
       - `bin/rails scryer:audit_dependencies`: a Gemfile.lock vulnerability
         + insecure-source audit against OSV.dev (README: "Dependency audit").
+      - `bin/rails scryer:ci`: a CI-friendly shortcut for
+        `scryer:report[json,sarif]` — JSON + SARIF output, dependency audit
+        on, same SCRYER_BASELINE support (README: "CI/CD integration").
+      - `require "scryer/rspec"` / `require "scryer/minitest"`: opt-in
+        matchers/assertions (`have_no_critical_findings`,
+        `assert_no_critical_scryer_findings`, ...) for asserting this app's
+        own scan stays clean as part of its normal test suite (README:
+        "Testing Scryer results in your own test suite").
 
 Example:
     bin/rails generate scryer:install

data/lib/generators/scryer/templates/scryer_initializer.rb

@@ -14,6 +14,21 @@ Scryer.configure do |c|
   # where checkouts often land in detached-HEAD state). Leave blank to use
   # the actual checked-out branch:
   # c.branch = ENV["CI_COMMIT_BRANCH"]
+
+  # Silence a specific rule by rule_id (repeatable) — a known false positive
+  # on this codebase, or a check that doesn't apply here. Prefer this over
+  # deleting/editing the rule itself; run `bin/rails scryer:report` once and
+  # check tmp/scryer_report.html's "Checks performed" section for the full
+  # list of rule_ids:
+  # c.skip_rules = %w[idor]
+
+  # Any object/Proc responding to #call(prompt) (or #complete(prompt)) that
+  # returns a String — opts into rewriting every finding's suggested_fix
+  # against its actual code via that LLM. Off by default: no network calls,
+  # no provider assumed. See the README's "AI-assisted fix suggestions" and
+  # "AI-verified remediation" sections for what this does and how the
+  # (optional) re-scan-to-confirm-the-fix-works verification works:
+  # c.ai_client = ->(prompt) { MyLlmClient.complete(prompt) }
 end
 
 # Runtime query watcher (N+1 / unused eager loading — see README's "Runtime

data/lib/scryer/ai_fix_suggester.rb

@@ -25,11 +25,20 @@ module Scryer
       # (client raises, times out, returns nothing usable) is swallowed and
       # the finding's original suggested_fix is left as-is — an LLM call
       # failing should never break a scan.
-      def enhance!(finding, client: Scryer.configuration.ai_client)
+      #
+      # `root`, when given (and only for a Scryer::Finding — see
+      # FixVerifier), triggers a follow-up verification pass: re-read the
+      # actual file from disk, substitute the AI's suggested replacement for
+      # the one offending line, and re-run just this finding's own rule
+      # against the result. Sets finding.fix_verified to true/false/nil (see
+      # Finding#fix_verified) — never raises, same failure-swallowing
+      # philosophy as the AI call itself.
+      def enhance!(finding, client: Scryer.configuration.ai_client, root: nil)
         return finding unless client
 
         reply = call_client(client, prompt_for(finding))
         finding.suggested_fix = reply.strip unless blank?(reply)
+        finding.fix_verified = FixVerifier.verify(finding: finding, root: root) if root
         finding
       rescue StandardError
         finding
@@ -40,10 +49,14 @@ module Scryer
       # (network-bound work, same pattern as
       # DependencyAudit.vulnerable_gems) so a large finding count doesn't
       # mean one-request-at-a-time. No-op if no client is configured —
-      # callers don't need to check first.
-      def enhance_result!(result, client: Scryer.configuration.ai_client, concurrency: 4)
+      # callers don't need to check first. Pass `root` (the project root
+      # `finding.file` is relative to) to also run fix verification — see
+      # `enhance!`; omit it to skip verification entirely (e.g. when the
+      # caller has no meaningful root, or doesn't want the extra re-parse
+      # work).
+      def enhance_result!(result, client: Scryer.configuration.ai_client, concurrency: 4, root: nil)
         enhance_many!(result.security_findings + result.performance_findings + result.style_findings,
-                      client: client, concurrency: concurrency)
+                      client: client, concurrency: concurrency, root: root)
         result
       end
 
@@ -51,8 +64,9 @@ module Scryer
       # Scryer::DependencyAudit::Finding objects, which aren't attached to a
       # Scanner::Result. Works on any mix of Finding/DependencyAudit::Finding
       # (prompt_for below dispatches on which one it got). No-op if no client
-      # is configured.
-      def enhance_many!(findings, client: Scryer.configuration.ai_client, concurrency: 4)
+      # is configured. `root` is ignored for DependencyAudit::Finding objects
+      # (FixVerifier only handles rule-backed Finding — see its guard clause).
+      def enhance_many!(findings, client: Scryer.configuration.ai_client, concurrency: 4, root: nil)
         return findings unless client
 
         queue = Queue.new
@@ -68,7 +82,7 @@ module Scryer
               end
               break unless finding
 
-              enhance!(finding, client: client)
+              enhance!(finding, client: client, root: root)
             end
           end
         end
@@ -107,8 +121,14 @@ module Scryer
 
           Generic guidance for this rule: #{finding.suggested_fix}
 
-          Reply with a short explanation (1-3 sentences) followed by a before/after code
-          example using the actual snippet above. Do not restate the issue description.
+          Reply with a short explanation (1-3 sentences), then a fenced code block showing the
+          fix in context if that's useful, and finally — as the very last thing in your reply,
+          exactly once — a line reading "AFTER:" followed by a fenced code block containing ONLY
+          the corrected replacement for the single offending line shown above (line
+          #{finding.line}), nothing else in that block (no surrounding context lines, no
+          comments about the change). This exact "AFTER:" block is parsed automatically to
+          verify the fix actually resolves the finding, so it must be a valid, direct drop-in
+          replacement for that one line. Do not restate the issue description.
         PROMPT
       end
 

data/lib/scryer/ast.rb

@@ -64,14 +64,17 @@ module Scryer
     # Returns the receiver node (nil for a bare/vcall) and the method name
     # string if `node` is a call to one of `method_names`, else nil.
     #
-    # Handles the two shapes Ripper produces for a called method:
-    #   [:call, receiver, [:@period,...]|:"::", [:@ident, "name", pos]]  (has a receiver)
-    #   [:vcall, [:@ident, "name", pos]]                                 (bare, no args)
-    #   [:command, [:@ident, "name", pos], args]                         (bare, with args, no parens)
-    #   [:method_add_arg, call_or_fcall_node, args_node]                 (receiver/bare + parens)
+    # Handles the shapes Ripper produces for a called method:
+    #   [:call, receiver, [:@period,...]|:"::", [:@ident, "name", pos]]        (has a receiver, parens or no args)
+    #   [:vcall, [:@ident, "name", pos]]                                       (bare, no args)
+    #   [:fcall, [:@ident, "name", pos]]                                       (bare + parens, no receiver)
+    #   [:command, [:@ident, "name", pos], args]                               (bare, with args, no parens)
+    #   [:command_call, receiver, [:@period,...], [:@ident, "name", pos], args] (receiver + args, no parens —
+    #                                                                            e.g. `config.session_store :x, y: z`)
+    #   [:method_add_arg, call_or_fcall_node, args_node]                       (receiver/bare + parens, wraps one of the above)
     def call_name(node)
       case node
-      when ->(n) { tagged?(n, :call) }
+      when ->(n) { tagged?(n, :call, :command_call) }
         [node[1], ident_text(node[3])]
       when ->(n) { tagged?(n, :vcall) }
         [nil, ident_text(node[1])]
@@ -88,6 +91,32 @@ module Scryer
       node[1] if node[0].is_a?(Symbol) && %i[@ident @const @kw @op].include?(node[0])
     end
 
+    # The full dotted name from a class/module's own name node — the second
+    # element of a `[:class, name_node, superclass, body]` sexp. A plain
+    # `class Foo` parses name_node as `[:const_ref, [:@const, "Foo", pos]]`;
+    # a namespaced `class Admin::PostsController` parses it as a
+    # `:const_path_ref` chain instead (verified via `Ripper.sexp` —
+    # `Api::V1::UsersController` nests two levels deep: `[:const_path_ref,
+    # [:const_path_ref, [:var_ref, [:@const,"Api"]], [:@const,"V1"]],
+    # [:@const,"UsersController"]]`). Several rules used to check only the
+    # `:const_ref` shape (`node[1][1]` via `ident_text`), so a namespaced
+    # controller's class name silently came back nil and the whole class was
+    # never examined — a real false-negative gap, not a minor edge case,
+    # given how common namespacing (admin areas, API versions) is in real
+    # Rails apps. Returns e.g. "Admin::PostsController" so a plain
+    # `.end_with?("Controller")` check still works the same either way.
+    def class_name(node)
+      if tagged?(node, :const_ref)
+        ident_text(node[1])
+      elsif tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+        node[1][1]
+      elsif tagged?(node, :const_path_ref)
+        left = class_name(node[1])
+        right = ident_text(node[2])
+        [left, right].compact.join("::")
+      end
+    end
+
     # Given a [:method_add_arg, call_node, args_node] or [:command, ident, args_node]
     # node, return the flattened list of top-level argument sexp nodes (best effort —
     # walks through the [:arg_paren, [:args_add_block, [args...], block]] wrapping).
@@ -247,6 +276,66 @@ module Scryer
       result
     end
 
+    # Given a list of top-level argument nodes (from call_arguments), finds
+    # the bare_assoc_hash entry whose label matches `label:` and returns its
+    # value node, or nil if that keyword argument isn't present. Covers
+    # Rails DSL calls like `session_store :cookie_store, secure: true` or
+    # `http_basic_authenticate_with password: "x"`, where keyword args
+    # arrive as a bare_assoc_hash rather than a real Hash literal.
+    def keyword_arg(args, label)
+      target = "#{label}:"
+
+      args.each do |arg|
+        next unless tagged?(arg, :bare_assoc_hash) && arg[1].is_a?(Array)
+
+        pair = arg[1].find { |p| tagged?(p, :assoc_new) && p[1].is_a?(Array) && p[1][0] == :@label && p[1][1] == target }
+        return pair[2] if pair
+      end
+
+      nil
+    end
+
+    # The literal text of a symbol_literal (`:inline`) or plain string_literal
+    # (`"inline"`) node — the two shapes a Rails DSL keyword argument's value
+    # commonly takes. nil for anything else (interpolated string, array,
+    # boolean, ...).
+    def literal_text(node)
+      return plain_string_value(node) if tagged?(node, :string_literal)
+      return nil unless tagged?(node, :symbol_literal) && node[1].is_a?(Array)
+
+      ident_text(node[1][1]) if tagged?(node[1], :symbol)
+    end
+
+    # True if `node` is the literal `true`/`false` keyword
+    # (`[:var_ref, [:@kw, "true"|"false", pos]]`).
+    def true_literal?(node)
+      kw_literal?(node) == "true"
+    end
+
+    def false_literal?(node)
+      kw_literal?(node) == "false"
+    end
+
+    def kw_literal?(node)
+      return nil unless tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@kw
+
+      node[1][1]
+    end
+
+    # True if `node` is `params`, `params[:x]`, or contains such a reference
+    # anywhere in its subtree — the shared "does this touch raw request data"
+    # check behind mass assignment, IDOR, SSRF, and path traversal detection.
+    # Says nothing about whether that reference is guarded (`.permit`,
+    # sanitization, an allowlist, ...) — callers that care about a specific
+    # guard (like MassAssignmentRule's `.permit`) check for it separately.
+    def references_params?(node)
+      return false unless node.is_a?(Array)
+
+      each_node(node).any? do |n|
+        tagged?(n, :vcall, :var_ref, :fcall) && ident_text(n[1]) == "params"
+      end
+    end
+
     # Walks every terminal token-bearing node inside `node` and maps it to a
     # normalized symbol: identifiers/literals become placeholders (so renamed
     # variables/changed literal values still count as "the same" shape),

data/lib/scryer/authorization_watcher.rb

@@ -0,0 +1,156 @@
+module Scryer
+  # Runtime companion to the static `idor`/`missing_authorization`/
+  # `missing_policy_scope` rules — those can only ever say "no call to a
+  # known authorization method is visible anywhere in this controller's
+  # source," which is exactly as wrong as it sounds whenever the real check
+  # happens somewhere the static AST walk can't see (a shared base
+  # controller, a concern, a class-level macro whose effect isn't visible by
+  # name). This watcher answers a narrower but much more reliable question
+  # instead: for *this actual request*, did Pundit's `authorize`/
+  # `policy_scope` or CanCanCan's `authorize!` genuinely get called?
+  #
+  # How: both libraries already track this themselves, for their own
+  # `verify_authorized`/`check_authorization` after_action helpers —
+  # `Pundit::Authorization#pundit_policy_authorized?`/`#pundit_policy_scoped?`
+  # (public API, `@_pundit_policy_authorized`/`@_pundit_policy_scoped` under
+  # the hood) and CanCanCan's `@_authorized` ivar (set by `authorize!` and by
+  # `skip_authorization_check`; verified by reading both gems' actual source,
+  # `pundit-2.5.2/lib/pundit/authorization.rb` and
+  # `cancancan-3.6.1/lib/cancan/controller_additions.rb` — not guessed). This
+  # class registers one more `after_action`, alongside those, that checks the
+  # same flags and reports when a write action completed with neither set.
+  #
+  # Deliberately Pundit/CanCanCan-only, same scope as the static rules this
+  # complements: with neither gem loaded, `enable!` still runs but every
+  # request is silently skipped (see `authorization_library_present?`) — an
+  # app with fully custom, non-object-level authorization (a single
+  # `before_action :require_admin!`, say) gets no findings and no false
+  # positives here, rather than a flood of "unauthorized" reports for a
+  # pattern this watcher has no way to recognize as intentional.
+  #
+  # Deliberately narrower than "check every action": only create/update/
+  # destroy (or any POST/PUT/PATCH/DELETE), matching MissingAuthorizationRule
+  # exactly — and only requests that actually completed (status < 400).
+  # Read-scoping gaps (an unscoped `index` — see MissingPolicyScopeRule) are
+  # NOT covered here; verifying "was the returned data correctly scoped" at
+  # runtime, rather than "was a method called," is a materially different
+  # and harder check this class doesn't attempt.
+  class AuthorizationWatcher
+    Finding = Struct.new(:kind, :message, :controller, :action, :method, :path, :suggested_fix, keyword_init: true) do
+      def to_h
+        super.transform_keys(&:to_s)
+      end
+    end
+
+    WRITE_ACTIONS = %w[create update destroy].freeze
+    WRITE_METHODS = %w[POST PUT PATCH DELETE].freeze
+
+    class << self
+      # Turns the watcher on for the life of the process. Idempotent — safe
+      # to call more than once (later calls are no-ops). No Rack middleware
+      # to install, unlike QueryWatcher: a Rails controller instance is
+      # already fresh per request, so there's no shared/leaking state to
+      # scope — the `after_action` below just runs once per completed
+      # action.
+      def enable!(logger: nil)
+        return if @enabled
+
+        @logger = logger || default_logger
+        @findings = []
+        @enabled = true
+
+        # Covers both API-only and normal Rails apps without special-casing
+        # either: ActionController::Base and ActionController::API are
+        # sibling classes (neither inherits from the other — verified via
+        # `ActionController::API.ancestors.include?(ActionController::Base)
+        # #=> false`), but Rails' own actionpack source calls
+        # `ActiveSupport.run_load_hooks(:action_controller, self)` from
+        # *both* action_controller/base.rb and action_controller/api.rb, so
+        # this block runs once per base class and `install_hook` ends up
+        # registering the after_action on both. Confirmed with a real
+        # ActionController::API + Pundit integration test, not assumed.
+        ActiveSupport.on_load(:action_controller) { Scryer::AuthorizationWatcher.send(:install_hook, self) }
+      end
+
+      def enabled?
+        !!@enabled
+      end
+
+      # Every finding recorded so far this process — inspect, log, or feed
+      # into your own alerting. Not reset automatically; call `clear!`
+      # yourself (e.g. between test examples, or on a timer) if you don't
+      # want it growing for the life of a long-running process.
+      def findings
+        @findings ||= []
+      end
+
+      def clear!
+        @findings = []
+      end
+
+      private
+
+      def default_logger
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger
+        else
+          require "logger"
+          Logger.new($stdout)
+        end
+      end
+
+      def install_hook(base)
+        base.after_action { |controller| Scryer::AuthorizationWatcher.send(:check, controller) }
+      end
+
+      def check(controller)
+        return unless authorization_library_present?
+
+        action = controller.action_name.to_s
+        request = controller.request
+        return unless WRITE_ACTIONS.include?(action) || WRITE_METHODS.include?(request.method)
+
+        status = controller.response&.status
+        return unless status && status < 400 # already rejected/errored — nothing to report
+        return if authorization_evidence?(controller)
+
+        finding = Finding.new(
+          kind: "runtime_missing_authorization",
+          message: "#{controller.class}##{action} completed a #{request.method} request " \
+                    "(status #{status}) with no authorization check actually invoked during it " \
+                    "(checked Pundit's authorize/policy_scope and CanCanCan's authorize!/" \
+                    "skip_authorization_check — neither fired).",
+          controller: controller.class.name,
+          action: action,
+          method: request.method,
+          path: request.path,
+          suggested_fix: "Add an authorization check to this action — Pundit's `authorize`/" \
+                          "`policy_scope`, or CanCanCan's `authorize!`/`load_and_authorize_resource` " \
+                          "— or call `skip_authorization`/`skip_authorization_check` explicitly if " \
+                          "this action is deliberately open to any authenticated (or anonymous) user."
+        )
+        findings << finding
+        @logger.warn("[Scryer::AuthorizationWatcher] #{finding.message}")
+      end
+
+      def authorization_library_present?
+        defined?(::Pundit::Authorization) || defined?(::CanCan::ControllerAdditions)
+      end
+
+      def authorization_evidence?(controller)
+        pundit_authorized?(controller) || cancancan_authorized?(controller)
+      end
+
+      def pundit_authorized?(controller)
+        return false unless controller.respond_to?(:pundit_policy_authorized?, true)
+
+        controller.send(:pundit_policy_authorized?) ||
+          (controller.respond_to?(:pundit_policy_scoped?, true) && controller.send(:pundit_policy_scoped?))
+      end
+
+      def cancancan_authorized?(controller)
+        controller.instance_variable_defined?(:@_authorized)
+      end
+    end
+  end
+end

data/lib/scryer/baseline.rb

@@ -0,0 +1,75 @@
+require "digest"
+require "json"
+require "set"
+
+module Scryer
+  # Baseline mode: `scryer --save-baseline FILE` snapshots the current scan's
+  # findings as a set of stable fingerprints; a later `scryer --baseline
+  # FILE` scan diffs against that snapshot and reports only *new* findings
+  # (plus how many were fixed since), instead of the same full list a legacy
+  # codebase would otherwise reproduce on every single run. This is what
+  # makes adopting Scryer on an app with real pre-existing security debt
+  # practical: gate CI on new issues only, and burn down the rest on its own
+  # schedule, instead of being forced to either fix everything on day one or
+  # turn the gate off entirely.
+  #
+  # Fingerprints are deliberately NOT tied to line number — SHA256 of
+  # (identifying fields + the offending source text/advisory), not
+  # file:line. A finding whose line shifts because of an unrelated edit
+  # earlier in the same file would otherwise look simultaneously "new" and
+  # "fixed" on every unrelated commit, which would make baseline mode
+  # useless noise instead of a real signal.
+  module Baseline
+    module_function
+
+    # `f` is a finding hash (Finding#to_h or DependencyAudit::Finding#to_h)
+    # — distinguished by "rule_id" (rule-based: security/performance/style)
+    # vs. "kind" (dependency findings, which have no rule_id at all).
+    def fingerprint(f)
+      basis =
+        if f["rule_id"]
+          [f["rule_id"], f["file"], f["code_snippet"].to_s.strip]
+        else
+          [f["kind"], f["gem_name"], f["advisory_id"], f["installed_version"]].compact
+        end
+
+      Digest::SHA256.hexdigest(basis.join("|"))[0, 16]
+    end
+
+    def fingerprints(findings)
+      findings.map { |f| fingerprint(f) }
+    end
+
+    def save(path, findings)
+      data = {
+        "scryer_version" => Scryer::VERSION,
+        "created_at" => Time.now.utc.iso8601,
+        "fingerprints" => fingerprints(findings).uniq
+      }
+      File.write(path, JSON.pretty_generate(data))
+    end
+
+    LoadError = Class.new(StandardError)
+
+    def load(path)
+      raise LoadError, "baseline file not found: #{path}" unless File.exist?(path)
+
+      data = JSON.parse(File.read(path))
+      Set.new(Array(data["fingerprints"]))
+    rescue JSON::ParserError => e
+      raise LoadError, "invalid baseline file #{path}: #{e.message}"
+    end
+
+    # Splits `findings` into [new_findings, fixed_count] against a baseline
+    # Set of fingerprints. `new_findings` is what the rest of the pipeline
+    # should treat as "the" findings from this point on (reports, exit code,
+    # top_risks, everything) — `fixed_count` is purely informational
+    # (present in the baseline, absent from this scan).
+    def diff(findings, baseline_fingerprints)
+      current = fingerprints(findings)
+      new_findings = findings.each_with_index.reject { |_, i| baseline_fingerprints.include?(current[i]) }.map(&:first)
+      fixed_count = (baseline_fingerprints - current.to_set).size
+      [new_findings, fixed_count]
+    end
+  end
+end