scryer 0.3.0 → 1.1.1

data/lib/scryer/rules/force_ssl_rule.rb

@@ -0,0 +1,48 @@
+module Scryer
+  module Rules
+    # Flags `config.force_ssl = false` — an explicit opt-out of Rails'
+    # built-in HTTPS enforcement (redirects, HSTS, secure cookie flag).
+    # Absence of `config.force_ssl = true` isn't flagged — that would require
+    # confirming no environment file sets it anywhere, which needs whole-app
+    # context this per-file rule doesn't have. Only the explicit opt-out is a
+    # reliable, low-noise signal on its own.
+    class ForceSslRule < Rule
+      self.rule_id = "force_ssl_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "HTTPS enforcement explicitly disabled"
+      self.cwe = "CWE-319"
+      self.owasp_category = "A02:2021-Cryptographic Failures"
+      self.confidence = "high"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "force_ssl"
+
+          value = node[2]
+          next unless Ast.false_literal?(value)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`config.force_ssl = false` explicitly disables Rails' HTTPS enforcement " \
+                      "(redirects, HSTS, and the secure flag on cookies) — traffic can be served " \
+                      "and session cookies transmitted over plain HTTP.",
+            suggested_fix: "Set `config.force_ssl = true` (the default for a new Rails production " \
+                            "environment) unless this app is deliberately terminating TLS " \
+                            "elsewhere (a load balancer already enforcing HTTPS) — and if so, " \
+                            "leave a comment explaining that so this doesn't look like an oversight."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/graphql_missing_query_limits_rule.rb

@@ -0,0 +1,106 @@
+module Scryer
+  module Rules
+    # Flags a `class X < GraphQL::Schema` (or a class whose superclass
+    # constant path text is exactly `GraphQL::Schema`) whose body calls
+    # neither `max_depth` nor `max_complexity` anywhere — without at least
+    # one of those, a client can send an arbitrarily deep/expensive query
+    # and the server will try to resolve all of it, a common
+    # denial-of-service vector for GraphQL APIs. Both missing is flagged as
+    # a single finding per class (not one per missing directive), the same
+    # "did the class do the safe thing at all" pattern as
+    # ActiveStorageMissingContentTypeValidationRule/IdorRule.
+    #
+    # Known precision limits, both around indirection this rule can't (or
+    # doesn't try to) resolve, same disclosed-gap spirit as IdorRule:
+    #
+    #   - A schema that inherits from a shared custom base class (e.g.
+    #     `class MySchema < BaseSchema`, where `BaseSchema` is the one that
+    #     actually extends `GraphQL::Schema` and calls `max_depth`/
+    #     `max_complexity`) is never even examined by this rule — the
+    #     superclass-name check only matches a literal `GraphQL::Schema`
+    #     superclass, so `MySchema` here isn't checked at all (a
+    #     false-negative blind spot, not a false positive: verified via
+    #     `Scryer::Scanner` that such a subclass produces no finding either
+    #     way).
+    #   - Conversely, a class that DOES extend `GraphQL::Schema` directly
+    #     but gets its limits from an `include`d module (e.g. `include
+    #     QueryLimits`, where the module sets `max_depth`/`max_complexity`
+    #     via its own `included do ... end` block in a different file) WILL
+    #     be flagged as missing them, even though it isn't — confirmed via
+    #     `Scryer::Scanner` against exactly this fixture. Resolving what an
+    #     `include`d module does requires following it to its own
+    #     definition, potentially in another file entirely — real
+    #     cross-file resolution, not a same-file AST tweak — so rather than
+    #     risk a broad/wrong exemption (e.g. "any class that calls
+    #     `include` at all is exempt" would silence the rule for classes
+    #     that include something unrelated and still have no real limit),
+    #     this gap is left as-is and disclosed here instead. Treat a
+    #     finding on a schema using a shared limits module as worth a
+    #     second look, not a confirmed bug.
+    class GraphqlMissingQueryLimitsRule < Rule
+      self.rule_id = "graphql_missing_query_limits"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "GraphQL schema without query depth/complexity limits"
+      self.cwe = "CWE-770"
+      self.owasp_category = "A04:2021-Insecure Design"
+      self.confidence = "medium"
+
+      LIMIT_METHODS = %w[max_depth max_complexity].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          superclass = superclass_name(node[2])
+          next unless superclass == "GraphQL::Schema"
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| LIMIT_METHODS.include?(name) }
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{class_name}` extends `GraphQL::Schema` but calls neither `max_depth` nor " \
+                      "`max_complexity` — without either limit, a client can send an arbitrarily " \
+                      "deep or expensive query and the server will attempt to resolve all of it, a " \
+                      "common denial-of-service vector for GraphQL APIs.",
+            suggested_fix: "Add at least one limit to the schema, e.g. `max_depth 15` and/or " \
+                            "`max_complexity 300` (tune both to what this API's real queries need)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def each_call_names(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last
+        end
+      end
+
+      # Textual name of a (possibly namespaced) constant superclass node —
+      # "GraphQL::Schema" for the `[:const_path_ref, ...]` chain a `< X::Y`
+      # superclass parses into, or the bare name for an unnamespaced
+      # superclass (`[:var_ref, [:@const, ...]]`). nil if there's no
+      # superclass (`node[2]` is nil for a plain `class X` with no `< ...`).
+      def superclass_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = superclass_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_basic_auth_rule.rb

@@ -0,0 +1,51 @@
+module Scryer
+  module Rules
+    # Flags `http_basic_authenticate_with` calls whose `password:` (or
+    # `name:`) keyword argument is a plain string literal — a shape
+    # `HardcodedSecretRule` doesn't cover (that rule only looks at
+    # `x = "literal"` assignment targets, not keyword-argument values in a
+    # method call).
+    class HardcodedBasicAuthRule < Rule
+      self.rule_id = "hardcoded_basic_auth"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Hardcoded HTTP Basic Auth credential"
+      self.cwe = "CWE-798"
+      self.owasp_category = "A07:2021-Identification and Authentication Failures"
+      self.confidence = "high"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?password|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && name_pair[1] == "http_basic_authenticate_with"
+
+          args = Ast.call_arguments(node)
+          password_value = Ast.plain_string_value(Ast.keyword_arg(args, "password"))
+          next unless password_value && !password_value.strip.empty? && !PLACEHOLDER_VALUES.match?(password_value.strip)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`http_basic_authenticate_with` is called with a literal `password:` — " \
+                      "anyone with read access to this source (including git history) has the " \
+                      "credential, and it can't be rotated without a code change and deploy.",
+            suggested_fix: "Move the credential out of source: " \
+                            "`http_basic_authenticate_with name: ENV.fetch(\"BASIC_AUTH_USER\"), " \
+                            "password: ENV.fetch(\"BASIC_AUTH_PASSWORD\")` (or Rails encrypted " \
+                            "credentials), and rotate this password since it's likely already " \
+                            "exposed in git history."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_secret_key_base_rule.rb

@@ -0,0 +1,58 @@
+module Scryer
+  module Rules
+    # Flags `config.secret_key_base = "literal"` (or
+    # `Rails.application.config.secret_key_base = "literal"`) — a plain
+    # string literal assigned to `secret_key_base` via a `.field=` target.
+    #
+    # HardcodedSecretRule doesn't catch this shape: its `target_name` walks
+    # the assignment target depth-first and returns the *first* identifier
+    # it finds, which for a `.field=` target with a receiver is the
+    # receiver's own name (`config`) rather than the attribute being
+    # assigned (`secret_key_base`) — so `config.secret_key_base = "..."`
+    # never matches its NAME_PATTERN, even though the value is exactly the
+    # kind of credential that rule exists to catch. Bare assignment
+    # (`secret_key_base = "..."` with no receiver) IS already caught by
+    # HardcodedSecretRule, since there the identifier IS the target name —
+    # this rule only covers the receiver'd shape it misses.
+    class HardcodedSecretKeyBaseRule < Rule
+      self.rule_id = "hardcoded_secret_key_base"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Hardcoded secret_key_base"
+      self.cwe = "CWE-798"
+      self.owasp_category = "A02:2021-Cryptographic Failures"
+      self.confidence = "high"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "secret_key_base"
+
+          value = Ast.plain_string_value(node[2])
+          next unless value && !value.strip.empty? && !PLACEHOLDER_VALUES.match?(value.strip)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`secret_key_base` is assigned a literal string — this key signs/encrypts " \
+                      "Rails sessions and other secrets; anyone with read access to this source " \
+                      "(including git history) can forge session cookies and other signed data.",
+            suggested_fix: "Use `Rails.application.credentials.secret_key_base` (the Rails default, " \
+                            "set via `bin/rails credentials:edit`) or `ENV.fetch(\"SECRET_KEY_BASE\")` " \
+                            "instead, and rotate this key since it's likely already exposed in git " \
+                            "history."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_secret_rule.rb

@@ -9,6 +9,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Hardcoded credential or API key"
+      self.cwe = "CWE-798"
+      self.owasp_category = "A07:2021-Identification and Authentication Failures"
+      self.confidence = "medium"
 
       NAME_PATTERN = /(api[_-]?key|secret|token|password|passwd|access[_-]?key|private[_-]?key|auth)/i.freeze
 

data/lib/scryer/rules/host_authorization_disabled_rule.rb

@@ -0,0 +1,50 @@
+module Scryer
+  module Rules
+    # Flags `config.hosts.clear` (in any file — `Rails.application.config.
+    # hosts.clear` and similar longer chains match too, since only the last
+    # two segments of the call chain matter). Rails 6+ checks the `Host`
+    # header on every request against `config.hosts` by default
+    # (ActionDispatch::HostAuthorization) specifically to block DNS-rebinding
+    # and Host-header-injection attacks; `.clear` empties that allowlist,
+    # which disables the check entirely rather than narrowing it — unlike
+    # adding a specific host to the list, there's no legitimate narrowing use
+    # of `.clear` itself (a project that wants to allow every host would
+    # still say so more precisely, e.g. a regex covering its actual domains).
+    class HostAuthorizationDisabledRule < Rule
+      self.rule_id = "host_authorization_disabled"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Host header authorization allowlist cleared"
+      self.cwe = "CWE-350"
+      self.owasp_category = "A05:2021-Security Misconfiguration"
+      self.confidence = "high"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :call)
+          next unless Ast.ident_text(node[3]) == "clear"
+
+          receiver = node[1]
+          next unless Ast.tagged?(receiver, :call)
+          next unless Ast.ident_text(receiver[3]) == "hosts"
+
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "`config.hosts.clear` empties Rails' Host-header allowlist " \
+                      "(ActionDispatch::HostAuthorization), disabling its check against DNS-" \
+                      "rebinding and Host-header-injection attacks entirely rather than narrowing it.",
+            suggested_fix: "Add this app's actual host(s) to the allowlist instead of clearing it " \
+                            "— e.g. `config.hosts << \"example.com\"` — or, if requests genuinely " \
+                            "come from unpredictable hosts (a multi-tenant app resolving hosts at " \
+                            "runtime), use a regex/proc that still validates against a known pattern " \
+                            "rather than accepting every host."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/idor_rule.rb

@@ -0,0 +1,165 @@
+module Scryer
+  module Rules
+    # Flags `Model.find(params[...])` / `Model.find_by(...params...)` inside
+    # a controller where the receiver is a bare, unnamespaced constant (not
+    # scoped through e.g. `current_user.things.find(...)`) and no
+    # authorization call (`authorize`, `authorize!`, `policy_scope`, `can?`,
+    # `cannot?` — the common Pundit/CanCanCan method names) appears anywhere
+    # else in the same controller class.
+    #
+    # This is the least precise rule in the gem, by nature of the problem:
+    # whether a given `find` is actually scoped to the current user is a
+    # question about the whole app's authorization model, not something
+    # visible from one file's AST. Expect real false positives — e.g. an
+    # admin-only controller already gated by a class-level `before_action`,
+    # or a genuinely global/unowned model (`Country.find(params[:id])`).
+    # Treat every finding as "worth a second look," not a confirmed bug —
+    # same spirit as CsrfProtectionRule's class-wide safeguard check, applied
+    # to a harder problem.
+    class IdorRule < Rule
+      self.rule_id = "idor"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Possible insecure direct object reference (IDOR)"
+      self.cwe = "CWE-639"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "low"
+
+      FINDER_METHODS = %w[find find_by find_by!].freeze
+
+      # Same reasoning as MassAssignmentRule::NON_MODEL_RECEIVERS: common
+      # stdlib/gem constants with their own `.find`-style methods that have
+      # nothing to do with an ActiveRecord model lookup.
+      NON_MODEL_RECEIVERS = %w[
+        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
+        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
+        Enumerable File Dir
+      ].freeze
+
+      # Pundit's `authorize`/`policy_scope`/`can?`/`cannot?` plus two more
+      # well-established framework-provided safeguards, deliberately not an
+      # attempt at an exhaustive list of every app's custom guard method
+      # (e.g. a homegrown `require_admin!` before_action) — this rule's own
+      # documented limitation above already covers that case as expected
+      # noise, since there's no reliable way to know a custom method name
+      # actually performs record-level authorization rather than something
+      # unrelated:
+      #   - `load_and_authorize_resource` / `authorize_resource` — CanCanCan's
+      #     own controller macros; declaring either one authorizes every
+      #     action in the controller (the same effect as calling `authorize!`
+      #     in each action by hand), so a controller using it has the same
+      #     safeguard this rule already accepts for a manual `authorize!` call.
+      #   - `verify_authorized` / `verify_policy_scoped` — Pundit's own
+      #     safety-net `after_action` callbacks (`after_action
+      #     :verify_authorized`), which raise unless some `authorize`/
+      #     `policy_scope` call already happened during the action. A
+      #     controller using this callback is *more* rigorously guarded than
+      #     one with a bare `authorize` call, not less.
+      AUTHORIZATION_METHODS = %w[
+        authorize authorize! policy_scope can? cannot?
+        load_and_authorize_resource authorize_resource
+        verify_authorized verify_policy_scoped
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.class_name(node[1])
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| AUTHORIZATION_METHODS.include?(name) }
+
+          each_unscoped_find(body).each do |find_node, method_name|
+            line = Ast.line_of(find_node)
+            findings << finding(
+              line: line,
+              message: "`#{method_name}` looks up a record directly from `params`, and " \
+                        "`#{class_name}` has no visible authorization check (no `authorize`, " \
+                        "`policy_scope`, or `can?`/`cannot?` anywhere in it) — if this record " \
+                        "belongs to a specific user/account, another user may be able to view or " \
+                        "modify it just by changing the id in the request.",
+              suggested_fix: "Scope the lookup to the current actor instead of the bare model, " \
+                              "e.g. `current_user.things.#{method_name}(params[:id])`, or add an " \
+                              "explicit authorization check (`authorize @thing` for Pundit, " \
+                              "`authorize! :show, @thing` for CanCanCan) before using the record."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      # Gathers both the call's own method name (`authorize` in `authorize
+      # @thing`, `load_and_authorize_resource` in the bare macro call) *and*
+      # any literal symbol/string arguments passed to it (`verify_authorized`
+      # in `after_action :verify_authorized`) — Pundit's `verify_authorized`/
+      # `verify_policy_scoped` safeguards are registered as callback names
+      # via `before_action`/`after_action`, not invoked directly, so checking
+      # only the enclosing call's name would miss them entirely.
+      def each_call_names(node)
+        Ast.each_node(node).flat_map do |n|
+          next [] unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name = Ast.call_name(inner)&.last
+          arg_names = Ast.call_arguments(n).filter_map { |a| Ast.literal_text(a) }
+          [name, *arg_names].compact
+        end
+      end
+
+      def each_unscoped_find(body)
+        Ast.each_node(body).filter_map do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless FINDER_METHODS.include?(method_name)
+          next unless likely_model_receiver?(receiver)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.references_params?(a) }
+
+          [node, method_name]
+        end
+      end
+
+      # A namespaced model (`Admin::Post.find(...)`, `Api::V1::User.find(...)`
+      # — a common real-world pattern for admin-scoped or API-versioned
+      # resources) parses as `:const_path_ref`, not `:var_ref` — verified via
+      # `Ripper.sexp("Admin::Post.find(params[:id])")`. The original version
+      # of this check only handled bare `:var_ref` receivers, so a
+      # namespaced model's `.find(params[...])` was silently never examined
+      # at all (a false negative, not a false positive — worth fixing since
+      # namespacing under a module is an extremely common Rails convention).
+      # Checked against the *last* segment (`"Post"`, not `"Admin"`), same
+      # exclusion list either way — none of NON_MODEL_RECEIVERS are commonly
+      # used in namespaced form for this purpose, but checking the actual
+      # class name being looked up is the more correct match regardless.
+      def likely_model_receiver?(receiver)
+        return false if receiver.nil? # bare find(...) inside the model itself, not a controller lookup
+
+        const_name = const_receiver_name(receiver)
+        return false unless const_name
+
+        !NON_MODEL_RECEIVERS.include?(const_name)
+      end
+
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref) && node[2].is_a?(Array) && node[2][0] == :@const
+          node[2][1]
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/insecure_cookie_serializer_rule.rb

@@ -0,0 +1,47 @@
+module Scryer
+  module Rules
+    # Flags `config.action_dispatch.cookies_serializer = :marshal`. Rails
+    # defaults to `:json` since Rails 4.1 specifically because deserializing
+    # a `Marshal`-encoded cookie can be turned into remote code execution if
+    # the cookie's secret is ever compromised (the same class of bug
+    # `UnsafeDeserializationRule` flags for `Marshal.load` directly) — only
+    # an explicit opt back into `:marshal` is flagged, never the (safe)
+    # default of not setting this at all.
+    class InsecureCookieSerializerRule < Rule
+      self.rule_id = "insecure_cookie_serializer"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Marshal cookie serializer enabled"
+      self.cwe = "CWE-502"
+      self.owasp_category = "A08:2021-Software and Data Integrity Failures"
+      self.confidence = "high"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "cookies_serializer"
+          next unless Ast.literal_text(node[2]) == "marshal"
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`cookies_serializer = :marshal` deserializes every cookie with " \
+                      "`Marshal.load` — if the app's `secret_key_base` is ever leaked (or brute " \
+                      "forced), a forged cookie deserialized this way can lead to remote code " \
+                      "execution, not just a spoofed session.",
+            suggested_fix: "Use the default `:json` serializer instead (remove this line, or set " \
+                            "`config.action_dispatch.cookies_serializer = :json` explicitly) — it " \
+                            "can only produce plain data structures, never arbitrary objects."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/job_raw_params_rule.rb

@@ -0,0 +1,131 @@
+module Scryer
+  module Rules
+    # Flags `SomeJob.perform_async(...)` / `.perform_later(...)` /
+    # `.perform_now(...)` (or the bare form inside the job's own class) where
+    # an argument references `params` more broadly than a single-key
+    # subscript — see raw_params_reference? below for exactly what's exempt
+    # (`params[:id]` and friends) versus what isn't.
+    #
+    # Sidekiq stores job arguments in Redis in plaintext and displays them in
+    # its web UI; both Sidekiq and ActiveJob log job arguments by default.
+    # Passing a raw `params` hash risks leaking whatever it contains —
+    # passwords, tokens, full user-submitted fields — into logs, Redis, and
+    # the Sidekiq UI, instead of passing just the specific id/value the job
+    # actually needs. This is a distinct, well-documented Sidekiq/ActiveJob
+    # concern from mass assignment (which is about writing untrusted params
+    # to a model, not about where params end up once queued).
+    class JobRawParamsRule < Rule
+      self.rule_id = "job_raw_params"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Raw params passed to a background job"
+      self.cwe = "CWE-532"
+      self.owasp_category = "A09:2021-Security Logging and Monitoring Failures"
+      self.confidence = "medium"
+
+      PERFORM_METHODS = %w[perform_async perform_later perform_now].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless PERFORM_METHODS.include?(method_name)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| raw_params_reference?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{method_name}` is called with an argument that references `params` — " \
+                      "Sidekiq stores job arguments in Redis in plaintext (visible in its web UI), " \
+                      "and both Sidekiq and ActiveJob log job arguments by default, so anything in " \
+                      "the raw params hash (passwords, tokens, other sensitive fields) can end up " \
+                      "somewhere it wasn't meant to be readable.",
+            suggested_fix: "Extract only the specific id/value(s) the job actually needs into " \
+                            "local variables before enqueuing (e.g. `id = params[:id]; " \
+                            "#{method_name}(id)`), instead of passing `params` (or a subscript of " \
+                            "it) straight through, and have the job re-fetch/re-derive anything " \
+                            "else it needs from that id."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      # True if `node`'s subtree references `params` in a way broader than a
+      # narrow, controlled extraction — a bare `params` value, or `params` as
+      # the receiver of anything other than `[]`, `.dig`, or `.permit`.
+      #
+      # `params[:id]` and `params.dig(:id)` are equivalent single-key
+      # extractions (`ActionController::Parameters#dig` behaves like `#[]`
+      # for one key, and digging through several keys still only ever
+      # returns one scalar/sub-value, never the rest of the hash) — flagging
+      # one but not the other would be an arbitrary inconsistency, not a
+      # risk-based distinction. `params.permit(:id, :name)` (optionally
+      # chained into `.to_h`/`.to_unsafe_h`/etc.) is Rails' own sanctioned
+      # allowlisting idiom — MassAssignmentRule already accepts a `.permit`
+      # call as sufficient sanitization elsewhere in this gem, so treating it
+      # as still "raw" here would send a contradictory message about the
+      # same idiom. None of this is zero-risk (a permitted field can still
+      # be a name/email/phone; a dug-up value can still be a token) — but
+      # flagging Rails' own recommended patterns here would just be noise
+      # that erodes trust in every other finding this rule reports.
+      # Everything else — bare `params`, `.to_json`, `.to_h`/`.to_unsafe_h`
+      # with no preceding `.permit`, `.merge`, `.except`, ... — still flags,
+      # since those really can carry the full, uncontrolled params payload.
+      NARROW_PARAMS_METHODS = %w[dig permit].freeze
+
+      def raw_params_reference?(node)
+        found = false
+
+        walk = lambda do |n|
+          next if found || !n.is_a?(Array)
+
+          if Ast.tagged?(n, :aref) && bare_params?(n[1])
+            walk.call(n[2]) if n[2].is_a?(Array)
+            next
+          end
+
+          if narrow_params_call?(n)
+            next
+          end
+
+          if bare_params?(n)
+            found = true
+            next
+          end
+
+          n.each { |c| walk.call(c) if c.is_a?(Array) }
+        end
+
+        walk.call(node)
+        found
+      end
+
+      def narrow_params_call?(node)
+        return false unless Ast.tagged?(node, :method_add_arg, :call, :command_call)
+
+        inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+        receiver_and_name = Ast.call_name(inner)
+        return false unless receiver_and_name
+
+        receiver, method_name = receiver_and_name
+        bare_params?(receiver) && NARROW_PARAMS_METHODS.include?(method_name)
+      end
+
+      def bare_params?(node)
+        Ast.tagged?(node, :vcall, :var_ref, :fcall) && Ast.ident_text(node[1]) == "params"
+      end
+    end
+  end
+end