scryer 0.3.0 → 1.1.1

data/lib/scryer/rules/jwt_insecure_rule.rb

@@ -0,0 +1,123 @@
+module Scryer
+  module Rules
+    # Flags insecure usage of the `jwt` gem's `JWT.decode`/`JWT.encode`:
+    #   - `JWT.decode(token, secret, false, ...)` — the third positional arg
+    #     literal `false` disables signature verification entirely, so any
+    #     caller can forge a token that decodes successfully.
+    #   - `algorithm: 'none'` / `'alg' => 'none'` — the "none" algorithm
+    #     means the token isn't signed at all.
+    #   - A plain string literal passed directly as the secret/key argument
+    #     — distinct from HardcodedSecretRule, which only matches
+    #     `x = "literal"` assignment targets, not a literal inline in a call
+    #     argument.
+    class JwtInsecureRule < Rule
+      self.rule_id = "jwt_insecure_usage"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Insecure JWT.decode/JWT.encode usage"
+      self.cwe = "CWE-347"
+      self.owasp_category = "A02:2021-Cryptographic Failures"
+      self.confidence = "high"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?(secret|key)|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless const_receiver_name(receiver) == "JWT" && %w[decode encode].include?(method_name)
+
+          args = Ast.call_arguments(node)
+          line = Ast.line_of(node)
+
+          findings << verify_bypass_finding(line) if method_name == "decode" && Ast.false_literal?(args[2])
+          findings << algorithm_none_finding(method_name, line) if algorithm_none?(node)
+          findings.concat(inline_secret_finding(method_name, args, line))
+        end
+
+        findings
+      end
+
+      private
+
+      def verify_bypass_finding(line)
+        finding(
+          line: line,
+          message: "`JWT.decode` is called with `false` for `verify` — signature verification is " \
+                    "disabled entirely, so any caller can hand this code a forged token with " \
+                    "arbitrary claims and it will be accepted as valid.",
+          suggested_fix: "Pass `true` for `verify` and supply the correct `algorithm:` option, e.g. " \
+                          "`JWT.decode(token, secret, true, algorithm: 'HS256')`."
+        )
+      end
+
+      def algorithm_none?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :assoc_new)
+
+          key = assoc_key_text(n[1])
+          next false unless key && %w[algorithm alg].include?(key.downcase)
+
+          value = assoc_value_text(n[2])
+          value&.downcase == "none"
+        end
+      end
+
+      def algorithm_none_finding(method_name, line)
+        finding(
+          line: line,
+          message: "`JWT.#{method_name}` is called with `algorithm: 'none'` — the \"none\" " \
+                    "algorithm means the token carries no signature at all, so its claims can be " \
+                    "freely modified/forged by anyone.",
+          suggested_fix: "Use a real signing algorithm (e.g. `algorithm: 'HS256'` or `'RS256'`) and " \
+                          "never accept `'none'` from user/client input when choosing it."
+        )
+      end
+
+      def inline_secret_finding(method_name, args, line)
+        secret_arg = args[1]
+        secret = secret_arg && Ast.plain_string_value(secret_arg)
+        return [] unless secret && !secret.strip.empty? && !PLACEHOLDER_VALUES.match?(secret.strip)
+
+        [
+          finding(
+            line: line,
+            message: "`JWT.#{method_name}` is called with a literal string as the signing " \
+                      "secret/key — anyone with read access to this source (including git " \
+                      "history) can forge or verify tokens with it.",
+            suggested_fix: "Move the secret out of source (`ENV.fetch(\"JWT_SECRET\")` or Rails " \
+                            "encrypted credentials) and rotate this value since it's likely " \
+                            "already exposed in git history."
+          )
+        ]
+      end
+
+      def assoc_key_text(key_node)
+        return key_node[1].to_s.delete_suffix(":") if key_node.is_a?(Array) && key_node[0] == :@label
+
+        Ast.plain_string_value(key_node) || Ast.literal_text(key_node)
+      end
+
+      def assoc_value_text(value_node)
+        Ast.plain_string_value(value_node) || Ast.literal_text(value_node)
+      end
+
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = const_receiver_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/mass_assignment_rule.rb

@@ -10,9 +10,28 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Unpermitted mass assignment from params"
+      self.cwe = "CWE-915"
+      self.owasp_category = "A08:2021-Software and Data Integrity Failures"
+      self.confidence = "medium"
 
       ASSIGNMENT_METHODS = %w[new create create! update update! assign_attributes attributes=].freeze
 
+      # `update`/`update!`/`assign_attributes`/`attributes=` on an instance
+      # variable (`@order.update(params[:order])`) is at least as common a
+      # real-world shape as `Model.new(...)`/`Model.create(...)` on a bare
+      # constant — the standard `before_action :set_thing` + `@thing.update`
+      # scaffold pattern — but was invisible to this rule entirely until
+      # found via the accuracy benchmark (benchmark/corpus.rb's
+      # "mass_assignment" vulnerable sample), since likely_model_receiver?
+      # only accepted a bare constant or implicit (nil) receiver. `.new`/
+      # `create`/`create!` deliberately stay constant/nil-only: those verbs
+      # only make sense as a receiver-less/class-level call in normal Rails
+      # code, whereas an ivar could just as easily be a plain Hash (`Hash#
+      # update` is a real `merge!` alias) — restricting the ivar allowance to
+      # only the update-style verbs keeps this from also matching things like
+      # `@filters.update(params[:filters])` on a Hash.
+      IVAR_RECEIVER_METHODS = %w[update update! assign_attributes attributes=].freeze
+
       # Common stdlib/gem constants with their own `.new`/`.create`-style
       # factory methods that have nothing to do with ActiveRecord mass
       # assignment (e.g. `BCrypt::Password.create(params[:password])` is
@@ -37,7 +56,7 @@ module Scryer
 
           receiver, method_name = receiver_and_name
           next unless ASSIGNMENT_METHODS.include?(method_name)
-          next unless likely_model_receiver?(receiver)
+          next unless likely_model_receiver?(receiver, method_name)
 
           args = Ast.call_arguments(node)
           next if args.empty?
@@ -64,11 +83,15 @@ module Scryer
       private
 
       # true for an implicit receiver (bare `create(...)` inside the model
-      # itself) or a plain unnamespaced constant reference (`Order`) that
-      # isn't a known non-model stdlib/gem constant; false for namespaced
-      # constant paths (`BCrypt::Password`) or anything else.
-      def likely_model_receiver?(receiver)
+      # itself), a plain unnamespaced constant reference (`Order`) that isn't
+      # a known non-model stdlib/gem constant, or — for the update-style
+      # verbs only, see IVAR_RECEIVER_METHODS — an instance variable
+      # (`@order`); false for namespaced constant paths (`BCrypt::Password`,
+      # `Admin::Order` — a real gap, see mass_assignment_rule's class comment
+      # and the benchmark corpus's "KNOWN LIMITATION" sample) or anything else.
+      def likely_model_receiver?(receiver, method_name)
         return true if receiver.nil?
+        return true if IVAR_RECEIVER_METHODS.include?(method_name) && ivar_receiver?(receiver)
         return false unless Ast.tagged?(receiver, :var_ref)
 
         const_node = receiver[1]
@@ -77,16 +100,17 @@ module Scryer
         !NON_MODEL_RECEIVERS.include?(const_node[1])
       end
 
-      # True if `node` is `params`, `params[:x]`, or contains such a reference
+      def ivar_receiver?(node)
+        Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@ivar
+      end
+
+      # True if `node` references `params` (see Ast.references_params?)
       # without a `.permit`/`.permit!` call wrapping it (permit! is itself
       # flagged as unsafe too, so it doesn't count as "safe").
       def references_raw_params?(node)
-        return false unless node.is_a?(Array)
         return false if has_permit_call?(node)
 
-        Ast.each_node(node).any? do |n|
-          Ast.tagged?(n, :vcall, :var_ref, :fcall) && Ast.ident_text(n[1]) == "params"
-        end
+        Ast.references_params?(node)
       end
 
       def has_permit_call?(node)

data/lib/scryer/rules/missing_authorization_rule.rb

@@ -0,0 +1,103 @@
+module Scryer
+  module Rules
+    # Flags a `*Controller` class that defines `create`/`update`/`destroy`
+    # (Rails' three standard write actions) with NO authorization evidence
+    # anywhere in the class — broader than IdorRule, which only fires when
+    # there's also a params-derived `Model.find` call in the same class.
+    # Plenty of write actions don't call `.find` at all (`Model.create(...)`
+    # needs no lookup; a `destroy` might act on an object set up in a
+    # `before_action`), so IdorRule's narrower pattern misses them even
+    # though "this write action has no visible authorization check at all"
+    # is exactly as real a concern. Restricted to the three standard write
+    # actions (not every public method) specifically to avoid flagging
+    # genuinely public controllers (a marketing page, a login form) that
+    # have no write actions at all and legitimately need no authorization —
+    # a controller that defines `create`/`update`/`destroy` at all is
+    # already a much stronger "this manages a real resource" signal than
+    # any action name would be.
+    #
+    # Expect overlap with `idor` on controllers that both `.find` a record
+    # AND have no authorization — that's two different rules independently
+    # confirming the same underlying gap from two different code shapes
+    # (a lookup vs. a write action), not double-counting a bug.
+    class MissingAuthorizationRule < Rule
+      self.rule_id = "missing_authorization"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Write action with no visible authorization check"
+      self.cwe = "CWE-862"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "low"
+
+      WRITE_ACTIONS = %w[create update destroy].freeze
+
+      # Duplicated from IdorRule intentionally, same as NON_MODEL_RECEIVERS
+      # is duplicated between IdorRule and MassAssignmentRule — a small,
+      # stable list not worth a shared-module indirection for two callers.
+      AUTHORIZATION_METHODS = %w[
+        authorize authorize! policy_scope can? cannot?
+        load_and_authorize_resource authorize_resource
+        verify_authorized verify_policy_scoped
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.class_name(node[1])
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| AUTHORIZATION_METHODS.include?(name) }
+
+          each_write_action_def(body).each do |def_node, action_name|
+            findings << finding(
+              line: Ast.line_of(def_node),
+              message: "`#{class_name}##{action_name}` writes data (a standard Rails write " \
+                        "action), and `#{class_name}` has no visible authorization check anywhere " \
+                        "in it (no `authorize`, `policy_scope`, `can?`/`cannot?`, or CanCanCan/" \
+                        "Pundit callback) — any logged-in (or, if this controller skips " \
+                        "authentication too, any) user may be able to call this action.",
+              suggested_fix: "Add an explicit authorization check before the write happens — " \
+                              "`authorize @thing` (Pundit) or `authorize! :#{action_name}, @thing` " \
+                              "(CanCanCan) — or `load_and_authorize_resource`/`after_action " \
+                              ":verify_authorized` at the class level if every action here should " \
+                              "be gated the same way."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      # Same "call name or literal symbol/string argument" gathering as
+      # IdorRule#each_call_names — see that method's comment for why the
+      # argument half matters (Pundit's verify_authorized/verify_policy_scoped
+      # are registered as before_action/after_action callback names, not
+      # called directly).
+      def each_call_names(node)
+        Ast.each_node(node).flat_map do |n|
+          next [] unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name = Ast.call_name(inner)&.last
+          arg_names = Ast.call_arguments(n).filter_map { |a| Ast.literal_text(a) }
+          [name, *arg_names].compact
+        end
+      end
+
+      def each_write_action_def(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :def)
+
+          name = Ast.ident_text(n[1])
+          [n, name] if WRITE_ACTIONS.include?(name)
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/missing_policy_scope_rule.rb

@@ -0,0 +1,134 @@
+module Scryer
+  module Rules
+    # Flags a controller's `index` action that queries a model directly
+    # (`Model.all`/`Model.where(...)`) instead of through Pundit's
+    # `policy_scope`, in a controller that clearly *uses* Pundit elsewhere
+    # (an `authorize` call appears somewhere in the class) — the well-known
+    # Pundit gotcha where a team remembers `authorize` on show/update/destroy
+    # (each of which checks one record) but forgets that `index` needs
+    # `policy_scope` instead, since there's no single record for `authorize`
+    # to check. Scoped to controllers that already show Pundit usage
+    # specifically so this doesn't fire on apps that don't use Pundit at all
+    # (no `authorize` anywhere) or that scope their index some other way
+    # entirely (a `current_user.posts.all` association instead of a bare
+    # `Post.all` is already scoped, and isn't flagged — see
+    # `references_unscoped_query?`).
+    #
+    # Same looseness as MassAssignmentRule#has_permit_call? and
+    # PathTraversalRule#sanitized_via_basename?: checks whether
+    # `policy_scope` appears *anywhere* in the `index` method body, not that
+    # it specifically wraps the `Model.all`/`.where` call — good enough to
+    # catch the common case (a bare unscoped query with no policy_scope call
+    # at all in sight) without a much harder "does this specific call sit
+    # inside that specific block" analysis.
+    class MissingPolicyScopeRule < Rule
+      self.rule_id = "missing_policy_scope"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "index action queries a model without policy_scope"
+      self.cwe = "CWE-862"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "medium"
+
+      UNSCOPED_METHODS = %w[all where].freeze
+      # Same list IdorRule/MassAssignmentRule use for the same reason —
+      # stdlib/gem constants with their own `.all`/`.where`-shaped methods
+      # that have nothing to do with an ActiveRecord model query.
+      NON_MODEL_RECEIVERS = %w[
+        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
+        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
+        Enumerable File Dir
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.class_name(node[1])
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          next unless each_call_names(body).include?("authorize") # uses Pundit at all
+
+          each_index_def(body).each do |def_node|
+            index_body = def_node[3]
+            next if each_call_names(index_body).include?("policy_scope")
+
+            query_node = find_unscoped_query(index_body)
+            next unless query_node
+
+            findings << finding(
+              line: Ast.line_of(query_node),
+              message: "`#{class_name}#index` queries a model directly (`#{describe_call(query_node)}`) " \
+                        "instead of through `policy_scope` — this controller uses Pundit's `authorize` " \
+                        "elsewhere, but `index` needs `policy_scope` instead (there's no single record " \
+                        "for `authorize` to check), so every record is visible here regardless of who's " \
+                        "allowed to see what.",
+              suggested_fix: "Wrap the query in `policy_scope`, e.g. `policy_scope(#{receiver_name(query_node)}).all` " \
+                              "instead of `#{describe_call(query_node)}`, and define the corresponding " \
+                              "Scope class in this model's policy."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_call_names(node)
+        Ast.each_node(node).flat_map do |n|
+          next [] unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          [Ast.call_name(inner)&.last].compact
+        end
+      end
+
+      def each_index_def(body)
+        Ast.each_node(body).select { |n| Ast.tagged?(n, :def) && Ast.ident_text(n[1]) == "index" }
+      end
+
+      def find_unscoped_query(node)
+        Ast.each_node(node).find do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :call, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          receiver_and_name = Ast.call_name(inner)
+          next false unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          UNSCOPED_METHODS.include?(method_name) && likely_model_receiver?(receiver)
+        end
+      end
+
+      def likely_model_receiver?(receiver)
+        const_name = const_receiver_name(receiver)
+        return false unless const_name
+
+        !NON_MODEL_RECEIVERS.include?(const_name)
+      end
+
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref) && node[2].is_a?(Array) && node[2][0] == :@const
+          node[2][1]
+        end
+      end
+
+      def receiver_name(query_node)
+        inner = Ast.tagged?(query_node, :method_add_arg) ? query_node[1] : query_node
+        const_receiver_name(Ast.call_name(inner)&.first) || "Model"
+      end
+
+      def describe_call(query_node)
+        inner = Ast.tagged?(query_node, :method_add_arg) ? query_node[1] : query_node
+        receiver, method_name = Ast.call_name(inner)
+        "#{const_receiver_name(receiver)}.#{method_name}"
+      end
+    end
+  end
+end

data/lib/scryer/rules/open_redirect_rule.rb

@@ -10,6 +10,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Possible open redirect via unvalidated params"
+      self.cwe = "CWE-601"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "high"
 
       def scan
         findings = []

data/lib/scryer/rules/path_traversal_rule.rb

@@ -0,0 +1,110 @@
+module Scryer
+  module Rules
+    # Flags a filesystem operation (`File.join/read/open/new/write/delete`,
+    # `Dir.glob/entries`, `send_file`) where an argument references `params`
+    # directly — without sanitization, `../../etc/passwd`-style path
+    # segments in the request let an attacker read (or write/delete) files
+    # outside whatever directory the code intended to restrict access to.
+    class PathTraversalRule < Rule
+      self.rule_id = "path_traversal"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Possible path traversal"
+      self.cwe = "CWE-22"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "medium"
+
+      DANGEROUS_CALLS = {
+        "File" => %w[join read open new write delete binread binwrite],
+        "Dir" => %w[glob entries]
+      }.freeze
+      BARE_METHODS = %w[send_file send_data].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless dangerous_call?(receiver, method_name)
+
+          args = Ast.call_arguments(node)
+          # `send_file`/`send_data`'s keyword options (`filename:`, `type:`,
+          # `disposition:`) control response metadata (the Content-Disposition
+          # filename the browser shows, the content-type header, inline vs.
+          # attachment) — none of them ever touch the filesystem. Only the
+          # first *positional* argument (the actual path for send_file, the
+          # raw bytes for send_data) is ever used as a path, so a `params`
+          # reference confined to the keyword-args hash isn't a path
+          # traversal risk and would otherwise be a false positive on the
+          # extremely common `send_file path, filename: params[:filename]`
+          # idiom. This exclusion is scoped to BARE_METHODS specifically —
+          # File.join/Dir.glob/etc. never take a keyword-args hash in
+          # practice, so they're unaffected.
+          path_args =
+            if receiver.nil? && BARE_METHODS.include?(method_name)
+              args.reject { |a| Ast.tagged?(a, :bare_assoc_hash) }
+            else
+              args
+            end
+          next unless path_args.any? { |a| Ast.references_params?(a) && !sanitized_via_basename?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{describe_call(receiver, method_name)}` is called with a path/argument " \
+                      "that references `params` — a value like `../../config/master.key` reaches " \
+                      "the filesystem unchanged, letting an attacker read or write files outside " \
+                      "whatever directory this was meant to be scoped to.",
+            suggested_fix: "Reduce the input to a safe basename before using it " \
+                            "(`File.basename(params[:name])`), and/or verify the resolved path " \
+                            "stays inside the intended directory (compare " \
+                            "`File.expand_path(...)` against the allowed root) before touching " \
+                            "the filesystem."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def dangerous_call?(receiver, method_name)
+        return true if receiver.nil? && BARE_METHODS.include?(method_name)
+
+        DANGEROUS_CALLS[receiver_name(receiver)]&.include?(method_name) || false
+      end
+
+      def describe_call(receiver, method_name)
+        name = receiver_name(receiver)
+        name ? "#{name}.#{method_name}" : method_name
+      end
+
+      def receiver_name(node)
+        return nil unless Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+
+        node[1][1]
+      end
+
+      # True if `File.basename(...)` appears anywhere in the argument's
+      # subtree — the standard way to strip directory-traversal segments
+      # before using a request-controlled filename. Same "does the guard
+      # appear anywhere in this expression" looseness as
+      # MassAssignmentRule#has_permit_call? — doesn't verify it wraps
+      # *exactly* the params reference, just that it's present.
+      def sanitized_via_basename?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last == "basename"
+        end
+      end
+    end
+  end
+end