scryer 1.0.0 → 1.2.0

data/lib/scryer/rules/idor_rule.rb

@@ -21,6 +21,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Possible insecure direct object reference (IDOR)"
+      self.cwe = "CWE-639"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "low"
 
       FINDER_METHODS = %w[find find_by find_by!].freeze
 
@@ -33,7 +36,30 @@ module Scryer
         Enumerable File Dir
       ].freeze
 
-      AUTHORIZATION_METHODS = %w[authorize authorize! policy_scope can? cannot?].freeze
+      # Pundit's `authorize`/`policy_scope`/`can?`/`cannot?` plus two more
+      # well-established framework-provided safeguards, deliberately not an
+      # attempt at an exhaustive list of every app's custom guard method
+      # (e.g. a homegrown `require_admin!` before_action) — this rule's own
+      # documented limitation above already covers that case as expected
+      # noise, since there's no reliable way to know a custom method name
+      # actually performs record-level authorization rather than something
+      # unrelated:
+      #   - `load_and_authorize_resource` / `authorize_resource` — CanCanCan's
+      #     own controller macros; declaring either one authorizes every
+      #     action in the controller (the same effect as calling `authorize!`
+      #     in each action by hand), so a controller using it has the same
+      #     safeguard this rule already accepts for a manual `authorize!` call.
+      #   - `verify_authorized` / `verify_policy_scoped` — Pundit's own
+      #     safety-net `after_action` callbacks (`after_action
+      #     :verify_authorized`), which raise unless some `authorize`/
+      #     `policy_scope` call already happened during the action. A
+      #     controller using this callback is *more* rigorously guarded than
+      #     one with a bare `authorize` call, not less.
+      AUTHORIZATION_METHODS = %w[
+        authorize authorize! policy_scope can? cannot?
+        load_and_authorize_resource authorize_resource
+        verify_authorized verify_policy_scoped
+      ].freeze
 
       def scan
         findings = []
@@ -41,7 +67,7 @@ module Scryer
         Ast.each_node(sexp) do |node|
           next unless Ast.tagged?(node, :class)
 
-          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          class_name = Ast.class_name(node[1])
           next unless class_name.to_s.end_with?("Controller")
 
           body = node[3]
@@ -69,12 +95,21 @@ module Scryer
 
       private
 
+      # Gathers both the call's own method name (`authorize` in `authorize
+      # @thing`, `load_and_authorize_resource` in the bare macro call) *and*
+      # any literal symbol/string arguments passed to it (`verify_authorized`
+      # in `after_action :verify_authorized`) — Pundit's `verify_authorized`/
+      # `verify_policy_scoped` safeguards are registered as callback names
+      # via `before_action`/`after_action`, not invoked directly, so checking
+      # only the enclosing call's name would miss them entirely.
       def each_call_names(node)
-        Ast.each_node(node).filter_map do |n|
-          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+        Ast.each_node(node).flat_map do |n|
+          next [] unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
 
           inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
-          Ast.call_name(inner)&.last
+          name = Ast.call_name(inner)&.last
+          arg_names = Ast.call_arguments(n).filter_map { |a| Ast.literal_text(a) }
+          [name, *arg_names].compact
         end
       end
 
@@ -97,14 +132,33 @@ module Scryer
         end
       end
 
+      # A namespaced model (`Admin::Post.find(...)`, `Api::V1::User.find(...)`
+      # — a common real-world pattern for admin-scoped or API-versioned
+      # resources) parses as `:const_path_ref`, not `:var_ref` — verified via
+      # `Ripper.sexp("Admin::Post.find(params[:id])")`. The original version
+      # of this check only handled bare `:var_ref` receivers, so a
+      # namespaced model's `.find(params[...])` was silently never examined
+      # at all (a false negative, not a false positive — worth fixing since
+      # namespacing under a module is an extremely common Rails convention).
+      # Checked against the *last* segment (`"Post"`, not `"Admin"`), same
+      # exclusion list either way — none of NON_MODEL_RECEIVERS are commonly
+      # used in namespaced form for this purpose, but checking the actual
+      # class name being looked up is the more correct match regardless.
       def likely_model_receiver?(receiver)
         return false if receiver.nil? # bare find(...) inside the model itself, not a controller lookup
-        return false unless Ast.tagged?(receiver, :var_ref)
 
-        const_node = receiver[1]
-        return false unless const_node.is_a?(Array) && const_node[0] == :@const
+        const_name = const_receiver_name(receiver)
+        return false unless const_name
+
+        !NON_MODEL_RECEIVERS.include?(const_name)
+      end
 
-        !NON_MODEL_RECEIVERS.include?(const_node[1])
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref) && node[2].is_a?(Array) && node[2][0] == :@const
+          node[2][1]
+        end
       end
     end
   end

data/lib/scryer/rules/insecure_cookie_serializer_rule.rb

@@ -12,6 +12,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Marshal cookie serializer enabled"
+      self.cwe = "CWE-502"
+      self.owasp_category = "A08:2021-Software and Data Integrity Failures"
+      self.confidence = "high"
 
       def scan
         findings = []

data/lib/scryer/rules/job_raw_params_rule.rb

@@ -19,6 +19,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Raw params passed to a background job"
+      self.cwe = "CWE-532"
+      self.owasp_category = "A09:2021-Security Logging and Monitoring Failures"
+      self.confidence = "medium"
 
       PERFORM_METHODS = %w[perform_async perform_later perform_now].freeze
 
@@ -60,13 +63,28 @@ module Scryer
       private
 
       # True if `node`'s subtree references `params` in a way broader than a
-      # single-key subscript (`params[:id]`) — a bare `params` value, or
-      # `params` as the receiver of anything other than `[]` (`.to_json`,
-      # `.permit`, `.to_h`, `.dig`, ...). `params[:id]` (and chained scalar
-      # coercion on the result, like `params[:id].to_i`) is the extremely
-      # common, safe idiom of pulling one field out — flagging every such
-      # call would make this rule useless noise. Anything else risks the
-      # raw/broad params data actually reaching Sidekiq's log/Redis/UI.
+      # narrow, controlled extraction — a bare `params` value, or `params` as
+      # the receiver of anything other than `[]`, `.dig`, or `.permit`.
+      #
+      # `params[:id]` and `params.dig(:id)` are equivalent single-key
+      # extractions (`ActionController::Parameters#dig` behaves like `#[]`
+      # for one key, and digging through several keys still only ever
+      # returns one scalar/sub-value, never the rest of the hash) — flagging
+      # one but not the other would be an arbitrary inconsistency, not a
+      # risk-based distinction. `params.permit(:id, :name)` (optionally
+      # chained into `.to_h`/`.to_unsafe_h`/etc.) is Rails' own sanctioned
+      # allowlisting idiom — MassAssignmentRule already accepts a `.permit`
+      # call as sufficient sanitization elsewhere in this gem, so treating it
+      # as still "raw" here would send a contradictory message about the
+      # same idiom. None of this is zero-risk (a permitted field can still
+      # be a name/email/phone; a dug-up value can still be a token) — but
+      # flagging Rails' own recommended patterns here would just be noise
+      # that erodes trust in every other finding this rule reports.
+      # Everything else — bare `params`, `.to_json`, `.to_h`/`.to_unsafe_h`
+      # with no preceding `.permit`, `.merge`, `.except`, ... — still flags,
+      # since those really can carry the full, uncontrolled params payload.
+      NARROW_PARAMS_METHODS = %w[dig permit].freeze
+
       def raw_params_reference?(node)
         found = false
 
@@ -78,6 +96,10 @@ module Scryer
             next
           end
 
+          if narrow_params_call?(n)
+            next
+          end
+
           if bare_params?(n)
             found = true
             next
@@ -90,6 +112,17 @@ module Scryer
         found
       end
 
+      def narrow_params_call?(node)
+        return false unless Ast.tagged?(node, :method_add_arg, :call, :command_call)
+
+        inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+        receiver_and_name = Ast.call_name(inner)
+        return false unless receiver_and_name
+
+        receiver, method_name = receiver_and_name
+        bare_params?(receiver) && NARROW_PARAMS_METHODS.include?(method_name)
+      end
+
       def bare_params?(node)
         Ast.tagged?(node, :vcall, :var_ref, :fcall) && Ast.ident_text(node[1]) == "params"
       end

data/lib/scryer/rules/jwt_insecure_rule.rb

@@ -15,6 +15,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Insecure JWT.decode/JWT.encode usage"
+      self.cwe = "CWE-347"
+      self.owasp_category = "A02:2021-Cryptographic Failures"
+      self.confidence = "high"
 
       PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?(secret|key)|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
 

data/lib/scryer/rules/mass_assignment_rule.rb

@@ -10,9 +10,28 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Unpermitted mass assignment from params"
+      self.cwe = "CWE-915"
+      self.owasp_category = "A08:2021-Software and Data Integrity Failures"
+      self.confidence = "medium"
 
       ASSIGNMENT_METHODS = %w[new create create! update update! assign_attributes attributes=].freeze
 
+      # `update`/`update!`/`assign_attributes`/`attributes=` on an instance
+      # variable (`@order.update(params[:order])`) is at least as common a
+      # real-world shape as `Model.new(...)`/`Model.create(...)` on a bare
+      # constant — the standard `before_action :set_thing` + `@thing.update`
+      # scaffold pattern — but was invisible to this rule entirely until
+      # found via the accuracy benchmark (benchmark/corpus.rb's
+      # "mass_assignment" vulnerable sample), since likely_model_receiver?
+      # only accepted a bare constant or implicit (nil) receiver. `.new`/
+      # `create`/`create!` deliberately stay constant/nil-only: those verbs
+      # only make sense as a receiver-less/class-level call in normal Rails
+      # code, whereas an ivar could just as easily be a plain Hash (`Hash#
+      # update` is a real `merge!` alias) — restricting the ivar allowance to
+      # only the update-style verbs keeps this from also matching things like
+      # `@filters.update(params[:filters])` on a Hash.
+      IVAR_RECEIVER_METHODS = %w[update update! assign_attributes attributes=].freeze
+
       # Common stdlib/gem constants with their own `.new`/`.create`-style
       # factory methods that have nothing to do with ActiveRecord mass
       # assignment (e.g. `BCrypt::Password.create(params[:password])` is
@@ -37,7 +56,7 @@ module Scryer
 
           receiver, method_name = receiver_and_name
           next unless ASSIGNMENT_METHODS.include?(method_name)
-          next unless likely_model_receiver?(receiver)
+          next unless likely_model_receiver?(receiver, method_name)
 
           args = Ast.call_arguments(node)
           next if args.empty?
@@ -64,11 +83,15 @@ module Scryer
       private
 
       # true for an implicit receiver (bare `create(...)` inside the model
-      # itself) or a plain unnamespaced constant reference (`Order`) that
-      # isn't a known non-model stdlib/gem constant; false for namespaced
-      # constant paths (`BCrypt::Password`) or anything else.
-      def likely_model_receiver?(receiver)
+      # itself), a plain unnamespaced constant reference (`Order`) that isn't
+      # a known non-model stdlib/gem constant, or — for the update-style
+      # verbs only, see IVAR_RECEIVER_METHODS — an instance variable
+      # (`@order`); false for namespaced constant paths (`BCrypt::Password`,
+      # `Admin::Order` — a real gap, see mass_assignment_rule's class comment
+      # and the benchmark corpus's "KNOWN LIMITATION" sample) or anything else.
+      def likely_model_receiver?(receiver, method_name)
         return true if receiver.nil?
+        return true if IVAR_RECEIVER_METHODS.include?(method_name) && ivar_receiver?(receiver)
         return false unless Ast.tagged?(receiver, :var_ref)
 
         const_node = receiver[1]
@@ -77,6 +100,10 @@ module Scryer
         !NON_MODEL_RECEIVERS.include?(const_node[1])
       end
 
+      def ivar_receiver?(node)
+        Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@ivar
+      end
+
       # True if `node` references `params` (see Ast.references_params?)
       # without a `.permit`/`.permit!` call wrapping it (permit! is itself
       # flagged as unsafe too, so it doesn't count as "safe").

data/lib/scryer/rules/missing_authorization_rule.rb

@@ -0,0 +1,103 @@
+module Scryer
+  module Rules
+    # Flags a `*Controller` class that defines `create`/`update`/`destroy`
+    # (Rails' three standard write actions) with NO authorization evidence
+    # anywhere in the class — broader than IdorRule, which only fires when
+    # there's also a params-derived `Model.find` call in the same class.
+    # Plenty of write actions don't call `.find` at all (`Model.create(...)`
+    # needs no lookup; a `destroy` might act on an object set up in a
+    # `before_action`), so IdorRule's narrower pattern misses them even
+    # though "this write action has no visible authorization check at all"
+    # is exactly as real a concern. Restricted to the three standard write
+    # actions (not every public method) specifically to avoid flagging
+    # genuinely public controllers (a marketing page, a login form) that
+    # have no write actions at all and legitimately need no authorization —
+    # a controller that defines `create`/`update`/`destroy` at all is
+    # already a much stronger "this manages a real resource" signal than
+    # any action name would be.
+    #
+    # Expect overlap with `idor` on controllers that both `.find` a record
+    # AND have no authorization — that's two different rules independently
+    # confirming the same underlying gap from two different code shapes
+    # (a lookup vs. a write action), not double-counting a bug.
+    class MissingAuthorizationRule < Rule
+      self.rule_id = "missing_authorization"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Write action with no visible authorization check"
+      self.cwe = "CWE-862"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "low"
+
+      WRITE_ACTIONS = %w[create update destroy].freeze
+
+      # Duplicated from IdorRule intentionally, same as NON_MODEL_RECEIVERS
+      # is duplicated between IdorRule and MassAssignmentRule — a small,
+      # stable list not worth a shared-module indirection for two callers.
+      AUTHORIZATION_METHODS = %w[
+        authorize authorize! policy_scope can? cannot?
+        load_and_authorize_resource authorize_resource
+        verify_authorized verify_policy_scoped
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.class_name(node[1])
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| AUTHORIZATION_METHODS.include?(name) }
+
+          each_write_action_def(body).each do |def_node, action_name|
+            findings << finding(
+              line: Ast.line_of(def_node),
+              message: "`#{class_name}##{action_name}` writes data (a standard Rails write " \
+                        "action), and `#{class_name}` has no visible authorization check anywhere " \
+                        "in it (no `authorize`, `policy_scope`, `can?`/`cannot?`, or CanCanCan/" \
+                        "Pundit callback) — any logged-in (or, if this controller skips " \
+                        "authentication too, any) user may be able to call this action.",
+              suggested_fix: "Add an explicit authorization check before the write happens — " \
+                              "`authorize @thing` (Pundit) or `authorize! :#{action_name}, @thing` " \
+                              "(CanCanCan) — or `load_and_authorize_resource`/`after_action " \
+                              ":verify_authorized` at the class level if every action here should " \
+                              "be gated the same way."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      # Same "call name or literal symbol/string argument" gathering as
+      # IdorRule#each_call_names — see that method's comment for why the
+      # argument half matters (Pundit's verify_authorized/verify_policy_scoped
+      # are registered as before_action/after_action callback names, not
+      # called directly).
+      def each_call_names(node)
+        Ast.each_node(node).flat_map do |n|
+          next [] unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name = Ast.call_name(inner)&.last
+          arg_names = Ast.call_arguments(n).filter_map { |a| Ast.literal_text(a) }
+          [name, *arg_names].compact
+        end
+      end
+
+      def each_write_action_def(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :def)
+
+          name = Ast.ident_text(n[1])
+          [n, name] if WRITE_ACTIONS.include?(name)
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/missing_policy_scope_rule.rb

@@ -0,0 +1,134 @@
+module Scryer
+  module Rules
+    # Flags a controller's `index` action that queries a model directly
+    # (`Model.all`/`Model.where(...)`) instead of through Pundit's
+    # `policy_scope`, in a controller that clearly *uses* Pundit elsewhere
+    # (an `authorize` call appears somewhere in the class) — the well-known
+    # Pundit gotcha where a team remembers `authorize` on show/update/destroy
+    # (each of which checks one record) but forgets that `index` needs
+    # `policy_scope` instead, since there's no single record for `authorize`
+    # to check. Scoped to controllers that already show Pundit usage
+    # specifically so this doesn't fire on apps that don't use Pundit at all
+    # (no `authorize` anywhere) or that scope their index some other way
+    # entirely (a `current_user.posts.all` association instead of a bare
+    # `Post.all` is already scoped, and isn't flagged — see
+    # `references_unscoped_query?`).
+    #
+    # Same looseness as MassAssignmentRule#has_permit_call? and
+    # PathTraversalRule#sanitized_via_basename?: checks whether
+    # `policy_scope` appears *anywhere* in the `index` method body, not that
+    # it specifically wraps the `Model.all`/`.where` call — good enough to
+    # catch the common case (a bare unscoped query with no policy_scope call
+    # at all in sight) without a much harder "does this specific call sit
+    # inside that specific block" analysis.
+    class MissingPolicyScopeRule < Rule
+      self.rule_id = "missing_policy_scope"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "index action queries a model without policy_scope"
+      self.cwe = "CWE-862"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "medium"
+
+      UNSCOPED_METHODS = %w[all where].freeze
+      # Same list IdorRule/MassAssignmentRule use for the same reason —
+      # stdlib/gem constants with their own `.all`/`.where`-shaped methods
+      # that have nothing to do with an ActiveRecord model query.
+      NON_MODEL_RECEIVERS = %w[
+        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
+        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
+        Enumerable File Dir
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.class_name(node[1])
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          next unless each_call_names(body).include?("authorize") # uses Pundit at all
+
+          each_index_def(body).each do |def_node|
+            index_body = def_node[3]
+            next if each_call_names(index_body).include?("policy_scope")
+
+            query_node = find_unscoped_query(index_body)
+            next unless query_node
+
+            findings << finding(
+              line: Ast.line_of(query_node),
+              message: "`#{class_name}#index` queries a model directly (`#{describe_call(query_node)}`) " \
+                        "instead of through `policy_scope` — this controller uses Pundit's `authorize` " \
+                        "elsewhere, but `index` needs `policy_scope` instead (there's no single record " \
+                        "for `authorize` to check), so every record is visible here regardless of who's " \
+                        "allowed to see what.",
+              suggested_fix: "Wrap the query in `policy_scope`, e.g. `policy_scope(#{receiver_name(query_node)}).all` " \
+                              "instead of `#{describe_call(query_node)}`, and define the corresponding " \
+                              "Scope class in this model's policy."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_call_names(node)
+        Ast.each_node(node).flat_map do |n|
+          next [] unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          [Ast.call_name(inner)&.last].compact
+        end
+      end
+
+      def each_index_def(body)
+        Ast.each_node(body).select { |n| Ast.tagged?(n, :def) && Ast.ident_text(n[1]) == "index" }
+      end
+
+      def find_unscoped_query(node)
+        Ast.each_node(node).find do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :call, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          receiver_and_name = Ast.call_name(inner)
+          next false unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          UNSCOPED_METHODS.include?(method_name) && likely_model_receiver?(receiver)
+        end
+      end
+
+      def likely_model_receiver?(receiver)
+        const_name = const_receiver_name(receiver)
+        return false unless const_name
+
+        !NON_MODEL_RECEIVERS.include?(const_name)
+      end
+
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref) && node[2].is_a?(Array) && node[2][0] == :@const
+          node[2][1]
+        end
+      end
+
+      def receiver_name(query_node)
+        inner = Ast.tagged?(query_node, :method_add_arg) ? query_node[1] : query_node
+        const_receiver_name(Ast.call_name(inner)&.first) || "Model"
+      end
+
+      def describe_call(query_node)
+        inner = Ast.tagged?(query_node, :method_add_arg) ? query_node[1] : query_node
+        receiver, method_name = Ast.call_name(inner)
+        "#{const_receiver_name(receiver)}.#{method_name}"
+      end
+    end
+  end
+end

data/lib/scryer/rules/open_redirect_rule.rb

@@ -10,6 +10,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Possible open redirect via unvalidated params"
+      self.cwe = "CWE-601"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "high"
 
       def scan
         findings = []

data/lib/scryer/rules/path_traversal_rule.rb

@@ -10,6 +10,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Possible path traversal"
+      self.cwe = "CWE-22"
+      self.owasp_category = "A01:2021-Broken Access Control"
+      self.confidence = "medium"
 
       DANGEROUS_CALLS = {
         "File" => %w[join read open new write delete binread binwrite],
@@ -31,7 +34,25 @@ module Scryer
           next unless dangerous_call?(receiver, method_name)
 
           args = Ast.call_arguments(node)
-          next unless args.any? { |a| Ast.references_params?(a) && !sanitized_via_basename?(a) }
+          # `send_file`/`send_data`'s keyword options (`filename:`, `type:`,
+          # `disposition:`) control response metadata (the Content-Disposition
+          # filename the browser shows, the content-type header, inline vs.
+          # attachment) — none of them ever touch the filesystem. Only the
+          # first *positional* argument (the actual path for send_file, the
+          # raw bytes for send_data) is ever used as a path, so a `params`
+          # reference confined to the keyword-args hash isn't a path
+          # traversal risk and would otherwise be a false positive on the
+          # extremely common `send_file path, filename: params[:filename]`
+          # idiom. This exclusion is scoped to BARE_METHODS specifically —
+          # File.join/Dir.glob/etc. never take a keyword-args hash in
+          # practice, so they're unaffected.
+          path_args =
+            if receiver.nil? && BARE_METHODS.include?(method_name)
+              args.reject { |a| Ast.tagged?(a, :bare_assoc_hash) }
+            else
+              args
+            end
+          next unless path_args.any? { |a| Ast.references_params?(a) && !sanitized_via_basename?(a) }
 
           line = Ast.line_of(node)
           findings << finding(

data/lib/scryer/rules/security_headers_rule.rb

@@ -16,6 +16,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Rails default security header explicitly disabled"
+      self.cwe = "CWE-1021"
+      self.owasp_category = "A05:2021-Security Misconfiguration"
+      self.confidence = "high"
 
       HEADERS = ["X-Frame-Options", "X-Content-Type-Options"].freeze
 

data/lib/scryer/rules/sql_injection_rule.rb

@@ -10,6 +10,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Possible SQL injection via string interpolation"
+      self.cwe = "CWE-89"
+      self.owasp_category = "A03:2021-Injection"
+      self.confidence = "high"
 
       QUERY_METHODS = %w[
         where find_by find_by! order pluck select group having