scryer 1.0.0 → 1.2.0

data/lib/scryer/rules/ssrf_rule.rb

@@ -11,6 +11,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Possible server-side request forgery (SSRF)"
+      self.cwe = "CWE-918"
+      self.owasp_category = "A10:2021-Server-Side Request Forgery"
+      self.confidence = "medium"
 
       DANGEROUS_CALLS = {
         "Net::HTTP" => %w[get get_response post post_form],
@@ -34,21 +37,40 @@ module Scryer
           next unless dangerous_call?(receiver, method_name)
 
           args = Ast.call_arguments(node)
-          next unless args.any? { |a| Ast.references_params?(a) }
+          matched_arg = args.find { |a| Ast.references_params?(a) }
+          next unless matched_arg
 
           line = Ast.line_of(node)
-          findings << finding(
-            line: line,
-            message: "`#{describe_call(receiver, method_name)}` is called with a URL/argument " \
-                      "that references `params` — the server can be made to issue a request to " \
-                      "any host an attacker chooses, including internal services and cloud " \
-                      "metadata endpoints (e.g. `169.254.169.254`) that aren't meant to be " \
-                      "reachable from outside.",
-            suggested_fix: "Validate the destination against an allowlist of known-safe hosts " \
-                            "before making the request, rather than passing the user-supplied " \
-                            "value straight through — and reject internal/link-local IP ranges " \
-                            "explicitly if the allowlist is host-based (DNS can still resolve to one)."
-          )
+          if (fixed_host = fixed_host_with_dynamic_path(matched_arg))
+            findings << finding(
+              line: line,
+              severity: "warning",
+              message: "`#{describe_call(receiver, method_name)}` is called with a URL whose host " \
+                        "(`#{fixed_host}`) is a fixed literal — only a path/query segment is " \
+                        "`params`-derived, so this can't redirect the request to an arbitrary " \
+                        "attacker-chosen host the way a fully dynamic URL could. Still worth a " \
+                        "look: a params-derived path segment can enumerate/probe endpoints on " \
+                        "that fixed host, or (if the target app doesn't validate it either) reach " \
+                        "unintended paths there.",
+              suggested_fix: "If the path segment is meant to be one of a known set of values " \
+                              "(an id, an enum), validate/allowlist it rather than interpolating " \
+                              "`params` straight into the URL — a stray `/` or `..` segment can " \
+                              "still change which path on #{fixed_host} gets requested."
+            )
+          else
+            findings << finding(
+              line: line,
+              message: "`#{describe_call(receiver, method_name)}` is called with a URL/argument " \
+                        "that references `params` — the server can be made to issue a request to " \
+                        "any host an attacker chooses, including internal services and cloud " \
+                        "metadata endpoints (e.g. `169.254.169.254`) that aren't meant to be " \
+                        "reachable from outside.",
+              suggested_fix: "Validate the destination against an allowlist of known-safe hosts " \
+                              "before making the request, rather than passing the user-supplied " \
+                              "value straight through — and reject internal/link-local IP ranges " \
+                              "explicitly if the allowlist is host-based (DNS can still resolve to one)."
+            )
+          end
         end
 
         findings
@@ -67,6 +89,38 @@ module Scryer
         name ? "#{name}.#{method_name}" : method_name
       end
 
+      # A URL's host is fully attacker-controlled the moment `params` reaches
+      # any part of it — but a `params` reference confined to the *path* of
+      # an otherwise-literal URL (`"https://api.example.com/users/#{params[:id]}"`)
+      # can't redirect the request to a different host at all, which is the
+      # actual SSRF risk (reaching internal services / cloud metadata
+      # endpoints). Distinguishing the two isn't possible in general — a URL
+      # built via string concatenation, a helper method, `URI.join`, or a
+      # variable can put `params` anywhere including the host, and this rule
+      # has no way to trace that. This only recognizes the one shape where
+      # it's unambiguous: a direct string_literal argument whose *first*
+      # literal chunk (everything before the first interpolation) already
+      # spells out a complete `scheme://host/` — meaning every `params`
+      # reference in the string necessarily lands after that fixed host, in
+      # the path/query. Returns the literal host text for the message, or
+      # nil if this argument doesn't match that exact shape (in which case
+      # the call is treated with full SSRF severity, same as before this
+      # existed — this only *adds* a more precise, lower-severity message
+      # for the case that's provably narrower, it never suppresses the
+      # finding).
+      def fixed_host_with_dynamic_path(node)
+        return nil unless Ast.tagged?(node, :string_literal)
+
+        content = node[1]
+        return nil unless Ast.tagged?(content, :string_content)
+
+        first_chunk = content[1]
+        return nil unless Ast.tagged?(first_chunk, :@tstring_content)
+
+        match = /\A(https?:\/\/[^\/\s{}]+)\//.match(first_chunk[1])
+        match && match[1]
+      end
+
       # Textual name of a (possibly namespaced) constant receiver —
       # "URI" for `[:var_ref, [:@const, "URI", pos]]`, "Net::HTTP" for the
       # `[:const_path_ref, ...]` chain `Net::HTTP` parses into. nil for

data/lib/scryer/rules/unsafe_deserialization_rule.rb

@@ -9,6 +9,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "critical"
       self.title = "Unsafe deserialization of untrusted data"
+      self.cwe = "CWE-502"
+      self.owasp_category = "A08:2021-Software and Data Integrity Failures"
+      self.confidence = "high"
 
       UNSAFE_CALLS = {
         %w[Marshal load] => "Marshal.load can instantiate arbitrary Ruby objects, including ones " \

data/lib/scryer/rules/verbose_production_log_level_rule.rb

@@ -0,0 +1,53 @@
+module Scryer
+  module Rules
+    # Flags `config.log_level = :debug` specifically in
+    # config/environments/production.rb. Debug-level Rails logging can write
+    # full request parameters (including anything not filtered by
+    # `config.filter_parameters`) and raw SQL bind values to the production
+    # log — wherever that log ends up (a shared file, a log-aggregation
+    # service), that's a broader-than-intended audience for potentially
+    # sensitive data. `:debug` is Rails' own default in development.rb, so
+    # it's only flagged in production.rb; other levels (`:info`, `:warn`)
+    # aren't flagged at all — those don't carry this risk.
+    class VerboseProductionLogLevelRule < Rule
+      self.rule_id = "verbose_production_log_level"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Debug-level logging enabled in production"
+      self.cwe = "CWE-532"
+      self.owasp_category = "A09:2021-Security Logging and Monitoring Failures"
+      self.confidence = "medium"
+
+      PRODUCTION_ENV_FILE = "config/environments/production.rb"
+
+      def scan
+        return [] unless file.to_s.end_with?(PRODUCTION_ENV_FILE)
+
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "log_level"
+          next unless Ast.literal_text(node[2]) == "debug"
+
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "`config.log_level = :debug` in #{PRODUCTION_ENV_FILE} logs full request " \
+                      "parameters and raw SQL bind values in production — anything not covered " \
+                      "by `config.filter_parameters` (e.g. a param name added after that list was " \
+                      "last updated) ends up in the log verbatim.",
+            suggested_fix: "Use `:info` (Rails' own production default) or higher in production, " \
+                            "and confirm `config.filter_parameters` covers every sensitive param " \
+                            "name this app actually receives if verbose logging is genuinely needed " \
+                            "for debugging."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/weak_crypto_rule.rb

@@ -11,9 +11,21 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Weak hash algorithm used for password/credential hashing"
+      self.cwe = "CWE-327"
+      self.owasp_category = "A02:2021-Cryptographic Failures"
+      self.confidence = "medium"
 
       WEAK_DIGESTS = %w[MD5 SHA1].freeze
-      PASSWORD_HINT = /password|passwd|credential/i.freeze
+
+      # `(?!less)` after "password" excludes "passwordless" (and
+      # "passwordlessly") specifically — a real identifier that means the
+      # *opposite* of what this heuristic is looking for (e.g. a magic-link
+      # or passwordless-auth token, `Digest::SHA1.hexdigest(passwordless_token)`),
+      # not a credential. It doesn't affect any legitimate match: every other
+      # "password"-containing identifier this heuristic cares about
+      # (`password`, `user_password`, `password_reset_token`, `hashed_password`,
+      # ...) is never immediately followed by the literal substring "less".
+      PASSWORD_HINT = /password(?!less)|passwd|credential/i.freeze
 
       def scan
         findings = []
@@ -29,7 +41,7 @@ module Scryer
           # non-credential uses (cache keys, ETags, checksums) that shouldn't
           # be flagged as a crypto weakness.
           line = Ast.line_of(node)
-          context_line = Ast.source_line(source, line).to_s
+          context_line = strip_trailing_comment(Ast.source_line(source, line).to_s)
           next unless PASSWORD_HINT.match?(context_line)
 
           findings << finding(
@@ -49,6 +61,29 @@ module Scryer
 
       private
 
+      # Strips a trailing `# ...` line comment before running PASSWORD_HINT
+      # against the raw source line. Without this, a defensive comment that
+      # *disclaims* password use (`Digest::SHA1.hexdigest(file_content) #
+      # cache key, not a password hash` — a natural thing to write specifically
+      # to preempt this exact kind of static-analysis false positive) still
+      # contains the substring "password" and would trip the heuristic just
+      # as hard as a genuine mention. This does give up the (much rarer) case
+      # where a comment is the *only* signal — e.g. an unnamed argument whose
+      # only password-ish hint is a comment describing it — but real
+      # password-hashing call sites almost always also have a password-ish
+      # identifier in the actual code (`password`, `user.password`, ...),
+      # which stays visible on the line after stripping the comment.
+      #
+      # Deliberately simple rather than a full tokenizer: finds the first `#`
+      # that isn't the start of a `#{` string interpolation and treats
+      # everything from there as comment. This means a literal `#` inside a
+      # string argument on the same line (e.g. `hexdigest("score: #1")`) would
+      # be mistaken for a comment start too — an accepted limitation of a
+      # same-line text heuristic, not a full parse.
+      def strip_trailing_comment(line)
+        line.sub(/#(?!\{).*\z/, "")
+      end
+
       # Matches `Digest::MD5` / `Digest::SHA1` referenced as a constant path.
       def digest_algorithm_name(node)
         text = Ast.each_node(node)

data/lib/scryer/rules/weak_session_cookie_rule.rb

@@ -10,6 +10,9 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Session cookie missing the secure flag"
+      self.cwe = "CWE-614"
+      self.owasp_category = "A05:2021-Security Misconfiguration"
+      self.confidence = "high"
 
       def scan
         findings = []

data/lib/scryer/rules/xss_unsafe_html_rule.rb

@@ -10,6 +10,33 @@ module Scryer
       self.category = "security"
       self.default_severity = "warning"
       self.title = "Unescaped HTML output (possible XSS)"
+      self.cwe = "CWE-79"
+      self.owasp_category = "A03:2021-Injection"
+      self.confidence = "high"
+
+      # Rails helpers whose whole job is to hand back HTML that's already
+      # safe to render unescaped, so a `.html_safe` immediately wrapped
+      # around a call to one of these isn't the same risk as calling it on
+      # raw user input:
+      #   - `sanitize(x)` strips to an explicit allow-list of tags/attrs —
+      #     it's the standard sanitize-then-mark-safe idiom this rule exists
+      #     to steer people *toward*, so flagging it would contradict our
+      #     own suggested fix.
+      #   - `strip_tags(x)` removes all markup, so there's no HTML left to
+      #     inject.
+      #   - `simple_format(x)` runs the text through `sanitize` internally by
+      #     default (it only skips that when called with an explicit
+      #     `sanitize: false` option, which we don't special-case here).
+      #   - `t(...)`/`translate(...)` pulls from the app's own locale files,
+      #     not attacker-controlled request data — translators, not users,
+      #     write that content, so this is Rails' own common "trusted copy"
+      #     idiom rather than a raw-input passthrough.
+      # This says nothing about the *argument* passed to these methods being
+      # safe on its own — it's specifically the combination of "wrapped in
+      # one of these calls, then marked html_safe" that's the recognized
+      # pattern. A bare `params[:bio].html_safe` or an interpolated string
+      # marked safe still flags, since neither goes through any of these.
+      SANITIZING_METHODS = %w[sanitize strip_tags simple_format t translate].freeze
 
       def scan
         findings = []
@@ -62,9 +89,23 @@ module Scryer
       def safe_literal?(node)
         return true if node.nil?
         return true if Ast.tagged?(node, :string_literal) && !Ast.string_literal_has_interpolation?(node)
+        return true if sanitizing_call?(node)
 
         false
       end
+
+      # True if `node` is a call (parenthesized or bare) to one of
+      # SANITIZING_METHODS — see that constant's comment for why those
+      # specific methods are exempt.
+      def sanitizing_call?(node)
+        inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+        return false unless Ast.tagged?(inner, :call, :command_call, :vcall, :fcall, :command)
+
+        name_pair = Ast.call_name(inner)
+        return false unless name_pair
+
+        SANITIZING_METHODS.include?(name_pair[1])
+      end
     end
   end
 end

data/lib/scryer/scanner.rb

@@ -31,10 +31,19 @@ module Scryer
     # `skip_rules` silences specific checks by rule_id (e.g. a known false
     # positive on this codebase) without editing/removing the rule itself —
     # accepts strings or symbols, matched against Rule.rule_id.
-    def initialize(root:, dirs: DEFAULT_GLOB_DIRS, skip_rules: [])
+    #
+    # `detect_duplicates: false` skips duplicate-code detection entirely
+    # (method/query/cache-key extraction and the DuplicateDetector passes
+    # below) — unlike the security/performance/style rules, duplicate
+    # detection isn't a `Scryer::Rule` with its own rule_id, so `skip_rules`
+    # has no way to address it; this is its equivalent off switch. See
+    # `Scryer::Configuration#detect_duplicates` for the config-driven default
+    # every CLI/rake entry point reads before constructing a Scanner.
+    def initialize(root:, dirs: DEFAULT_GLOB_DIRS, skip_rules: [], detect_duplicates: true)
       @root = File.expand_path(root)
       @dirs = dirs
       @skip_rules = Set.new(skip_rules.map(&:to_s))
+      @detect_duplicates = detect_duplicates
     end
 
     def call
@@ -77,24 +86,28 @@ module Scryer
           bucket.concat(rule_class.new(file: rel_path, source: source, sexp: sexp).scan)
         end
 
-        if duplicate_detection_target?(rel_path)
+        if @detect_duplicates && duplicate_detection_target?(rel_path)
           all_methods.concat(MethodExtractor.extract(file: rel_path, source: source, sexp: sexp))
           all_queries.concat(QueryExtractor.extract(file: rel_path, source: source, sexp: sexp))
           all_cache_calls.concat(CacheExtractor.extract(file: rel_path, source: source, sexp: sexp))
         end
       end
 
-      # Same computed value cached under the same key from multiple call
-      # sites is normal (just reusing the cache). Only flag it when the
-      # *keys* differ too — that's either a redundant cache entry or a key
-      # that drifted out of sync with a copy-pasted sibling.
-      cache_groups = DuplicateDetector.call(all_cache_calls, threshold: CACHE_SIMILARITY_THRESHOLD, kind: "cache_duplicate")
-                                       .select { |g| g.members.map(&:cache_key).uniq.size > 1 }
-
       duplicate_groups =
-        DuplicateDetector.call(all_methods, kind: "method_duplicate") +
-        DuplicateDetector.call(all_queries, threshold: QUERY_SIMILARITY_THRESHOLD, kind: "query_duplicate") +
-        cache_groups
+        if @detect_duplicates
+          # Same computed value cached under the same key from multiple call
+          # sites is normal (just reusing the cache). Only flag it when the
+          # *keys* differ too — that's either a redundant cache entry or a
+          # key that drifted out of sync with a copy-pasted sibling.
+          cache_groups = DuplicateDetector.call(all_cache_calls, threshold: CACHE_SIMILARITY_THRESHOLD, kind: "cache_duplicate")
+                                           .select { |g| g.members.map(&:cache_key).uniq.size > 1 }
+
+          DuplicateDetector.call(all_methods, kind: "method_duplicate") +
+            DuplicateDetector.call(all_queries, threshold: QUERY_SIMILARITY_THRESHOLD, kind: "query_duplicate") +
+            cache_groups
+        else
+          []
+        end
 
       Result.new(
         security_findings: security_findings,

data/lib/scryer/style_rules/frozen_string_literal_rule.rb

@@ -12,6 +12,7 @@ module Scryer
       self.category = "style"
       self.default_severity = "info"
       self.title = "Missing `frozen_string_literal` magic comment"
+      self.confidence = "high"
 
       MAGIC_COMMENT = /\A#\s*frozen_string_literal:\s*(true|false)\s*\z/i.freeze
 

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "1.0.0"
+  VERSION = "1.2.0"
 end

data/lib/scryer.rb

@@ -1,4 +1,5 @@
 require "scryer/version"
+require "scryer/colorizer"
 require "scryer/ast"
 require "scryer/finding"
 require "scryer/rule_set"
@@ -10,8 +11,13 @@ require "scryer/duplicate_detector"
 require "scryer/scanner"
 require "scryer/report_renderer"
 require "scryer/dependency_audit"
+require "scryer/baseline"
 require "scryer/ai_client"
+require "scryer/fix_verifier"
+require "scryer/mechanical_fixer"
 require "scryer/ai_fix_suggester"
+require "scryer/fix_runner"
+require "scryer/dependency_fixer"
 
 Dir[File.join(__dir__, "scryer", "rules", "*.rb")].sort.each { |f| require f }
 Dir[File.join(__dir__, "scryer", "performance_rules", "*.rb")].sort.each { |f| require f }
@@ -37,11 +43,21 @@ module Scryer
     # default: every registered rule runs. The `scryer` executable's
     # `--skip RULE_ID` flag adds to this list for a single run rather than
     # replacing it.
-    attr_accessor :project_name, :dirs, :branch, :ai_client, :skip_rules
+    #
+    # `detect_duplicates` toggles duplicate-code detection (method/query/
+    # cache-key similarity across models, controllers, helpers, and
+    # concerns — see Scryer::DuplicateDetector) on or off. `true` by
+    # default, matching this gem's existing behavior. Duplicate detection
+    # isn't a `Scryer::Rule`, so it has no `rule_id` and `skip_rules` can't
+    # address it — set this to `false` instead (or pass `--no-duplicates` /
+    # `SCRYER_NO_DUPLICATES=1` for a single run without changing the
+    # configured default) if it's too noisy or too slow for a given project.
+    attr_accessor :project_name, :dirs, :branch, :ai_client, :skip_rules, :detect_duplicates
 
     def initialize
       @dirs = Scryer::Scanner::DEFAULT_GLOB_DIRS
       @skip_rules = []
+      @detect_duplicates = true
     end
   end
 
@@ -53,6 +69,19 @@ module Scryer
     def configuration
       @configuration ||= Configuration.new
     end
+
+    # Runs the static scan with the current configuration (or explicit
+    # overrides) applied, without needing to know Scanner's own constructor
+    # shape. Exists mainly so the RSpec/Minitest test helpers (see
+    # lib/scryer/rspec.rb / lib/scryer/minitest.rb) — and any other future
+    # caller that just wants "the result of a normal scan" — don't each
+    # duplicate `Scanner.new(root:, dirs:, skip_rules:).call`. The CLI/rake
+    # task aren't changed to use this (they also handle dependency auditing,
+    # baselines, and report writing inline) — this is for callers that only
+    # need the static-scan Result itself.
+    def scan(root:, dirs: configuration.dirs, skip_rules: configuration.skip_rules, detect_duplicates: configuration.detect_duplicates)
+      Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: skip_rules, detect_duplicates: detect_duplicates).call
+    end
   end
 end