scryer 1.2.1 → 1.2.2

data/lib/scryer/performance_rules/unbounded_table_scan_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module PerformanceRules
     # Flags `Model.all.each`/`Model.where(...).each` (or `.order(...).each`) —
@@ -9,6 +10,11 @@ module Scryer
     # assigned from the query and iterated later (that pattern is out of scope
     # here; see `NPlusOneQueryRule`, which does track simple local
     # assignments, for a related check on what happens *inside* such a loop).
+    # The receiver constant is checked against known_models/known_non_models
+    # (see Ast.likely_model_name?) rather than accepted unconditionally — a
+    # bare Ruby module/class with no AR ancestry (e.g. this gem's own
+    # `RuleSet.all.each`) can coincidentally match the same `Const.all.each`
+    # shape without being a query at all.
     class UnboundedTableScanRule < Rule
       self.rule_id = "unbounded_table_scan"
       self.category = "performance"
@@ -61,7 +67,9 @@ module Scryer
         return false unless Ast.tagged?(root, :var_ref, :vcall)
 
         const = root[1]
-        const.is_a?(Array) && const[0] == :@const
+        return false unless const.is_a?(Array) && const[0] == :@const
+
+        Ast.likely_model_name?(const[1], known_models: known_models, known_non_models: known_non_models)
       end
 
       def root_of(node)

data/lib/scryer/query_extractor.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "ripper"
 
 module Scryer

data/lib/scryer/query_watcher.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "set"
 
 module Scryer

data/lib/scryer/railtie.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   # This gem runs on-demand via a rake task, not as request-cycle
   # instrumentation — so the Railtie doesn't need to hook into the

data/lib/scryer/report_renderer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "json"
 require "time"
 
@@ -56,6 +57,9 @@ module Scryer
         "duplicate_groups" => @result.duplicate_groups.map { |g| duplicate_group_hash(g) },
         "dependency_findings" => @dependency_findings.map(&:to_h),
         "security_score" => security_score,
+        "performance_score" => performance_score,
+        "style_score" => style_score,
+        "dependency_score" => dependency_score,
         "rules_clean_rate" => rules_clean_rate
       }
     end
@@ -105,71 +109,84 @@ module Scryer
       counts.sort_by { |category, count| [-count, category] }
     end
 
-    # A single 0-100 number (plus a letter grade) summarizing this scan's
-    # security risk exposure — security findings and dependency findings at
-    # full weight, plus performance findings at a small fraction of that
-    # weight (a slow app is a real cost, just not a *security* one, so it
-    # nudges the score rather than driving it — see SCORE_CATEGORY_WEIGHT).
-    # Code-quality findings (duplicate-code groups, frozen_string_literal)
-    # are never part of this on purpose: a `DuplicateDetector::DuplicateGroup`
-    # isn't even a `Finding` (no severity/confidence to weigh in the first
-    # place — see duplicate_detector.rb), and style findings are cosmetic,
-    # not risk. Deliberately NOT normalized by files-scanned or lines of
-    # code: it reflects this scan's absolute finding exposure, so it's
-    # meaningful for tracking one project's trend over time (does the next
-    # scan score higher or lower), not for comparing two differently-sized
-    # codebases against each other — a bigger app with the same finding
-    # *density* will naturally score lower here, and that's a documented
-    # limitation, not a bug.
+    # Four independent 0-100 scores (each with its own letter grade) — one
+    # per category (security/performance/style/dependency) — rather than
+    # one blended number. A single combined score used to fold performance
+    # findings in at a diluted weight and drop style findings entirely,
+    # which meant a bad performance problem or a wall of style noise could
+    # never really move "the" score, and there was no way to see "how bad
+    # is *just* the security picture" without mentally subtracting the
+    # other categories back out. Each of the four methods below runs the
+    # exact same severity+confidence-weighted formula (see
+    # #category_score) against only that one category's own findings —
+    # nothing here dilutes or borrows weight from another category anymore.
+    #
+    # Deliberately NOT normalized by files-scanned or lines of code: each
+    # score reflects that category's absolute finding exposure in this
+    # scan, so it's meaningful for tracking one project's own trend over
+    # time (does the next scan score higher or lower), not for comparing
+    # two differently-sized codebases against each other — a bigger app
+    # with the same finding *density* will naturally score lower here, and
+    # that's a documented limitation, not a bug.
     #
     # Exponential decay rather than linear subtraction from 100: a single
-    # critical/high finding should visibly move the score (100 -> ~86) without
-    # a handful of findings driving a real app straight to a hard-clamped 0,
-    # which would make the score useless for comparing "bad" against "worse."
-    # weighted_penalty combines severity (the dominant factor) with
-    # confidence (a low-confidence rule's finding shouldn't hurt the score as
-    # much as a high-confidence one saying the same severity) and category —
-    # same philosophy as SARIF's `rank` (see sarif_rank above), computed once
-    # here for a single scan-level number instead of per-result.
+    # critical/high finding should visibly move a score (100 -> ~86)
+    # without a handful of findings driving a real app straight to a
+    # hard-clamped 0, which would make the score useless for comparing
+    # "bad" against "worse." weighted_penalty combines severity (the
+    # dominant factor) with confidence (a low-confidence rule's finding
+    # shouldn't hurt the score as much as a high-confidence one saying the
+    # same severity) — same philosophy as SARIF's `rank` (see sarif_rank
+    # above), computed once per category instead of per-result.
     # "info" is deliberately far below critical/warning, not just a step
     # down from them — an info-severity finding is closer to a cosmetic
     # note than a real risk (see e.g. csrf_protection_disabled's
-    # narrowly-scoped-skip case), so a codebase with only info findings
+    # narrowly-scoped-skip case), so a category with only info findings
     # should barely move off 100 even with a fair number of them, rather
     # than accumulating like a smaller warning would.
     SCORE_SEVERITY_WEIGHT = { "critical" => 15, "warning" => 6, "info" => 0.25 }.freeze
     SCORE_CONFIDENCE_WEIGHT = { "high" => 1.0, "medium" => 0.7, "low" => 0.4 }.freeze
-    # `category` is "security" for every Scryer::Finding in security_findings
-    # and every DependencyAudit::Finding (which has no `category` field at
-    # all — `f["category"]` is nil for those, so they fall through to the
-    # 1.0 default below, same full weight as security). "performance" is the
-    # only other category ever passed into this method's `findings` — style
-    # findings and duplicate-code groups never reach here at all (see above).
-    SCORE_CATEGORY_WEIGHT = { "security" => 1.0, "performance" => 0.2 }.freeze
     SCORE_DECAY_CONSTANT = 100.0
 
-    # Deliberately reads @result/@dependency_findings directly rather than
-    # going through as_hash — as_hash includes this method's own output (so
-    # JSON consumers get the score without a separate call), and as_hash
-    # calling security_score while security_score called as_hash would
-    # recurse forever.
     def security_score
+      category_score(@result.security_findings)
+    end
+
+    def performance_score
+      category_score(@result.performance_findings)
+    end
+
+    # Duplicate-code groups are deliberately excluded from this (and so
+    # from every score) — a `DuplicateDetector::DuplicateGroup` isn't even
+    # a `Finding` (no severity/confidence to weigh in the first place; see
+    # duplicate_detector.rb) — so this is really just `frozen_string_literal`
+    # today, the one style check this gem has.
+    def style_score
+      category_score(@result.style_findings)
+    end
+
+    def dependency_score
+      category_score(@dependency_findings)
+    end
+
+    # Shared by all four *_score methods above. Deliberately takes the raw
+    # findings array rather than going through as_hash — as_hash includes
+    # every score's own output (so JSON consumers get all four without a
+    # separate call), and as_hash calling a *_score method while that
+    # method called as_hash would recurse forever.
+    def category_score(findings)
       # .to_h (not the full as_hash) so this works uniformly across Finding
       # (has "confidence") and DependencyAudit::Finding (doesn't — a plain
       # Hash returns nil for a missing key rather than raising, unlike
       # calling #confidence directly on a struct that has no such member).
-      # style_findings/duplicate_groups are never included — see this
-      # method's doc comment above for why.
-      findings = (@result.security_findings + @result.performance_findings + @dependency_findings).map(&:to_h)
-
-      weighted_penalty = findings.sum do |f|
-        (SCORE_SEVERITY_WEIGHT[f["severity"]] || 3) *
-          (SCORE_CONFIDENCE_WEIGHT[f["confidence"]] || 0.7) *
-          (SCORE_CATEGORY_WEIGHT[f["category"]] || 1.0)
+      hashes = findings.map(&:to_h)
+
+      weighted_penalty = hashes.sum do |f|
+        (SCORE_SEVERITY_WEIGHT[f["severity"]] || 3) * (SCORE_CONFIDENCE_WEIGHT[f["confidence"]] || 0.7)
       end
 
       score = (100 * Math.exp(-weighted_penalty / SCORE_DECAY_CONSTANT)).round
-      { "score" => score, "grade" => score_grade(score), "finding_count" => findings.size }
+      { "score" => score, "grade" => score_grade(score), "finding_count" => hashes.size }
     end
 
     SCORE_GRADE_BANDS = [[90, "A"], [80, "B"], [70, "C"], [60, "D"]].freeze
@@ -183,10 +200,12 @@ module Scryer
     # (security + performance + style; NOT the dependency checks, which
     # aren't backed by a Rule subclass at all — see DEPENDENCY_SARIF_RULES)
     # fired zero findings in this scan, out of every rule that exists to
-    # fire. A rule-level pass rate, distinct from security_score (which is
-    # finding-weighted, not rule-counted) — a codebase can have a high clean
-    # rate (few distinct rules triggered) and still a low score (the few
-    # that did trigger were severe/high-confidence), or the reverse (many
+    # fire. A single rule-level pass rate spanning all three rule-backed
+    # categories together, distinct from the four *_score methods above
+    # (each of which is finding-weighted, not rule-counted, and scoped to
+    # one category) — a codebase can have a high clean rate (few distinct
+    # rules triggered) and still a low score in one category (the few that
+    # did trigger there were severe/high-confidence), or the reverse (many
     # different rules each firing once, none of them serious). Report both;
     # neither alone tells the whole story.
     def rules_clean_rate
@@ -251,14 +270,18 @@ module Scryer
           <style>#{CSS}</style>
         </head>
         <body>
-          <h1>Scryer report</h1>
-          <p class="meta">
-            #{escape(@project_name)} &middot; #{escape(h["release_label"] || "no release label")} &middot;
-            #{escape(h["scanned_at"])} &middot; #{h["files_scanned"]} files scanned
-            #{h["parse_errors"].any? ? "&middot; <span class=\"crit\">#{h["parse_errors"].size} parse error(s)</span>" : ""}
-          </p>
-
-          #{render_executive_summary(h, h["security_score"], h["rules_clean_rate"])}
+          <header class="hero">
+            <h1>Scryer report</h1>
+            <p class="meta">
+              <span class="meta-item meta-project">#{escape(@project_name)}</span>
+              <span class="meta-item">#{escape(h["release_label"] || "no release label")}</span>
+              <span class="meta-item">#{escape(h["scanned_at"])}</span>
+              <span class="meta-item">#{h["files_scanned"]} files scanned</span>
+              #{h["parse_errors"].any? ? "<span class=\"meta-item crit\">#{h["parse_errors"].size} parse error(s)</span>" : ""}
+            </p>
+          </header>
+
+          #{render_executive_summary(h, h["rules_clean_rate"])}
 
           #{render_toc(h)}
 
@@ -347,14 +370,13 @@ module Scryer
       HTML
     end
 
-    # The score badge + severity bar chart at the very top of the report —
-    # an "is this bad or fine" answer in the first thing a reader sees,
-    # ahead of even the table of contents. Scoped to security + dependency
-    # findings only, same as ReportRenderer#security_score itself
-    # (performance/code-quality findings aren't part of the security score,
-    # so they're not part of this chart either — the Summary table further
-    # down still shows those breakdowns).
-    def render_executive_summary(h, score, clean_rate)
+    # The four score badges + severity bar chart at the very top of the
+    # report — an "is this bad or fine" answer in the first thing a reader
+    # sees, ahead of even the table of contents. The bar chart itself stays
+    # scoped to security + dependency findings (the two categories a
+    # "should I be worried" skim cares about most) — the Summary table
+    # further down shows the performance/style breakdown too.
+    def render_executive_summary(h, clean_rate)
       sec_and_deps = h["security_findings"] + h["dependency_findings"]
       by_severity = Hash.new(0)
       sec_and_deps.each { |f| by_severity[f["severity"]] += 1 }
@@ -382,20 +404,41 @@ module Scryer
         BAR
       end.join
 
+      score_badges = [
+        ["Security", h["security_score"]],
+        ["Performance", h["performance_score"]],
+        ["Style", h["style_score"]],
+        ["Dependency", h["dependency_score"]]
+      ].map do |label, score|
+        <<~BADGE
+          <div class="score-badge-item">
+            <div class="score-badge grade-#{score["grade"]}">
+              <span class="score-number">#{score["score"]}</span>
+              <span class="score-grade">#{score["grade"]}</span>
+            </div>
+            <span class="score-category">#{label}</span>
+          </div>
+        BADGE
+      end.join
+
       <<~HTML
         <div class="score-panel">
-          <div class="score-badge grade-#{score["grade"]}">
-            <span class="score-number">#{score["score"]}</span>
-            <span class="score-grade">#{score["grade"]}</span>
+          <div class="score-badges">
+            #{score_badges}
           </div>
+          <div class="score-panel-divider"></div>
           <div class="score-details">
-            <p class="score-label">Security Score — #{score["finding_count"]} security + dependency
-              + performance finding(s) (performance weighted far lighter than security), weighted
-              by severity and this rule's confidence. Not normalized by app
-              size — see the README for what this number does and doesn't mean.
+            <p class="score-label">Four independent scores, one per category — Security
+              (#{h["security_score"]["finding_count"]} finding(s)), Performance
+              (#{h["performance_score"]["finding_count"]}), Style
+              (#{h["style_score"]["finding_count"]}), and Dependency audit
+              (#{h["dependency_score"]["finding_count"]}) — each weighted by severity and
+              confidence within its own category only, so a bad performance problem or a wall of
+              style findings can't hide inside (or get diluted by) a security number. Not
+              normalized by app size — see the README for what these numbers do and don't mean.
               <strong>#{clean_rate["clean"]}/#{clean_rate["total"]}</strong> rules clean
               (#{clean_rate["percent"]}%) — a rule-level pass rate, a different (and not always
-              matching) signal from the finding-weighted score.</p>
+              matching) signal from the finding-weighted scores.</p>
             #{bars}
           </div>
         </div>
@@ -1008,35 +1051,54 @@ module Scryer
     end
 
     CSS = <<~CSS
-      body { font-family: -apple-system, Helvetica, Arial, sans-serif; margin: 2rem; color: #1e293b; }
-      h1 { margin-bottom: 0.25rem; }
-      h2 { margin-top: 2rem; border-bottom: 1px solid #e2e8f0; padding-bottom: 0.35rem; }
-      .meta { color: #64748b; font-size: 0.875rem; margin-top: 0; }
-      .crit { color: #b91c1c; font-weight: 600; }
-      .score-panel { display: flex; gap: 1.5rem; align-items: center; background: #f8fafc;
-        border: 1px solid #e2e8f0; border-radius: 12px; padding: 1.25rem 1.5rem; margin: 1rem 0 1.25rem; }
-      .score-badge { flex: 0 0 auto; width: 5.5rem; height: 5.5rem; border-radius: 50%;
+      :root {
+        --ink: #0f172a; --muted: #64748b; --border: #e2e8f0; --surface: #ffffff; --canvas: #f6f8fb;
+      }
+      body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+        margin: 0; padding: 2.5rem clamp(1.25rem, 4vw, 3rem) 3rem; color: var(--ink); background: var(--canvas); }
+      h1 { margin: 0 0 0.4rem; font-size: 1.9rem; font-weight: 800; letter-spacing: -0.02em; }
+      h2 { margin-top: 2.75rem; font-size: 1.05rem; font-weight: 700; border-bottom: 1px solid var(--border);
+        padding-bottom: 0.5rem; }
+      .hero { margin-bottom: 1.5rem; }
+      .meta { color: var(--muted); font-size: 0.85rem; margin: 0; display: flex; flex-wrap: wrap;
+        gap: 0.35rem 0; }
+      .meta-item + .meta-item::before { content: "\\00b7"; margin: 0 0.55rem; color: #cbd5e1; }
+      .crit { color: #b91c1c; font-weight: 700; }
+      .score-panel { display: flex; gap: 2rem; align-items: center; flex-wrap: wrap; background: var(--surface);
+        border: 1px solid var(--border); border-radius: 16px; padding: 1.75rem 2rem; margin: 1.25rem 0 1.75rem;
+        box-shadow: 0 1px 2px rgba(15, 23, 42, 0.04), 0 12px 28px -16px rgba(15, 23, 42, 0.12); }
+      .score-badges { display: flex; gap: 1.5rem; flex-wrap: wrap; }
+      .score-panel-divider { align-self: stretch; width: 1px; background: var(--border); }
+      .score-badge-item { display: flex; flex-direction: column; align-items: center; gap: 0.55rem; }
+      .score-category { font-size: 0.68rem; font-weight: 700; color: var(--muted); text-transform: uppercase;
+        letter-spacing: 0.06em; }
+      .score-badge { flex: 0 0 auto; width: 5rem; height: 5rem; border-radius: 20px;
         display: flex; flex-direction: column; align-items: center; justify-content: center;
-        color: #fff; }
-      .score-badge .score-number { font-size: 1.5rem; font-weight: 700; line-height: 1; }
-      .score-badge .score-grade { font-size: 0.9rem; font-weight: 600; opacity: 0.9; }
-      .score-badge.grade-A { background: #16a34a; }
-      .score-badge.grade-B { background: #0891b2; }
-      .score-badge.grade-C { background: #d97706; }
-      .score-badge.grade-D { background: #ea580c; }
-      .score-badge.grade-F { background: #dc2626; }
-      .score-details { flex: 1 1 auto; min-width: 0; }
-      .score-label { margin: 0 0 0.6rem; font-size: 0.82rem; color: #475569; }
-      .score-bar-row { display: flex; align-items: center; gap: 0.6rem; font-size: 0.8rem; margin: 0.25rem 0; }
-      .score-bar-label { flex: 0 0 4.5rem; color: #475569; }
-      .score-bar-track { flex: 1 1 auto; background: #e2e8f0; border-radius: 999px; height: 0.6rem; overflow: hidden; }
+        color: #fff; box-shadow: 0 6px 14px -6px rgba(15, 23, 42, 0.35); }
+      .score-badge .score-number { font-size: 1.45rem; font-weight: 800; line-height: 1; }
+      .score-badge .score-grade { font-size: 0.7rem; font-weight: 700; opacity: 0.9; margin-top: 0.15rem; }
+      .score-badge.grade-A { background: linear-gradient(155deg, #4ade80, #15803d); }
+      .score-badge.grade-B { background: linear-gradient(155deg, #22d3ee, #0e7490); }
+      .score-badge.grade-C { background: linear-gradient(155deg, #fbbf24, #b45309); }
+      .score-badge.grade-D { background: linear-gradient(155deg, #fb923c, #c2410c); }
+      .score-badge.grade-F { background: linear-gradient(155deg, #f87171, #b91c1c); }
+      .score-details { flex: 1 1 18rem; min-width: 0; }
+      .score-label { margin: 0 0 0.85rem; font-size: 0.82rem; color: var(--muted); line-height: 1.5; }
+      .score-bar-row { display: grid; grid-template-columns: 5rem 1fr 2.25rem; align-items: center; gap: 0.75rem;
+        font-size: 0.8rem; margin: 0.4rem 0; }
+      .score-bar-label { color: var(--muted); font-weight: 600; }
+      .score-bar-track { background: #eef1f6; border-radius: 999px; height: 0.55rem; overflow: hidden; }
       .score-bar-fill { height: 100%; border-radius: 999px; }
-      .score-bar-fill.critical { background: #dc2626; }
-      .score-bar-fill.warning { background: #d97706; }
-      .score-bar-fill.info { background: #64748b; }
-      .score-bar-count { flex: 0 0 1.75rem; text-align: right; color: #1e293b; font-weight: 600;
+      .score-bar-fill.critical { background: linear-gradient(90deg, #f87171, #dc2626); }
+      .score-bar-fill.warning { background: linear-gradient(90deg, #fbbf24, #d97706); }
+      .score-bar-fill.info { background: #94a3b8; }
+      .score-bar-count { text-align: right; color: var(--ink); font-weight: 700;
         text-decoration: none; }
       .score-bar-count:hover { text-decoration: underline; }
+      @media (max-width: 640px) {
+        .score-panel { flex-direction: column; align-items: stretch; }
+        .score-panel-divider { display: none; }
+      }
       .findings-search { display: block; width: 100%; max-width: 28rem; margin: 0.75rem 0 1.25rem;
         padding: 0.5rem 0.75rem; font: inherit; font-size: 0.85rem; border: 1px solid #cbd5e1;
         border-radius: 8px; box-sizing: border-box; }

data/lib/scryer/rspec.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Opt-in RSpec integration — require this file yourself (e.g. `require
 # "scryer/rspec"` in spec_helper.rb) rather than it loading automatically
 # with the gem, since RSpec itself is never a Scryer runtime dependency (see

data/lib/scryer/rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   # Base class for a single detection rule. Subclasses implement `#scan` and
   # return an Array of Finding. Every rule gets the parsed sexp tree (so it
@@ -30,13 +31,25 @@ module Scryer
       end
     end
 
-    def initialize(file:, source:, sexp:)
+    # `known_models`/`known_non_models` — Sets of unqualified, last-segment
+    # class names Scanner#call resolved once per scan by walking every
+    # `class X < Y` declaration across every scanned file (see its own
+    # comment, and Ast.likely_model_name?, for what these mean and why they
+    # exist) — a real, project-wide signal for "is this class actually an
+    # ActiveRecord model," instead of the pure name-guessing
+    # MassAssignmentRule/IdorRule/MissingPolicyScopeRule used to each do
+    # independently. Optional and empty by default: only those three rules
+    # read them; every other rule (and every existing direct `Rule.new` call
+    # outside Scanner, e.g. in tests) is unaffected.
+    def initialize(file:, source:, sexp:, known_models: Ast::EMPTY_SET, known_non_models: Ast::EMPTY_SET)
       @file = file
       @source = source
       @sexp = sexp
+      @known_models = known_models
+      @known_non_models = known_non_models
     end
 
-    attr_reader :file, :source, :sexp
+    attr_reader :file, :source, :sexp, :known_models, :known_non_models
 
     def scan
       raise NotImplementedError, "#{self.class} must implement #scan"

data/lib/scryer/rule_set.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   # Registry of every Rule subclass (rules self-register via Rule.inherited).
   # Scanner uses .all to run every registered rule against each parsed file.

data/lib/scryer/rules/action_cable_forgery_protection_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.action_cable.disable_request_forgery_protection = true`

data/lib/scryer/rules/active_storage_inline_disposition_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags an explicit `disposition: "inline"`/`:inline` on a blob/variant

data/lib/scryer/rules/active_storage_missing_content_type_validation_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `has_one_attached`/`has_many_attached :name` with no

data/lib/scryer/rules/authentication_bypass_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags a controller class that calls `skip_before_action`/

data/lib/scryer/rules/command_injection_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags shell-executing calls (`system`, `` ` ` `` backticks, `%x{}`,

data/lib/scryer/rules/consider_all_requests_local_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.consider_all_requests_local = true` specifically in

data/lib/scryer/rules/cors_misconfiguration_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags the well-known Rack::Cors antipattern: a wildcard origin

data/lib/scryer/rules/csrf_protection_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags a controller class named *Controller that calls

data/lib/scryer/rules/dangerous_eval_rule.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+module Scryer
+  module Rules
+    # Flags `eval`/`instance_eval`/`class_eval`/`module_eval` called with
+    # anything other than a plain string literal with no interpolation —
+    # the standard "Dangerous Eval" pattern every mainstream Rails security
+    # scanner (Brakeman included) checks for.
+    #
+    # Deliberately broader than this gem's other injection rules
+    # (sql_injection/mass_assignment/ssrf/path_traversal all only fire when
+    # the argument specifically traces back to `params` — see
+    # Ast.references_params?): eval-family methods execute their argument
+    # as arbitrary Ruby code, and there's essentially no legitimate reason
+    # for that string to be anything other than a literal the developer
+    # wrote themselves. A local variable, an instance variable, a method
+    # call, or an interpolated string are all flagged here regardless of
+    # where the value actually came from, since tracing where a local
+    # variable's value originated is real data-flow analysis this gem's
+    # per-expression heuristics don't attempt (see the README's honest
+    # comparison to Brakeman).
+    #
+    # `severity` is always "critical" — regardless of confidence, the
+    # blast radius if this argument is ever attacker-influenced is the
+    # same (arbitrary code execution in this process), and `eval` is never
+    # the *correct* way to do dynamic dispatch even when today's value
+    # happens to be safe (`const_get`/`safe_constantize` do the same job
+    # with zero code-execution risk). `confidence`, though, genuinely
+    # varies — this is exactly the axis Brakeman's own "Dangerous Eval"
+    # check varies confidence on too (High when its taint engine traces the
+    # argument to request data, Weak otherwise), and a real false-positive
+    # comparison against a real app surfaced why: the single most common
+    # shape here by far is `eval(controller_path.classify)` — a Rails-
+    # internal string identifying the *current controller class*, not
+    # request data at all, used as a (badly chosen) dynamic-dispatch idiom.
+    # That's still worth flagging at "critical" — it's needless RCE risk
+    # for something `const_get` does safely — but it is not the same
+    # confidence-of-actual-exploitability as `eval(params[:code])`. Since
+    # this gem has no real taint tracking, `Ast.references_params?`
+    # appearing anywhere in the argument is the strongest signal available
+    # for "this is confidently, not just plausibly, attacker-reachable" —
+    # confidence is "high" when it's present, and the class default
+    # ("medium" — real risk, but not confidently proven external input)
+    # otherwise.
+    #
+    # A block-only call (`obj.instance_eval { ... }`, no string argument at
+    # all) is never flagged — that's just running a block of code the
+    # developer wrote inline, nothing dynamic about it, and it doesn't even
+    # reach this rule's node-matching (see class comment on the shared
+    # `:method_add_arg, :command, :command_call` matching this gem's other
+    # call-shaped rules use — a block wraps the call in `:method_add_block`
+    # instead, a different tag entirely).
+    class DangerousEvalRule < Rule
+      self.rule_id = "dangerous_eval"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Dynamic code evaluation (eval) with non-literal input"
+      self.cwe = "CWE-95"
+      self.owasp_category = "A03:2021-Injection"
+      self.confidence = "medium"
+
+      EVAL_METHODS = %w[eval instance_eval class_eval module_eval].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless EVAL_METHODS.include?(method_name)
+
+          args = Ast.call_arguments(node)
+          next if args.empty? # block-only call — nothing dynamic being evaluated
+
+          arg = args.first
+          next if safe_literal?(arg)
+
+          params_tainted = Ast.references_params?(arg)
+          message =
+            if params_tainted
+              "`#{method_name}` executes its argument as Ruby code, and that argument directly " \
+              "references `params` — request data reaches this eval, which means arbitrary code " \
+              "execution for anyone who can influence that value."
+            else
+              "`#{method_name}` executes its argument as Ruby code, and this one isn't a plain " \
+              "hardcoded string — no `params` reference is directly visible here, but there's " \
+              "still no safe way to be sure the value can never come from outside this process, " \
+              "and `eval` risks arbitrary code execution the moment it does."
+            end
+
+          line = Ast.line_of(arg) || Ast.line_of(node)
+          findings << finding(
+            line: line,
+            confidence: params_tainted ? "high" : self.class.confidence,
+            message: message,
+            suggested_fix: "Avoid `#{method_name}` with dynamic input entirely — there's almost " \
+                            "always a safer, narrower way to express what it's doing (e.g. " \
+                            "`public_send`/`const_get`/`safe_constantize` for dynamic dispatch, a " \
+                            "case/lookup table instead of building code as a string)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def safe_literal?(node)
+        Ast.tagged?(node, :string_literal) && !Ast.string_literal_has_interpolation?(node)
+      end
+    end
+  end
+end

data/lib/scryer/rules/force_ssl_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.force_ssl = false` — an explicit opt-out of Rails'

data/lib/scryer/rules/graphql_missing_query_limits_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags a `class X < GraphQL::Schema` (or a class whose superclass

data/lib/scryer/rules/hardcoded_basic_auth_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `http_basic_authenticate_with` calls whose `password:` (or

data/lib/scryer/rules/hardcoded_secret_key_base_rule.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   module Rules
     # Flags `config.secret_key_base = "literal"` (or