serum-rails 0.1.0

checksums.yaml

@@ -0,0 +1,15 @@
+---
+!binary "U0hBMQ==":
+  metadata.gz: !binary |-
+    MjQxNGE4Y2QyM2M2M2NmZDJhZDYzOGZiZTcxYTFhYWI3MGIzNDgxMw==
+  data.tar.gz: !binary |-
+    OTdiOGRkMjUyMzE3YzU5NTU4MjczYjIwYjM0ZTk0OGE3OTQyYmU2Zg==
+!binary "U0hBNTEy":
+  metadata.gz: !binary |-
+    N2YzMGQ3MGNhOWQ4ZDhiOTA5OTJiNDRmMDgzZTgxMjNmOWYwNGU4YWYzOGZl
+    OGQ1NWVlMDUyMTI2MmVkODRkYjVlODAyMzNkYWRiZjFhYjA1Yjc4OWE3YTQy
+    YTVkZWU3YWVjYWRjNGU1MjFkM2VmNWU3YjMwNzdmMGM0NTQzMTA=
+  data.tar.gz: !binary |-
+    YWM0YjllYjAyMzljYTY0MjRmNDJjNjBlNDJlOWQ0OWNhYzUzYmVkNzhiYjI1
+    MDdkNzFiNGU5NTJlMzgwMWRiZmM3MjZiMmNjYTA3MzU3YjcyMjgwNzcyNzY4
+    OTFjZWMwMDRjMzdiNDhmMDViZDBiZDJlYjc2MDE2ZGNhMWRhY2Q=

data/.gitignore

@@ -0,0 +1,6 @@
+doc
+pkg
+tags
+*.gem
+.idea
+tmp

data/.rspec

@@ -0,0 +1,3 @@
+--color
+--warnings
+--require spec_helper

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gemspec

data/Gemfile.lock

@@ -0,0 +1,42 @@
+PATH
+  remote: .
+  specs:
+    serum-rails (0.1.0)
+      activesupport (>= 3.2)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (4.0.5)
+      i18n (~> 0.6, >= 0.6.9)
+      minitest (~> 4.2)
+      multi_json (~> 1.3)
+      thread_safe (~> 0.1)
+      tzinfo (~> 0.3.37)
+    diff-lcs (1.2.5)
+    i18n (0.6.9)
+    minitest (4.7.5)
+    multi_json (1.10.0)
+    rake (10.3.1)
+    rspec (3.0.0)
+      rspec-core (~> 3.0.0)
+      rspec-expectations (~> 3.0.0)
+      rspec-mocks (~> 3.0.0)
+    rspec-core (3.0.4)
+      rspec-support (~> 3.0.0)
+    rspec-expectations (3.0.4)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.0.0)
+    rspec-mocks (3.0.4)
+      rspec-support (~> 3.0.0)
+    rspec-support (3.0.4)
+    thread_safe (0.3.3)
+    tzinfo (0.3.39)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  rake
+  rspec (>= 3)
+  serum-rails!

data/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2014 makandra GmbH
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,40 @@
+serum-rails
+===========
+
+Code scanner to prepare security audits
+---------------------------------------
+
+When you inquire about the cost of a security audit at [makandra](http://www.makandra.com)
+we will ask you to provide some metrics about your application, like the number of controller actions
+and many others.
+
+This gem provides a `serum-rails` command you can use to scan your project and
+provide these metrics automatically. By sending us the output of the `serum-rails` command
+we can give you an recommendation for the time you should invest for a security audit.
+
+Since all you send us are a few numbers, we don't need to look at your code for a first
+estimate. This saves us signing an NDA and giving us access to your repository before
+we even work together.
+
+
+### Installation
+
+You can install `serum-rails` as a Ruby gem:
+
+```
+gem install serum-rails
+```
+
+Once you have installed the gem you should have a `serum-rails` command in your path.
+
+### Usage
+
+Start serum-rails like this:
+
+```
+serum-rails PATH_TO_YOUR_RAILS_APPLICATION
+```
+
+`serum-rails` will scan the code of your application and output some code metric to the console.
+
+Please e-mail the output to your security audit contact at makandra to continue the process.

data/bin/serum-rails

@@ -0,0 +1,13 @@
+#!/usr/bin/env ruby
+
+require 'serum-rails'
+
+root = ARGV[0].presence || '.'
+
+metrics = Serum::Rails::Metrics.new(root)
+
+puts "time = #{Time.now.utc.to_s(:db)}"
+
+metrics.to_hash.each do |metric, value|
+  puts "#{metric} = #{value}"
+end

data/lib/serum/rails/app.rb

@@ -0,0 +1,50 @@
+module Serum
+  module Rails
+    class App
+
+      attr_reader :root
+
+      def initialize(root)
+        @root = File.expand_path(root)
+        ensure_root_exists
+        ensure_is_rails_app
+      end
+
+      #def gems
+      #  cd
+      #  bundle list | wc -l
+      #end
+
+      def lines_of_code
+        count_lines # matches anything in all folders
+      end
+
+      delegate :count_lines, :to => :code_scanner
+
+      private
+
+      def ensure_root_exists
+        File.directory?(@root) or raise "Not a directory: #{@root}"
+      end
+
+      def ensure_is_rails_app
+        expected_folders = %w[
+          app/models
+          app/controllers
+          app/views
+          config
+          db
+        ]
+        expected_folders.each do |expected_folder|
+          path = File.join(@root, expected_folder)
+          File.directory?(path) or raise "Not a Rails application: #{@root} (expected folder #{expected_folder}"
+        end
+      end
+
+      def code_scanner
+        @code_scanner ||= CodeScanner.new(@root)
+      end
+
+    end
+  end
+end

data/lib/serum/rails/code_scanner.rb

@@ -0,0 +1,49 @@
+module Serum
+  module Rails
+    class CodeScanner
+
+      DEFAULT_FOLDERS = %w[app lib config public].freeze
+      ANYTHING = /.*/.freeze
+      DEBUG = false
+
+      def initialize(root)
+        @root = root
+      end
+
+      def count_lines(options = {})
+        pattern = options.fetch(:pattern, ANYTHING)
+        folders = Array.wrap(options.fetch(:folders, DEFAULT_FOLDERS))
+        type_selection = TypeSelection.new(options[:types])
+        paths(folders, type_selection).sort.sum do |path|
+          count_occurrences(path, pattern)
+        end
+      end
+
+      private
+
+      def paths(folders, type_selection)
+        patterns = []
+        folders.each do |folder|
+          type_selection.extensions.each do |extension|
+            patterns << "#{@root}/#{folder}/**/*.#{extension}"
+          end
+        end
+        # puts "Calling patterns: #{patterns}"
+        Dir[*patterns]
+      end
+
+      def count_occurrences(path, pattern)
+        content = File.read(path) or raise "Could not read file: #{path}"
+        #if path =~ /session_store/
+        #  puts "-----"
+        #  puts content
+        #  puts "-----"
+        #end
+        matches = content.scan(pattern)
+        matches.each { |match| puts "#{path}: #{match}" } if DEBUG
+        matches.size
+      end
+
+    end
+  end
+end

data/lib/serum/rails/metrics.rb

@@ -0,0 +1,118 @@
+module Serum
+  module Rails
+    class Metrics
+
+      FRACTION_PRIVATE_CONTROLLER_METHODS = 0.2
+
+      class << self
+
+        attr_reader :metrics
+
+        private
+
+        def metric(name, &block)
+          @metrics ||= []
+          @metrics << name
+          define_method name, &block
+        end
+
+      end
+
+      def initialize(root)
+        @app = App.new(root)
+      end
+
+      metric :unescaped_strings do
+        @app.count_lines(
+          :pattern => /\b(raw|html_safe)\b/,
+          :types => [:ruby, :views]
+        )
+      end
+
+      metric :controller_actions do
+        count = @app.count_lines(
+          :pattern => /\bdef\b/,
+          :types => [:ruby],
+          :folders => 'app/controllers'
+        )
+        count *= (1 - FRACTION_PRIVATE_CONTROLLER_METHODS)
+        count.round
+      end
+
+      #metric :gem_count do
+      #  @app.gems.size
+      #end
+
+      metric :uploaders do
+        @app.count_lines(
+          :pattern => /\b(has_attached_file|mount_uploader|has_attachment|dragonfly_accessor|has_attached)\b/,
+          :types => :ruby
+        )
+      end
+
+      metric :crypto_terms do
+        @app.count_lines(
+          :pattern => /SHA1|MD5|Digest|Crypt|Token|Secret|Signature/i,
+          :types => :ruby
+        )
+      end
+
+      metric :cookie_accesses do
+        @app.count_lines(
+          :pattern => /cookies/,
+          :types => [:ruby, :javascript]
+        )
+      end
+
+      metric :file_accesses do
+        @app.count_lines(
+          :pattern => /\b(File|Pathname|FileUtils|Dir|render|send_file)\b/,
+          :types => :ruby
+        )
+      end
+
+      metric :mailer_invocations do
+        @app.count_lines(
+          :pattern => /Mailer/,
+          :types => :ruby
+        )
+      end
+
+      metric :redirects do
+        @app.count_lines(
+          :pattern => /\bredirect_to\b/,
+          :types => :ruby
+        )
+      end
+
+      metric :json_outputs do
+        @app.count_lines(
+          :pattern => /\b(to_json|JSON\.generate|JSON\.dump)\b/,
+          :types => [:ruby, :views],
+          :folders => 'app/views'
+        )
+      end
+
+      metric :yaml_inputs do
+        @app.count_lines(
+          :pattern => /\bYAML\.load\b/,
+          :types => [:ruby, :views]
+        )
+      end
+
+      metric :lines_of_code do
+        @app.lines_of_code
+      end
+
+      def to_hash
+        hash = {}
+        self.class.metrics.sort.each do |metric|
+          hash[metric] = send(metric)
+        end
+        hash
+      end
+
+    end
+  end
+end
+

data/lib/serum/rails/type_selection.rb

@@ -0,0 +1,31 @@
+module Serum
+  module Rails
+    class TypeSelection
+
+      EXTENSIONS_BY_TYPE = {
+        :ruby       => %w[ rb ],
+        :javascript => %w[ js coffee coffeescript ],
+        :views      => %w[ erb haml mab ]
+      }.freeze
+
+      DEFAULT_TYPES = EXTENSIONS_BY_TYPE.keys.freeze
+
+      def initialize(types = nil)
+        @types = types ? Array.wrap(types) : DEFAULT_TYPES
+      end
+
+      #def matches_path?(path)
+      #  extensions.any? { |extension|
+      #    path.ends_with?("\.#{extension}")
+      #  }
+      #end
+
+      def extensions
+        @types.collect { |type|
+          EXTENSIONS_BY_TYPE[type] or raise "No such type: #{type}"
+        }.flatten
+      end
+
+    end
+  end
+end

data/lib/serum/rails/version.rb

@@ -0,0 +1,7 @@
+module Serum
+  module Rails
+
+    VERSION = '0.1.0'
+
+  end
+end

data/lib/serum-rails.rb

@@ -0,0 +1,5 @@
+require 'active_support/all'
+require 'serum/rails/app'
+require 'serum/rails/code_scanner'
+require 'serum/rails/metrics'
+require 'serum/rails/type_selection'

data/serum-rails.gemspec

@@ -0,0 +1,23 @@
+$:.push File.expand_path("../lib", __FILE__)
+require "serum/rails/version"
+
+Gem::Specification.new do |s|
+  s.name = 'serum-rails'
+  s.version = Serum::Rails::VERSION
+  s.authors = ["Henning Koch"]
+  s.email = 'henning.koch@makandra.de'
+  s.homepage = 'https://github.com/makandra/serum-rails'
+  s.summary = 'Scans a Rails application for metrics relevant to security audits'
+  s.description = s.summary
+  s.license = 'MIT'
+
+  s.files         = `git ls-files -z`.split("\x0")
+  s.executables   = s.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  s.test_files    = s.files.grep(%r{^(test|spec|features)/})
+  s.require_paths = ["lib"]
+
+  s.add_development_dependency "rake"
+  s.add_development_dependency "rspec", '>= 3'
+  s.add_runtime_dependency('activesupport', '>= 3.2')
+
+end

data/spec/serum/rails/metrics_spec.rb

@@ -0,0 +1,87 @@
+# Expected values were determined by manually grepping
+# through the example application in spec/test_app
+describe Serum::Rails::Metrics do
+
+  let(:root) { 'spec/test_app' }
+
+  subject { Serum::Rails::Metrics.new(root) }
+
+  describe '#unescaped_strings' do
+    it 'should count the occurrences' do
+      expect(subject.unescaped_strings).to eq(17)
+    end
+  end
+
+  describe '#controller_actions' do
+    it 'should count the occurrences' do
+      expect(subject.controller_actions).to eq((94 * 0.8).round) # we ignore some fraction for private methods
+    end
+  end
+
+  describe '#uploaders' do
+    it 'should count the occurrences' do
+      expect(subject.uploaders).to eq(2)
+    end
+  end
+
+  describe '#crypto_terms' do
+    it 'should count the occurrences' do
+      expect(subject.crypto_terms).to eq(17)
+    end
+  end
+
+  describe '#cookie_accesses' do
+    it 'should count the occurrences' do
+      expect(subject.cookie_accesses).to eq(5)
+    end
+  end
+
+  describe '#file_accesses' do
+    it 'should count the occurrences' do
+      expect(subject.file_accesses).to eq(33)
+    end
+  end
+
+  describe '#mailer_invocations' do
+    it 'should count the occurrences' do
+      expect(subject.mailer_invocations).to eq(4)
+    end
+  end
+
+  describe '#redirects' do
+    it 'should count the occurrences' do
+      expect(subject.redirects).to eq(15)
+    end
+  end
+
+  describe '#json_outputs' do
+    it 'should count the occurrences' do
+      expect(subject.json_outputs).to eq(2)
+    end
+  end
+
+  describe '#yaml_inputs' do
+    it 'should count the occurrences' do
+      expect(subject.yaml_inputs).to eq(3)
+    end
+  end
+
+  describe '#lines_of_code' do
+    it 'should count the occurrences' do
+      expect(subject.lines_of_code).to eq(12627)
+    end
+  end
+
+  #describe '#lines_of_ruby_code' do
+  #  expect(subject.lines_of_ruby_code).to eq(123)
+  #end
+  #
+  #describe '#lines_of_view_code' do
+  #  expect(subject.lines_of_view_code).to eq(123)
+  #end
+  #
+  #describe '#lines_of_javascript_code' do
+  #  expect(subject.lines_of_javascript_code).to eq(123)
+  #end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,80 @@
+require 'serum-rails'
+
+# This file was generated by the `rspec --init` command. Conventionally, all
+# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`.
+# The generated `.rspec` file contains `--require spec_helper` which will cause this
+# file to always be loaded, without a need to explicitly require it in any files.
+#
+# Given that it is always loaded, you are encouraged to keep this file as
+# light-weight as possible. Requiring heavyweight dependencies from this file
+# will add to the boot time of your test suite on EVERY test run, even for an
+# individual file that may not need all of that loaded. Instead, make a
+# separate helper file that requires this one and then use it only in the specs
+# that actually need it.
+#
+# The `.rspec` file also contains a few flags that are not defaults but that
+# users commonly want.
+#
+# See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
+RSpec.configure do |config|
+# The settings below are suggested to provide a good initial experience
+# with RSpec, but feel free to customize to your heart's content.
+=begin
+  # These two settings work together to allow you to limit a spec run
+  # to individual examples or groups you care about by tagging them with
+  # `:focus` metadata. When nothing is tagged with `:focus`, all examples
+  # get run.
+  config.filter_run :focus
+  config.run_all_when_everything_filtered = true
+
+  # Many RSpec users commonly either run the entire suite or an individual
+  # file, and it's useful to allow more verbose output when running an
+  # individual spec file.
+  if config.files_to_run.one?
+    # Use the documentation formatter for detailed output,
+    # unless a formatter has already been configured
+    # (e.g. via a command-line flag).
+    config.default_formatter = 'doc'
+  end
+
+  # Print the 10 slowest examples and example groups at the
+  # end of the spec run, to help surface which specs are running
+  # particularly slow.
+  config.profile_examples = 10
+
+  # Run specs in random order to surface order dependencies. If you find an
+  # order dependency and want to debug it, you can fix the order by providing
+  # the seed, which is printed after each run.
+  #     --seed 1234
+  config.order = :random
+
+  # Seed global randomization in this process using the `--seed` CLI option.
+  # Setting this allows you to use `--seed` to deterministically reproduce
+  # test failures related to randomization by passing the same `--seed` value
+  # as the one that triggered the failure.
+  Kernel.srand config.seed
+
+  # rspec-expectations config goes here. You can use an alternate
+  # assertion/expectation library such as wrong or the stdlib/minitest
+  # assertions if you prefer.
+  config.expect_with :rspec do |expectations|
+    # Enable only the newer, non-monkey-patching expect syntax.
+    # For more details, see:
+    #   - http://myronmars.to/n/dev-blog/2012/06/rspecs-new-expectation-syntax
+    expectations.syntax = :expect
+  end
+
+  # rspec-mocks config goes here. You can use an alternate test double
+  # library (such as bogus or mocha) by changing the `mock_with` option here.
+  config.mock_with :rspec do |mocks|
+    # Enable only the newer, non-monkey-patching expect syntax.
+    # For more details, see:
+    #   - http://teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/
+    mocks.syntax = :expect
+
+    # Prevents you from mocking or stubbing a method that does not exist on
+    # a real object. This is generally recommended.
+    mocks.verify_partial_doubles = true
+  end
+=end
+end

data/spec/test_app/Capfile

@@ -0,0 +1,4 @@
+load 'deploy' if respond_to?(:namespace) # cap2 differentiator
+Dir['vendor/plugins/*/recipes/*.rb'].each { |plugin| load(plugin) }
+
+load 'config/deploy' # remove this line to skip loading any of the default tasks

data/spec/test_app/Gemfile

@@ -0,0 +1,54 @@
+# Describes library dependencies of the application. 
+# origin: RM
+
+source 'http://rubygems.org'
+gem 'aegis'
+gem 'rails', '=2.3.11'
+gem 'mysql'
+gem 'andand', '=1.3.1'
+gem 'haml'
+gem 'sass'
+gem 'will_paginate', '=2.3.15'
+gem 'clearance', '=0.8.8'
+gem 'modularity', '=0.6.0'
+gem 'resource_controller', '=0.6.6'
+gem 'erubis', '=2.6.6'
+gem 'jrails', '=0.6.0'
+gem 'acts-as-taggable-on', '=2.0.6'
+gem 'ruby-debug'
+gem 'paperclip', '=2.3.4'
+gem 'spreadsheet', '=0.6.5.2'
+gem 'ancestry'
+gem 'vpim'
+
+group :development do
+  gem 'query_diet', '=0.2.0'
+  gem "inaction_mailer"
+end
+
+group :test do
+  gem "machinist", "=1.0.6"
+  gem "faker", "=0.3.1"
+  gem "timecop", "=0.3.5"
+  gem "shoulda", "=2.11.1"
+  gem 'rspec', '=1.3.2'
+  gem 'rspec-rails'
+  gem 'machinist_callbacks', '=0.1.3'
+  gem 'rspec_spinner', "=1.1.3"
+end
+
+group :cucumber do
+  gem 'cucumber'
+  gem 'cucumber-rails', :path => File.join(File.dirname(__FILE__), '/vendor/gems/cucumber-rails-0.4.1')
+  gem "cucumber_factory"
+  gem 'cucumber_spinner'
+  gem 'database_cleaner'
+  gem 'capybara'
+  gem 'rspec', '=1.3.2'
+  gem 'rspec-rails'
+  gem "faker", "=0.3.1"
+  gem "machinist", "=1.0.6"
+  gem "timecop", "=0.3.5"
+  gem 'machinist_callbacks', '=0.1.3'
+  gem 'launchy'
+end