spektr 0.3.3 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1afb80e4a1c5d9cc60a44031a5f3e0b467728f0d5edc75c5ba96dc905afcad6b
-  data.tar.gz: a92f43e5cc7865642641df39ba697609c926e67bdbc3cf14130ee2aed186c106
+  metadata.gz: 36b0bd72a136d6af28c36ef6c14943fadeb061271abfc152d442754ad2356d0e
+  data.tar.gz: a85bb727b8457e55338b842b483cbddd18fe2596412168d7aa9eeef788c403a1
 SHA512:
-  metadata.gz: e3369c1e335efd31cd527bd81b6848f50fe718dce399feef67ec3e5afe669629b09fce1acd0e09e5fc45b4fefaed6f5ac592918619306a750381b6aae9843e21
-  data.tar.gz: 6750ac48db9693f2b02448b13127456d0a8384f94e84d7d1c7d06ecc5f5320246d8c9bb6471a18d5c75bc7adf421b48d4f3145ba3e14a483cf0079e995734744
+  metadata.gz: 2d8342a2567d22c458cb9316fa6643de595422ae7e3a30d002181de2f2436a8d08c493dedb783aa1d3b8df93d3ab555b7797e427b067c00fcb38191562f62662
+  data.tar.gz: 8fc8196c6cf809b44691b88ab7a1b856102d7cba7062b97474beaf97c465d02134721478484127f0b260a1fe1b1bdbaf7497cb29227211974af9a1ecff5cab2d

data/.gitignore

@@ -7,3 +7,4 @@
 /spec/reports/
 /tmp/
 .byebug_history
+Gemfile.lock

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 0.4.0
+
+* make XSS check work without a Rails version
+* change parent class extraction to support Structs
+* fix parsing errors
+
+## 0.3.4
+
+* Relax dependencies, to help with using spektr as a gem
+* Fix executable
+
 ## 0.3.3
 
 * Remove hard dependency of haml 5

data/lib/spektr/checks/base.rb

@@ -88,7 +88,7 @@ module Spektr
           next unless child.is_a?(Parser::AST::Node)
           return true if user_input?(child.type, child.children.last, child)
         end
-      when :block, :pair, :hash, :if
+      when :block, :pair, :hash, :array, :if, :or
         ast.children.each do |child|
           next unless child.is_a?(Parser::AST::Node)
           return true if user_input?(child.type, child.children.last, child)
@@ -125,7 +125,7 @@ module Spektr
         return true if _send.receiver && model_names.include?(_send.receiver.name)
       when :const
         return true if model_names.include? item.name
-      when :block, :pair, :hash, :if
+      when :block, :pair, :hash, :array, :if, :or
         item.children.each do |child|
           next unless child.is_a?(Parser::AST::Node)
           return true if model_attribute?(child)

data/lib/spektr/checks/content_tag_xss.rb

@@ -23,6 +23,7 @@ module Spektr
 
       def run
         return unless super
+        return unless @app.rails_version
         calls = @target.find_calls(:content_tag)
         # https://groups.google.com/d/msg/ruby-security-ann/8B2iV2tPRSE/JkjCJkSoCgAJ
         cve_2016_6316_check(calls)

data/lib/spektr/processors/base.rb

@@ -16,13 +16,25 @@ module Spektr::Processors
     end
 
     def parent_name
-      @parent_parts.shift if @parent_parts.first.to_s == name
-      @parent_parts.join('::')
+      parent_parts.join('::')
+    end
+
+    def parent_parts
+      result = @parent_parts.dup
+      result.pop if part_matches_self?(result.last.to_s)
+      result
+    end
+
+    def part_matches_self?(part)
+      (part == name || part_with_module(part) == name)
+    end
+
+    def part_with_module(part)
+      (@parent_modules | [part]).join('::')
     end
 
     def parent_name_with_modules
-      parts = @parent_modules | @parent_parts
-      parts.shift if parts.first.to_s == name
+      parts = @parent_modules | parent_parts
       parts.join('::')
     end
 
@@ -39,17 +51,12 @@ module Spektr::Processors
     end
 
     def extract_parent_parts(node)
-      if node.children[1] && node.children[1].is_a?(Parser::AST::Node)
-        node.children[1].children.each do |child|
-          if child.is_a?(Parser::AST::Node)
-            extract_parent_parts(child)
-            @parent_parts << child.children.last
-          elsif child.is_a? Symbol
-            @parent_parts << child.to_s
-          end
+      return unless node.is_a?(Parser::AST::Node) && %i[ module class const send].include?(node.type)
+      @parent_parts.prepend(node.children.last) if node.type == :const
+      if node.children.any?
+        node.children.each do |child|
+          extract_parent_parts(child)
         end
-      elsif node&.children&.first&.children&.last
-        @parent_parts << node.children.first.children.last
       end
     end
 

data/lib/spektr/targets/base.rb

@@ -100,9 +100,9 @@ module Spektr
           Exp::Send.new(ast)
         when :def
           Exp::Definition.new(ast)
-        when :ivasgn
+        when :ivasgn, :ivar
           Exp::Ivasgin.new(ast)
-        when :lvasign
+        when :lvasign, :lvar
           Exp::Lvasign.new(ast)
         when :const
           Exp::Const.new(ast)

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.3.3'
+  VERSION = '0.4.0'
 end

data/lib/spektr.rb

@@ -3,7 +3,6 @@
 require 'bundler'
 require 'parser'
 require 'parser/current'
-require 'unparser'
 require 'erb'
 require 'haml'
 require 'logger'
@@ -22,7 +21,7 @@ module Spektr
     pastel = Pastel.new
     @output_format = output_format
     start_spinner('Initializing')
-    if debug
+    @log_level = if debug
       Logger::DEBUG
     elsif terminal?
       Logger::ERROR

data/spektr.gemspec

@@ -24,21 +24,20 @@ Gem::Specification.new do |spec|
     `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   end
   spec.bindir = 'bin'
-  spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.executables = 'spektr'
   spec.require_paths = ['lib']
 
   spec.add_dependency 'erubi'
   spec.add_dependency 'haml'
-  spec.add_dependency 'parser', '~> 3.0.0'
+  spec.add_dependency 'parser', '>= 2.6.0'
   spec.add_dependency 'pastel'
-  spec.add_dependency 'ruby_parser', '~>3.13'
+  spec.add_dependency 'ruby_parser', '>= 3.0'
   spec.add_dependency 'slim'
   spec.add_dependency 'tty-color'
   spec.add_dependency 'tty-option'
   spec.add_dependency 'tty-spinner'
   spec.add_dependency 'tty-table'
-  spec.add_dependency 'unparser', '~> 0.6.0'
-  spec.add_dependency 'zeitwerk'
+  spec.add_dependency 'zeitwerk', '>= 2.6'
 
   spec.add_development_dependency 'byebug'
   spec.add_development_dependency 'guard'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.0
 platform: ruby
 authors:
 - Greg Molnar
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-11-10 00:00:00.000000000 Z
+date: 2023-01-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: erubi
@@ -42,16 +42,16 @@ dependencies:
   name: parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 2.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 2.6.0
 - !ruby/object:Gem::Dependency
   name: pastel
   requirement: !ruby/object:Gem::Requirement
@@ -70,16 +70,16 @@ dependencies:
   name: ruby_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.13'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.13'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: slim
   requirement: !ruby/object:Gem::Requirement
@@ -150,34 +150,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: unparser
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.6.0
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.6.0
 - !ruby/object:Gem::Dependency
   name: zeitwerk
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.6'
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -265,7 +251,8 @@ dependencies:
 description: Rails static code analyzer for security issues
 email:
 - molnargerg@gmail.com
-executables: []
+executables:
+- spektr
 extensions: []
 extra_rdoc_files: []
 files: