spektr 0.5.1 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d54c697220111ee8557c44b0fb056ed3cc83d543cf02c2c265f64d157a72711
-  data.tar.gz: 67127b009d369bd7dc334d22500f9e39fff69bc62beab271ff793400f72294a2
+  metadata.gz: 67409372de77e0e8bf4117c53e8589c393250ce270720735e6f306aabe97dd3f
+  data.tar.gz: db4149f62a076ae7ce005b72a3daf1e9cbbf26d860f092ff8e0259923c4736bb
 SHA512:
-  metadata.gz: 0a3140d228bc1e8c3990a88ebd46eb8bd32223b2e33f32d29b4dfd9e7b0bd79cffd291c5d83e9c01b2ec70de09203d7d89ca624abd4e89259ff092e423692a0b
-  data.tar.gz: aed13dc1e2cd1632e5e0ec9db5bee844957d9623b852ae7e5f5c5abb41b569bb293f0eeaa7d054b70b84564c92dde745205780ac8aa456a4c7cc3745a4be1f4d
+  metadata.gz: 05c35aff0fb9d5453585f302febdcdfe1e5a778925cc59caa958a1a41ad8b4de657bb1f9ff47aa895f0cc382c09accc731cd0095fbf51b5a7c33dad4c1bbc137
+  data.tar.gz: 1a9ccf43fc043a6d66574d195a45ee6351c0fe98937928a17f3452e4ad184dd70565fc878f63f5008475cc3ae07740665fa8e624b327b2734e6855af45de04a1

data/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.5.3
+
+* parser fixes
+
+## 0.5.2
+
+* handle nil nodes
+
 ## 0.5.1
 
 * fix root scope handling

data/lib/spektr/checks/base.rb

@@ -54,11 +54,11 @@ module Spektr
             return true if user_input?(argument)
           end
         end
-      when :embedded_statements_node
+      when :embedded_statements_node, :if_node, :else_node
         node.statements.body.each do |item|
           return true if user_input? item
         end
-      when :interpolated_string_node, :interpolated_x_string_node
+      when :interpolated_string_node, :interpolated_x_string_node, :interpolated_symbol_node
         node.parts.each do |part|
           return true if user_input?(part)
         end
@@ -67,6 +67,10 @@ module Spektr
           return true if user_input?(element.key)
           return true if user_input?(element.value)
         end
+      when :array_node
+        node.elements.each do |element|
+          return true if user_input?(element)
+        end
       # TODO: make this better. ivars can be overridden in the view as well and
       # can be set in non controller targets too
       when :instance_variable_read_node
@@ -84,15 +88,25 @@ module Spektr
           end
         end
       when :local_variable_read_node
-        return user_input?(@target.lvars.find{|n| n.name == node.name })
+        variable = @target.lvars.find do |n|
+          n.name == node.name
+        end
+        return if variable && variable.location.start_line == node.location.start_line
+        return user_input?(variable)
+      when :local_variable_or_write_node
+        return user_input?(node.value)
+      when :and_node, :or_node
+        return user_input?(node.left)
+        return user_input?(node.right)
       when :instance_variable_write_node, :local_variable_write_node
         return user_input? node.value
+      when :splat_node
+        return user_input? node.expression
       when :parentheses_node
         node.body.body.each do |item|
           return user_input? item
         end
-
-      when :string_node, :symbol_node, :constant_read_node, :integer_node, :true_node, :constant_path_node
+      when :string_node, :symbol_node, :constant_read_node, :integer_node, :true_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node
         # do nothing
       else
         raise "Unknown argument type #{node.type.inspect} #{node.inspect}"
@@ -120,6 +134,11 @@ module Spektr
             end
           end
         end
+      when :local_variable_or_write_node
+        return model_attribute?(node.value)
+      when :and_node, :or_node
+        return model_attribute?(node.left)
+        return model_attribute?(node.right)
       when :call_node
         return model_attribute?(node.receiver) if node.receiver
         if node.arguments
@@ -127,17 +146,38 @@ module Spektr
             return true if model_attribute?(argument)
           end
         end
+      when :keyword_hash_node, :hash_node
+        node.elements.each do |element|
+          return true if model_attribute?(element.key)
+          return true if model_attribute?(element.value)
+        end
+      when :array_node
+        node.elements.each do |element|
+          return true if model_attribute?(element)
+        end
       when :parentheses_node
         node.body.body.each do |item|
           return model_attribute? item
         end
+      when :interpolated_string_node, :interpolated_x_string_node, :interpolated_symbol_node
+        node.parts.each do |part|
+          return true if model_attribute?(part)
+        end
+      when :embedded_statements_node, :if_node, :else_node
+        node.statements.body.each do |item|
+          return true if model_attribute? item
+        end
+      when :instance_variable_write_node, :local_variable_write_node
+        return model_attribute? node.value
       when :constant_read_node
         return true if model_names.include? node.name.to_s
       when :interpolated_string_node
         node.parts.each do |item|
           return model_attribute? item
         end
-      when :string_node, :symbol_node, :integer_node, :constant_path_node
+      when :splat_node
+        return model_attribute? node.expression
+      when :string_node, :symbol_node, :integer_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node
         # do nothing
       else
         raise "Unknown argument type #{node.type}"

data/lib/spektr/checks/link_to_href.rb

@@ -26,7 +26,11 @@ module Spektr
           next unless call.arguments
           ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments[1].inspect}"
           next unless call.arguments.arguments[1]
-          next if call.arguments.arguments[1].name =~ /_url$|_path$/
+          require 'byebug'
+          if call.arguments.arguments[1] && call.arguments.arguments[1].respond_to?(:name)
+            name = call.arguments.arguments[1].name
+          end
+          next if name && name =~ /_url$|_path$/
           if user_input? call.arguments.arguments[1]
             warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
           end

data/lib/spektr/checks/mass_assignment.rb

@@ -16,7 +16,7 @@ module Spektr
         calls = []
         model_names.each do |receiver|
           [:new, :build, :create].each do |method|
-            calls.concat @target.find_calls(method, receiver.to_sym)
+            calls.concat @target.find_calls(method, receiver&.to_sym)
           end
         end
         calls.each do |call|
@@ -25,9 +25,9 @@ module Spektr
           ::Spektr.logger.debug "Mass assignment check at #{call.location.start_line}"
           if user_input?(argument)
             # we check for permit! separately
-            next if argument.name == :permit!
+            next if argument.respond_to?(:name) && argument.name == :permit!
             # check for permit with arguments
-            next if argument.name == :permit && argument.arguments
+            next if argument.respond_to?(:name) && argument.name == :permit && argument.arguments
             warn! @target, self, call.location, "Mass assignment"
           end
         end

data/lib/spektr/checks/xss.rb

@@ -43,7 +43,12 @@ module Spektr
             warn! @target, self, call.location, "Cross-Site Scripting: Unescaped user input"
           end
           if model_attribute?(call.receiver)
-            warn! @target, self, call.location, "Cross-Site Scripting: Unescaped model attribute #{call.receiver.name}"
+            name = if call.receiver.respond_to?(:name)
+                     call.receiver.name
+                   else
+                     ""
+                   end
+            warn! @target, self, call.location, "Cross-Site Scripting: Unescaped model attribute #{name}"
           end
         end
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.5.1'
+  VERSION = '0.5.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.3
 platform: ruby
 authors:
 - Greg Molnar