spektr 0.5.2 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 07ac33de0dc43a2bd98945e035ceda36db6d48c95fc6cc1ae5625d2599921911
-  data.tar.gz: 216f3ab944681799b61d8b880710c8d136a934260d504bb167ae2bad41c0e5be
+  metadata.gz: 67409372de77e0e8bf4117c53e8589c393250ce270720735e6f306aabe97dd3f
+  data.tar.gz: db4149f62a076ae7ce005b72a3daf1e9cbbf26d860f092ff8e0259923c4736bb
 SHA512:
-  metadata.gz: b68041c229127905c5d426003ed9fcacb51d818b497270600a25d7c1648350e40b9db9fb5f29b7bd1bd089466effd01cc5ecc3b77bf5e49f17956682684f4ea9
-  data.tar.gz: 1e98efc4bb04e89b886c79decb345f5ab189922d7e0ae9a5d90ff1c4c418a470902cfccdeb3f862e9fe42b0e9c67ddc5f4869902ab6d18cc07ed270b942fe4b8
+  metadata.gz: 05c35aff0fb9d5453585f302febdcdfe1e5a778925cc59caa958a1a41ad8b4de657bb1f9ff47aa895f0cc382c09accc731cd0095fbf51b5a7c33dad4c1bbc137
+  data.tar.gz: 1a9ccf43fc043a6d66574d195a45ee6351c0fe98937928a17f3452e4ad184dd70565fc878f63f5008475cc3ae07740665fa8e624b327b2734e6855af45de04a1

data/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.5.3
+
+* parser fixes
+
 ## 0.5.2
 
 * handle nil nodes

data/lib/spektr/checks/base.rb

@@ -54,11 +54,11 @@ module Spektr
             return true if user_input?(argument)
           end
         end
-      when :embedded_statements_node
+      when :embedded_statements_node, :if_node, :else_node
         node.statements.body.each do |item|
           return true if user_input? item
         end
-      when :interpolated_string_node, :interpolated_x_string_node
+      when :interpolated_string_node, :interpolated_x_string_node, :interpolated_symbol_node
         node.parts.each do |part|
           return true if user_input?(part)
         end
@@ -67,6 +67,10 @@ module Spektr
           return true if user_input?(element.key)
           return true if user_input?(element.value)
         end
+      when :array_node
+        node.elements.each do |element|
+          return true if user_input?(element)
+        end
       # TODO: make this better. ivars can be overridden in the view as well and
       # can be set in non controller targets too
       when :instance_variable_read_node
@@ -84,14 +88,25 @@ module Spektr
           end
         end
       when :local_variable_read_node
-        return user_input?(@target.lvars.find{|n| n.name == node.name })
+        variable = @target.lvars.find do |n|
+          n.name == node.name
+        end
+        return if variable && variable.location.start_line == node.location.start_line
+        return user_input?(variable)
+      when :local_variable_or_write_node
+        return user_input?(node.value)
+      when :and_node, :or_node
+        return user_input?(node.left)
+        return user_input?(node.right)
       when :instance_variable_write_node, :local_variable_write_node
         return user_input? node.value
+      when :splat_node
+        return user_input? node.expression
       when :parentheses_node
         node.body.body.each do |item|
           return user_input? item
         end
-      when :string_node, :symbol_node, :constant_read_node, :integer_node, :true_node, :constant_path_node, :nil_node
+      when :string_node, :symbol_node, :constant_read_node, :integer_node, :true_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node
         # do nothing
       else
         raise "Unknown argument type #{node.type.inspect} #{node.inspect}"
@@ -119,6 +134,11 @@ module Spektr
             end
           end
         end
+      when :local_variable_or_write_node
+        return model_attribute?(node.value)
+      when :and_node, :or_node
+        return model_attribute?(node.left)
+        return model_attribute?(node.right)
       when :call_node
         return model_attribute?(node.receiver) if node.receiver
         if node.arguments
@@ -126,17 +146,38 @@ module Spektr
             return true if model_attribute?(argument)
           end
         end
+      when :keyword_hash_node, :hash_node
+        node.elements.each do |element|
+          return true if model_attribute?(element.key)
+          return true if model_attribute?(element.value)
+        end
+      when :array_node
+        node.elements.each do |element|
+          return true if model_attribute?(element)
+        end
       when :parentheses_node
         node.body.body.each do |item|
           return model_attribute? item
         end
+      when :interpolated_string_node, :interpolated_x_string_node, :interpolated_symbol_node
+        node.parts.each do |part|
+          return true if model_attribute?(part)
+        end
+      when :embedded_statements_node, :if_node, :else_node
+        node.statements.body.each do |item|
+          return true if model_attribute? item
+        end
+      when :instance_variable_write_node, :local_variable_write_node
+        return model_attribute? node.value
       when :constant_read_node
         return true if model_names.include? node.name.to_s
       when :interpolated_string_node
         node.parts.each do |item|
           return model_attribute? item
         end
-      when :string_node, :symbol_node, :integer_node, :constant_path_node, :nil_node
+      when :splat_node
+        return model_attribute? node.expression
+      when :string_node, :symbol_node, :integer_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node
         # do nothing
       else
         raise "Unknown argument type #{node.type}"

data/lib/spektr/checks/link_to_href.rb

@@ -26,7 +26,11 @@ module Spektr
           next unless call.arguments
           ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments[1].inspect}"
           next unless call.arguments.arguments[1]
-          next if call.arguments.arguments[1].name =~ /_url$|_path$/
+          require 'byebug'
+          if call.arguments.arguments[1] && call.arguments.arguments[1].respond_to?(:name)
+            name = call.arguments.arguments[1].name
+          end
+          next if name && name =~ /_url$|_path$/
           if user_input? call.arguments.arguments[1]
             warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
           end

data/lib/spektr/checks/mass_assignment.rb

@@ -16,7 +16,7 @@ module Spektr
         calls = []
         model_names.each do |receiver|
           [:new, :build, :create].each do |method|
-            calls.concat @target.find_calls(method, receiver.to_sym)
+            calls.concat @target.find_calls(method, receiver&.to_sym)
           end
         end
         calls.each do |call|
@@ -25,9 +25,9 @@ module Spektr
           ::Spektr.logger.debug "Mass assignment check at #{call.location.start_line}"
           if user_input?(argument)
             # we check for permit! separately
-            next if argument.name == :permit!
+            next if argument.respond_to?(:name) && argument.name == :permit!
             # check for permit with arguments
-            next if argument.name == :permit && argument.arguments
+            next if argument.respond_to?(:name) && argument.name == :permit && argument.arguments
             warn! @target, self, call.location, "Mass assignment"
           end
         end

data/lib/spektr/checks/xss.rb

@@ -43,7 +43,12 @@ module Spektr
             warn! @target, self, call.location, "Cross-Site Scripting: Unescaped user input"
           end
           if model_attribute?(call.receiver)
-            warn! @target, self, call.location, "Cross-Site Scripting: Unescaped model attribute #{call.receiver.name}"
+            name = if call.receiver.respond_to?(:name)
+                     call.receiver.name
+                   else
+                     ""
+                   end
+            warn! @target, self, call.location, "Cross-Site Scripting: Unescaped model attribute #{name}"
           end
         end
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.5.2'
+  VERSION = '0.5.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.3
 platform: ruby
 authors:
 - Greg Molnar