spektr 0.5.2 → 0.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 07ac33de0dc43a2bd98945e035ceda36db6d48c95fc6cc1ae5625d2599921911
-  data.tar.gz: 216f3ab944681799b61d8b880710c8d136a934260d504bb167ae2bad41c0e5be
+  metadata.gz: 3856f34c87bf7f347c90149e5cc0a824e68d80df6c6a4704a204e4862ea3e54b
+  data.tar.gz: f0c98f054f09841c3de0e7f756c80537b5d0a409a2fe0a70d555b63715958691
 SHA512:
-  metadata.gz: b68041c229127905c5d426003ed9fcacb51d818b497270600a25d7c1648350e40b9db9fb5f29b7bd1bd089466effd01cc5ecc3b77bf5e49f17956682684f4ea9
-  data.tar.gz: 1e98efc4bb04e89b886c79decb345f5ab189922d7e0ae9a5d90ff1c4c418a470902cfccdeb3f862e9fe42b0e9c67ddc5f4869902ab6d18cc07ed270b942fe4b8
+  metadata.gz: fb99134225086acbaab6417f03594c7cb1b44893bdd413faf5056d3990afdd8e6bea3812c6a5a61344fc518e7d47b78bdbe49dfdb49e75722f6c5303df43101a
+  data.tar.gz: 7c20a2d6f2ec1a7c1a5e006b2ce4bb41e527a55fae099fd66d4e120f7fdffd9c6849496269abd998226f303b4602b5ac23b703a8be448abcd851a4f25bdb974a

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 0.5.4
+
+* more parser fixes
+
+
+## 0.5.3
+
+* parser fixes
+
 ## 0.5.2
 
 * handle nil nodes

data/lib/spektr/checks/base.rb

@@ -54,11 +54,11 @@ module Spektr
             return true if user_input?(argument)
           end
         end
-      when :embedded_statements_node
+      when :embedded_statements_node, :if_node, :else_node, :case_node, :embedded_variable_node
         node.statements.body.each do |item|
           return true if user_input? item
         end
-      when :interpolated_string_node, :interpolated_x_string_node
+      when :interpolated_string_node, :interpolated_x_string_node, :interpolated_symbol_node, :interpolated_regular_expression_node
         node.parts.each do |part|
           return true if user_input?(part)
         end
@@ -67,6 +67,10 @@ module Spektr
           return true if user_input?(element.key)
           return true if user_input?(element.value)
         end
+      when :array_node
+        node.elements.each do |element|
+          return true if user_input?(element)
+        end
       # TODO: make this better. ivars can be overridden in the view as well and
       # can be set in non controller targets too
       when :instance_variable_read_node
@@ -84,26 +88,84 @@ module Spektr
           end
         end
       when :local_variable_read_node
-        return user_input?(@target.lvars.find{|n| n.name == node.name })
+        variable = @target.lvars.find do |n|
+          n.name == node.name
+        end
+        return if variable && variable.location.start_line == node.location.start_line
+        return user_input?(variable)
+      when :instance_variable_or_write_node, :local_variable_or_write_node
+        return user_input?(node.value)
       when :instance_variable_write_node, :local_variable_write_node
         return user_input? node.value
+      when :and_node, :or_node
+        return user_input?(node.left)
+        return user_input?(node.right)
+      when :splat_node
+        return user_input? node.expression
       when :parentheses_node
         node.body.body.each do |item|
           return user_input? item
         end
-      when :string_node, :symbol_node, :constant_read_node, :integer_node, :true_node, :constant_path_node, :nil_node
+      when :string_node, :symbol_node, :constant_read_node, :integer_node, :true_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node, :and_node
         # do nothing
       else
-        raise "Unknown argument type #{node.type.inspect} #{node.inspect}"
+        Spektr::Logger.debug "Unknown argument type #{node.type.inspect} #{node.inspect}"
       end
       false
     end
 
     # TODO: this doesn't work properly
     def model_attribute?(node)
+      return false if node.nil?
       model_names = @app.models.collect(&:name)
       case node.type
-      when :local_variable_read_node, :instance_variable_read_node
+      when :call_node
+        return model_attribute?(node.receiver) if node.receiver
+        if node.arguments
+          node.arguments.arguments.each do |argument|
+            return true if model_attribute?(argument)
+          end
+        end
+      when :embedded_statements_node, :if_node, :else_node, :case_node, :embedded_variable_node
+        node.statements.body.each do |item|
+          return true if model_attribute? item
+        end
+      when :interpolated_string_node, :interpolated_x_string_node, :interpolated_symbol_node, :interpolated_regular_expression_node
+        node.parts.each do |part|
+          return true if model_attribute?(part)
+        end
+      when :keyword_hash_node, :hash_node
+        node.elements.each do |element|
+          return true if model_attribute?(element.key)
+          return true if model_attribute?(element.value)
+        end
+      when :array_node
+        node.elements.each do |element|
+          return true if model_attribute?(element)
+        end
+      # TODO: make this better. ivars can be overridden in the view as well and
+      # can be set in non controller targets too
+      when :_instance_variable_read_node
+        return false unless @target.respond_to?(:view_path)
+        actions = []
+        @app.controllers.each do |controller|
+          actions = actions.concat controller.actions.select { |action|
+            action.template == @target.view_path
+          }
+        end
+        actions.each do |action|
+          next unless action.body
+          action.body.each do |exp|
+            return true if exp.name == node.name && model_attribute?(exp)
+          end
+        end
+      when :local_variable_read_node
+        variable = @target.lvars.find do |n|
+          n.name == node.name
+        end
+        return if variable && variable.location.start_line == node.location.start_line
+        return model_attribute?(variable)
+      when :instance_variable_read_node
         # TODO: handle helpers here too
         if ["Spektr::Targets::Controller", "Spektr::Targets::View"].include?(@target.class.name)
           actions = []
@@ -119,27 +181,25 @@ module Spektr
             end
           end
         end
-      when :call_node
-        return model_attribute?(node.receiver) if node.receiver
-        if node.arguments
-          node.arguments.arguments.each do |argument|
-            return true if model_attribute?(argument)
-          end
-        end
+      when :instance_variable_or_write, :local_variable_or_write_node
+        return model_attribute?(node.value)
+      when :instance_variable_write_node, :local_variable_write_node
+        return model_attribute? node.value
+      when :and_node, :or_node
+        return model_attribute?(node.left)
+        return model_attribute?(node.right)
+      when :splat_node
+        return model_attribute? node.expression
       when :parentheses_node
         node.body.body.each do |item|
           return model_attribute? item
         end
       when :constant_read_node
         return true if model_names.include? node.name.to_s
-      when :interpolated_string_node
-        node.parts.each do |item|
-          return model_attribute? item
-        end
-      when :string_node, :symbol_node, :integer_node, :constant_path_node, :nil_node
+      when :string_node, :symbol_node, :integer_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node
         # do nothing
       else
-        raise "Unknown argument type #{node.type}"
+        Spektr::Logger.debug "Unknown argument type #{node.type}"
       end
     end
 

data/lib/spektr/checks/link_to_href.rb

@@ -26,7 +26,11 @@ module Spektr
           next unless call.arguments
           ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments[1].inspect}"
           next unless call.arguments.arguments[1]
-          next if call.arguments.arguments[1].name =~ /_url$|_path$/
+          require 'byebug'
+          if call.arguments.arguments[1] && call.arguments.arguments[1].respond_to?(:name)
+            name = call.arguments.arguments[1].name
+          end
+          next if name && name =~ /_url$|_path$/
           if user_input? call.arguments.arguments[1]
             warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
           end

data/lib/spektr/checks/mass_assignment.rb

@@ -16,7 +16,7 @@ module Spektr
         calls = []
         model_names.each do |receiver|
           [:new, :build, :create].each do |method|
-            calls.concat @target.find_calls(method, receiver.to_sym)
+            calls.concat @target.find_calls(method, receiver&.to_sym)
           end
         end
         calls.each do |call|
@@ -25,9 +25,9 @@ module Spektr
           ::Spektr.logger.debug "Mass assignment check at #{call.location.start_line}"
           if user_input?(argument)
             # we check for permit! separately
-            next if argument.name == :permit!
+            next if argument.respond_to?(:name) && argument.name == :permit!
             # check for permit with arguments
-            next if argument.name == :permit && argument.arguments
+            next if argument.respond_to?(:name) && argument.name == :permit && argument.arguments
             warn! @target, self, call.location, "Mass assignment"
           end
         end

data/lib/spektr/checks/xss.rb

@@ -43,7 +43,12 @@ module Spektr
             warn! @target, self, call.location, "Cross-Site Scripting: Unescaped user input"
           end
           if model_attribute?(call.receiver)
-            warn! @target, self, call.location, "Cross-Site Scripting: Unescaped model attribute #{call.receiver.name}"
+            name = if call.receiver.respond_to?(:name)
+                     call.receiver.name
+                   else
+                     ""
+                   end
+            warn! @target, self, call.location, "Cross-Site Scripting: Unescaped model attribute #{name}"
           end
         end
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.5.2'
+  VERSION = '0.5.4'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.4
 platform: ruby
 authors:
 - Greg Molnar