spektr 0.5.4 → 0.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3856f34c87bf7f347c90149e5cc0a824e68d80df6c6a4704a204e4862ea3e54b
-  data.tar.gz: f0c98f054f09841c3de0e7f756c80537b5d0a409a2fe0a70d555b63715958691
+  metadata.gz: e26ec9d89007e489dcb99102598d93d72d3e6d1acc43451dddc2ecc2dc5f653f
+  data.tar.gz: 663f275b4b5e710928729698133f071a8b0bdac65d6598b5aed1959d212f26d6
 SHA512:
-  metadata.gz: fb99134225086acbaab6417f03594c7cb1b44893bdd413faf5056d3990afdd8e6bea3812c6a5a61344fc518e7d47b78bdbe49dfdb49e75722f6c5303df43101a
-  data.tar.gz: 7c20a2d6f2ec1a7c1a5e006b2ce4bb41e527a55fae099fd66d4e120f7fdffd9c6849496269abd998226f303b4602b5ac23b703a8be448abcd851a4f25bdb974a
+  metadata.gz: 816d3c285a9f54ebe75cf9759e301d0dfd169a1a32dfa018afe1e51ed71dd243a3432519c0036ddb4f2a32ec37d50241bbbff12a5eccf61fb538ad3df34fc13e
+  data.tar.gz: 0c7ce498c2875fd179cb32f949321ef67aaa82036cbfb76637bc1066f8d06e4264cf8a1f3b4035623c52b9104cc964ce650f8297cd618219b73d7186093aac5e

data/CHANGELOG.md

@@ -2,11 +2,19 @@
 
 ## Unreleased
 
+## 0.5.6
+
+* fix nil handling positives
+* remove herb from dependencies
+
+## 0.5.5
+
+* fix false positives
+
 ## 0.5.4
 
 * more parser fixes
 
-
 ## 0.5.3
 
 * parser fixes

data/lib/spektr/checks/base.rb

@@ -106,10 +106,10 @@ module Spektr
         node.body.body.each do |item|
           return user_input? item
         end
-      when :string_node, :symbol_node, :constant_read_node, :integer_node, :true_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node, :and_node
+      when :string_node, :symbol_node, :constant_read_node, :integer_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node
         # do nothing
       else
-        Spektr::Logger.debug "Unknown argument type #{node.type.inspect} #{node.inspect}"
+        ::Spektr.logger.debug "Unknown argument type #{node.type.inspect} #{node.inspect}"
       end
       false
     end
@@ -199,7 +199,7 @@ module Spektr
       when :string_node, :symbol_node, :integer_node, :constant_path_node, :nil_node, :true_node, :false_node, :self_node, :global_variable_read_node
         # do nothing
       else
-        Spektr::Logger.debug "Unknown argument type #{node.type}"
+        Spektr.logger.debug "Unknown argument type #{node.type}"
       end
     end
 

data/lib/spektr/checks/mass_assignment.rb

@@ -23,13 +23,20 @@ module Spektr
           argument = call.arguments&.arguments&.first
           next if argument.nil?
           ::Spektr.logger.debug "Mass assignment check at #{call.location.start_line}"
-          if user_input?(argument)
-            # we check for permit! separately
-            next if argument.respond_to?(:name) && argument.name == :permit!
-            # check for permit with arguments
-            next if argument.respond_to?(:name) && argument.name == :permit && argument.arguments
-            warn! @target, self, call.location, "Mass assignment"
+          next unless user_input?(argument)
+          if argument.type == :local_variable_read_node
+            variable = @target.lvars.find do |n|
+              n.name == argument.name
+            end
+            param = variable.value
+          else
+            param = argument
           end
+          # we check for permit! separately
+          next if param.respond_to?(:name) && param.name == :permit!
+          # check for permit with arguments
+          next if param.respond_to?(:name) && param.name == :permit && param.arguments
+          warn! @target, self, call.location, "Mass assignment"
         end
         @target.find_calls(:permit!).each do |call|
           unless call.arguments

data/lib/spektr/checks/send.rb

@@ -12,8 +12,8 @@ module Spektr
         return unless super
         [:send, :try, :__send__, :public_send].each do |method|
           @target.find_calls(method).each do |call|
-            argument = call.arguments.arguments.first
-            if user_input?(argument)
+            argument = call.arguments&.arguments&.first
+            if argument && user_input?(argument)
               warn! @target, self, call.location, "User supplied value in send"
             end
           end

data/lib/spektr/checks/sqli.rb

@@ -19,7 +19,9 @@ module Spektr
 
         ].each do |m|
           @target.find_calls(m).each do |call|
-            check_argument(call.arguments&.arguments&.first, m, call)
+            arguments = call.arguments&.arguments&.first
+            next if arguments && arguments.type == :keyword_hash_node
+            check_argument(arguments, m, call)
           end
         end
         [:calculate].each do |m|

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.5.4'
+  VERSION = '0.5.6'
 end

data/lib/spektr.rb

@@ -3,7 +3,6 @@
 require 'bundler'
 require 'prism'
 require 'erb'
-require 'herb'
 require 'haml'
 require 'logger'
 require 'tty/spinner'

data/spektr.gemspec

@@ -28,7 +28,6 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_dependency 'erubi'
-  spec.add_dependency 'herb'
   spec.add_dependency 'haml'
   spec.add_dependency 'pastel'
   spec.add_dependency 'prism'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.5.4
+  version: 0.5.6
 platform: ruby
 authors:
 - Greg Molnar
@@ -23,20 +23,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: herb
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: haml
   requirement: !ruby/object:Gem::Requirement