spektr 0.5.5 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b3f2e35ede68f8a611ce58a5ad3a4fc251e3d18191b9f1bc7fb314666d789063
-  data.tar.gz: 908740bb4515316fa1c5a69a0b583ea282251a3483fc33a704f83e63521fe249
+  metadata.gz: ddcc5f8096643294db83930d7df5cace71619eca037464d68e109ff6f3c9f190
+  data.tar.gz: d2a32908dbe7f10b1ee680a62c3442f44e0529b6ea50e3c352451086c5eb7a97
 SHA512:
-  metadata.gz: f92ec1f4949da94bad355d9062b825fbb96480bdf6fe9fb424a421afbaa132cae4b9d0313d0f7af902e25b6ac6141ddc871ecd01cc8f4e4118bd0e7082f362d3
-  data.tar.gz: b6e240e0449e4fb858ae591aaeec936a18502741e105b56b30f00c05c6286a7ce690cfb3ae7d66ce07c5f53c64eb8f6bff55420b0f016d2764d30cba5bb090eb
+  metadata.gz: f0d7a1db5105c0abc1413b81098cb76895b20bf42e94b33087e9c7a87860cbebaa78efd31fa2e569dacbe3c6df71007cc59dfbae7aa755c4ea049a1ce8890bed
+  data.tar.gz: d93c5cf94158219882efd1f6c9c756b2324e87d42a4dbd768479ea0ad1580e70a36e9fc74a249cab34e8cf06e20588cf7f4516a605192ec3da7a52dc25994add

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 1.0.0
+
+* Add support for ignoring findings from specific checks with a `# spektr:ignore CHECK_NAME` source comment
+* Add File.binread to check
+
+## 0.5.6
+
+* fix nil handling positives
+* remove herb from dependencies
+
 ## 0.5.5
 
 * fix false positives

data/README.md

@@ -36,8 +36,21 @@ spektr path/to/app
 
 To see the available options, you can run `spektr --help`.
 
-To ignore a finding, you can use the `--ignore` flag with a comma separated list of fingerprints from the report.
+To ignore findings from the command line, use the `--ignore` flag with a comma-separated list of fingerprints from the report.
 
+Findings can also be ignored in source code by placing `# spektr:ignore`, followed by one or more comma-separated check names, on the line immediately above them:
+
+Use the check names shown in the report:
+
+```ruby
+# spektr:ignore Arbitrary code execution -- input is validated before this method is called
+eval(params[:code])
+
+# spektr:ignore Arbitrary code execution, Dangerous send -- both uses are safe
+eval(send(params[:method]))
+```
+
+The directive only applies to the named checks on the next line; a directive without a check name has no effect. Keeping a reason after `--` is recommended.
 
 ### Railsgoat Example output
 

data/lib/spektr/checks/base.rb

@@ -28,6 +28,7 @@ module Spektr
     def warn!(target, check, location, message, confidence = :high)
       full_path = target.is_a?(String) ? target : target.path
       path = full_path.gsub(@app.root, "")
+      return if target.respond_to?(:ignored_at?) && target.ignored_at?(location&.start_line, check)
       return if dupe?(path, location, message)
 
       @app.warnings << Warning.new(path, full_path, check, location, message, confidence)

data/lib/spektr/checks/file_access.rb

@@ -16,7 +16,7 @@ module Spektr
       def run
         return unless super
         targets = ["Dir", "File", "IO", "Kernel", "Net::FTP", "Net::HTTP", "PStore", "Pathname", "Shell"]
-        methods = [:[], :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
+        methods = [:[], :binread, :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
         targets.each do |target|
           methods.each do |method|
             check_calls_for_user_input(@target.find_calls(method, target.to_sym))

data/lib/spektr/checks/send.rb

@@ -12,8 +12,8 @@ module Spektr
         return unless super
         [:send, :try, :__send__, :public_send].each do |method|
           @target.find_calls(method).each do |call|
-            argument = call.arguments.arguments.first
-            if user_input?(argument)
+            argument = call.arguments&.arguments&.first
+            if argument && user_input?(argument)
               warn! @target, self, call.location, "User supplied value in send"
             end
           end

data/lib/spektr/targets/base.rb

@@ -1,10 +1,13 @@
 module Spektr
   module Targets
     class Base < Prism::Visitor
+      IGNORE_DIRECTIVE = /^\s*#\s*spektr:ignore\s+(.+)$/i
+
       attr_accessor :path, :name, :options, :ast, :parent, :parent_modules, :methods, :calls, :interpolated_xstrings, :lvars
 
       def initialize(path, content)
         Spektr.logger.debug "loading #{path}"
+        @source_lines = content.lines
         @ast = Prism.parse(content)
         @path = path
         return unless @ast
@@ -20,6 +23,16 @@ module Spektr
         @name = @name.prepend("#{@parent_modules.map(&:name).join('::')}::") if @name && @parent_modules.any?
       end
 
+      def ignored_at?(line_number, check)
+        return false unless line_number && line_number > 1
+
+        directive = @source_lines[line_number - 2]&.match(IGNORE_DIRECTIVE)
+        return false unless directive
+
+        ignored_checks = directive[1].split(/\s+--\s+/, 2).first.split(',').map(&:strip)
+        ignored_checks.include?(check.name)
+      end
+
       def method_definitions
         @method_definitions ||= find_methods(node: @ast)
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.5.5'
+  VERSION = '1.0.0'
 end

data/lib/spektr.rb

@@ -3,7 +3,6 @@
 require 'bundler'
 require 'prism'
 require 'erb'
-require 'herb'
 require 'haml'
 require 'logger'
 require 'tty/spinner'

data/spektr.gemspec

@@ -28,7 +28,6 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_dependency 'erubi'
-  spec.add_dependency 'herb'
   spec.add_dependency 'haml'
   spec.add_dependency 'pastel'
   spec.add_dependency 'prism'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.5.5
+  version: 1.0.0
 platform: ruby
 authors:
 - Greg Molnar
@@ -23,20 +23,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: herb
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: haml
   requirement: !ruby/object:Gem::Requirement
@@ -348,7 +334,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Rails static code analyzer for security issues
 test_files: []