spektr 0.5.6 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e26ec9d89007e489dcb99102598d93d72d3e6d1acc43451dddc2ecc2dc5f653f
-  data.tar.gz: 663f275b4b5e710928729698133f071a8b0bdac65d6598b5aed1959d212f26d6
+  metadata.gz: ddcc5f8096643294db83930d7df5cace71619eca037464d68e109ff6f3c9f190
+  data.tar.gz: d2a32908dbe7f10b1ee680a62c3442f44e0529b6ea50e3c352451086c5eb7a97
 SHA512:
-  metadata.gz: 816d3c285a9f54ebe75cf9759e301d0dfd169a1a32dfa018afe1e51ed71dd243a3432519c0036ddb4f2a32ec37d50241bbbff12a5eccf61fb538ad3df34fc13e
-  data.tar.gz: 0c7ce498c2875fd179cb32f949321ef67aaa82036cbfb76637bc1066f8d06e4264cf8a1f3b4035623c52b9104cc964ce650f8297cd618219b73d7186093aac5e
+  metadata.gz: f0d7a1db5105c0abc1413b81098cb76895b20bf42e94b33087e9c7a87860cbebaa78efd31fa2e569dacbe3c6df71007cc59dfbae7aa755c4ea049a1ce8890bed
+  data.tar.gz: d93c5cf94158219882efd1f6c9c756b2324e87d42a4dbd768479ea0ad1580e70a36e9fc74a249cab34e8cf06e20588cf7f4516a605192ec3da7a52dc25994add

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 1.0.0
+
+* Add support for ignoring findings from specific checks with a `# spektr:ignore CHECK_NAME` source comment
+* Add File.binread to check
+
 ## 0.5.6
 
 * fix nil handling positives

data/README.md

@@ -36,8 +36,21 @@ spektr path/to/app
 
 To see the available options, you can run `spektr --help`.
 
-To ignore a finding, you can use the `--ignore` flag with a comma separated list of fingerprints from the report.
+To ignore findings from the command line, use the `--ignore` flag with a comma-separated list of fingerprints from the report.
 
+Findings can also be ignored in source code by placing `# spektr:ignore`, followed by one or more comma-separated check names, on the line immediately above them:
+
+Use the check names shown in the report:
+
+```ruby
+# spektr:ignore Arbitrary code execution -- input is validated before this method is called
+eval(params[:code])
+
+# spektr:ignore Arbitrary code execution, Dangerous send -- both uses are safe
+eval(send(params[:method]))
+```
+
+The directive only applies to the named checks on the next line; a directive without a check name has no effect. Keeping a reason after `--` is recommended.
 
 ### Railsgoat Example output
 

data/lib/spektr/checks/base.rb

@@ -28,6 +28,7 @@ module Spektr
     def warn!(target, check, location, message, confidence = :high)
       full_path = target.is_a?(String) ? target : target.path
       path = full_path.gsub(@app.root, "")
+      return if target.respond_to?(:ignored_at?) && target.ignored_at?(location&.start_line, check)
       return if dupe?(path, location, message)
 
       @app.warnings << Warning.new(path, full_path, check, location, message, confidence)

data/lib/spektr/checks/file_access.rb

@@ -16,7 +16,7 @@ module Spektr
       def run
         return unless super
         targets = ["Dir", "File", "IO", "Kernel", "Net::FTP", "Net::HTTP", "PStore", "Pathname", "Shell"]
-        methods = [:[], :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
+        methods = [:[], :binread, :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
         targets.each do |target|
           methods.each do |method|
             check_calls_for_user_input(@target.find_calls(method, target.to_sym))

data/lib/spektr/targets/base.rb

@@ -1,10 +1,13 @@
 module Spektr
   module Targets
     class Base < Prism::Visitor
+      IGNORE_DIRECTIVE = /^\s*#\s*spektr:ignore\s+(.+)$/i
+
       attr_accessor :path, :name, :options, :ast, :parent, :parent_modules, :methods, :calls, :interpolated_xstrings, :lvars
 
       def initialize(path, content)
         Spektr.logger.debug "loading #{path}"
+        @source_lines = content.lines
         @ast = Prism.parse(content)
         @path = path
         return unless @ast
@@ -20,6 +23,16 @@ module Spektr
         @name = @name.prepend("#{@parent_modules.map(&:name).join('::')}::") if @name && @parent_modules.any?
       end
 
+      def ignored_at?(line_number, check)
+        return false unless line_number && line_number > 1
+
+        directive = @source_lines[line_number - 2]&.match(IGNORE_DIRECTIVE)
+        return false unless directive
+
+        ignored_checks = directive[1].split(/\s+--\s+/, 2).first.split(',').map(&:strip)
+        ignored_checks.include?(check.name)
+      end
+
       def method_definitions
         @method_definitions ||= find_methods(node: @ast)
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.5.6'
+  VERSION = '1.0.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.5.6
+  version: 1.0.0
 platform: ruby
 authors:
 - Greg Molnar
@@ -334,7 +334,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Rails static code analyzer for security issues
 test_files: []