spektr 0.5.6 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e26ec9d89007e489dcb99102598d93d72d3e6d1acc43451dddc2ecc2dc5f653f
-  data.tar.gz: 663f275b4b5e710928729698133f071a8b0bdac65d6598b5aed1959d212f26d6
+  metadata.gz: 8a830f6b6b9be5ac380e1cbf4a755b9171b77f9835d9e3f62c5f62c411ba529e
+  data.tar.gz: 97a48a8cdaf9d5ab568dcc7d201daf1433b07c1a6043901c300147185ef99dec
 SHA512:
-  metadata.gz: 816d3c285a9f54ebe75cf9759e301d0dfd169a1a32dfa018afe1e51ed71dd243a3432519c0036ddb4f2a32ec37d50241bbbff12a5eccf61fb538ad3df34fc13e
-  data.tar.gz: 0c7ce498c2875fd179cb32f949321ef67aaa82036cbfb76637bc1066f8d06e4264cf8a1f3b4035623c52b9104cc964ce650f8297cd618219b73d7186093aac5e
+  metadata.gz: 162e450e6584062cf616d010401090d8e367041042aca79b3b1a6268948e3a99185bbe08ee4fa1928a13a3a45b9cdd5a05f165a282c4abec47f52e23c059b363
+  data.tar.gz: d61db3f6438d1ddcd64564815096beb67007539a543c90a0768423d41ede3bf571ea8acd7d167339ee4dde5074677d49719d0fb14fcebabe9fe9d22bc30b2ac9

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 1.0.1
+
+* various nil handling fixes
+
+## 1.0.0
+
+* Add support for ignoring findings from specific checks with a `# spektr:ignore CHECK_NAME` source comment
+* Add File.binread to check
+
 ## 0.5.6
 
 * fix nil handling positives

data/CODE_OF_CONDUCT.md

@@ -1,3 +1,3 @@
-# Contributor Covenant Code of Conduct
+# Code of Conduct
 
 Same as Ruby: [https://www.ruby-lang.org/en/conduct/](https://www.ruby-lang.org/en/conduct/)

data/README.md

@@ -36,8 +36,21 @@ spektr path/to/app
 
 To see the available options, you can run `spektr --help`.
 
-To ignore a finding, you can use the `--ignore` flag with a comma separated list of fingerprints from the report.
+To ignore findings from the command line, use the `--ignore` flag with a comma-separated list of fingerprints from the report.
 
+Findings can also be ignored in source code by placing `# spektr:ignore`, followed by one or more comma-separated check names, on the line immediately above them:
+
+Use the check names shown in the report:
+
+```ruby
+# spektr:ignore Arbitrary code execution -- input is validated before this method is called
+eval(params[:code])
+
+# spektr:ignore Arbitrary code execution, Dangerous send -- both uses are safe
+eval(send(params[:method]))
+```
+
+The directive only applies to the named checks on the next line; a directive without a check name has no effect. Keeping a reason after `--` is recommended.
 
 ### Railsgoat Example output
 

data/lib/spektr/checks/base.rb

@@ -28,6 +28,7 @@ module Spektr
     def warn!(target, check, location, message, confidence = :high)
       full_path = target.is_a?(String) ? target : target.path
       path = full_path.gsub(@app.root, "")
+      return if target.respond_to?(:ignored_at?) && target.ignored_at?(location&.start_line, check)
       return if dupe?(path, location, message)
 
       @app.warnings << Warning.new(path, full_path, check, location, message, confidence)
@@ -64,7 +65,7 @@ module Spektr
         end
       when :keyword_hash_node, :hash_node
         node.elements.each do |element|
-          return true if user_input?(element.key)
+          return true if element.respond_to?(:key) && user_input?(element.key)
           return true if user_input?(element.value)
         end
       when :array_node
@@ -84,7 +85,7 @@ module Spektr
         actions.each do |action|
           next unless action.body
           action.body.each do |exp|
-            return true if exp.name == node.name && user_input?(exp)
+            return true if exp.respond_to?(:name) && exp.name == node.name && user_input?(exp)
           end
         end
       when :local_variable_read_node
@@ -136,7 +137,7 @@ module Spektr
         end
       when :keyword_hash_node, :hash_node
         node.elements.each do |element|
-          return true if model_attribute?(element.key)
+          return true if element.respond_to?(:key) && model_attribute?(element.key)
           return true if model_attribute?(element.value)
         end
       when :array_node
@@ -175,8 +176,9 @@ module Spektr
             }
           end
           actions.each do |action|
+            next unless action.body
             action.body.each do |exp|
-              next unless node.respond_to?(:name)
+              next unless exp.respond_to?(:name) && node.respond_to?(:name)
               return model_attribute?(exp.value) if exp.is_a?(Prism::InstanceVariableWriteNode) && exp.name == node.name
             end
           end

data/lib/spektr/checks/command_injection.rb

@@ -34,11 +34,7 @@ module Spektr
         # TODO: might need to exclude tempfile and ActiveStorage::Filename
         return if calls.empty?
         calls.each do |call|
-          if call.arguments.is_a?(Prism::ArgumentsNode)
-            argument = call.arguments.arguments.first
-          else
-            argument = call.arguments.first
-          end
+          argument = call.arguments.arguments.first if call.arguments.is_a?(Prism::ArgumentsNode)
           next unless argument
           if user_input?(argument) || model_attribute?(argument)
             warn! @target, self, call.location, "Command injection in #{call.name}"

data/lib/spektr/checks/content_tag_xss.rb

@@ -36,7 +36,7 @@ module Spektr
             end
             if argument.is_a?(Prism::KeywordHashNode)
               argument.elements.each do |element|
-                if user_input?(element.key)
+                if element.respond_to?(:key) && user_input?(element.key)
                   warn! @target, self, call.location, "Unescaped parameter in content_tag at #{element.key.name}"
                 end
               end

data/lib/spektr/checks/evaluation.rb

@@ -12,6 +12,7 @@ module Spektr
         return unless super
         [:eval, :instance_eval, :class_eval, :module_eval].each do |name|
           @target.find_calls(name).each do |call|
+            next unless call.arguments
             call.arguments.arguments.each do |argument|
               if user_input?(argument)
                 warn! @target, self, call.location, "User input in eval"

data/lib/spektr/checks/file_access.rb

@@ -16,7 +16,7 @@ module Spektr
       def run
         return unless super
         targets = ["Dir", "File", "IO", "Kernel", "Net::FTP", "Net::HTTP", "PStore", "Pathname", "Shell"]
-        methods = [:[], :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
+        methods = [:[], :binread, :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
         targets.each do |target|
           methods.each do |method|
             check_calls_for_user_input(@target.find_calls(method, target.to_sym))

data/lib/spektr/targets/base.rb

@@ -1,13 +1,17 @@
 module Spektr
   module Targets
     class Base < Prism::Visitor
+      IGNORE_DIRECTIVE = /^\s*#\s*spektr:ignore\s+(.+)$/i
+
       attr_accessor :path, :name, :options, :ast, :parent, :parent_modules, :methods, :calls, :interpolated_xstrings, :lvars
 
       def initialize(path, content)
         Spektr.logger.debug "loading #{path}"
+        @source_lines = content.lines
         @ast = Prism.parse(content)
         @path = path
         return unless @ast
+        @name = ""
         @parent = ""
         @parent_modules = []
         @methods = []
@@ -20,6 +24,16 @@ module Spektr
         @name = @name.prepend("#{@parent_modules.map(&:name).join('::')}::") if @name && @parent_modules.any?
       end
 
+      def ignored_at?(line_number, check)
+        return false unless line_number && line_number > 1
+
+        directive = @source_lines[line_number - 2]&.match(IGNORE_DIRECTIVE)
+        return false unless directive
+
+        ignored_checks = directive[1].split(/\s+--\s+/, 2).first.split(',').map(&:strip)
+        ignored_checks.include?(check.name)
+      end
+
       def method_definitions
         @method_definitions ||= find_methods(node: @ast)
       end
@@ -76,12 +90,12 @@ module Spektr
           @parent = node.superclass.receiver.name.to_s
         when Prism::ConstantPathNode, Prism::ConstantReadNode
           @parent = node.superclass.name.to_s
-          @parent.prepend("#{node.superclass.parent.name}::") if node.superclass.respond_to?(:parent)
-          if node.superclass.respond_to?(:parent) && node.superclass.parent.respond_to?(:parent)
+          @parent.prepend("#{node.superclass.parent.name}::") if node.superclass.respond_to?(:parent) && node.superclass.parent
+          if node.superclass.respond_to?(:parent) && node.superclass.parent.respond_to?(:parent) && node.superclass.parent&.parent
             @parent.prepend("#{node.superclass.parent.parent.name}::")
           end
         end
-        if node.is_a?(Prism::ClassNode) && node.constant_path && node.constant_path.respond_to?(:parent)
+        if node.is_a?(Prism::ClassNode) && node.constant_path && node.constant_path.respond_to?(:parent) && node.constant_path.parent
           @parent = node.constant_path.parent.name.to_s
         end
         @parent = @parent.prepend("#{@parent_modules.map(&:name).join('::')}::") if @parent_modules.any?
@@ -89,7 +103,7 @@ module Spektr
       end
 
       def visit_module_node(node)
-        @parent_modules << node.constant_path.parent.name if node.constant_path && node.constant_path.respond_to?(:parent)
+        @parent_modules << node.constant_path.parent.name if node.constant_path && node.constant_path.respond_to?(:parent) && node.constant_path.parent
         @parent_modules << node
         super
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '0.5.6'
+  VERSION = '1.0.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 0.5.6
+  version: 1.0.1
 platform: ruby
 authors:
 - Greg Molnar
@@ -334,7 +334,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Rails static code analyzer for security issues
 test_files: []