spektr 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ddcc5f8096643294db83930d7df5cace71619eca037464d68e109ff6f3c9f190
-  data.tar.gz: d2a32908dbe7f10b1ee680a62c3442f44e0529b6ea50e3c352451086c5eb7a97
+  metadata.gz: 8a830f6b6b9be5ac380e1cbf4a755b9171b77f9835d9e3f62c5f62c411ba529e
+  data.tar.gz: 97a48a8cdaf9d5ab568dcc7d201daf1433b07c1a6043901c300147185ef99dec
 SHA512:
-  metadata.gz: f0d7a1db5105c0abc1413b81098cb76895b20bf42e94b33087e9c7a87860cbebaa78efd31fa2e569dacbe3c6df71007cc59dfbae7aa755c4ea049a1ce8890bed
-  data.tar.gz: d93c5cf94158219882efd1f6c9c756b2324e87d42a4dbd768479ea0ad1580e70a36e9fc74a249cab34e8cf06e20588cf7f4516a605192ec3da7a52dc25994add
+  metadata.gz: 162e450e6584062cf616d010401090d8e367041042aca79b3b1a6268948e3a99185bbe08ee4fa1928a13a3a45b9cdd5a05f165a282c4abec47f52e23c059b363
+  data.tar.gz: d61db3f6438d1ddcd64564815096beb67007539a543c90a0768423d41ede3bf571ea8acd7d167339ee4dde5074677d49719d0fb14fcebabe9fe9d22bc30b2ac9

data/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 1.0.1
+
+* various nil handling fixes
+
 ## 1.0.0
 
 * Add support for ignoring findings from specific checks with a `# spektr:ignore CHECK_NAME` source comment

data/CODE_OF_CONDUCT.md

@@ -1,3 +1,3 @@
-# Contributor Covenant Code of Conduct
+# Code of Conduct
 
 Same as Ruby: [https://www.ruby-lang.org/en/conduct/](https://www.ruby-lang.org/en/conduct/)

data/lib/spektr/checks/base.rb

@@ -65,7 +65,7 @@ module Spektr
         end
       when :keyword_hash_node, :hash_node
         node.elements.each do |element|
-          return true if user_input?(element.key)
+          return true if element.respond_to?(:key) && user_input?(element.key)
           return true if user_input?(element.value)
         end
       when :array_node
@@ -85,7 +85,7 @@ module Spektr
         actions.each do |action|
           next unless action.body
           action.body.each do |exp|
-            return true if exp.name == node.name && user_input?(exp)
+            return true if exp.respond_to?(:name) && exp.name == node.name && user_input?(exp)
           end
         end
       when :local_variable_read_node
@@ -137,7 +137,7 @@ module Spektr
         end
       when :keyword_hash_node, :hash_node
         node.elements.each do |element|
-          return true if model_attribute?(element.key)
+          return true if element.respond_to?(:key) && model_attribute?(element.key)
           return true if model_attribute?(element.value)
         end
       when :array_node
@@ -176,8 +176,9 @@ module Spektr
             }
           end
           actions.each do |action|
+            next unless action.body
             action.body.each do |exp|
-              next unless node.respond_to?(:name)
+              next unless exp.respond_to?(:name) && node.respond_to?(:name)
               return model_attribute?(exp.value) if exp.is_a?(Prism::InstanceVariableWriteNode) && exp.name == node.name
             end
           end

data/lib/spektr/checks/command_injection.rb

@@ -34,11 +34,7 @@ module Spektr
         # TODO: might need to exclude tempfile and ActiveStorage::Filename
         return if calls.empty?
         calls.each do |call|
-          if call.arguments.is_a?(Prism::ArgumentsNode)
-            argument = call.arguments.arguments.first
-          else
-            argument = call.arguments.first
-          end
+          argument = call.arguments.arguments.first if call.arguments.is_a?(Prism::ArgumentsNode)
           next unless argument
           if user_input?(argument) || model_attribute?(argument)
             warn! @target, self, call.location, "Command injection in #{call.name}"

data/lib/spektr/checks/content_tag_xss.rb

@@ -36,7 +36,7 @@ module Spektr
             end
             if argument.is_a?(Prism::KeywordHashNode)
               argument.elements.each do |element|
-                if user_input?(element.key)
+                if element.respond_to?(:key) && user_input?(element.key)
                   warn! @target, self, call.location, "Unescaped parameter in content_tag at #{element.key.name}"
                 end
               end

data/lib/spektr/checks/evaluation.rb

@@ -12,6 +12,7 @@ module Spektr
         return unless super
         [:eval, :instance_eval, :class_eval, :module_eval].each do |name|
           @target.find_calls(name).each do |call|
+            next unless call.arguments
             call.arguments.arguments.each do |argument|
               if user_input?(argument)
                 warn! @target, self, call.location, "User input in eval"

data/lib/spektr/targets/base.rb

@@ -11,6 +11,7 @@ module Spektr
         @ast = Prism.parse(content)
         @path = path
         return unless @ast
+        @name = ""
         @parent = ""
         @parent_modules = []
         @methods = []
@@ -89,12 +90,12 @@ module Spektr
           @parent = node.superclass.receiver.name.to_s
         when Prism::ConstantPathNode, Prism::ConstantReadNode
           @parent = node.superclass.name.to_s
-          @parent.prepend("#{node.superclass.parent.name}::") if node.superclass.respond_to?(:parent)
-          if node.superclass.respond_to?(:parent) && node.superclass.parent.respond_to?(:parent)
+          @parent.prepend("#{node.superclass.parent.name}::") if node.superclass.respond_to?(:parent) && node.superclass.parent
+          if node.superclass.respond_to?(:parent) && node.superclass.parent.respond_to?(:parent) && node.superclass.parent&.parent
             @parent.prepend("#{node.superclass.parent.parent.name}::")
           end
         end
-        if node.is_a?(Prism::ClassNode) && node.constant_path && node.constant_path.respond_to?(:parent)
+        if node.is_a?(Prism::ClassNode) && node.constant_path && node.constant_path.respond_to?(:parent) && node.constant_path.parent
           @parent = node.constant_path.parent.name.to_s
         end
         @parent = @parent.prepend("#{@parent_modules.map(&:name).join('::')}::") if @parent_modules.any?
@@ -102,7 +103,7 @@ module Spektr
       end
 
       def visit_module_node(node)
-        @parent_modules << node.constant_path.parent.name if node.constant_path && node.constant_path.respond_to?(:parent)
+        @parent_modules << node.constant_path.parent.name if node.constant_path && node.constant_path.respond_to?(:parent) && node.constant_path.parent
         @parent_modules << node
         super
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '1.0.0'
+  VERSION = '1.0.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Greg Molnar