spektr 1.0.0 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ddcc5f8096643294db83930d7df5cace71619eca037464d68e109ff6f3c9f190
-  data.tar.gz: d2a32908dbe7f10b1ee680a62c3442f44e0529b6ea50e3c352451086c5eb7a97
+  metadata.gz: e3ad6c1899df739d3af4a37a6e4494b6fc5daed76a1004130182e89222ce1c46
+  data.tar.gz: f4fb6570bfc3da7bb3c762ac5d2cc6278606410e7731489a287aea968a4bd5b8
 SHA512:
-  metadata.gz: f0d7a1db5105c0abc1413b81098cb76895b20bf42e94b33087e9c7a87860cbebaa78efd31fa2e569dacbe3c6df71007cc59dfbae7aa755c4ea049a1ce8890bed
-  data.tar.gz: d93c5cf94158219882efd1f6c9c756b2324e87d42a4dbd768479ea0ad1580e70a36e9fc74a249cab34e8cf06e20588cf7f4516a605192ec3da7a52dc25994add
+  metadata.gz: 32f425fb5c3d6c856f852936f5e138f1e9bff68984bcc681a4fe49a80099d3b8401f965b89d4ba64e69e5d92838f0543e9b80a5ce7bd96eea8cb3605a2e654d7
+  data.tar.gz: ac96dc9367cf88ea33b9994428ab3c089d70cd090b3d894e00d27c4cccae110ae79b0cca901b2e0eb1b37df67c46e97e5305df64fb4332c56d245959fe0610b8

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 1.0.2
+
+* Remove an accidental `byebug` require that caused scans to fail when development dependencies were not installed
+* Avoid false-positive XSS findings for route helpers in block-form `link_to` calls
+* Preserve dots in reported paths and stable warning fingerprints when scanning with `.` as the root
+* Require `tty-table` 0.10 or newer
+
+## 1.0.1
+
+* various nil handling fixes
+
 ## 1.0.0
 
 * Add support for ignoring findings from specific checks with a `# spektr:ignore CHECK_NAME` source comment

data/CODE_OF_CONDUCT.md

@@ -1,3 +1,3 @@
-# Contributor Covenant Code of Conduct
+# Code of Conduct
 
 Same as Ruby: [https://www.ruby-lang.org/en/conduct/](https://www.ruby-lang.org/en/conduct/)

data/lib/spektr/checks/base.rb

@@ -27,7 +27,7 @@ module Spektr
 
     def warn!(target, check, location, message, confidence = :high)
       full_path = target.is_a?(String) ? target : target.path
-      path = full_path.gsub(@app.root, "")
+      path = full_path.delete_prefix(@app.root)
       return if target.respond_to?(:ignored_at?) && target.ignored_at?(location&.start_line, check)
       return if dupe?(path, location, message)
 
@@ -65,7 +65,7 @@ module Spektr
         end
       when :keyword_hash_node, :hash_node
         node.elements.each do |element|
-          return true if user_input?(element.key)
+          return true if element.respond_to?(:key) && user_input?(element.key)
           return true if user_input?(element.value)
         end
       when :array_node
@@ -85,7 +85,7 @@ module Spektr
         actions.each do |action|
           next unless action.body
           action.body.each do |exp|
-            return true if exp.name == node.name && user_input?(exp)
+            return true if exp.respond_to?(:name) && exp.name == node.name && user_input?(exp)
           end
         end
       when :local_variable_read_node
@@ -137,7 +137,7 @@ module Spektr
         end
       when :keyword_hash_node, :hash_node
         node.elements.each do |element|
-          return true if model_attribute?(element.key)
+          return true if element.respond_to?(:key) && model_attribute?(element.key)
           return true if model_attribute?(element.value)
         end
       when :array_node
@@ -176,8 +176,9 @@ module Spektr
             }
           end
           actions.each do |action|
+            next unless action.body
             action.body.each do |exp|
-              next unless node.respond_to?(:name)
+              next unless exp.respond_to?(:name) && node.respond_to?(:name)
               return model_attribute?(exp.value) if exp.is_a?(Prism::InstanceVariableWriteNode) && exp.name == node.name
             end
           end

data/lib/spektr/checks/command_injection.rb

@@ -34,11 +34,7 @@ module Spektr
         # TODO: might need to exclude tempfile and ActiveStorage::Filename
         return if calls.empty?
         calls.each do |call|
-          if call.arguments.is_a?(Prism::ArgumentsNode)
-            argument = call.arguments.arguments.first
-          else
-            argument = call.arguments.first
-          end
+          argument = call.arguments.arguments.first if call.arguments.is_a?(Prism::ArgumentsNode)
           next unless argument
           if user_input?(argument) || model_attribute?(argument)
             warn! @target, self, call.location, "Command injection in #{call.name}"

data/lib/spektr/checks/content_tag_xss.rb

@@ -36,7 +36,7 @@ module Spektr
             end
             if argument.is_a?(Prism::KeywordHashNode)
               argument.elements.each do |element|
-                if user_input?(element.key)
+                if element.respond_to?(:key) && user_input?(element.key)
                   warn! @target, self, call.location, "Unescaped parameter in content_tag at #{element.key.name}"
                 end
               end

data/lib/spektr/checks/evaluation.rb

@@ -12,6 +12,7 @@ module Spektr
         return unless super
         [:eval, :instance_eval, :class_eval, :module_eval].each do |name|
           @target.find_calls(name).each do |call|
+            next unless call.arguments
             call.arguments.arguments.each do |argument|
               if user_input?(argument)
                 warn! @target, self, call.location, "User input in eval"

data/lib/spektr/checks/link_to_href.rb

@@ -1,6 +1,10 @@
 module Spektr
   class Checks
     class LinkToHref < Base
+      # Route helpers build the href themselves and escape any interpolated
+      # values, so user input reaching one is not an XSS sink.
+      ROUTE_HELPER = /_url$|_path$/
+
       def initialize(app, target)
         super
         @name = "XSS in href param of link_to"
@@ -14,9 +18,11 @@ module Spektr
         block_locations = []
         @target.find_calls_with_block(:link_to).each do |call|
           block_locations << call.location
-          next unless call.arguments.arguments.first
-          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments.first.inspect}"
-          if user_input? call.arguments.arguments.first
+          href = call.arguments.arguments.first
+          next unless href
+          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{href.inspect}"
+          next if route_helper?(href)
+          if user_input? href
             warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
           end
         end
@@ -24,18 +30,21 @@ module Spektr
         @target.find_calls(:link_to).each do |call|
           next if block_locations.include? call.location
           next unless call.arguments
-          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments[1].inspect}"
-          next unless call.arguments.arguments[1]
-          require 'byebug'
-          if call.arguments.arguments[1] && call.arguments.arguments[1].respond_to?(:name)
-            name = call.arguments.arguments[1].name
-          end
-          next if name && name =~ /_url$|_path$/
-          if user_input? call.arguments.arguments[1]
+          href = call.arguments.arguments[1]
+          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{href.inspect}"
+          next unless href
+          next if route_helper?(href)
+          if user_input? href
             warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
           end
         end
       end
+
+      private
+
+      def route_helper?(node)
+        node.respond_to?(:name) && node.name.to_s =~ ROUTE_HELPER
+      end
     end
   end
 end

data/lib/spektr/targets/base.rb

@@ -11,6 +11,7 @@ module Spektr
         @ast = Prism.parse(content)
         @path = path
         return unless @ast
+        @name = ""
         @parent = ""
         @parent_modules = []
         @methods = []
@@ -89,12 +90,12 @@ module Spektr
           @parent = node.superclass.receiver.name.to_s
         when Prism::ConstantPathNode, Prism::ConstantReadNode
           @parent = node.superclass.name.to_s
-          @parent.prepend("#{node.superclass.parent.name}::") if node.superclass.respond_to?(:parent)
-          if node.superclass.respond_to?(:parent) && node.superclass.parent.respond_to?(:parent)
+          @parent.prepend("#{node.superclass.parent.name}::") if node.superclass.respond_to?(:parent) && node.superclass.parent
+          if node.superclass.respond_to?(:parent) && node.superclass.parent.respond_to?(:parent) && node.superclass.parent&.parent
             @parent.prepend("#{node.superclass.parent.parent.name}::")
           end
         end
-        if node.is_a?(Prism::ClassNode) && node.constant_path && node.constant_path.respond_to?(:parent)
+        if node.is_a?(Prism::ClassNode) && node.constant_path && node.constant_path.respond_to?(:parent) && node.constant_path.parent
           @parent = node.constant_path.parent.name.to_s
         end
         @parent = @parent.prepend("#{@parent_modules.map(&:name).join('::')}::") if @parent_modules.any?
@@ -102,7 +103,7 @@ module Spektr
       end
 
       def visit_module_node(node)
-        @parent_modules << node.constant_path.parent.name if node.constant_path && node.constant_path.respond_to?(:parent)
+        @parent_modules << node.constant_path.parent.name if node.constant_path && node.constant_path.respond_to?(:parent) && node.constant_path.parent
         @parent_modules << node
         super
       end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '1.0.0'
+  VERSION = '1.0.2'
 end

data/spektr.gemspec

@@ -36,7 +36,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'tty-color'
   spec.add_dependency 'tty-option'
   spec.add_dependency 'tty-spinner'
-  spec.add_dependency 'tty-table'
+  spec.add_dependency 'tty-table', '>= 0.10'
   spec.add_dependency 'zeitwerk', '>= 2.6'
 
   spec.add_development_dependency 'byebug'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.2
 platform: ruby
 authors:
 - Greg Molnar
@@ -141,14 +141,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.10'
 - !ruby/object:Gem::Dependency
   name: zeitwerk
   requirement: !ruby/object:Gem::Requirement