spektr 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a830f6b6b9be5ac380e1cbf4a755b9171b77f9835d9e3f62c5f62c411ba529e
-  data.tar.gz: 97a48a8cdaf9d5ab568dcc7d201daf1433b07c1a6043901c300147185ef99dec
+  metadata.gz: e3ad6c1899df739d3af4a37a6e4494b6fc5daed76a1004130182e89222ce1c46
+  data.tar.gz: f4fb6570bfc3da7bb3c762ac5d2cc6278606410e7731489a287aea968a4bd5b8
 SHA512:
-  metadata.gz: 162e450e6584062cf616d010401090d8e367041042aca79b3b1a6268948e3a99185bbe08ee4fa1928a13a3a45b9cdd5a05f165a282c4abec47f52e23c059b363
-  data.tar.gz: d61db3f6438d1ddcd64564815096beb67007539a543c90a0768423d41ede3bf571ea8acd7d167339ee4dde5074677d49719d0fb14fcebabe9fe9d22bc30b2ac9
+  metadata.gz: 32f425fb5c3d6c856f852936f5e138f1e9bff68984bcc681a4fe49a80099d3b8401f965b89d4ba64e69e5d92838f0543e9b80a5ce7bd96eea8cb3605a2e654d7
+  data.tar.gz: ac96dc9367cf88ea33b9994428ab3c089d70cd090b3d894e00d27c4cccae110ae79b0cca901b2e0eb1b37df67c46e97e5305df64fb4332c56d245959fe0610b8

data/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 1.0.2
+
+* Remove an accidental `byebug` require that caused scans to fail when development dependencies were not installed
+* Avoid false-positive XSS findings for route helpers in block-form `link_to` calls
+* Preserve dots in reported paths and stable warning fingerprints when scanning with `.` as the root
+* Require `tty-table` 0.10 or newer
+
 ## 1.0.1
 
 * various nil handling fixes

data/lib/spektr/checks/base.rb

@@ -27,7 +27,7 @@ module Spektr
 
     def warn!(target, check, location, message, confidence = :high)
       full_path = target.is_a?(String) ? target : target.path
-      path = full_path.gsub(@app.root, "")
+      path = full_path.delete_prefix(@app.root)
       return if target.respond_to?(:ignored_at?) && target.ignored_at?(location&.start_line, check)
       return if dupe?(path, location, message)
 

data/lib/spektr/checks/link_to_href.rb

@@ -1,6 +1,10 @@
 module Spektr
   class Checks
     class LinkToHref < Base
+      # Route helpers build the href themselves and escape any interpolated
+      # values, so user input reaching one is not an XSS sink.
+      ROUTE_HELPER = /_url$|_path$/
+
       def initialize(app, target)
         super
         @name = "XSS in href param of link_to"
@@ -14,9 +18,11 @@ module Spektr
         block_locations = []
         @target.find_calls_with_block(:link_to).each do |call|
           block_locations << call.location
-          next unless call.arguments.arguments.first
-          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments.first.inspect}"
-          if user_input? call.arguments.arguments.first
+          href = call.arguments.arguments.first
+          next unless href
+          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{href.inspect}"
+          next if route_helper?(href)
+          if user_input? href
             warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
           end
         end
@@ -24,18 +30,21 @@ module Spektr
         @target.find_calls(:link_to).each do |call|
           next if block_locations.include? call.location
           next unless call.arguments
-          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments[1].inspect}"
-          next unless call.arguments.arguments[1]
-          require 'byebug'
-          if call.arguments.arguments[1] && call.arguments.arguments[1].respond_to?(:name)
-            name = call.arguments.arguments[1].name
-          end
-          next if name && name =~ /_url$|_path$/
-          if user_input? call.arguments.arguments[1]
+          href = call.arguments.arguments[1]
+          ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{href.inspect}"
+          next unless href
+          next if route_helper?(href)
+          if user_input? href
             warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
           end
         end
       end
+
+      private
+
+      def route_helper?(node)
+        node.respond_to?(:name) && node.name.to_s =~ ROUTE_HELPER
+      end
     end
   end
 end

data/lib/spektr/version.rb

@@ -1,3 +1,3 @@
 module Spektr
-  VERSION = '1.0.1'
+  VERSION = '1.0.2'
 end

data/spektr.gemspec

@@ -36,7 +36,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'tty-color'
   spec.add_dependency 'tty-option'
   spec.add_dependency 'tty-spinner'
-  spec.add_dependency 'tty-table'
+  spec.add_dependency 'tty-table', '>= 0.10'
   spec.add_dependency 'zeitwerk', '>= 2.6'
 
   spec.add_development_dependency 'byebug'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spektr
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Greg Molnar
@@ -141,14 +141,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.10'
 - !ruby/object:Gem::Dependency
   name: zeitwerk
   requirement: !ruby/object:Gem::Requirement