tainted_love 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea2bb8edc59c047e25dfca2ee1e8375a008ccf93c4e98e4746854c404cc7d11d
-  data.tar.gz: c23dd71cd581ab0a27e3df8d9e137f91cf203cefabb304b7761bb86f7a44f1b3
+  metadata.gz: 8d0dcb453bcce3f13b5655307c9ce22bbe47f8232dc2b8920a887aa0da301b08
+  data.tar.gz: 9d9fd135566c29aa7fb4e1703a95f5d4cf55a4e3a86f3741d82d7a8e43c1a9e4
 SHA512:
-  metadata.gz: b8ae7c54209f62bc4ecf0257b470bdc2733b93b69f35635b40555cd6f42eb479755a69e0a971016a1d164071801db4af7e7ae5f933b44b211140ab3c4ca5f688
-  data.tar.gz: c5e76a2da036357ba6a73c3a01c01d717362077adfd29bbfe0b5b2ed4ce0b95fa6fe13e3c05bad779669c8eaf024ea32184e8b5b79aedbdcc435565e94eee6c0
+  metadata.gz: 7479db0de47a8dd343855a7ccfd928c42d7abf401e99d78d44ed2300725f401e385db01ff99285cd0c2af5c15395af58043623ed803e54c44b4efd10b7e59943
+  data.tar.gz: 075ef8c8b4df823d281ac1bab1ba593dd75acbb040e7c4037a8431a32072e77b6b5b4e3b11a41ca70c2b593dde1b888a7088483ec82cdf429fd05986b3da5db4

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    tainted_love (0.4.0)
+    tainted_love (0.4.1)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -4,6 +4,8 @@
 
 # TaintedLove
 
+Note: [Ruby 2.7+ removed support of the taint checking mechanism](https://blog.saeloun.com/2020/02/18/ruby-2-7-access-and-setting-of-safe-warned-will-become-global-variable)
+
 TaintedLove is a dynamic security analysis tool for Ruby. It leverages Ruby's object tainting and monkey patching features to identify vulnerable code paths at runtime.
 
 - [Getting Started](https://github.com/Shopify/tainted_love/wiki/Getting-Started)
@@ -83,7 +85,6 @@ Model.order(tainted_input)
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `bin/test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
 To install this gem onto your local machine, run `bundle exec rake install`.
 
 ## Contributing

data/lib/tainted_love.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require 'tainted_love/replacer/base'
+require 'tainted_love/validator/base'
+require 'tainted_love/reporter/base'
 Dir[File.dirname(__FILE__) + '/tainted_love/**/*.rb'].each { |f| require f }
 
 module TaintedLove

data/lib/tainted_love/replacer/replace_active_record.rb

@@ -40,8 +40,12 @@ module TaintedLove
         mod = Module.new do
           [:find_by_sql, :count_by_sql].each do |method|
             define_method(method) do |*args|
-              if args.first.tainted?
-                TaintedLove.report(:ReplaceActiveRecord, args.first, [:sqli], "Model##{method} using tainted string")
+
+              # skip if find_by_sql is coming from find_by because the where monkey-patch will catch it
+              unless Thread.current.backtrace(3).take(1).first["in `find_by'"]
+                if args.first.tainted?
+                  TaintedLove.report(:ReplaceActiveRecord, args.first, [:sqli], "Model##{method} using tainted string")
+                end
               end
 
               super(*args)

data/lib/tainted_love/replacer/replace_string.rb

@@ -2,7 +2,7 @@ module TaintedLove
   module Replacer
     class ReplaceString < Base
       WRAP_METHODS = [
-        :+, :*, :[], :[]= , :sub, :replace, :strip, :strip!, :inspect
+        :+, :*, :[], :[]= , :replace, :strip, :strip!, :inspect
       ]
 
       def replace!
@@ -27,28 +27,6 @@ module TaintedLove
             wrap_call(sym)
           end
 
-          def gsub(*args, &block)
-            # Context for this hack: https://stackoverflow.com/a/52783055/3349159
-
-            match(args.first)
-
-            unless block.nil?
-              block.binding.tap do |b|
-                b.local_variable_set(:_tainted_love_tilde_variable, $~)
-                b.eval("$~ = _tainted_love_tilde_variable")
-              end
-            end
-
-            result = super(*args, &block)
-
-            result.tainted_love_tags += tainted_love_tags if tainted?
-            args.select(&:tainted?).each do |arg|
-              result.tainted_love_tags += arg.tainted_love_tags
-            end
-
-            result
-          end
-
           def split(*args)
             result = super(*args)
 

data/lib/tainted_love/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module TaintedLove
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

data/tests/rails/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../..
   specs:
-    tainted_love (0.4.0)
+    tainted_love (0.4.1)
 
 GEM
   remote: https://rubygems.org/

data/tests/rails/test/replacers/replace_active_record_test.rb

@@ -12,6 +12,11 @@ class ReplaceActiveRecordTest < ActiveSupport::TestCase
     assert_report do
       Product.where("id = ?".taint, 1)
       Product.where("id = ?", 1)
+
+      # these should not report
+      Product.where(id: 1)
+      Product.where(id: "1")
+      Product.where(id: "1".taint)
     end
   end
 
@@ -23,9 +28,10 @@ class ReplaceActiveRecordTest < ActiveSupport::TestCase
   end
 
   test "doesn't report when a hash is used with find_by" do
-    assert_report(0) do
+    assert_report do
       Product.find_by(id: 1)
       Product.find_by(name: "name".taint)
+      Product.find_by("name".taint) # this should report
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tainted_love
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Benoit Cote-Jodoin
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-08-07 00:00:00.000000000 Z
+date: 2020-02-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler