veracode 1.0.0.alpha16 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f9679b127c0fea3a3044f5470c2336d02dcbd3c453df0bdc121827d41ce27c7
-  data.tar.gz: c4a8fb0378e691164646c70f53e8c866b4355fad557daedbc701d4afc05f695b
+  metadata.gz: f66a40787c8297707914cc96ba81def96cff04a70d119b07bbd84c3fc59933d3
+  data.tar.gz: 1183be46375e9050ffa70a61565f17c428fc2478a03ef7f80d09658a3cdda9e0
 SHA512:
-  metadata.gz: 431b1b21871f274c9c394fff11873bf53730356f5c589aa439f59ab857c6dbcc22e9297d7dbd1f479438eafc0b25ca15cb7cbf5c5dc36f2346246670fd135f40
-  data.tar.gz: fb1c0e34fc6d61955557b439f7b855b977cdaa5431684654a03868021913cd2137f0ad64688f7eeca36e4723ace8024a84434af37d4c6a3dcfd1768a35ab022a
+  metadata.gz: 285a3853aed2b60503bbd7d042fe4a3a9d9f7b5652a6435791ff909774b9ab46b955fdf41f962bc78cb10c290c96e878804da389ebf83f777c5a336ad739b659
+  data.tar.gz: 27e5ac6b2d3fdb44d36284a131f8b337daa0529e06e0dbf042751df169dddb2b51d7b395013e2fc03a3556c7afd2f96ed6016b644ddfa8ded6c6b3cf5b7ef5d4

data/bin/veracode

@@ -23,8 +23,13 @@ require 'veracode/version'
 $options =  {
               :archive_source => true,
               :include_inherited => false,
-              :jruby => false,
               :environment => false,
+              :verbose => false,
+              :jruby => false,
+              :skipactiverecord => false,
+              :skipactionview => false,
+              :skipsprockets => false,
+              :snapshot => false
             }
 
 subcommand = ARGV.shift
@@ -61,6 +66,10 @@ case subcommand
         $DEBUG = true
       end
 
+      opts.on("--debug-snapshot", "Generate a snapshot of the prepare state for Veracode debugging.") do 
+        $options[:snapshot] = true
+      end
+
     end.parse!
 
     Veracode.prepare

data/lib/veracode.rb

@@ -36,6 +36,7 @@ module Veracode
   @archive_filename = nil
   @archive_dirname = nil
 
+  @expanded_app_dir = Dir.getwd
 
   def self.init
     if Gem::Dependency.new('', '~> 2.2.0').match?('', RUBY_VERSION)
@@ -120,10 +121,11 @@ module Veracode
 
     @manifest += Dir.glob("*").keep_if {|f| File.file?(f)}
 
-#     {app config db doc lib log public script test tmp vendor}
-    %w{app config        lib log public script          vendor}.each {|dirname|
+    #{app config db doc lib log public script test tmp vendor}
+    %w{app config lib log public script}.each {|dirname|
       @manifest += Dir[File.join(dirname, "**", "*")].keep_if {|f| File.file?(f)}
     }
+    @manifest += Dir[File.join("vendor", "**", "*.rb")]
     @manifest += Dir[File.join("db", "**", "*.rb")]
 
     if $options[:archive_source]
@@ -202,7 +204,11 @@ module Veracode
       exit
     end
 
-    puts "Please upload #{@archive_filename}"
+    if $options[:snapshot]
+      puts "Please provide #{@archive_filename} to veracode for further investigation."
+    else
+      puts "Please upload #{@archive_filename}"
+    end
   end
 
   def self.cleanup
@@ -284,23 +290,27 @@ module Veracode
   end
 
   def self.safe_name(o)
-    case 
-    when o == ActiveSupport::TimeWithZone
-      "ActiveSupport::TimeWithZone"
-    when o.is_a?(Module)
-      begin
-        ( o.name.nil? ? o.to_s : o.name.to_s )
-      rescue
+    begin
+      case 
+      when o == ActiveSupport::TimeWithZone
+        "ActiveSupport::TimeWithZone"
+      when o.is_a?(Module)
         begin
-          ( o.nil? ? "nil" : o.to_s )
+          ( o.name.nil? ? o.to_s : o.name.to_s )
         rescue
-          "nil"
+          begin
+            ( o.nil? ? "nil" : o.to_s )
+          rescue
+              ( o == nil ? "nil" : o.to_s ) # in case of monkey patched nil?
+          end
         end
+      when o.is_a?(Method), o.is_a?(UnboundMethod)
+        o.name.to_s
+      else
+        o.to_s
       end
-    when o.is_a?(Method), o.is_a?(UnboundMethod)
-      o.name.to_s
-    else
-      o.to_s
+    rescue
+      "Veracode" #should result in this being dropped from the archive since we can't get a safe name for it
     end
   end
   
@@ -392,8 +402,8 @@ module Veracode
 
     if with_disasm
       insns = RubyVM::InstructionSequence.disassemble(m)
-      formatted += ( (insns.nil? || insns.empty?) ? 
-                     "== disasm\n== end disasm\n" : 
+      formatted += ( (insns.nil? || insns.empty? || insns[/.*#{@expanded_app_dir}.*/].nil?) ? 
+                     "\n" :
                      "#{insns}== end disasm\n" 
                    )
     end
@@ -419,20 +429,25 @@ module Veracode
   ##############################################################################
   # Archiving Headers
   def self.class_header(c)
-    return "" unless c.is_a? Class
+    begin
+      return "" unless c.is_a? Class
+
+      puts "  class header" if $options[:verbose]
 
-    puts "  class header" if $options[:verbose]
+      case
+      when c.superclass.nil? # this should only happen for BasicObject
+        return ""
+      when c.superclass.name.nil? # in case the parent is anonymous
+        name = c.superclass.to_s.dump
+      else
+        name = c.superclass.name.dump
+      end
 
-    case
-    when c.superclass.nil? # this should only happen for BasicObject
+      "superclass #{name}\n"
+    rescue Exception => e
+      log_error e.message
       return ""
-    when c.superclass.name.nil? # in case the parent is anonymous
-      name = c.superclass.to_s.dump
-    else
-      name = c.superclass.name.dump
     end
-
-    "superclass #{name}\n"
   end
 
   def self.module_header(m)
@@ -531,7 +546,14 @@ module Veracode
   end
 
   def self.object_contents(o, with_disasm=true)
-    return "" unless !o.nil? && o.is_a?(Object)
+    begin
+      return "" unless !o.nil?
+    rescue Exception => e
+      log_error "Error testing #{o} with nil?. Probable monkey patching. #{e.message}"
+      return "" if o == nil
+    end
+
+    return "" unless o.is_a?(Object)
 
     puts "  object contents" if $options[:verbose]
 
@@ -575,12 +597,28 @@ module Veracode
   ##############################################################################
   # Archiving Objects
   def self.archive(objects, with_disasm=true)
-    objects = objects - [
-                            Veracode, 
-                            Veracode::ActiveRecord, 
-                            Veracode::ActiveRecord::Model, 
-                            Veracode::ActiveRecord::Schema,
-                           ]
+    veracode_artifacts = Set[
+      safe_name(Veracode),
+      safe_name(Veracode::ActiveRecord),
+      safe_name(Veracode::ActiveRecord::Model),
+      safe_name(Veracode::ActiveRecord::Schema)
+    ]
+    rails_filters = [
+      "ActionCable::",
+      "ActionController::",
+      "ActionDispatch::",
+      "ActionMailer::",
+      "ActiveJob::",
+      "ActiveSupport::",
+      "ActiveStorage::",
+      "ActionView::(?!CompiledTemplates)", #Allows Compiled templates with the not group
+      "ActiveRecord::",
+    ]
+    objects = objects.reject do |o|
+      sn = safe_name(o).dup
+      while with_disasm && !sn.slice!(/^#<(Class|Module):/).nil? do sn = sn[0..-2] end #strip #<Class: and #<Module: prefix, strip corresponding > suffix
+      veracode_artifacts.include?(sn) || (with_disasm && sn[/^(#{rails_filters.join('|')}).*/])
+    end
 
     if $options[:verbose]
       puts "Archiving #{objects.count.to_s} objects" + (with_disasm ? " with disassembly" : "")
@@ -589,18 +627,47 @@ module Veracode
 
     objects.sort_by {|o| safe_name(o) }.each do |o|
 
-    puts "archiving #{o.class.to_s.downcase} #{quote(safe_name(o))}" if $options[:verbose]
+      sn = safe_name(o)
+      puts "archiving #{o.class.to_s.downcase} #{quote(sn)}" if $options[:verbose]
 
-    add_to_archive "#{o.class.to_s.downcase} #{quote(safe_name(o))}\n" + 
+      add_to_archive "#{o.class.to_s.downcase} #{quote(sn)}\n" + 
                    ( o.is_a?(Class)  ? class_header(o)  : "") + # superclass
+                   ( @rails6 && sn == "ActionView::Base" ? "include \"ActionView::CompiledTemplates\"\n" : "") + #hack for rails 6 compiled template output
                    ( o.is_a?(Module) ? module_header(o) : "") + # included modules
-                   ( (o.is_a?(Object) && !o.nil?) ? object_contents(o, with_disasm) : "") + 
+                   ( o.is_a?(Object) ? object_contents(o, with_disasm) : "") + 
                    ( o.is_a?(Module) ? module_contents(o, with_disasm) : "") + 
                    "end#{o.class.to_s.downcase}\n" + 
                    "\n"
     end
   end
 
+  def self.archive_rails6_templates
+    puts "archiving views" if $options[:verbose]
+    o = @view.compiled_method_container
+    compiled_views = o.instance_methods - @view_methods
+    formatted_contents = ""
+    for m_symbol in compiled_views
+      begin
+        m = o.instance_method(m_symbol)
+        formatted_contents += format_method(m, "public_instance", true)
+      rescue Exception => e
+        log_error "Error archiving singleton method #{m_symbol.to_s.dump}: #{e.message}"
+      end
+    end
+    # fake the module outpput to match what SAF expects from Rails <= 5
+    add_to_archive "module \"ActionView::CompiledTemplates\"\n" + 
+                   "extend \"ActiveSupport::Dependencies::ModuleConstMissing\"\n" +
+                   "extend \"Module::Concerning\"\n" +
+                   "extend \"ActiveSupport::ToJsonWithActiveSupportEncoder\"\n" +
+                   "extend \"PP::ObjectMixin\"\n" +
+                   "extend \"ActiveSupport::Dependencies::Loadable\"\n" +
+                   "extend \"JSON::Ext::Generator::GeneratorMethods::Object\"\n" +
+                   "extend \"ActiveSupport::Tryable\"\n" +
+                   "extend \"Kernel\"\n" +
+                   formatted_contents +
+                   "endmodule\n"
+  end
+
 
   def self.compile_templates
 
@@ -647,7 +714,7 @@ module Veracode
     assigns = {}
     view = ActionView::Base.new(view_paths, assigns)
     begin
-      controller_view = ApplicationController.new.view_context
+        
     rescue Exception => e
       log_error "Unable to get controller view context (#{e.message})"
     end
@@ -663,9 +730,11 @@ module Veracode
       end
     }
 
-    puts "Compiled #{ActionView::CompiledTemplates.instance_methods.count.to_s} templates" if $options[:verbose]
-    log_error "Compiled #{ActionView::CompiledTemplates.instance_methods.count.to_s} templates"
-    log_error "Not all templates were compiled" if ActionView::CompiledTemplates.instance_methods.count < templates.count
+    unless @rails6
+      puts "Compiled #{ActionView::CompiledTemplates.instance_methods.count.to_s} templates" if $options[:verbose]
+      log_error "Compiled #{ActionView::CompiledTemplates.instance_methods.count.to_s} templates"
+      log_error "Not all templates were compiled" if ActionView::CompiledTemplates.instance_methods.count < templates.count
+    end
   end
 
   def self.compile_erb_templates
@@ -708,7 +777,9 @@ module Veracode
         )
 
         case t.method(:compile).arity
-        when 2  # Rails 3.1.0+
+        when 1 # Rails 6
+          t.send(:compile, @view)
+        when 2 # Rails 3.1.0+
           t.send(:compile, ActionView::Base.new, ActionView::CompiledTemplates)
         when 3
           t.send(:compile, {}, ActionView::Base.new, ActionView::CompiledTemplates)
@@ -721,7 +792,7 @@ module Veracode
 
     }
 
-    puts "Compiled templates: " + ActionView::CompiledTemplates.instance_methods.count.to_s if $options[:verbose]
+    puts "Compiled templates: " + ActionView::CompiledTemplates.instance_methods.count.to_s if $options[:verbose] && !@rails6
 
   end
 
@@ -764,7 +835,9 @@ module Veracode
         )
 
         case t.method(:compile).arity
-        when 2  # Rails 3.1.0+
+        when 1 # Rails 6
+          t.send(:compile, @view) 
+        when 2 # Rails 3.1.0+
           t.send(:compile, ActionView::Base.new, ActionView::CompiledTemplates)
         when 3
           t.send(:compile, {}, ActionView::Base.new, ActionView::CompiledTemplates)
@@ -777,7 +850,7 @@ module Veracode
 
     }
 
-    puts "Compiled templates: " + ActionView::CompiledTemplates.instance_methods.count.to_s if $options[:verbose]
+    puts "Compiled templates: " + ActionView::CompiledTemplates.instance_methods.count.to_s if $options[:verbose] && !@rails6
 
   end
 
@@ -795,6 +868,9 @@ module Veracode
               lib = "#{part}/#{lib}"
               lib = lib[0..lib.length-2] if lib[lib.length-1] == '/'
             begin
+              if @rails6 && (lib =~ /node_modules/ || lib == 'debug')
+                next
+              end
               if cond_require lib
                 puts "requiring #{lib}" if $options[:verbose]
               end
@@ -834,9 +910,6 @@ def self.require_rails(gemdir)
   end
 end
 
-
-
-
 ################################################################################
 # Subcommands
   def self.prepare
@@ -888,11 +961,12 @@ end
       puts "Required rails" if $options[:verbose]
     end
 
+    @rails6 = Gem::Version.new(Rails.version) >= Gem::Version.new("6.0.0")
     ## Imitate script/rails
     # APP_PATH = File.expand_path('config/application')
-      # APP_PATH is already set in bin/veracode
+    # APP_PATH is already set in bin/veracode
     #require File.expand_path('../../config/boot',  __FILE__)
-      glob_require "config/boot.rb"
+    glob_require "config/boot.rb"
     #require 'rails/commands'
       # this will trigger the console to be launched
       # ARGV.clear
@@ -901,7 +975,16 @@ end
       # require 'rails/commands'
 
     ## Imitate rails/commands when console
-    cond_require 'rails/commands/console.rb'
+    if @rails6 || Gem::Version.new(Rails.version) >= Gem::Version.new("5.1.0")
+      cond_require 'rails/command.rb'
+      cond_require 'rails/command/actions.rb'
+      cond_require 'rails/command/base.rb'
+      cond_require 'rails/command/behavior.rb'
+      cond_require 'rails/command/environment_argument.rb'
+      cond_require 'rails/commands/console/console_command.rb'
+    else 
+      cond_require 'rails/commands/console.rb'
+    end
     # require APP_PATH # => config/application.rb
 
     glob_require "config/application.rb"
@@ -937,36 +1020,63 @@ end
 
     puts "Phase 3 - Imitate Rails" if $options[:verbose]
 
-    any_new = true
-    while any_new
-      any_new = false
-      any_new |= glob_require "lib/**/*.rb"
-      any_new |= glob_require "app/**/*.rb"
-      puts "new successful requires? #{any_new.to_s}" if $options[:verbose]
-    end
+    begin
+      any_new = true
+      while any_new
+        any_new = false
+        any_new |= glob_require "lib/**/*.rb"
+        any_new |= glob_require "app/**/*.rb"
+        puts "new successful requires? #{any_new.to_s}" if $options[:verbose]
+      end
 
-    compile_templates
+      begin
+        if @rails6
+          self.update
+          @view = ActionView::Base.with_empty_template_cache
+          @view_methods = @view.compiled_method_container.instance_methods
+          compile_erb_templates
+          compile_haml_templates
+          self.stats if $options[:verbose]
+        else
+          compile_templates
+          self.update
+          self.stats if $options[:verbose]
+        end
+      rescue Exception => e
+        puts "Unable to compile templates: #{e.message}" if $options[:verbose]
+        log_error "Unable to compile templates: #{e.message}"
+      end
 
-    self.update
-    self.stats if $options[:verbose]
+      # Ensure compiled templates are fully disassembled in archive
+      @baseline_modules.delete(ActionView::CompiledTemplates) unless @rails6
 
-    # Ensure compiled templates are fully disassembled in archive
-    @baseline_modules.delete(ActionView::CompiledTemplates)
+      if $options[:environment]
+        puts "Processing and disassembling environment"
+        archive(@modules.reject  {|o| safe_name(o) =~ /^#<(Class|Module):0x[0-9a-f]+>/i }
+                        .reject  {|o| safe_name(o) =~ /^Veracode/ }
+                        .reject  {|o| safe_name(o) =~ /^EmptyRails/ }
+                        .reject  {|o| safe_name(o) =~ /^ActionView::CompiledTemplates$/ }, false)
+      else
+        puts "Processing Ruby and Rails classes and modules"
+        archive(@baseline_modules, false)
+        add_to_archive "\n# Phase 3 - App disassembly\n"
+        puts "Processing and disassembling #{APP_NAME} classes and modules"
+        safe_baseline_modules = @baseline_modules.each_with_object(Set.new) { |o, s| s << safe_name(o) }
+        archive(@modules.reject {|o| safe_baseline_modules.include?(safe_name(o))}, true)
+        if @rails6
+          archive_rails6_templates()
+        end
+        archive_schema
 
-    if $options[:environment]
-      puts "Processing and disassembling environment"
-      archive(@modules.reject  {|o| safe_name(o) =~ /^#<(Class|Module):0x[0-9a-f]+>/i }
-                      .reject  {|o| safe_name(o) =~ /^Veracode/ }
-                      .reject  {|o| safe_name(o) =~ /^EmptyRails/ }
-                      .reject  {|o| safe_name(o) =~ /^ActionView::CompiledTemplates$/ }, false)
-    else
-      puts "Processing Ruby and Rails classes and modules"
-      archive(@baseline_modules, false)
-      add_to_archive "\n# Phase 3 - App disassembly\n"
-      puts "Processing and disassembling #{APP_NAME} classes and modules"
-      archive(@modules - @baseline_modules, true)
-      archive_schema
+      end
 
+    rescue Exception => e
+      if $options[:snapshot]
+        log_error e.message
+        log_error e.backtrace.join("\n")
+      else
+        raise
+      end
     end
 
     ## /phase 3 - require app

data/lib/veracode/version.rb

@@ -1,4 +1,4 @@
 module Veracode
-  VERSION = '1.0.0.alpha16'
-  ARCHIVE_VERSION = '2012-07-04'
+  VERSION = '1.0.1'
+  ARCHIVE_VERSION = '2020-06-29'
 end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: veracode
 version: !ruby/object:Gem::Version
-  version: 1.0.0.alpha16
+  version: 1.0.1
 platform: ruby
 authors:
 - Veracode
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-04-24 00:00:00.000000000 Z
+date: 2021-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
 description: Prepares your Ruby on Rails app for submission to Veracode.
 email: devcontact@veracode.com
 executables:
@@ -39,7 +39,7 @@ files:
 homepage: http://veracode.com/
 licenses: []
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -50,13 +50,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.8
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: Command line tool for preparing your Ruby on Rails app for submission to
   Veracode