@critiq/rules 0.3.0 → 0.4.0

package/rules/python/py.security.weak-hash-algorithm.rule.yaml

@@ -0,0 +1,57 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: py.security.weak-hash-algorithm
+  aliases:
+    - BAN-B303
+    - BAN-B324
+  title: Avoid weak cryptographic hash algorithms
+  summary: Python security-sensitive hashing should use SHA-256 or stronger, not MD5 or SHA-1.
+  rationale: SHA-1 and MD5 are collision-vulnerable and unsuitable for signatures, session tokens, or integrity checks in production services.
+  detection:
+    kind: pattern
+  references:
+    - kind: cwe
+      id: CWE-327
+      title: Use of a Broken or Risky Cryptographic Algorithm
+    - kind: owasp
+      title: Cryptographic Storage Cheat Sheet
+      url: https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
+  tags:
+    - security
+    - python
+    - crypto
+    - hashing
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - python
+  paths:
+    include:
+      - "**/*.py"
+    exclude:
+      - "**/tests/**"
+      - "**/test_*.py"
+      - "**/*_test.py"
+      - "**/migrations/**"
+match:
+  fact:
+    kind: security.weak-hash-algorithm
+    bind: issue
+emit:
+  finding:
+    category: security.crypto
+    severity: medium
+    confidence: 0.95
+    tags:
+      - security
+      - python
+      - crypto
+      - hashing
+  message:
+    title: Replace weak hash in `${captures.issue.text}`
+    summary: "`${captures.issue.text}` uses a weak hash algorithm vulnerable to collision attacks."
+  remediation:
+    summary: Replace SHA-1 or MD5 with SHA-256 (or stronger). For password hashing, use `bcrypt`, `scrypt`, or `argon2`.

package/rules/python/py.security.wildcard-subprocess-injection.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: py.security.wildcard-subprocess-injection
+  aliases:
+    - BAN-B603
+  title: Avoid wildcard expansion in subprocess calls
+  summary: Shell wildcards in subprocess calls can be expanded unexpectedly, enabling injection
+  rationale: When `shell=True` is used in subprocess calls, shell wildcards (`*`, `?`, `[]`) are expanded by the shell. Combined with untrusted input, this can lead to command injection or unexpected file operations (e.g., `rm -rf /tmp/*` expanding to delete unintended files).
+  detection:
+    kind: pattern
+  references:
+    - kind: cwe
+      id: CWE-78
+      title: Improper Neutralization of Special Elements used in an OS Command
+  tags:
+    - security
+    - python
+    - injection
+    - subprocess
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - python
+  paths:
+    include:
+      - "**/*.py"
+    exclude:
+      - "**/tests/**"
+      - "**/test_*.py"
+      - "**/*_test.py"
+      - "**/migrations/**"
+match:
+  fact:
+    kind: python.security.wildcard-subprocess-injection
+    bind: issue
+emit:
+  finding:
+    category: security.injection
+    severity: high
+    confidence: 0.9
+    tags:
+      - security
+      - python
+      - injection
+      - subprocess
+  message:
+    title: Avoid shell wildcards in `${captures.issue.text}`
+    summary: "`${captures.issue.text}` uses shell wildcards in a subprocess call with `shell=True`."
+  remediation:
+    summary: Pass arguments as a list instead of a shell string, and set `shell=False`. Use explicit file paths without wildcards (e.g., `subprocess.run(["rm", "-rf", "/tmp/tempfile"], shell=False)`).

package/rules/python/py.security.xmlrpc-import.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: py.security.xmlrpc-import
+  aliases:
+    - BAN-B414
+  title: Avoid XML-RPC protocol usage
+  summary: XML-RPC uses XML serialization that is vulnerable to DTD attacks
+  rationale: XML-RPC relies on XML parsing which can be exploited through DTD-based attacks including entity expansion (billion laughs) and external entity injection. Modern RPC should use safer serialization formats.
+  detection:
+    kind: pattern
+  references:
+    - kind: cwe
+      id: CWE-611
+      title: Improper Restriction of XML External Entity Reference
+  tags:
+    - security
+    - python
+    - transport
+    - xml
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - python
+  paths:
+    include:
+      - "**/*.py"
+    exclude:
+      - "**/tests/**"
+      - "**/test_*.py"
+      - "**/*_test.py"
+      - "**/migrations/**"
+match:
+  fact:
+    kind: python.security.xmlrpc-import
+    bind: issue
+emit:
+  finding:
+    category: security.transport
+    severity: medium
+    confidence: 0.85
+    tags:
+      - security
+      - python
+      - transport
+      - xml
+  message:
+    title: Replace XML-RPC with safer transport in `${captures.issue.text}`
+    summary: "`${captures.issue.text}` imports or uses XML-RPC which is vulnerable to XML attacks."
+  remediation:
+    summary: Use REST/JSON APIs with `requests` or gRPC/Protobuf for modern RPC communication.

package/rules/ruby/ruby.bug-risk.action-mailer-base-subclass.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.action-mailer-base-subclass
+  title: Rails 5+ mailers should subclass ApplicationMailer
+  summary: >-
+    Mailer class directly subclasses `ActionMailer::Base` instead of
+    `ApplicationMailer`.
+  rationale: >-
+    Rails 5+ generators create mailers that inherit from `ApplicationMailer`.
+    Directly subclassing `ActionMailer::Base` bypasses shared layout, default
+    from address, and other behavior defined in `ApplicationMailer`.
+  aliases:
+    - RB-RL1007
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - action-mailer
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.action-mailer-base-subclass
+    bind: issue
+emit:
+  finding:
+    category: correctness.convention
+    severity: medium
+    confidence: 0.9
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` should subclass ApplicationMailer"
+    summary: >-
+      "`${captures.issue.text}` subclasses `ActionMailer::Base` directly.
+      Inherit from `ApplicationMailer` instead to pick up shared configuration."
+  remediation:
+    summary: >-
+      Change `class SomeMailer < ActionMailer::Base` to
+      `class SomeMailer < ApplicationMailer`.

package/rules/ruby/ruby.bug-risk.active-job-base-subclass.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.active-job-base-subclass
+  title: Rails 5+ jobs should subclass ApplicationJob
+  summary: >-
+    Job class directly subclasses `ActiveJob::Base` instead of
+    `ApplicationJob`.
+  rationale: >-
+    Rails 5+ generators create jobs that inherit from `ApplicationJob`.
+    Directly subclassing `ActiveJob::Base` bypasses shared retry logic,
+    logging, and other behavior defined in `ApplicationJob`.
+  aliases:
+    - RB-RL1006
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-job
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.active-job-base-subclass
+    bind: issue
+emit:
+  finding:
+    category: correctness.convention
+    severity: medium
+    confidence: 0.9
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` should subclass ApplicationJob"
+    summary: >-
+      "`${captures.issue.text}` subclasses `ActiveJob::Base` directly.
+      Inherit from `ApplicationJob` instead to pick up shared configuration."
+  remediation:
+    summary: >-
+      Change `class SomeJob < ActiveJob::Base` to
+      `class SomeJob < ApplicationJob`.

package/rules/ruby/ruby.bug-risk.active-record-alias.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.active-record-alias
+  title: Use of deprecated ActiveRecord method aliases
+  summary: >-
+    ActiveRecord method `update_attributes` or `update_attributes!` is called.
+    These are deprecated aliases for `update` and `update!`.
+  rationale: >-
+    Rails 6.1 deprecated `update_attributes` and `update_attributes!` in favor
+    of `update` and `update!`. The deprecated methods will be removed in
+    Rails 7.0+ and generate deprecation warnings.
+  aliases:
+    - RB-RL1002
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-record
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.active-record-alias
+    bind: issue
+emit:
+  finding:
+    category: correctness.deprecation
+    severity: medium
+    confidence: 0.85
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` is deprecated — use `update` or `update!`"
+    summary: >-
+      "`${captures.issue.text}` is a deprecated ActiveRecord method alias.
+      Replace it with `update` or `update!`."
+  remediation:
+    summary: >-
+      Replace `update_attributes` with `update`, and `update_attributes!`
+      with `update!`.

package/rules/ruby/ruby.bug-risk.active-record-base-subclass.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.active-record-base-subclass
+  title: Rails 5+ models should subclass ApplicationRecord
+  summary: >-
+    Model class directly subclasses `ActiveRecord::Base` instead of
+    `ApplicationRecord`.
+  rationale: >-
+    Rails 5+ generators create models that inherit from `ApplicationRecord`.
+    Directly subclassing `ActiveRecord::Base` bypasses shared concerns,
+    default scopes, and other behavior defined in `ApplicationRecord`.
+  aliases:
+    - RB-RL1008
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-record
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.active-record-base-subclass
+    bind: issue
+emit:
+  finding:
+    category: correctness.convention
+    severity: medium
+    confidence: 0.9
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` should subclass ApplicationRecord"
+    summary: >-
+      "`${captures.issue.text}` subclasses `ActiveRecord::Base` directly.
+      Inherit from `ApplicationRecord` instead to pick up shared configuration."
+  remediation:
+    summary: >-
+      Change `class SomeModel < ActiveRecord::Base` to
+      `class SomeModel < ApplicationRecord`.

package/rules/ruby/ruby.bug-risk.active-record-method-override.rule.yaml

@@ -0,0 +1,55 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.active-record-method-override
+  title: Override of built-in ActiveRecord methods
+  summary: >-
+    An ActiveRecord model overrides a built-in ActiveRecord method such as
+    `save`, `create`, `destroy`, or `update`. This can cause subtle bugs when
+    ActiveRecord lifecycle expects the original behavior.
+  rationale: >-
+    Overriding built-in AR methods like `save`, `destroy`, or `create` is risky
+    because callbacks, transactions, and other lifecycle guarantees depend on
+    the original implementation. Consider using `before_*` / `after_*` callbacks
+    instead.
+  aliases:
+    - RB-RL1003
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-record
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.active-record-method-override
+    bind: issue
+emit:
+  finding:
+    category: correctness.bug-risk
+    severity: medium
+    confidence: 0.65
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` overrides a built-in ActiveRecord method"
+    summary: >-
+      "`${captures.issue.text}` is a built-in ActiveRecord method. Overriding
+      it in a model subclass can cause unexpected behavior. Prefer callbacks."
+  remediation:
+    summary: >-
+      Replace method overrides with ActiveRecord callbacks (`before_save`,
+      `after_destroy`, etc.) wherever possible.

package/rules/ruby/ruby.bug-risk.active-support-alias.rule.yaml

@@ -0,0 +1,52 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.active-support-alias
+  title: Use of ActiveSupport alias instead of core Ruby method
+  summary: >-
+    An ActiveSupport alias method (`starts_with?`, `ends_with?`, `append`,
+    `prepend`) is used instead of the core Ruby equivalent.
+  rationale: >-
+    ActiveSupport provides aliases for Ruby core methods. Using the core
+    equivalents (`start_with?`, `end_with?`, `<<`, `unshift`) reduces
+    dependencies and improves portability.
+  aliases:
+    - RB-RL1004
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-support
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.active-support-alias
+    bind: issue
+emit:
+  finding:
+    category: correctness.deprecation
+    severity: medium
+    confidence: 0.8
+    tags:
+      - ruby
+  message:
+    title: "Prefer Ruby core method over ActiveSupport alias `${captures.issue.text}`"
+    summary: >-
+      "`${captures.issue.text}` is an ActiveSupport alias. Use the core Ruby
+      equivalent instead."
+  remediation:
+    summary: >-
+      Replace `starts_with?` with `start_with?`, `ends_with?` with `end_with?`,
+      `append` with `<<`, and `prepend` with `unshift`.

package/rules/ruby/ruby.bug-risk.all-each-to-find-each.rule.yaml

@@ -0,0 +1,55 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.all-each-to-find-each
+  title: Replace Model.all.each with find_each
+  summary: >-
+    `Model.all.each` loads all records into memory. Use `find_each` for
+    batch processing.
+  rationale: >-
+    `Model.all.each` loads the entire result set into memory at once, which
+    can exhaust memory for large tables. `find_each` uses
+    `find_in_batches` internally to load records in batches of 1000,
+    keeping memory usage constant regardless of table size.
+  aliases:
+    - RB-RL1024
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-record
+    - performance
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.all-each-to-find-each
+    bind: issue
+emit:
+  finding:
+    category: correctness.performance
+    severity: medium
+    confidence: 0.85
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "Use `find_each` instead of `${captures.issue.text}`"
+    summary: >-
+      "`${captures.issue.text}` loads all records into memory. Use
+      `find_each` for batch iteration."
+  remediation:
+    summary: >-
+      Replace `Model.all.each { |r| ... }` with
+      `Model.all.find_each { |r| ... }` to batch-process records.

package/rules/ruby/ruby.bug-risk.allow-blank-with-delegate.rule.yaml

@@ -0,0 +1,52 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.allow-blank-with-delegate
+  title: Avoid allow_blank with delegate
+  summary: >-
+    Use `allow_nil` instead of `allow_blank` in `delegate` declarations.
+  rationale: >-
+    `allow_blank: true` in a `delegate` call silently swallows blank
+    (including falsey) values from the delegated method, which can mask bugs.
+    Prefer `allow_nil: true` to only suppress nil values.
+  aliases:
+    - RB-RL1016
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.allow-blank-with-delegate
+    bind: issue
+emit:
+  finding:
+    category: correctness.bug-risk
+    severity: medium
+    confidence: 0.9
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` uses `allow_blank: true`"
+    summary: >-
+      "`${captures.issue.text}` delegates with `allow_blank: true`. This
+      masks blank values. Consider `allow_nil: true` instead, which only
+      suppresses nil values."
+  remediation:
+    summary: >-
+      Replace `allow_blank: true` with `allow_nil: true` in the delegate
+      declaration.

package/rules/ruby/ruby.bug-risk.alter-queries-combine.rule.yaml

@@ -0,0 +1,54 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.alter-queries-combine
+  title: Combine alter queries in migrations
+  summary: >-
+    Prefer `change_table` with multiple column changes over repeated
+    `change_column` calls.
+  rationale: >-
+    Combining column alterations in a single `change_table` block groups
+    related schema changes and reduces the number of database round-trips
+    during migration execution.
+  aliases:
+    - RB-RL1012
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - migration
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.alter-queries-combine
+    bind: issue
+emit:
+  finding:
+    category: performance.database
+    severity: low
+    confidence: 0.8
+    tags:
+      - ruby
+      - rails
+      - migration
+  message:
+    title: "`${captures.issue.text}` can be combined"
+    summary: >-
+      "`${captures.issue.text}` alters a column individually. Consider grouping
+      multiple column changes into a single `change_table` block."
+  remediation:
+    summary: >-
+      Replace multiple `change_column` calls with a `change_table` block that
+      contains all column changes.

package/rules/ruby/ruby.bug-risk.ambiguous-block-association.rule.yaml

@@ -0,0 +1,49 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.ambiguous-block-association
+  title: Ambiguous association of block with method
+  summary: >-
+    A block is attached to a method call that already has arguments, but the
+    intended receiver of the block is ambiguous. Add parentheses to clarify
+    whether the block belongs to the outer or inner method.
+  rationale: >-
+    Without parentheses, `foo bar { |x| x }` could mean `foo(bar) { |x| x }`
+    (block on outer method) or `foo(bar { |x| x })` (block on inner method).
+    Adding parentheses removes the ambiguity.
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.ambiguous-block-association
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.8
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.ambiguous-block-association`."
+  remediation:
+    summary: >-
+      Add parentheses to disambiguate the block binding, e.g.
+      `method(arg) { |x| x }` or `method(arg { |x| x })`.