Merge pull request #55 from LTe/tools_check_updated

Tools check updated

Author: dmajda

lib/scanny.rb

@@ -3,6 +3,7 @@
 require_relative "scanny/report"
 require_relative "scanny/runner"
 require_relative "scanny/checks/check"
+require_relative "scanny/checks/helpers"
 
 Dir[File.dirname(__FILE__) + "/scanny/checks/**/*_check.rb"].each do |file|
   require file

lib/scanny/checks/helpers.rb

@@ -0,0 +1,26 @@
+module Scanny
+  module Checks
+    module Helpers
+      def build_pattern_exec_command(command)
+        command = command.to_s if command.is_a?(Symbol)
+        result  = command.inspect
+
+        <<-EOT
+            SendWithArguments
+            <
+              name = :system | :exec,
+              arguments = ActualArguments<
+                array = [
+                  any*,
+                  StringLiteral<string *= #{result}>,
+                  any*
+                ]
+              >
+            >
+            |
+            ExecuteString<string *= #{result}>
+        EOT
+      end
+    end
+  end
+end

lib/scanny/checks/system_tools/gpg_usage_check.rb

@@ -0,0 +1,46 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class GpgUsageCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          [
+            pattern_gpg_class,
+            pattern_gpg_method,
+            build_pattern_exec_command('gpg')
+          ].join("|")
+        end
+
+        def check(node)
+          issue :info, warning_message, :cwe => 0
+        end
+
+        private
+
+        def warning_message
+          "Using gpg tool in the wrong way can lead to security problems"
+        end
+
+        def pattern_gpg_class
+          <<-EOT
+          Send | SendWithArguments
+          <
+            receiver = ConstantAccess<
+              name =
+                :GPG |
+                :Gpg |
+                :GpgKey
+            >
+          >
+
+          EOT
+        end
+
+        def pattern_gpg_method
+          "Send | SendWithArguments<name = :gpg>"
+        end
+      end
+    end
+  end
+end

lib/scanny/checks/system_tools/sudo_check.rb

@@ -0,0 +1,24 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class SudoCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          build_pattern_exec_command('sudo')
+        end
+
+        def check(node)
+          issue :info, warning_message, :cwe => 0
+        end
+
+        private
+
+        def warning_message
+          "Using sudo can lead to the execution" +
+          "of programs on root administrator rights"
+        end
+      end
+    end
+  end
+end

lib/scanny/checks/system_tools/tar_check.rb

@@ -0,0 +1,24 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class TarCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          build_pattern_exec_command(/tar\s+/)
+        end
+
+        def check(node)
+          issue :medium, warning_message, :cwe => 88
+        end
+
+        private
+
+        def warning_message
+          "Tar command can execute dangerous operations on files" +
+          "and can travel through directories"
+        end
+      end
+    end
+  end
+end

lib/scanny/checks/system_tools/tar_commands_check.rb

@@ -0,0 +1,27 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class TarCommandsCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          [
+            build_pattern_exec_command(/tar.*\-\-to\-command/),
+            build_pattern_exec_command(/tar.*\-\-rmt\-command/),
+            build_pattern_exec_command(/tar.*\-\-rsh\-command/)
+          ].join("|")
+        end
+
+        def check(node)
+          issue :high, warning_message, :cwe => 88
+        end
+
+        private
+
+        def warning_message
+          "Tar command has an option that allows to run external programs"
+        end
+      end
+    end
+  end
+end

lib/scanny/checks/system_tools/unzip_check.rb

@@ -0,0 +1,30 @@
+module Scanny
+  module Checks
+    module SystemTools
+      class UnzipCheck < Check
+        include Scanny::Checks::Helpers
+
+        def pattern
+          [
+            build_pattern_exec_command(/unzip\s+[^(=|&)]/),
+            build_pattern_exec_command(/unzip.*-:/)
+          ].join("|")
+        end
+
+        def check(node)
+          if Machete.matches?(node, build_pattern_exec_command(/unzip.*-:/))
+            issue :high, warning_message, :cwe => [23, 88]
+          elsif Machete.matches?(node, build_pattern_exec_command(/unzip\s+[^(=|&)]/))
+            issue :medium, warning_message, :cwe => [23, 88]
+          end
+        end
+
+        private
+
+        def warning_message
+          "Unzip option allows '../' in archived file path, dir traversal"
+        end
+      end
+    end
+  end
+end

spec/scanny/checks/system_tools/gpg_usage_check_spec.rb

@@ -0,0 +1,31 @@
+require "spec_helper"
+
+module Scanny::Checks::SystemTools
+  describe GpgUsageCheck do
+    before do
+      @runner = Scanny::Runner.new(GpgUsageCheck.new)
+      @message =  "Using gpg tool in the wrong way can lead to security problems"
+      @issue = issue(:info, @message, 0)
+    end
+
+    it "reports \"GPG.method\" correctly" do
+      @runner.should check("GPG.method").with_issue(@issue)
+    end
+
+    it "reports \"GPG.method\" correctly" do
+      @runner.should check("Gpg.method").with_issue(@issue)
+    end
+
+    it "reports \"GPG.method\" correctly" do
+      @runner.should check("GpgKey.method").with_issue(@issue)
+    end
+
+    it "reports \"system('gpg --example-flag')\" correctly" do
+      @runner.should check("system('gpg --example-flag')").with_issue(@issue)
+    end
+
+    it "reports \"`gpg --example-flag`\" correctly" do
+      @runner.should check("`gpg --example-flag`").with_issue(@issue)
+    end
+  end
+end

spec/scanny/checks/system_tools/sudo_check_spec.rb

@@ -0,0 +1,24 @@
+require "spec_helper"
+
+module Scanny::Checks::SystemTools
+  describe SudoCheck do
+    before do
+      @runner = Scanny::Runner.new(SudoCheck.new)
+      @message =  "Using sudo can lead to the execution" +
+                  "of programs on root administrator rights"
+      @issue = issue(:info, @message, 0)
+    end
+
+    it "reports \"system('sudo shutdown -h now')\" correctly" do
+      @runner.should check("system('sudo shutdown -h now')").with_issue(@issue)
+    end
+
+    it "reports \"exec('sudo shutdown -h now')\" correctly" do
+      @runner.should check("exec('sudo shutdown -h now')").with_issue(@issue)
+    end
+
+    it "reports \"`sudo shutdown -h now`\" correctly" do
+      @runner.should check("`sudo shutdown -h now`").with_issue(@issue)
+    end
+  end
+end

spec/scanny/checks/system_tools/tar_check_spec.rb

@@ -0,0 +1,20 @@
+require "spec_helper"
+
+module Scanny::Checks::SystemTools
+  describe TarCheck do
+    before do
+      @runner = Scanny::Runner.new(TarCheck.new)
+      @message =  "Tar command can execute dangerous operations on files" +
+                  "and can travel through directories"
+      @issue = issue(:medium, @message, 88)
+    end
+
+    it "reports \"system('tar xvf archive.tar.gz')\" correctly" do
+      @runner.should check("system('tar xvf archive.tar.gz')").with_issue(@issue)
+    end
+
+    it "reports \"`tar xvf archive.tar.gz`\" correctly" do
+      @runner.should check("`tar xvf archive.tar.gz`").with_issue(@issue)
+    end
+  end
+end