Class: FiberAudit::Static::Rules::ThreadCurrentState

Inherits:
Base
  • Object
show all
Defined in:
lib/fiber_audit/static/rules/thread_current_state.rb

Overview

Detect thread-variable and Thread.current index state.

Constant Summary collapse

TITLE = 
'Thread-local state in fiber code'
CATEGORY = 
:thread_local
MESSAGE = 
'Thread-local state may be shared across fibers and leak request-local data.'
REMEDIATION = 
'Use fiber-local or framework-provided request-local state instead of Thread thread variables.'
THREAD_VARIABLE_METHODS = 
%i[thread_variable_get thread_variable_set].freeze
INDEX_METHODS = 
%i[[] []=].freeze

Constants inherited from Base

Base::CONTEXT_CEILING

Instance Method Summary collapse

Methods inherited from Base

confidence, default_confidence, default_severity, description, id, #initialize, severity

Constructor Details

This class inherits a constructor from FiberAudit::Static::Rules::Base

Instance Method Details

#analyze(call_sites:) ⇒ Object 



26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/fiber_audit/static/rules/thread_current_state.rb', line 26

def analyze(call_sites:)
  findings = []
  call_sites.each do |site|
    next if skip?(site)

    finding = match_thread_variable(site) || match_index_op(site)
    findings << finding if finding
  end
  findings
rescue StandardError
  []
end