Class: Scryer::Rules::CorsMisconfigurationRule

Inherits:
Scryer::Rule
  • Object
show all
Defined in:
lib/scryer/rules/cors_misconfiguration_rule.rb

Overview

Flags the well-known Rack::Cors antipattern: a wildcard origin (origins '*') combined with credentials: true on a resource call. Per the CORS spec, browsers reject this combination in practice, but it's still the standard misconfiguration flagged in security reviews — either half alone (wildcard origin with no credentials, or credentials with a real origin allowlist) is fine.

config/initializers/cors.rb is small and self-contained, so this checks "does origins(...) with a literal '*' appear anywhere in the file AND does a resource call with credentials: true appear anywhere in the file" rather than requiring both inside the exact same allow do ... end block — the same file-wide-evidence looseness IdorRule uses for its class-wide authorization check.

Instance Attribute Summary

Attributes inherited from Scryer::Rule

#file, #sexp, #source

Instance Method Summary collapse

Methods inherited from Scryer::Rule

inherited, #initialize

Constructor Details

This class inherits a constructor from Scryer::Rule

Instance Method Details

#scan ⇒ Object 



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/scryer/rules/cors_misconfiguration_rule.rb', line 22

def scan
  findings = []
  return findings unless wildcard_origin_anywhere?(sexp)

  each_credentialed_resource(sexp).each do |node|
    findings << finding(
      line: Ast.line_of(node),
      message: "This file allows a wildcard origin (`origins '*'`) somewhere and this " \
                "`resource` call sets `credentials: true` — browsers won't honor that " \
                "combination for actual credentialed requests, and Rack::Cors handling it " \
                "inconsistently is the standard CORS misconfiguration flagged in reviews. " \
                "Either restrict origins to a real allowlist, or drop `credentials: true`.",
      suggested_fix: "Replace the wildcard with an explicit origin allowlist wherever " \
                      "`credentials: true` is set: `origins 'https://app.example.com'` " \
                      "instead of `origins '*'` — a wildcard origin should only be paired " \
                      "with `credentials: false` (the default)."
    )
  end

  findings
end