Class: Scryer::Rules::ForceSslRule

Inherits:
Scryer::Rule show all
Defined in:
lib/scryer/rules/force_ssl_rule.rb

Overview

Flags config.force_ssl = false — an explicit opt-out of Rails' built-in HTTPS enforcement (redirects, HSTS, secure cookie flag). Absence of config.force_ssl = true isn't flagged — that would require confirming no environment file sets it anywhere, which needs whole-app context this per-file rule doesn't have. Only the explicit opt-out is a reliable, low-noise signal on its own.

Instance Attribute Summary

Attributes inherited from Scryer::Rule

#file, #sexp, #source

Instance Method Summary collapse

Methods inherited from Scryer::Rule

inherited, #initialize

Constructor Details

This class inherits a constructor from Scryer::Rule

Instance Method Details

#scan ⇒ Object 



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/scryer/rules/force_ssl_rule.rb', line 15

def scan
  findings = []

  Ast.each_node(sexp) do |node|
    next unless Ast.tagged?(node, :assign)

    target = node[1]
    next unless Ast.tagged?(target, :field)
    next unless Ast.ident_text(target[3]) == "force_ssl"

    value = node[2]
    next unless Ast.false_literal?(value)

    line = Ast.line_of(node)
    findings << finding(
      line: line,
      message: "`config.force_ssl = false` explicitly disables Rails' HTTPS enforcement " \
                "(redirects, HSTS, and the secure flag on cookies) — traffic can be served " \
                "and session cookies transmitted over plain HTTP.",
      suggested_fix: "Set `config.force_ssl = true` (the default for a new Rails production " \
                      "environment) unless this app is deliberately terminating TLS " \
                      "elsewhere (a load balancer already enforcing HTTPS) — and if so, " \
                      "leave a comment explaining that so this doesn't look like an oversight."
    )
  end

  findings
end