Class: Scryer::Rules::SecurityHeadersRule

Inherits:
Scryer::Rule show all
Defined in:
lib/scryer/rules/security_headers_rule.rb

Overview

Flags an explicit insecure override of Rails' default security headers/config — NOT absence of a header, which would require knowing every environment file and initializer in the app (too noisy/ environment-dependent for a per-file static rule). Only the explicit opt-out is a reliable, low-noise signal on its own — same reasoning as ForceSslRule.

config.action_dispatch.default_headers['X-Frame-Options'] = 'ALLOWALL' (or false)
config.action_dispatch.default_headers['X-Content-Type-Options'] = false
config.action_dispatch.default_headers.merge!('X-Frame-Options' => 'ALLOWALL', ...)
config.content_security_policy = nil

Constant Summary collapse

HEADERS = 
["X-Frame-Options", "X-Content-Type-Options"].freeze

Instance Attribute Summary

Attributes inherited from Scryer::Rule

#file, #sexp, #source

Instance Method Summary collapse

Methods inherited from Scryer::Rule

inherited, #initialize

Constructor Details

This class inherits a constructor from Scryer::Rule

Instance Method Details

#scan ⇒ Object 



22
23
24
25
26
27
28
29
30
31
32
33
34
 
# File 'lib/scryer/rules/security_headers_rule.rb', line 22

def scan
  findings = []

  Ast.each_node(sexp) do |node|
    if Ast.tagged?(node, :assign)
      scan_assign(findings, node)
    elsif Ast.tagged?(node, :method_add_arg)
      scan_merge_bang(findings, node)
    end
  end

  findings
end