Class: Scryer::Rules::ConsiderAllRequestsLocalRule

Inherits:
Scryer::Rule
  • Object
show all
Defined in:
lib/scryer/rules/consider_all_requests_local_rule.rb

Overview

Flags config.consider_all_requests_local = true specifically in config/environments/production.rb. This setting is Rails' own default in development.rb and test.rb (it's what shows the full backtrace/ debug page on an unhandled exception instead of a generic error page) — completely normal there, and NOT flagged there; only an explicit true in the production environment file is a real information- disclosure risk (stack traces, local variable values, and request params rendered straight to whoever triggered the error).

Constant Summary collapse

PRODUCTION_ENV_FILE = 
"config/environments/production.rb"

Instance Attribute Summary

Attributes inherited from Scryer::Rule

#file, #sexp, #source

Instance Method Summary collapse

Methods inherited from Scryer::Rule

inherited, #initialize

Constructor Details

This class inherits a constructor from Scryer::Rule

Instance Method Details

#scan ⇒ Object 



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/scryer/rules/consider_all_requests_local_rule.rb', line 22

def scan
  return [] unless file.to_s.end_with?(PRODUCTION_ENV_FILE)

  findings = []

  Ast.each_node(sexp) do |node|
    next unless Ast.tagged?(node, :assign)

    target = node[1]
    next unless Ast.tagged?(target, :field)
    next unless Ast.ident_text(target[3]) == "consider_all_requests_local"
    next unless Ast.true_literal?(node[2])

    findings << finding(
      line: Ast.line_of(node),
      message: "`config.consider_all_requests_local = true` in #{PRODUCTION_ENV_FILE} shows " \
                "the full Rails debug error page (backtrace, local variables, request " \
                "params) to anyone who triggers an unhandled exception in production.",
      suggested_fix: "Remove this line or set it to `false` in production — let " \
                      "`config.consider_all_requests_local` stay at Rails' own default " \
                      "there (only true in development/test) and rely on " \
                      "`public/500.html` (or an exception-tracking service) for production errors."
    )
  end

  findings
end