Class: Scryer::Rules::VerboseProductionLogLevelRule

Inherits:
Scryer::Rule
  • Object
show all
Defined in:
lib/scryer/rules/verbose_production_log_level_rule.rb

Overview

Flags config.log_level = :debug specifically in config/environments/production.rb. Debug-level Rails logging can write full request parameters (including anything not filtered by config.filter_parameters) and raw SQL bind values to the production log — wherever that log ends up (a shared file, a log-aggregation service), that's a broader-than-intended audience for potentially sensitive data. :debug is Rails' own default in development.rb, so it's only flagged in production.rb; other levels (:info, :warn) aren't flagged at all — those don't carry this risk.

Constant Summary collapse

PRODUCTION_ENV_FILE = 
"config/environments/production.rb"

Instance Attribute Summary

Attributes inherited from Scryer::Rule

#file, #sexp, #source

Instance Method Summary collapse

Methods inherited from Scryer::Rule

inherited, #initialize

Constructor Details

This class inherits a constructor from Scryer::Rule

Instance Method Details

#scan ⇒ Object 



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/scryer/rules/verbose_production_log_level_rule.rb', line 23

def scan
  return [] unless file.to_s.end_with?(PRODUCTION_ENV_FILE)

  findings = []

  Ast.each_node(sexp) do |node|
    next unless Ast.tagged?(node, :assign)

    target = node[1]
    next unless Ast.tagged?(target, :field)
    next unless Ast.ident_text(target[3]) == "log_level"
    next unless Ast.literal_text(node[2]) == "debug"

    findings << finding(
      line: Ast.line_of(node),
      message: "`config.log_level = :debug` in #{PRODUCTION_ENV_FILE} logs full request " \
                "parameters and raw SQL bind values in production — anything not covered " \
                "by `config.filter_parameters` (e.g. a param name added after that list was " \
                "last updated) ends up in the log verbatim.",
      suggested_fix: "Use `:info` (Rails' own production default) or higher in production, " \
                      "and confirm `config.filter_parameters` covers every sensitive param " \
                      "name this app actually receives if verbose logging is genuinely needed " \
                      "for debugging."
    )
  end

  findings
end