class RailsSecurityTagger

• RailsSecurityTagger
• FrameworkTagger
• Tagger
• Reference
• Object

Overview

Rails-specific security tagger.

ruby_auth already classifies authentication (Devise/Pundit/CanCanCan/…), so this tagger covers the other Rails controller-level security signals that map cleanly onto an action and are deviations from the framework default — i.e. worth a reviewer's attention rather than ambient noise:

• csrf-protection — CSRF disabled (skip_before_action :verify_authenticity_token, skip_forgery_protection) or downgraded (protect_from_forgery with: :null_session). Rails protects every state-changing request by default, so an explicit opt-out is the interesting case.
• mass-assignment — Strong Parameters bypassed (params.permit!, params.to_unsafe_h, or a raw params[:x] hash handed to a model writer like Model.new(params[:user])).
• rate-limit — Rails 8 native rate_limit throttle on the action.

Like ruby_auth, detection is single-file and line-based: it walks the controller the action lives in. Cross-file concerns (a null_session base controller inherited by children, a Rack::Attack initializer) are out of scope by design — those live outside the action's own file.

Defined in:

Constant Summary

CSRF_DISABLE_PATTERNS = [{/skip_before_action\s+:verify_authenticity_token/, "verify_authenticity_token skipped"}, {/skip_forgery_protection/, "skip_forgery_protection"}]

Class-level macros that turn CSRF verification OFF for (some) actions.

CSRF_NULL_SESSION_PATTERN = /protect_from_forgery\s+.*with:\s*:null_session/

protect_from_forgery with: :null_session keeps the filter but lets a forged request through with a blank session instead of rejecting it — the usual choice for token/API controllers, and worth flagging because cookie-session callers lose CSRF rejection.

MASS_ASSIGN_BANG_PATTERNS = [{/params\.permit!/, "params.permit!"}, {/params\.to_unsafe_h(?:ash)?\b/, "params.to_unsafe_h"}]

Strong-Parameters escape hatches in an action body.

MASS_ASSIGN_WRITER_PATTERN = /\.(?:new|create|create!|update|update!|update_attributes|update_attributes!|assign_attributes)\s*\(\s*params\[/

A raw params[:x] hash passed straight into a model writer (no intervening .permit). find/where take a scalar id, so they are deliberately excluded — only attribute-setting writers are risky.

RATE_LIMIT_PATTERN = /\brate_limit\s+(?:to|within|by|with|store|name|only|except):/

Rails 8 rate_limit to: N, within: T[, only:/except:] declared like a before_action at class scope.

Constructors

• .new(options : Hash(String, YAML::Any))

Class Method Summary

• .target_techs : Array(String)

Instance Method Summary

• #perform(endpoints : Array(Endpoint)) : Array(Endpoint)

Constructor Detail

Class Method Detail

Instance Method Detail