nyx/src/patterns/ruby.rs

use crate::patterns::{Pattern, Severity};
pub const PATTERNS: &[Pattern] = &[
    // ---------- Runtime code-execution primitives ----------
    Pattern {
        id: "eval_call",
        description: "Kernel#eval usage",
        query: r#"
          (call
            (identifier) @id
            (#eq? @id "eval")
          ) @vuln
        "#,
        severity: Severity::High,
    },
    Pattern {
        id: "instance_eval_call",
        description: "Object#instance_eval usage",
        query: r#"
          (call
            (identifier) @id
            (#eq? @id "instance_eval")
          ) @vuln
        "#,
        severity: Severity::High,
    },
    Pattern {
        id: "class_eval_call",
        description: "Module#class_eval / module_eval usage",
        query: r#"
          (call
            (identifier) @id
            (#match? @id "^(class_eval|module_eval)$")
          ) @vuln
        "#,
        severity: Severity::High,
    },
    // ---------- Shell execution ----------
    Pattern {
        id: "system_exec_interp",
        description: "system/exec with string interpolation",
        query: r#"
          (call
            method: (identifier) @m
            (#match? @m "^(system|exec)$")
            arguments: (argument_list
              (string
                (interpolation)+ @vuln
              )
            )
          )
        "#,
        severity: Severity::High,
    },
    Pattern {
        id: "backtick_command",
        description: "Back-tick shell execution",
        // `uname -a`
        query: r#"(shell_command) @vuln"#,
        severity: Severity::High,
    },
    // ---------- Dangerous deserialisation ----------
    Pattern {
        id: "yaml_load",
        description: "YAML.load / Psych.load (arbitrary object deserialisation)",
        query: r#"
          (call
            receiver: (constant) @recv
            (#match? @recv "^(YAML|Psych)$")
            method: (identifier) @m
            (#eq? @m "load")
          ) @vuln
        "#,
        severity: Severity::High,
    },
    Pattern {
        id: "marshal_load",
        description: "Marshal.load usage",
        query: r#"
          (call
            receiver: (constant) @recv
            (#eq? @recv "Marshal")
            method: (identifier) @m
            (#eq? @m "load")
          ) @vuln
        "#,
        severity: Severity::High,
    },
    // ---------- Reflection / meta-programming ----------
    Pattern {
        id: "send_dynamic",
        description: "send() with dynamic first argument (not a literal symbol)",
        query: r#"
          (call
            method: (identifier) @m
            (#eq? @m "send")
            arguments: (argument_list
              [
                (identifier)                ; send(method_name_var, …)
                (string (interpolation)+)   ; send("user_#{role}", …)
              ] @vuln
            )
          )
        "#,
        severity: Severity::Medium,
    },
    Pattern {
        id: "constantize_call",
        description: "ActiveSupport constantize / safe_constantize on tainted data",
        query: r#"
          (call
            method: (identifier) @m
            (#match? @m "^(constantize|safe_constantize)$")
          ) @vuln
        "#,
        severity: Severity::Medium,
    },
    // ---------- Insecure resource access ----------
    Pattern {
        id: "open_uri_http",
        description: "Kernel#open with HTTP(S) URL (open-uri auto-follow)",
        query: r#"
          (call
            method: (identifier) @m
            (#eq? @m "open")
            arguments: (argument_list
              (string) @url
              (#match? @url "^\"https?://")
            )
          ) @vuln
        "#,
        severity: Severity::Medium,
    },
];