rules-crystal

Pointer(Void) — untyped raw pointer in Crystal. This bypasses the type system and is required only for low-level C FFI. Confirm this is intentional FFI code and document the memory ownership contract.

HTTP::Server.new usage detected. Ensure you are using the current Crystal HTTP::Server API (handlers array), as the single-handler constructor form was changed in older versions. Check Crystal release notes for your target version.

Hardcoded secret or API key in Crystal source (CWE-798). Secrets committed to source are exposed via version control. Use ENV["SECRET_KEY"] or a crystal-env / dotenv library. For production, inject secrets via environment variables at deploy time.

TLS certificate verification disabled in Crystal (CWE-295). Setting verify_mode to NONE allows MITM attacks — the client accepts any certificate including self-signed ones from attackers. Remove this setting or use verify_mode = OpenSSL::SSL::VerifyMode::PEER with a valid CA bundle.

Path traversal risk in Crystal: File.read/write/open with externally controlled path (CWE-22). User-supplied filenames with '../' sequences can escape the intended directory. Validate paths with File.expand_path and assert they start with the allowed base directory before opening.

Command injection risk in Crystal: Process.run or backtick interpolation with user-controlled data (CWE-78). Crystal string interpolation in shell commands allows injection of arbitrary shell commands. Use Process.run with an args array (Process.run("cmd", args: [arg1, arg2])) and never pass shell: true with interpolated data.

Raw pointer operation detected in Crystal. Crystal's Pointer(T) and pointerof() bypass the type system and garbage collector — use-after-free and memory corruption are possible. Wrap all FFI operations in safe Crystal abstractions using lib/LibC bindings with explicit lifetime management.

YAML.parse() called with external input. Crystal's YAML.parse returns a recursive Any tree — untrusted YAML with deeply nested/aliased structures (YAML Bomb, CVE-2013-4164-class) can cause excessive memory allocation. Use YAML.parse on trusted data only; deserialize into typed structs with T.from_yaml(input) to fail fast on unexpected shapes.