Land rapid7#3103, vars_get check for msftidy

Author: wvu

tools/msftidy.rb

@@ -62,7 +62,7 @@ def initialize(source_file)
   # @return status [Integer] Returns WARNINGS unless we already have an
   # error.
   def warn(txt, line=0) line_msg = (line>0) ? ":#{line}" : ''
-    puts "#{@full_filepath}#{line_msg} - [#{'WARNING'.yellow}] #{txt}"
+    puts "#{@full_filepath}#{line_msg} - [#{'WARNING'.yellow}] #{cleanup_text(txt)}"
     @status == ERRORS ? @status = ERRORS : @status = WARNINGS
   end
 
@@ -74,14 +74,14 @@ def warn(txt, line=0) line_msg = (line>0) ? ":#{line}" : ''
   # @return status [Integer] Returns ERRORS
   def error(txt, line=0)
     line_msg = (line>0) ? ":#{line}" : ''
-    puts "#{@full_filepath}#{line_msg} - [#{'ERROR'.red}] #{txt}"
+    puts "#{@full_filepath}#{line_msg} - [#{'ERROR'.red}] #{cleanup_text(txt)}"
     @status = ERRORS
   end
 
   # Currently unused, but some day msftidy will fix errors for you.
   def fixed(txt, line=0)
     line_msg = (line>0) ? ":#{line}" : ''
-    puts "#{@full_filepath}#{line_msg} - [#{'FIXED'.green}] #{txt}"
+    puts "#{@full_filepath}#{line_msg} - [#{'FIXED'.green}] #{cleanup_text(txt)}"
   end
 
 
@@ -463,7 +463,7 @@ def check_lines
 
       # do not change datastore in code
       if ln =~ /(?<!\.)datastore\[["'][^"']+["']\]\s*=(?![=~>])/
-        error("datastore is modified in code: #{ln.inspect}", idx)
+        error("datastore is modified in code: #{ln}", idx)
       end
     }
   end
@@ -475,6 +475,15 @@ def check_vuln_codes
     end
   end
 
+  def check_vars_get
+    test = @source.scan(/send_request_(?:cgi|raw)\s*\(\s*\{\s*['"]uri['"]\s*=>\s*[^=\}]*?\?[^,\}]+/im)
+    unless test.empty?
+      test.each { |item|
+        warn("Please use vars_get in send_request_cgi and send_request_raw: #{item}")
+      }
+    end
+  end
+
   private
 
   def load_file(file)
@@ -484,6 +493,13 @@ def load_file(file)
     f.close
     return buf
   end
+
+  def cleanup_text(txt)
+    # remove line breaks
+    txt = txt.gsub(/[\r\n]/, ' ')
+    # replace multiple spaces by one space
+    txt.gsub(/\s{2,}/, ' ')
+  end
 end
 
 #
@@ -511,6 +527,7 @@ def run_checks(full_filepath)
   tidy.check_snake_case_filename
   tidy.check_comment_splat
   tidy.check_vuln_codes
+  tidy.check_vars_get
   return tidy
 end