sinatra-review

Sinatra Review Command

Performs comprehensive code review of Sinatra applications, identifying security vulnerabilities, performance issues, routing conflicts, and deviations from best practices.

Arguments

• $1: path (optional) - Path to review (defaults to current directory)

Usage Examples

# Review current directory
/sinatra-review

# Review specific directory
/sinatra-review /path/to/sinatra-app

# Review specific file
/sinatra-review app/controllers/users_controller.rb

Workflow

Step 1: Scan and Identify Application Files

Discovery Phase:

1. Locate config.ru to identify Rack application
2. Find Sinatra application files (controllers, routes)
3. Identify application structure (classic vs modular)
4. Scan for middleware configuration
5. Locate view templates and helpers
6. Find configuration files
7. Identify database and model files

File Patterns to Search:

# Application files
*.rb files inheriting from Sinatra::Base
config.ru
app.rb (classic style)
app/controllers/*.rb
lib/**/*.rb

# View templates
views/**/*.erb
views/**/*.haml
views/**/*.slim

# Configuration
config/*.rb
Gemfile
.env files

Step 2: Analyze Route Definitions

Route Conflict Detection:

Check for:

1. Duplicate routes with same path and HTTP method
2. Overlapping routes where order matters (specific before generic)
3. Missing route constraints leading to ambiguous matching
4. Wildcard route conflicts

Examples of Issues:

# ISSUE: Route order conflict
get '/users/new' do
  # Never reached because of wildcard below
end

get '/users/:id' do
  # This catches /users/new
end

# FIX: Specific routes before wildcards
get '/users/new' do
  # Now reached first
end

get '/users/:id' do
  # Only catches other IDs
end

# ISSUE: Duplicate routes
get '/api/users' do
  # First definition
end

get '/api/users' do
  # Overwrites first - only this runs
end

# ISSUE: Missing validation
get '/users/:id' do
  user = User.find(params[:id])  # What if id is not numeric?
end

# FIX: Add validation
get '/users/:id', id: /\d+/ do
  user = User.find(params[:id])
end