Sha256: 0052ca851ff77fc31e7b65a2bbc96bf789e6127e3bc5494fa0065fa9f09ce5d3
Contents?: true
Size: 1.63 KB
Versions: 40
Compression:
Stored size: 1.63 KB
Contents
class Brakeman::CheckRenderInline < Brakeman::CheckCrossSiteScripting
Brakeman::Checks.add self
@description = "Checks for cross-site scripting in render calls"
def run_check
setup
tracker.find_call(:target => nil, :method => :render).each do |result|
check_render result
end
end
def check_render result
return unless original? result
call = result[:call]
if node_type? call, :render and
(call.render_type == :text or call.render_type == :inline)
unless call.render_type == :text and content_type_set? call[3]
render_value = call[2]
if input = has_immediate_user_input?(render_value)
warn :result => result,
:warning_type => "Cross-Site Scripting",
:warning_code => :cross_site_scripting_inline,
:message => msg("Unescaped ", msg_input(input), " rendered inline"),
:user_input => input,
:confidence => :high,
:cwe_id => [79]
elsif input = has_immediate_model?(render_value)
warn :result => result,
:warning_type => "Cross-Site Scripting",
:warning_code => :cross_site_scripting_inline,
:message => "Unescaped model attribute rendered inline",
:user_input => input,
:confidence => :medium,
:cwe_id => [79]
end
end
end
end
CONTENT_TYPES = ["text/html", "text/javascript", "application/javascript"]
def content_type_set? opts
if hash? opts
content_type = hash_access(opts, :content_type)
string? content_type and not CONTENT_TYPES.include? content_type.value
end
end
end
Version data entries
40 entries across 40 versions & 3 rubygems