Sha256: 1799ef21ba8b21312e3f908e2d64a43f35ccbfb0f5314b4ed9bf2fa8ad5051a2
Contents?: true
Size: 1.06 KB
Versions: 40
Compression:
Stored size: 1.06 KB
Contents
require 'brakeman/checks/base_check'
class Brakeman::CheckSecrets < Brakeman::BaseCheck
Brakeman::Checks.add_optional self
@description = "Checks for secrets stored in source code"
def run_check
check_constants
end
def check_constants
@warned = Set.new
@tracker.constants.each do |constant|
name = constant.name_array.last
value = constant.value
if string? value and not value.value.empty? and looks_like_secret? name
match = [name, value, value.line]
unless @warned.include? match
@warned << match
warn :warning_code => :secret_in_source,
:warning_type => "Authentication",
:message => msg("Hardcoded value for ", msg_code(name), " in source code"),
:confidence => :medium,
:file => constant.file,
:line => constant.line,
:cwe_id => [798]
end
end
end
end
def looks_like_secret? name
# REST_AUTH_SITE_KEY is the pepper in Devise
name.match(/password|secret|(rest_auth_site|api)_key$/i)
end
end
Version data entries
40 entries across 40 versions & 3 rubygems