Contents

require 'checks/base_check'

#This check looks for calls to +eval+, +instance_eval+, etc. which include
#user input.
class CheckEvaluation < BaseCheck
  Checks.add self

  #Process calls
  def run_check
    calls = tracker.find_call nil, [:eval, :instance_eval, :class_eval, :module_eval]

    @templates = tracker.templates

    calls.each do |call|
      process_result call
    end
  end

  #Warns if result includes user input
  def process_result result
    if include_user_input? result[-1]
      warn :result => result,
        :warning_type => "Dangerous Eval",
        :message => "User input in eval",
        :code => result[-1],
        :confidence => CONFIDENCE[:high]
    end
  end
end

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
brakeman-0.0.2	lib/checks/check_evaluation.rb