Sha256: 2ec464d9f7557f8b9206f7027b689ee0cfdde8eaccc3d76c1ec36f95cb685cd4
Contents?: true
Size: 989 Bytes
Versions: 28
Compression:
Stored size: 989 Bytes
Contents
require 'brakeman/checks/base_check'
#Checks if user supplied data is passed to send
class Brakeman::CheckSend < Brakeman::BaseCheck
Brakeman::Checks.add self
@description = "Check for unsafe use of Object#send"
def run_check
Brakeman.debug("Finding instances of #send")
calls = tracker.find_call :methods => [:send, :try, :__send__, :public_send]
calls.each do |call|
process_result call
end
end
def process_result result
return if duplicate? result or result[:call].original_line
add_result result
process_call_args result[:call]
target = process result[:call].target
if input = has_immediate_user_input?(result[:call].first_arg)
warn :result => result,
:warning_type => "Dangerous Send",
:warning_code => :dangerous_send,
:message => "User controlled method execution",
:code => result[:call],
:user_input => input.match,
:confidence => CONFIDENCE[:high]
end
end
end
Version data entries
28 entries across 28 versions & 2 rubygems