Sha256: 50206d69e9338170cad443f9a2416c37f9c0bebc6f49f525713313c5e16352c2
Contents?: true
Size: 877 Bytes
Versions: 174
Compression:
Stored size: 877 Bytes
Contents
Can detect: -Possibly unescaped model attributes or parameters in views (Cross-Site Scripting) -Bad string interpolation in calls to Model.find, Model.last, Model.first, etc., as well as chained calls (SQL Injection) -String interpolation in find_by_sql (SQL Injection) -String interpolation or params in calls to system, exec, and syscall and `` (Command Injection) -Unrestricted mass assignments -Global restriction of mass assignment -Missing call to protect_from_forgery in ApplicationController (CSRF protection) -Default routes, per-controller and globally -Redirects based on params (probably too broad currently) -Validation regexes not using \A and \z -Calls to render with dynamic paths General capabilities: -Search for method calls based on target class and/or method name -Determine 'output' of templates using ERB, Erubis, or HAML. Can handle automatic escaping
Version data entries
174 entries across 160 versions & 5 rubygems