Sha256: 58552e9504b68436a1caa8d759a44da43e0c4f0d0844a94ef095d884125dccd6

Contents?: true

Size: 1.14 KB

Versions: 102

Compression:

Stored size: 1.14 KB

Contents

require 'brakeman/checks/base_check'

#Checks if user supplied data is passed to send
class Brakeman::CheckSend < Brakeman::BaseCheck
  Brakeman::Checks.add self

  @description = "Check for unsafe use of Object#send"

  def run_check
    @send_methods = [:send, :try, :__send__, :public_send]
    Brakeman.debug("Finding instances of #send")
    calls = tracker.find_call :methods => @send_methods, :nested => true

    calls.each do |call|
      process_result call
    end
  end

  def process_result result
    return unless original? result

    send_call = get_send result[:call]
    process_call_args send_call
    process send_call.target

    if input = has_immediate_user_input?(send_call.first_arg)
      warn :result => result,
        :warning_type => "Dangerous Send",
        :warning_code => :dangerous_send,
        :message => "User controlled method execution",
        :user_input => input,
        :confidence => :high
    end
  end

  # Recursively check call chain for send call
  def get_send exp
    if call? exp
      if @send_methods.include? exp.method
        return exp
      else
        get_send exp.target
      end
    end
  end
end

Version data entries

102 entries across 88 versions & 4 rubygems

Version Path
zuora_connect_ui-0.10.0 vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.10.0 vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_send.rb
brakeman-4.7.2 lib/brakeman/checks/check_send.rb
brakeman-lib-4.7.2 lib/brakeman/checks/check_send.rb
brakeman-min-4.7.2 lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.2 vendor/ruby/2.6.0/gems/brakeman-4.7.1/lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.2 vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.2 vendor/ruby/2.6.0/gems/brakeman-4.5.1/lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.2 vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_send.rb
brakeman-4.7.1 lib/brakeman/checks/check_send.rb
brakeman-lib-4.7.1 lib/brakeman/checks/check_send.rb
brakeman-min-4.7.1 lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.1 vendor/ruby/2.6.0/gems/brakeman-4.5.1/lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.1 vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.1 vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_send.rb
brakeman-4.7.0 lib/brakeman/checks/check_send.rb
brakeman-lib-4.7.0 lib/brakeman/checks/check_send.rb
brakeman-min-4.7.0 lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.0 vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_send.rb
zuora_connect_ui-0.9.0 vendor/ruby/2.6.0/gems/brakeman-4.5.1/lib/brakeman/checks/check_send.rb