Sha256: 5eba03928c6b20be46ca6030bf7cacb6028d213ec96fb46ee82bfd5089acc2dc
Contents?: true
Size: 1.17 KB
Versions: 9
Compression:
Stored size: 1.17 KB
Contents
module Codesake
module Dawn
module Kb
module OwaspRorCheatSheet
class SensitiveFiles
include PatternMatchCheck
def initialize
message = "Many Ruby on Rails apps are open source and hosted on publicly available source code repositories. Whether that is the case or the code is committed to a corporate source control system, there are certain files that should be either excluded or carefully managed."
super({
:name=>"Owasp Ror CheatSheet: Sensitive Files",
:kind=>Codesake::Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
:applies=>["rails"],
:glob=>".gitignore",
:aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
:message=>message,
:check_family=>:owasp_ror_cheatsheet,
:severity=>:info,
:attack_pattern => ["/config/database.yml", "/config/initializers/secret_token.rb", "/db/seeds.rb", "/db/*.sqlite3"],
:mitigation=>"Put sensitive files in your repository gitignore file"
})
# @debug = true
end
end
end
end
end
end
Version data entries
9 entries across 9 versions & 2 rubygems