Contents

require 'brakeman/checks/base_check'

class Brakeman::CheckRouteDoS < Brakeman::BaseCheck
  Brakeman::Checks.add self

  @description = "Checks for route DoS (CVE-2015-7581)"

  def run_check
    fix_version = case
                  when version_between?("4.0.0", "4.1.14")
                    "4.1.14.1"
                  when version_between?("4.2.0", "4.2.5")
                    "4.2.5.1"
                  else
                    return
                  end

    if controller_wildcards?
      message = "Rails #{rails_version} has a denial of service vulnerability with :controller routes (CVE-2015-7581). Upgrade to Rails #{fix_version}"

      warn :warning_type => "Denial of Service",
        :warning_code => :CVE_2015_7581,
        :message => message,
        :confidence => :medium,
        :gem_info => gemfile_or_environment,
        :link_path => "https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ"
    end
  end

  def controller_wildcards?
    tracker.routes.each do |name, actions|
      if name == :':controllerController'
        # awful hack for routes with :controller in them
        return true
      elsif string? actions and actions.value.include? ":controller"
        return true
      end
    end

    false
  end
end

Version data entries

25 entries across 25 versions & 3 rubygems

Version	Path
brakeman-4.3.1	lib/brakeman/checks/check_route_dos.rb
brakeman-lib-4.3.1	lib/brakeman/checks/check_route_dos.rb
brakeman-min-4.3.1	lib/brakeman/checks/check_route_dos.rb
brakeman-4.3.0	lib/brakeman/checks/check_route_dos.rb
brakeman-min-4.3.0	lib/brakeman/checks/check_route_dos.rb
brakeman-lib-4.3.0	lib/brakeman/checks/check_route_dos.rb
brakeman-4.2.1	lib/brakeman/checks/check_route_dos.rb
brakeman-min-4.2.1	lib/brakeman/checks/check_route_dos.rb
brakeman-lib-4.2.1	lib/brakeman/checks/check_route_dos.rb
brakeman-4.2.0	lib/brakeman/checks/check_route_dos.rb
brakeman-lib-4.2.0	lib/brakeman/checks/check_route_dos.rb
brakeman-min-4.2.0	lib/brakeman/checks/check_route_dos.rb
brakeman-4.1.1	lib/brakeman/checks/check_route_dos.rb
brakeman-lib-4.1.1	lib/brakeman/checks/check_route_dos.rb
brakeman-min-4.1.1	lib/brakeman/checks/check_route_dos.rb
brakeman-4.1.0	lib/brakeman/checks/check_route_dos.rb
brakeman-lib-4.1.0	lib/brakeman/checks/check_route_dos.rb
brakeman-min-4.1.0	lib/brakeman/checks/check_route_dos.rb
brakeman-4.0.1	lib/brakeman/checks/check_route_dos.rb
brakeman-min-4.0.1	lib/brakeman/checks/check_route_dos.rb