Sha256: 99f4a6e92ea3ca7fb6565111f409c0b86c3a3a928e31bf3452ad25ef1fd9f469
Contents?: true
Size: 1.03 KB
Versions: 40
Compression:
Stored size: 1.03 KB
Contents
require 'brakeman/checks/base_check'
class Brakeman::CheckPermitAttributes < Brakeman::BaseCheck
Brakeman::Checks.add self
@description = "Warn on potentially dangerous attributes allowed via permit"
SUSPICIOUS_KEYS = {
admin: :high,
account_id: :high,
role: :medium,
banned: :medium,
}
def run_check
tracker.find_call(:method => :permit).each do |result|
check_permit result
end
end
def check_permit result
return unless original? result
call = result[:call]
call.each_arg do |arg|
if symbol? arg
if SUSPICIOUS_KEYS.key? arg.value
warn_on_permit_key result, arg
end
end
end
end
def warn_on_permit_key result, key, confidence = nil
warn :result => result,
:warning_type => "Mass Assignment",
:warning_code => :dangerous_permit_key,
:message => "Potentially dangerous key allowed for mass assignment",
:confidence => (confidence || SUSPICIOUS_KEYS[key.value]),
:user_input => key,
:cwe_id => [915]
end
end
Version data entries
40 entries across 40 versions & 3 rubygems