Contents

require 'railroader/checks/base_check'

class Railroader::CheckRouteDoS < Railroader::BaseCheck
  Railroader::Checks.add self

  @description = "Checks for route DoS (CVE-2015-7581)"

  def run_check
    fix_version = case
                  when version_between?("4.0.0", "4.1.14")
                    "4.1.14.1"
                  when version_between?("4.2.0", "4.2.5")
                    "4.2.5.1"
                  else
                    return
                  end

    if controller_wildcards?
      message = "Rails #{rails_version} has a denial of service vulnerability with :controller routes (CVE-2015-7581). Upgrade to Rails #{fix_version}"

      warn :warning_type => "Denial of Service",
        :warning_code => :CVE_2015_7581,
        :message => message,
        :confidence => :medium,
        :gem_info => gemfile_or_environment,
        :link_path => "https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ"
    end
  end

  def controller_wildcards?
    tracker.routes.each do |name, actions|
      if name == :':controllerController'
        # awful hack for routes with :controller in them
        return true
      elsif string? actions and actions.value.include? ":controller"
        return true
      end
    end

    false
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
railroader-4.3.8	lib/railroader/checks/check_route_dos.rb
railroader-4.3.7	lib/railroader/checks/check_route_dos.rb
railroader-4.3.5	lib/railroader/checks/check_route_dos.rb
railroader-4.3.4	lib/railroader/checks/check_route_dos.rb