Sha256: cf26a6fa9b066c80f2efcd7f8a8cdb903923799aa185f76bc664b09d9712c394
Contents?: true
Size: 664 Bytes
Versions: 38
Compression:
Stored size: 664 Bytes
Contents
require 'checks/base_check'
#This check looks for calls to +eval+, +instance_eval+, etc. which include
#user input.
class CheckEvaluation < BaseCheck
Checks.add self
#Process calls
def run_check
calls = tracker.find_call nil, [:eval, :instance_eval, :class_eval, :module_eval]
calls.each do |call|
process_result call
end
end
#Warns if result includes user input
def process_result result
if include_user_input? result[-1]
warn :result => result,
:warning_type => "Dangerous Eval",
:message => "User input in eval",
:code => result[-1],
:confidence => CONFIDENCE[:high]
end
end
end
Version data entries
38 entries across 38 versions & 2 rubygems