Contents

class Railroader::CheckRenderInline < Railroader::CheckCrossSiteScripting
  Railroader::Checks.add self

  @description = "Checks for cross-site scripting in render calls"

  def run_check
    setup

    tracker.find_call(:target => nil, :method => :render).each do |result|
      check_render result
    end
  end

  def check_render result
    return unless original? result

    call = result[:call]

    if node_type? call, :render and
      (call.render_type == :text or call.render_type == :inline)

      unless call.render_type == :text and content_type_set? call[3]
        render_value = call[2]

        if input = has_immediate_user_input?(render_value)
          warn :result => result,
            :warning_type => "Cross-Site Scripting",
            :warning_code => :cross_site_scripting_inline,
            :message => "Unescaped #{friendly_type_of input} rendered inline",
            :user_input => input,
            :confidence => :high
        elsif input = has_immediate_model?(render_value)
          warn :result => result,
            :warning_type => "Cross-Site Scripting",
            :warning_code => :cross_site_scripting_inline,
            :message => "Unescaped model attribute rendered inline",
            :user_input => input,
            :confidence => :medium
        end
      end
    end
  end

  CONTENT_TYPES = ["text/html", "text/javascript", "application/javascript"]

  def content_type_set? opts
    if hash? opts
      content_type = hash_access(opts, :content_type)

      string? content_type and not CONTENT_TYPES.include? content_type.value
    end
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
railroader-4.3.8	lib/railroader/checks/check_render_inline.rb
railroader-4.3.7	lib/railroader/checks/check_render_inline.rb
railroader-4.3.5	lib/railroader/checks/check_render_inline.rb
railroader-4.3.4	lib/railroader/checks/check_render_inline.rb