Sha256: d6d294785c8cc218910d8ba468bd87ff1cb84ae36b116e37f48ae4c8ee84fbfe
Contents?: true
Size: 1.92 KB
Versions: 22
Compression:
Stored size: 1.92 KB
Contents
require 'brakeman/checks/base_check'
#At the moment, this looks for
#
# skip_before_filter :verify_authenticity_token, :except => [...]
#
#which is essentially a blacklist approach (no actions are checked EXCEPT the
#ones listed) versus a whitelist approach (ONLY the actions listed will skip
#the check)
class Brakeman::CheckSkipBeforeFilter < Brakeman::BaseCheck
Brakeman::Checks.add self
@description = "Warn when skipping CSRF or authentication checks by default"
def run_check
tracker.controllers.each do |name, controller|
filter_skips = (controller[:options][:skip_before_filter] || []) + (controller[:options][:skip_filter] || [])
filter_skips.each do |filter|
process_skip_filter filter, controller
end
end
end
def process_skip_filter filter, controller
case skip_except_value filter
when :verify_authenticity_token
warn :class => controller[:name], #ugh this should be a controller warning, too
:warning_type => "Cross-Site Request Forgery",
:warning_code => :csrf_blacklist,
:message => "Use whitelist (:only => [..]) when skipping CSRF check",
:code => filter,
:confidence => CONFIDENCE[:med],
:file => controller[:file]
when :login_required, :authenticate_user!, :require_user
warn :controller => controller[:name],
:warning_code => :auth_blacklist,
:warning_type => "Authentication",
:message => "Use whitelist (:only => [..]) when skipping authentication",
:code => filter,
:confidence => CONFIDENCE[:med],
:link => "authentication_whitelist",
:file => controller[:file]
end
end
def skip_except_value filter
return false unless call? filter
first_arg = filter.first_arg
last_arg = filter.last_arg
if symbol? first_arg and hash? last_arg
if hash_access(last_arg, :except)
return first_arg.value
end
end
false
end
end
Version data entries
22 entries across 22 versions & 2 rubygems