Sha256: dfff1e9d5a2d22c56fa97d0f7a897b5ca7c4523d87d22c3f57b1f6b882db3ff5
Contents?: true
Size: 1.02 KB
Versions: 39
Compression:
Stored size: 1.02 KB
Contents
require 'brakeman/checks/base_check'
class Brakeman::CheckSecrets < Brakeman::BaseCheck
Brakeman::Checks.add_optional self
@description = "Checks for secrets stored in source code"
def run_check
check_constants
end
def check_constants
@warned = Set.new
@tracker.constants.each do |constant|
name = constant.name_array.last
value = constant.value
if string? value and not value.value.empty? and looks_like_secret? name
match = [name, value, value.line]
unless @warned.include? match
@warned << match
warn :warning_code => :secret_in_source,
:warning_type => "Authentication",
:message => "Hardcoded value for #{name} in source code",
:confidence => CONFIDENCE[:med],
:file => constant.file,
:line => constant.line
end
end
end
end
def looks_like_secret? name
# REST_AUTH_SITE_KEY is the pepper in Devise
name.match /password|secret|(rest_auth_site|api)_key$/i
end
end
Version data entries
39 entries across 39 versions & 3 rubygems