Class: Brakeman::CheckValidationRegex

Inherits:
BaseCheck show all
Defined in:
lib/brakeman/checks/check_validation_regex.rb

Overview

Reports any calls to validates_format_of which do not use \A and \z as anchors in the given regular expression.

For example:

#Allows anything after new line validates_format_of :user_name, :with => /^w+$/

Constant Summary collapse

WITH = 
Sexp.new(:lit, :with)

Constants inherited from BaseCheck

BaseCheck::CONFIDENCE

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::PARAMETERS, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from BaseCheck

#tracker, #warnings

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseCheck

#add_result, #initialize, #process_call, #process_cookies, #process_default, #process_if, #process_params

Methods included from Util

#array?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #node_type?, #number?, #params?, #pluralize, #regexp?, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#class_name, #process_all, #process_module

Methods inherited from SexpProcessor

#error_handler, #in_context, #initialize, #process, #process_dummy, #scope

Constructor Details

This class inherits a constructor from Brakeman::BaseCheck

Instance Method Details

#check_regex(value, validator) ⇒ Object

Issue warning if the regular expression does not use \A and \z



38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 38

def check_regex value, validator
  return unless regexp? value

  regex = value.value.inspect
  if regex =~ /^\/(.{2}).*(.{2})\/(m|i|x|n|e|u|s|o)*\z/
    if $1 != "\\A" or ($2 != "\\Z" and $2 != "\\z")
      warn :model => @current_model,
        :warning_type => "Format Validation", 
        :message => "Insufficient validation for '#{get_name validator}' using #{value.value.inspect}. Use \\A and \\z as anchors",
        :line => value.line,
        :confidence => CONFIDENCE[:high] 
    end
  end
end

#get_name(validator) ⇒ Object

Get the name of the attribute being validated.



54
55
56
57
58
59
60
61
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 54

def get_name validator
  name = validator[1]
  if sexp? name
    name[1]
  else
    name
  end
end

#process_validator(validator) ⇒ Object

Check validates_format_of



30
31
32
33
34
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 30

def process_validator validator
  if value = hash_access(validator.last, WITH)
    check_regex value, validator
  end
end

#run_check ⇒ Object 



17
18
19
20
21
22
23
24
25
26
27
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 17

def run_check
  active_record_models.each do |name, model|
    @current_model = name
    format_validations = model[:options][:validates_format_of]
    if format_validations
      format_validations.each do |v|
        process_validator v
      end
    end
  end
end