Class: Brakeman::CheckSymbolDoS
- Inherits:
-
BaseCheck
- Object
- SexpProcessor
- BaseCheck
- Brakeman::CheckSymbolDoS
- Defined in:
- lib/brakeman/checks/check_symbol_dos.rb
Constant Summary collapse
- UNSAFE_METHODS =
[:to_sym, :literal_to_sym, :intern, :symbolize_keys, :symbolize_keys!]
Constants inherited from BaseCheck
Constants included from Util
Util::ALL_COOKIES, Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_COOKIES, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP
Constants inherited from SexpProcessor
Instance Attribute Summary
Attributes inherited from BaseCheck
Attributes inherited from SexpProcessor
Instance Method Summary collapse
- #check_unsafe_symbol_creation(result) ⇒ Object
- #run_check ⇒ Object
- #safe_parameter?(input) ⇒ Boolean
Methods inherited from BaseCheck
#add_result, inherited, #initialize, #process_call, #process_cookies, #process_default, #process_dstr, #process_if, #process_params
Methods included from Util
#array?, #block?, #call?, #camelize, #class_name, #constant?, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore
Methods included from ProcessorHelper
#current_file_name, #process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module
Methods inherited from SexpProcessor
#in_context, #initialize, #process, processors, #scope
Constructor Details
This class inherits a constructor from Brakeman::BaseCheck
Instance Method Details
#check_unsafe_symbol_creation(result) ⇒ Object
19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 |
# File 'lib/brakeman/checks/check_symbol_dos.rb', line 19 def check_unsafe_symbol_creation result return unless original? result call = result[:call] if result[:method] == :literal_to_sym args = call.select { |e| sexp? e } else args = [call.target] end if input = args.map{ |arg| has_immediate_user_input?(arg) }.compact.first confidence = :high elsif input = args.map{ |arg| include_user_input?(arg) }.compact.first confidence = :medium end if confidence return if safe_parameter? input.match = "Symbol conversion from unsafe string (#{friendly_type_of input})" warn :result => result, :warning_type => "Denial of Service", :warning_code => :unsafe_symbol_creation, :message => , :user_input => input, :confidence => confidence end end |
#run_check ⇒ Object
10 11 12 13 14 15 16 17 |
# File 'lib/brakeman/checks/check_symbol_dos.rb', line 10 def run_check return if rails_version and rails_version >= "5.0.0" return if tracker.config.ruby_version >= "2.2" tracker.find_call(:methods => UNSAFE_METHODS, :nested => true).each do |result| check_unsafe_symbol_creation(result) end end |
#safe_parameter?(input) ⇒ Boolean
50 51 52 53 54 55 56 57 58 59 60 61 62 |
# File 'lib/brakeman/checks/check_symbol_dos.rb', line 50 def safe_parameter? input if call? input if node_type? input.target, :params input.method == :[] and symbol? input.first_arg and [:controller, :action].include? input.first_arg.value else safe_parameter? input.target end else false end end |