Class: Brakeman::CheckValidationRegex

Inherits:
BaseCheck show all
Defined in:
lib/brakeman/checks/check_validation_regex.rb

Overview

Reports any calls to validates_format_of which do not use \A and \z as anchors in the given regular expression.

For example:

#Allows anything after new line validates_format_of :user_name, :with => /^w+$/

Constant Summary collapse

WITH = 
Sexp.new(:lit, :with)
FORMAT = 
Sexp.new(:lit, :format)
SECURE_REGEXP_PATTERN =

Match secure regexp without extended option

%r{
  \A
  \\A
  .*
  \\[zZ]
  \z
}x
EXTENDED_SECURE_REGEXP_PATTERN =

Match secure of regexp with extended option

%r{
  \A
  \s*
  \\A
  .*
  \\[zZ]
  \s*
  \z
}mx

Constants inherited from BaseCheck

BaseCheck::CONFIDENCE

Constants included from Util

Util::ALL_COOKIES, Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::DIR_CONST, Util::LITERALS, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_COOKIES, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::REQUEST_REQUEST_PARAMETERS, Util::SAFE_LITERAL, Util::SESSION, Util::SESSION_SEXP, Util::SIMPLE_LITERALS

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from BaseCheck

#tracker, #warnings

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseCheck

#add_result, inherited, #initialize, #process_array, #process_call, #process_cookies, #process_default, #process_dstr, #process_if, #process_params

Methods included from Messages

#msg, #msg_code, #msg_cve, #msg_file, #msg_input, #msg_lit, #msg_plain, #msg_version

Methods included from Util

#all_literals?, #array?, #block?, #call?, #camelize, #class_name, #constant?, #contains_class?, #cookies?, #dir_glob?, #false?, #hash?, #hash_access, #hash_insert, #hash_iterate, #hash_values, #integer?, #kwsplat?, #literal?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #recurse_check?, #regexp?, #remove_kwsplat, #request_headers?, #request_value?, #result?, #safe_literal, #safe_literal?, #safe_literal_target?, #set_env_defaults, #sexp?, #simple_literal?, #string?, #string_interp?, #symbol?, #template_path_to_name, #true?, #underscore

Methods included from ProcessorHelper

#current_file, #process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module

Methods inherited from SexpProcessor

#in_context, #initialize, #process, processors, #scope

Constructor Details

This class inherits a constructor from Brakeman::BaseCheck

Instance Method Details

#check_regex(value, validator) ⇒ Object

Issue warning if the regular expression does not use \A and \z



84
85
86
87
88
89
90
91
92
93
94
95
96
97
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 84

def check_regex value, validator
  return unless regexp? value

  regex = value.value
  unless secure_regex?(regex)
    warn :model => @current_model,
    :warning_type => "Format Validation",
    :warning_code => :validation_regex,
    :message => msg("Insufficient validation for ", msg_code(get_name validator), " using ", msg_code(regex.inspect), ". Use ", msg_code("\\A"), " and ", msg_code("\\z"), " as anchors"),
    :line => value.line,
    :confidence => :high,
    :cwe_id => [777]
  end
end

#get_name(validator) ⇒ Object

Get the name of the attribute being validated.



100
101
102
103
104
105
106
107
108
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 100

def get_name validator
  name = validator[1]

  if sexp? name
    name.value
  else
    name
  end
end

#process_validates(validator) ⇒ Object

Check validates …, :format => …



47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 47

def process_validates validator
  hash_arg = validator.last
  return unless hash? hash_arg

  value = hash_access(hash_arg, FORMAT)

  if hash? value
    value = hash_access(value, WITH)
  end

  if value
    check_regex value, validator
  end
end

#process_validates_format_of(validator) ⇒ Object

Check validates_format_of



40
41
42
43
44
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 40

def process_validates_format_of validator
  if value = hash_access(validator.last, WITH)
    check_regex value, validator
  end
end

#run_check ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 18

def run_check
  active_record_models.each do |name, model|
    @current_model = model
    format_validations = model.options[:validates_format_of]

    if format_validations
      format_validations.each do |v|
        process_validates_format_of v
      end
    end

    validates = model.options[:validates]

    if validates
      validates.each do |v|
        process_validates v
      end
    end
  end
end