Class: Spektr::Checks::FileDisclosure

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/file_disclosure.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #model_attribute?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ FileDisclosure

Returns a new instance of FileDisclosure.



5
6
7
8
9
10
 
# File 'lib/spektr/checks/file_disclosure.rb', line 5

def initialize(app, target)
  super
  @name = "File existence disclosure"
  @type = "Information Disclosure"
  @targets = ["Spektr::Targets::Base"]
end

Instance Method Details

#run ⇒ Object 



12
13
14
15
16
17
18
 
# File 'lib/spektr/checks/file_disclosure.rb', line 12

def run
  return unless super
  config = @app.production_config.find_calls(:serve_static_assets=).first
  if config && config.arguments.first.type == :true
    warn! "root", self, nil, "File existence disclosure vulnerability"
  end
end

#should_run? ⇒ Boolean

Returns:

  • (Boolean) 


20
21
22
 
# File 'lib/spektr/checks/file_disclosure.rb', line 20

def should_run?
  app_version_between?("2.0.0", "2.3.18") || app_version_between?("3.0.0", "3.2.20") || app_version_between?("4.0.0", "4.0.11") || app_version_between?("4.1.0", "4.1.7")
end