Class: Spektr::Checks::JsonEncoding

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/json_encoding.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #model_attribute?, #should_run?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ JsonEncoding

Returns a new instance of JsonEncoding.



4
5
6
7
8
9
 
# File 'lib/spektr/checks/json_encoding.rb', line 4

def initialize(app, target)
  super
  @name = "XSS by missing JSON encoding"
  @type = "Cross-Site Scripting"
  @targets = ["Spektr::Targets::Base", "Spektr::Targets::Controller", "Spektr::Targets::Routes", "Spektr::Targets::View"]
end

Instance Method Details

#run ⇒ Object 



11
12
13
14
15
16
17
18
19
20
 
# File 'lib/spektr/checks/json_encoding.rb', line 11

def run
  return unless super
  if app_version_between?("4.1.0", "4.1.10") || app_version_between?("4.2.0", "4.2.1")
    if calls = @target.find_calls(:to_json).any? || calls = @target.find_calls(:encode).any?
      warn! @target, self, calls.first.location, "Cross-Site Scripting CVE_2015_3226"
    else
      warn! "root", self, nil, "Cross-Site Scripting CVE_2015_3226"
    end
  end
end