Class: Spektr::Checks::LinkToHref

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/link_to_href.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #model_attribute?, #should_run?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ LinkToHref

Returns a new instance of LinkToHref.



4
5
6
7
8
9
 
# File 'lib/spektr/checks/link_to_href.rb', line 4

def initialize(app, target)
  super
  @name = "XSS in href param of link_to"
  @type = "Cross-Site Scripting"
  @targets = ["Spektr::Targets::Base", "Spektr::Targets::Controller", "Spektr::Targets::View"]
end

Instance Method Details

#run ⇒ Object

TODO: check for user supplied model attributes too



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
 
# File 'lib/spektr/checks/link_to_href.rb', line 12

def run
  return unless super
  block_locations = []
  @target.find_calls_with_block(:link_to).each do |call|
    block_locations << call.location
    next unless call.arguments.first
    ::Spektr.logger.debug "#{@target.path}  #{call.location.line} #{call.arguments.first.inspect}"
    if user_input? call.arguments.first.type, call.arguments.first.name, call.arguments.first.ast, call.arguments.first
      warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
    end
  end

  @target.find_calls(:link_to).each do |call|
    next if block_locations.include? call.location
    ::Spektr.logger.debug "#{@target.path}  #{call.location.line} #{call.arguments[1].inspect}"
    next unless call.arguments[1] || call.arguments[1]&.name =~ /_url$|_path$/
    if user_input? call.arguments[1].type, call.arguments[1].name, call.arguments[1].ast, call.arguments[1]
      warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
    end
  end
end