Class: Brakeman::CheckModelAttrAccessible

Inherits:
BaseCheck
  • Object
show all
Defined in:
lib/brakeman/checks/check_model_attr_accessible.rb

Overview

Author: Paul Deardorff (themetric) Checks models to see if important foreign keys or attributes are exposed as attr_accessible when they probably shouldn't be.

Constant Summary collapse

SUSP_ATTRS = 
[
  [:admin, :high], # Very dangerous unless some Rails authorization used
  [:role, :medium],
  [:banned, :medium],
  [:account_id, :high],
  [/\S*_id(s?)\z/, :weak] # All other foreign keys have weak/low confidence
]

Instance Method Summary collapse

Instance Method Details

#check_models ⇒ Object 



50
51
52
53
54
55
56
 
# File 'lib/brakeman/checks/check_model_attr_accessible.rb', line 50

def check_models
  tracker.models.each do |name, model|
    if !model.attr_accessible.nil?
      yield name, model
    end
  end
end

#role_limited?(model, attribute) ⇒ Boolean

Returns:

  • (Boolean) 


44
45
46
47
48
 
# File 'lib/brakeman/checks/check_model_attr_accessible.rb', line 44

def role_limited? model, attribute
  role_accessible = model.role_accessible
  return if role_accessible.nil?
  role_accessible.include? attribute
end

#run_check ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/brakeman/checks/check_model_attr_accessible.rb', line 21

def run_check
  check_models do |name, model|
    model.attr_accessible.each do |attribute|
      next if role_limited? model, attribute

      SUSP_ATTRS.each do |susp_attr, confidence|
        if susp_attr.is_a?(Regexp) and susp_attr =~ attribute.to_s or susp_attr == attribute
          warn :model => model,
            :file => model.file,
            :warning_type => "Mass Assignment",
            :warning_code => :dangerous_attr_accessible,
            :message => "Potentially dangerous attribute available for mass assignment",
            :confidence => confidence,
            :code => Sexp.new(:lit, attribute),
            :cwe_id => [915]

          break # Prevent from matching single attr multiple times
        end
      end
    end
  end
end