Class: Brakeman::CheckModelSerialize

Inherits:
BaseCheck
  • Object
show all
Defined in:
lib/brakeman/checks/check_model_serialize.rb

Instance Method Summary collapse

Instance Method Details

#check_for_serialize(model) ⇒ Object

High confidence warning on serialized, unprotected attributes. Medium confidence warning for serialized, protected attributes.



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'lib/brakeman/checks/check_model_serialize.rb', line 27

def check_for_serialize model
  if serialized_attrs = model.options[:serialize]
    attrs = Set.new

    serialized_attrs.each do |arglist|
      arglist.each do |arg|
        attrs << arg if symbol? arg
      end
    end

    if unsafe_attrs = model.attr_accessible
      attrs.delete_if { |attr| not unsafe_attrs.include? attr.value }
    elsif protected_attrs = model.attr_protected
      safe_attrs = Set.new

      protected_attrs.each do |arglist|
        arglist.each do |arg|
          safe_attrs << arg if symbol? arg
        end
      end

      attrs.delete_if { |attr| safe_attrs.include? attr }
    end

    if attrs.empty?
      confidence = :medium
    else
      confidence = :high
    end

    warn :model => model,
      :warning_type => "Remote Code Execution",
      :warning_code => :CVE_2013_0277,
      :message => msg("Serialized attributes are vulnerable in ", msg_version(rails_version), ", upgrade to ", msg_version(@upgrade_version), " or patch"),
      :confidence => confidence,
      :link => "https://groups.google.com/d/topic/rubyonrails-security/KtmwSbEpzrU/discussion",
      :file => model.file,
      :line => model.top_line,
      :cwe_id => [502]
  end
end

#run_check ⇒ Object 



8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/brakeman/checks/check_model_serialize.rb', line 8

def run_check
  @upgrade_version = case
                    when version_between?("2.0.0", "2.3.16")
                      "2.3.17"
                    when version_between?("3.0.0", "3.0.99")
                      "3.2.11"
                    else
                      nil
                    end

  return unless @upgrade_version

  tracker.models.each do |_name, model|
    check_for_serialize model
  end
end