Class: Brakeman::CheckPermitAttributes

Inherits:
BaseCheck
  • Object
show all
Defined in:
lib/brakeman/checks/check_permit_attributes.rb

Constant Summary collapse

SUSPICIOUS_KEYS = 
{
  admin: :high,
  account_id: :high,
  role: :medium,
  banned: :medium,
}

Instance Method Summary collapse

Instance Method Details

#check_permit(result) ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/brakeman/checks/check_permit_attributes.rb', line 21

def check_permit result
  return unless original? result

  call = result[:call]

  call.each_arg do |arg|
    if symbol? arg
      if SUSPICIOUS_KEYS.key? arg.value
        warn_on_permit_key result, arg
      end
    end
  end
end

#run_check ⇒ Object 



15
16
17
18
19
 
# File 'lib/brakeman/checks/check_permit_attributes.rb', line 15

def run_check
  tracker.find_call(:method => :permit).each do |result|
    check_permit result
  end
end

#warn_on_permit_key(result, key, confidence = nil) ⇒ Object 



35
36
37
38
39
40
41
42
43
 
# File 'lib/brakeman/checks/check_permit_attributes.rb', line 35

def warn_on_permit_key result, key, confidence = nil
  warn :result => result,
    :warning_type => "Mass Assignment",
    :warning_code => :dangerous_permit_key,
    :message => "Potentially dangerous key allowed for mass assignment",
    :confidence => (confidence || SUSPICIOUS_KEYS[key.value]),
    :user_input => key,
    :cwe_id => [915]
end