Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
CoCo_Code_Op2
brakeman
提交
934530d1
B
brakeman
项目概览
CoCo_Code_Op2
/
brakeman
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
B
brakeman
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
934530d1
编写于
5月 07, 2013
作者:
J
Justin Collins
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Add checks for CSV.load and Marshal.load
and combine with YAML checks
上级
e62cf7e8
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
100 addition
and
1 deletion
+100
-1
lib/brakeman/checks/check_deserialize.rb
lib/brakeman/checks/check_deserialize.rb
+57
-0
test/apps/rails3.1/app/controllers/other_controller.rb
test/apps/rails3.1/app/controllers/other_controller.rb
+8
-0
test/tests/test_rails31.rb
test/tests/test_rails31.rb
+35
-1
未找到文件。
lib/brakeman/checks/check_
yaml_load
.rb
→
lib/brakeman/checks/check_
deserialize
.rb
浏览文件 @
934530d1
require
'brakeman/checks/base_check'
#YAML.load can be used for remote code execution
class
Brakeman::CheckYAMLLoad
<
Brakeman
::
BaseCheck
class
Brakeman::CheckDeserialize
<
Brakeman
::
BaseCheck
Brakeman
::
Checks
.
add
self
@description
=
"Checks for u
ses of YAML.load
"
@description
=
"Checks for u
nsafe deserialization of objects
"
def
run_check
yaml_methods
=
[
:load
,
:load_documents
,
:load_stream
,
:parse_documents
,
:parse_stream
]
check_yaml
check_csv
check_marshal
end
def
check_yaml
check_methods
:YAML
,
:load
,
:load_documents
,
:load_stream
,
:parse_documents
,
:parse_stream
end
def
check_csv
check_methods
:CSV
,
:load
end
def
check_marshal
check_methods
:Marshal
,
:load
,
:restore
end
tracker
.
find_call
(
:target
=>
:YAML
,
:methods
=>
yaml_methods
).
each
do
|
result
|
check_yaml_load
result
def
check_methods
target
,
*
methods
tracker
.
find_call
(
:target
=>
target
,
:methods
=>
methods
).
each
do
|
result
|
check_deserialize
result
,
target
end
end
def
check_
yaml_load
result
def
check_
deserialize
result
,
target
,
arg
=
nil
return
if
duplicate?
result
add_result
result
arg
=
result
[
:call
].
first_arg
arg
||
=
result
[
:call
].
first_arg
method
=
result
[
:call
].
method
if
input
=
has_immediate_user_input?
(
arg
)
...
...
@@ -28,7 +43,7 @@ class Brakeman::CheckYAMLLoad < Brakeman::BaseCheck
end
if
confidence
message
=
"
YAML
.
#{
method
}
called with
#{
friendly_type_of
input
}
"
message
=
"
#{
target
}
.
#{
method
}
called with
#{
friendly_type_of
input
}
"
warn
:result
=>
result
,
:warning_type
=>
"Remote Code Execution"
,
...
...
@@ -36,7 +51,7 @@ class Brakeman::CheckYAMLLoad < Brakeman::BaseCheck
:message
=>
message
,
:user_input
=>
input
.
match
,
:confidence
=>
confidence
,
:link_path
=>
"
remote_code_execution_yaml_load
"
:link_path
=>
"
unsafe_deserialization
"
end
end
end
test/apps/rails3.1/app/controllers/other_controller.rb
浏览文件 @
934530d1
...
...
@@ -64,4 +64,12 @@ class OtherController < ApplicationController
sanitize
something
@css
=
sanitize_css
(
some_css
)
end
def
test_deserialization
CSV
.
load
params
[
:csv
]
Marshal
.
load
params
[
:object
]
Marshal
.
restore
User
.
find
(
1
).
cool_stored_thing
end
end
test/tests/test_rails31.rb
浏览文件 @
934530d1
...
...
@@ -15,7 +15,7 @@ class Rails31Tests < Test::Unit::TestCase
:model
=>
3
,
:template
=>
22
,
:controller
=>
4
,
:warning
=>
68
}
:warning
=>
71
}
end
def
test_without_protection
...
...
@@ -969,6 +969,7 @@ class Rails31Tests < Test::Unit::TestCase
:confidence
=>
0
,
:file
=>
/admin_controller\.rb/
end
def
test_unsafe_reflection_constantize_indirect
assert_warning
:type
=>
:warning
,
:warning_type
=>
"Remote Code Execution"
,
...
...
@@ -977,4 +978,37 @@ class Rails31Tests < Test::Unit::TestCase
:confidence
=>
1
,
:file
=>
/admin_controller\.rb/
end
def
test_csv_load
assert_warning
:type
=>
:warning
,
:warning_code
=>
25
,
:fingerprint
=>
"3b58b691bf7ef0b244ee463aa812e4e6ffe3fe1075c8bd138c0cb5a77f365f41"
,
:warning_type
=>
"Remote Code Execution"
,
:line
=>
69
,
:message
=>
/^CSV\.load\ called\ with\ parameter\ value/
,
:confidence
=>
0
,
:relative_path
=>
"app/controllers/other_controller.rb"
end
def
test_marshal_load
assert_warning
:type
=>
:warning
,
:warning_code
=>
25
,
:fingerprint
=>
"ecdb984aa40fbe7d42a74ab474a412579b42b36c630bcac640d382e108109437"
,
:warning_type
=>
"Remote Code Execution"
,
:line
=>
71
,
:message
=>
/^Marshal\.load\ called\ with\ parameter\ value/
,
:confidence
=>
0
,
:relative_path
=>
"app/controllers/other_controller.rb"
end
def
test_marshal_restore
assert_warning
:type
=>
:warning
,
:warning_code
=>
25
,
:fingerprint
=>
"78ef96a81c8b02f97992a7056e4d9696ab238e12bc8a7a3204df29ef11e0a3fe"
,
:warning_type
=>
"Remote Code Execution"
,
:line
=>
73
,
:message
=>
/^Marshal\.restore\ called\ with\ model\ attrib/
,
:confidence
=>
1
,
:relative_path
=>
"app/controllers/other_controller.rb"
end
end
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录