提交 988f908a 编写于 作者: N Noah Davis

Recognize how slim sometimes outputs safe html (with `escape_html_safe`)

Reduces slim XSS false positives in cases where brakeman is run in the context
of an app that includes active support.

Templates compile down to Template::Utils.escape_html_utils if
Active Support's `html_safe?` method is defined.

See:

https://github.com/judofyr/temple/blob/master/lib/temple/filters/escapable.rb#L12
上级 7ebe5266
......@@ -96,7 +96,7 @@ class Brakeman::SlimTemplateProcessor < Brakeman::TemplateProcessor
def is_escaped? exp
call? exp and
exp.target == TEMPLE_UTILS and
exp.method == :escape_html
(exp.method == :escape_html or exp.method == :escape_html_safe)
end
def render? exp
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册