提交 9f97910d 编写于 作者: J Justin Collins
上级 2d733ae1
require 'checks/base_check'
require 'processors/lib/find_call'
#Check for versions with vulnerable html escape method
#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195
class CheckEscapeFunction < BaseCheck
Checks.add self
def run_check
if version_between?('2.0.0', '2.3.12') and RUBY_VERSION < '1.9.0'
warn :warning_type => 'Cross Site Scripting',
:message => 'Versions before 2.3.13 have a vulnerability in escape method when used with Ruby 1.8. Upgrade or apply patches as needed.',
:confidence => CONFIDENCE[:high]
end
end
end
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册