提交 9fec336e 编写于 作者: J Justin Collins

Fix warning code on low confidence XSS warnings

上级 870b815c
...@@ -173,11 +173,14 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck ...@@ -173,11 +173,14 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
add_result exp add_result exp
link_path = "cross_site_scripting" link_path = "cross_site_scripting"
warning_code = :cross_site_scripting
if @known_dangerous.include? exp.method if @known_dangerous.include? exp.method
confidence = CONFIDENCE[:high] confidence = CONFIDENCE[:high]
if exp.method == :to_json if exp.method == :to_json
message += " in JSON hash" message += " in JSON hash"
link_path += "_to_json" link_path += "_to_json"
warning_code = :xss_to_json
end end
else else
confidence = CONFIDENCE[:low] confidence = CONFIDENCE[:low]
...@@ -185,7 +188,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck ...@@ -185,7 +188,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
warn :template => @current_template, warn :template => @current_template,
:warning_type => "Cross Site Scripting", :warning_type => "Cross Site Scripting",
:warning_code => :xss_to_json, :warning_code => warning_code,
:message => message, :message => message,
:code => exp, :code => exp,
:user_input => @matched.match, :user_input => @matched.match,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册