Merge pull request #196 from grosser/translate-html

more details on xss warning

lib/brakeman/checks/check_translate_bug.rb

 require 'brakeman/checks/base_check'
 
 #Check for vulnerability in translate() helper that allows cross-site scripting
-#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5
 class Brakeman::CheckTranslateBug < Brakeman::BaseCheck
   Brakeman::Checks.add self
 
@@ -12,32 +11,34 @@ class Brakeman::CheckTranslateBug < Brakeman::BaseCheck
         version_between?('3.0.0', '3.0.10') or
         version_between?('3.1.0', '3.1.1')
 
-      if uses_translate?
-        confidence = CONFIDENCE[:high]
+      confidence = if uses_translate?
+        CONFIDENCE[:high]
       else
-        confidence = CONFIDENCE[:med]
+        CONFIDENCE[:med]
       end
 
       version = tracker.config[:rails_version]
+      description = "have a vulnerability in the translate helper with keys ending in _html"
 
-      if version =~ /^3\.1/
-        message = "Versions before 3.1.2 have a vulnerability in the translate helper."
+      message = if version =~ /^3\.1/
+        "Versions before 3.1.2 #{description}."
       elsif version =~ /^3\.0/
-        message = "Versions before 3.0.11 have a vulnerability in translate helper."
+        "Versions before 3.0.11 #{description}."
       else
-        message = "Rails 2.3.x using the rails_xss plugin have a vulnerability in translate helper."
+        "Rails 2.3.x using the rails_xss plugin #{description}}."
       end
 
       warn :warning_type => "Cross Site Scripting",
         :message => message,
         :confidence => confidence,
-        :file => gemfile_or_environment
+        :file => gemfile_or_environment,
+        :link_path => "http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5"
     end
   end
 
   def uses_translate?
     Brakeman.debug "Finding calls to translate() or t()"
 
-    not tracker.find_call(:target => nil, :methods => [:t, :translate]).empty?
+    tracker.find_call(:target => nil, :methods => [:t, :translate]).any?
   end
 end