提交 ffdba206 编写于 作者: J Justin Collins

Don't ignore URLs in link_to

上级 dd32dbd1
......@@ -11,6 +11,8 @@ class Brakeman::CheckLinkToHref < Brakeman::CheckLinkTo
@description = "Checks to see if values used for hrefs are sanitized using a :url_safe_method to protect against javascript:/data: XSS"
IGNORE_LIKE = /_path$/
def run_check
@ignore_methods = Set[:button_to, :check_box,
:field_field, :fields_for, :hidden_field,
......@@ -89,4 +91,8 @@ class Brakeman::CheckLinkToHref < Brakeman::CheckLinkTo
end
end
end
def ignored_method? method
@ignore_methods.include? method or method.to_s =~ IGNORE_LIKE
end
end
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册