Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
社会瑞弟呀
brakeman
提交
cbe43fe6
B
brakeman
项目概览
社会瑞弟呀
/
brakeman
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
B
brakeman
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
cbe43fe6
编写于
4月 18, 2012
作者:
J
Justin Collins
提交者:
Justin Collins
4月 19, 2012
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Return Struct for BaseCheck#has_user_input?
上级
7da75463
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
16 addition
and
10 deletion
+16
-10
lib/brakeman/checks/base_check.rb
lib/brakeman/checks/base_check.rb
+8
-6
lib/brakeman/checks/check_file_access.rb
lib/brakeman/checks/check_file_access.rb
+4
-3
lib/brakeman/checks/check_render.rb
lib/brakeman/checks/check_render.rb
+4
-1
未找到文件。
lib/brakeman/checks/base_check.rb
浏览文件 @
cbe43fe6
...
@@ -12,6 +12,8 @@ class Brakeman::BaseCheck < SexpProcessor
...
@@ -12,6 +12,8 @@ class Brakeman::BaseCheck < SexpProcessor
CONFIDENCE
=
{
:high
=>
0
,
:med
=>
1
,
:low
=>
2
}
CONFIDENCE
=
{
:high
=>
0
,
:med
=>
1
,
:low
=>
2
}
Match
=
Struct
.
new
(
:type
,
:match
)
#Initialize Check with Checks.
#Initialize Check with Checks.
def
initialize
tracker
def
initialize
tracker
super
()
super
()
...
@@ -66,13 +68,13 @@ class Brakeman::BaseCheck < SexpProcessor
...
@@ -66,13 +68,13 @@ class Brakeman::BaseCheck < SexpProcessor
process
exp
[
3
]
process
exp
[
3
]
if
params?
exp
[
1
]
if
params?
exp
[
1
]
@has_user_input
=
:params
@has_user_input
=
Match
.
new
(
:params
,
exp
)
elsif
cookies?
exp
[
1
]
elsif
cookies?
exp
[
1
]
@has_user_input
=
:cookies
@has_user_input
=
Match
.
new
(
:cookies
,
exp
)
elsif
request_env?
exp
[
1
]
elsif
request_env?
exp
[
1
]
@has_user_input
=
:request
@has_user_input
=
Match
.
new
(
:request
,
exp
)
elsif
sexp?
exp
[
1
]
and
model_name?
exp
[
1
][
1
]
elsif
sexp?
exp
[
1
]
and
model_name?
exp
[
1
][
1
]
@has_user_input
=
:model
@has_user_input
=
Match
.
new
(
:model
,
exp
)
end
end
exp
exp
...
@@ -92,13 +94,13 @@ class Brakeman::BaseCheck < SexpProcessor
...
@@ -92,13 +94,13 @@ class Brakeman::BaseCheck < SexpProcessor
#Note that params are included in current expression
#Note that params are included in current expression
def
process_params
exp
def
process_params
exp
@has_user_input
=
:params
@has_user_input
=
Match
.
new
(
:params
,
exp
)
exp
exp
end
end
#Note that cookies are included in current expression
#Note that cookies are included in current expression
def
process_cookies
exp
def
process_cookies
exp
@has_user_input
=
:cookies
@has_user_input
=
Match
.
new
(
:cookies
,
exp
)
exp
exp
end
end
...
...
lib/brakeman/checks/check_file_access.rb
浏览文件 @
cbe43fe6
...
@@ -28,13 +28,14 @@ class Brakeman::CheckFileAccess < Brakeman::BaseCheck
...
@@ -28,13 +28,14 @@ class Brakeman::CheckFileAccess < Brakeman::BaseCheck
file_name
=
call
[
3
][
1
]
file_name
=
call
[
3
][
1
]
if
check
=
include_user_input?
(
file_name
)
if
input
=
include_user_input?
(
file_name
)
unless
duplicate?
result
unless
duplicate?
result
add_result
result
add_result
result
if
check
==
:params
case
input
.
type
when
:params
message
=
"Parameter"
message
=
"Parameter"
elsif
check
==
:cookies
when
:cookies
message
=
"Cookie"
message
=
"Cookie"
else
else
message
=
"User input"
message
=
"User input"
...
...
lib/brakeman/checks/check_render.rb
浏览文件 @
cbe43fe6
...
@@ -36,7 +36,10 @@ class Brakeman::CheckRender < Brakeman::BaseCheck
...
@@ -36,7 +36,10 @@ class Brakeman::CheckRender < Brakeman::BaseCheck
if
type
if
type
confidence
=
CONFIDENCE
[
:high
]
confidence
=
CONFIDENCE
[
:high
]
elsif
type
=
include_user_input?
(
view
)
elsif
input
=
include_user_input?
(
view
)
type
=
input
.
type
match
=
input
.
match
if
node_type?
view
,
:string_interp
,
:dstr
if
node_type?
view
,
:string_interp
,
:dstr
confidence
=
CONFIDENCE
[
:med
]
confidence
=
CONFIDENCE
[
:med
]
else
else
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录