- 06 3月, 2012 5 次提交
- 05 3月, 2012 2 次提交
- 03 3月, 2012 1 次提交
-
-
由 Justin Collins 提交于
-
- 02 3月, 2012 9 次提交
-
-
由 Justin 提交于
[ci skip]
-
由 Justin Collins 提交于
instead of using :only. This is essentially a blacklist vs. whitelist issue.
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
upgrading is recommended, no workarounds https://groups.google.com/group/rubyonrails-security/browse_thread/thread/edd28f1e3d04e913?pli=1
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
-
- 29 2月, 2012 7 次提交
-
-
由 Justin Collins 提交于
since most development is done with 1.9.3 now
-
由 Justin Collins 提交于
fixes bug where resource routes attempted to merge into :allow_all_actions
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
because before they were kind of all over the place
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
-
- 28 2月, 2012 1 次提交
-
-
由 Justin Collins 提交于
-
- 25 2月, 2012 5 次提交
-
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
instead of "sexp? exp and exp.node_type == :blah" or "sexp? exp and exp[0] == :blah"
-
由 Justin Collins 提交于
-
由 Justin Collins 提交于
instead of returning false for options[:exit_on_warn]
-
由 Justin Collins 提交于
-
- 24 2月, 2012 3 次提交
-
-
由 Justin Collins 提交于
because sometimes that row gets modified and subsequent calls to Warning#to_row will return the modified version thereby breaking things.
-
由 Justin Collins 提交于
instead of when reporting, which lead to confusion and filtering all over the place instead of in one place.
-
由 Justin Collins 提交于
fixes #47
-
- 23 2月, 2012 2 次提交
- 16 2月, 2012 4 次提交
-
-
由 Neil Matatall 提交于
-
由 Neil Matatall 提交于
-
由 Neil Matatall 提交于
Add concept of a safe-ening method to mark hrefs as safe Feature: Warn when using unsafe hrefs. This is a very specific case that as of now produces a ton of noise. This came out of an xss vuln where the value was escaped but still vulnerable. link_to 'asdf', h(@scary) where @scary = 'javascript:alert(1)' or @scary = 'data: # http://palpapers.plynt.com/issues/2010Oct/bypass-xss-filters/ This branch accomplishes slightly intelligent warnings by adding a new command line option to declare methods that make a string URL safe (unless there is already a standard one out there). e.g.: $ brakeman . --url-safe-methods ensure_valid_protocol! link_to 'asdf', ensure_valid_protocol!(@scary, :javascript)
-
由 Neil Matatall 提交于
-
- 11 2月, 2012 1 次提交
-
-
由 Justin Collins 提交于
-