Showing 41 of 41 total issues
Class has too many lines. [199/100] Open
class CollectionMatrix < ApplicationRecord
### Download Helpers #########################################################
# Get the base URL for remote matrix downloads
def self.get_base_url
- Read upRead up
- Exclude checks
Checks if the length a class exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
Example: CountAsOne: ['array', 'heredoc']
class Foo
ARRAY = [ # +1
1,
2
]
HASH = { # +3
key: 'value'
}
MSG = <<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
NOTE: This cop also applies for Struct
definitions.
Module has too many lines. [109/100] Open
module CollectionMatricesHelper
# Determines how many matrices to display at a time via pagination
# Reads from the params and session hashes, but also handles the special
# case of displaying "All" matrices that match the given filters.
def per_page(params, session)
- Read upRead up
- Exclude checks
Checks if the length a module exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
Example: CountAsOne: ['array', 'heredoc']
module M
ARRAY = [ # +1
1,
2
]
HASH = { # +3
key: 'value'
}
MSG = <<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
Method has too many lines. [21/10] Open
def index
# List of permitted fields for params
permitted_params = params.permit(PERMITTED_PARAMTERS)
# Initialize filterrific filtering system
- Read upRead up
- Exclude checks
Checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
NOTE: The ExcludedMethods
configuration is deprecated and only kept
for backwards compatibility. Please use IgnoredMethods
instead.
Example: CountAsOne: ['array', 'heredoc']
def m
array = [ # +1
1,
2
]
hash = { # +3
key: 'value'
}
<<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
Method has too many lines. [18/10] Open
def self.options_for_sorted_by
[
['ID (High to Low)', 'id_desc'],
['ID (Low to High)', 'id_asc'],
['Group (A to Z)', 'group_asc'],
- Read upRead up
- Exclude checks
Checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
NOTE: The ExcludedMethods
configuration is deprecated and only kept
for backwards compatibility. Please use IgnoredMethods
instead.
Example: CountAsOne: ['array', 'heredoc']
def m
array = [ # +1
1,
2
]
hash = { # +3
key: 'value'
}
<<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
Method has too many lines. [15/10] Open
def show
# List of permitted fields for params
permitted_params = params.permit([{ filterrific: %i[reset_filterrific sorted_by] },
:format, :group, :page, :per_page, :utf8, :_])
- Read upRead up
- Exclude checks
Checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
NOTE: The ExcludedMethods
configuration is deprecated and only kept
for backwards compatibility. Please use IgnoredMethods
instead.
Example: CountAsOne: ['array', 'heredoc']
def m
array = [ # +1
1,
2
]
hash = { # +3
key: 'value'
}
<<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
Method has too many lines. [14/10] Open
def submit
# Verify the reCaptcha
if verify_recaptcha
permitted_params = params[:submitted_matrix].permit(:submitter_name,
:submitter_email, :display_email, :name, :kind, :notes,
- Read upRead up
- Exclude checks
Checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
NOTE: The ExcludedMethods
configuration is deprecated and only kept
for backwards compatibility. Please use IgnoredMethods
instead.
Example: CountAsOne: ['array', 'heredoc']
def m
array = [ # +1
1,
2
]
hash = { # +3
key: 'value'
}
<<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
Method has too many lines. [13/10] Open
def get_url(file_format)
base_url = CollectionMatrix.get_base_url
case file_format
when :matlab
"#{base_url}mat/#{group}/#{name}.mat"
- Read upRead up
- Exclude checks
Checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
NOTE: The ExcludedMethods
configuration is deprecated and only kept
for backwards compatibility. Please use IgnoredMethods
instead.
Example: CountAsOne: ['array', 'heredoc']
def m
array = [ # +1
1,
2
]
hash = { # +3
key: 'value'
}
<<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
Method has too many lines. [11/10] Open
def image_list(matrix)
return [] if matrix.nil? || matrix.image_files.nil?
filename_list = matrix.image_files.split(',')
image_list = []
- Read upRead up
- Exclude checks
Checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
You can set literals you want to fold with CountAsOne
.
Available are: 'array', 'hash', and 'heredoc'. Each literal
will be counted as one line regardless of its actual size.
NOTE: The ExcludedMethods
configuration is deprecated and only kept
for backwards compatibility. Please use IgnoredMethods
instead.
Example: CountAsOne: ['array', 'heredoc']
def m
array = [ # +1
1,
2
]
hash = { # +3
key: 'value'
}
<<~HEREDOC # +1
Heredoc
content.
HEREDOC
end # 5 points
Line is too long. [130/120] Open
'The percentage of nonzero entries that have a matching nonzero entry across the diagonal (but the value may be different)',
- Read upRead up
- Exclude checks
Checks the length of lines in the source code.
The maximum length is configurable.
The tab size is configured in the IndentationWidth
of the Layout/IndentationStyle
cop.
It also ignores a shebang line by default.
This cop has some autocorrection capabilities. It can programmatically shorten certain long lines by inserting line breaks into expressions that can be safely split across lines. These include arrays, hashes, and method calls with argument lists.
If autocorrection is enabled, the following Layout cops are recommended to further format the broken lines. (Many of these are enabled by default.)
- ArgumentAlignment
- BlockAlignment
- BlockDelimiters
- BlockEndNewline
- ClosingParenthesisIndentation
- FirstArgumentIndentation
- FirstArrayElementIndentation
- FirstHashElementIndentation
- FirstParameterIndentation
- HashAlignment
- IndentationWidth
- MultilineArrayLineBreaks
- MultilineBlockLayout
- MultilineHashBraceLayout
- MultilineHashKeyLineBreaks
- MultilineMethodArgumentLineBreaks
- ParameterAlignment
Together, these cops will pretty print hashes, arrays, method calls, etc. For example, let's say the max columns is 25:
Example:
# bad
{foo: "0000000000", bar: "0000000000", baz: "0000000000"}
# good
{foo: "0000000000",
bar: "0000000000", baz: "0000000000"}
# good (with recommended cops enabled)
{
foo: "0000000000",
bar: "0000000000",
baz: "0000000000",
}
Unescaped parameter value Open
= replace_bold_tags(page_entries_info @matrices, model: 'CollectionMatrix')
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped parameter value Open
%th= filterrific_sorting_link(@filterrific, :nonzeros, filterrific_options())
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped parameter value Open
%th.d-none.d-md-table-cell= filterrific_sorting_link(@filterrific, :date, filterrific_options())
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped parameter value Open
%th= filterrific_sorting_link(@filterrific, :name, filterrific_options())
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Mass assignment is not restricted using attr_accessible Open
class ApplicationRecord < ActiveRecord::Base
- Read upRead up
- Exclude checks
This warning comes up if a model does not limit what attributes can be set through mass assignment.
In particular, this check looks for attr_accessible
inside model definitions. If it is not found, this warning will be issued.
Brakeman also warns on use of attr_protected
- especially since it was found to be vulnerable to bypass. Warnings for mass assignment on models using attr_protected
will be reported, but at a lower confidence level.
Note that disabling mass assignment globally will suppress these warnings.
Unescaped parameter value Open
%th= filterrific_sorting_link(@filterrific, :id, filterrific_options())
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped model attribute Open
= paginate groups
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Mass assignment is not restricted using attr_accessible Open
class Group < ApplicationRecord
- Read upRead up
- Exclude checks
This warning comes up if a model does not limit what attributes can be set through mass assignment.
In particular, this check looks for attr_accessible
inside model definitions. If it is not found, this warning will be issued.
Brakeman also warns on use of attr_protected
- especially since it was found to be vulnerable to bypass. Warnings for mass assignment on models using attr_protected
will be reported, but at a lower confidence level.
Note that disabling mass assignment globally will suppress these warnings.
Unescaped parameter value Open
= paginate matrices
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped parameter value Open
%th= filterrific_sorting_link(@filterrific, :cols, filterrific_options())
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped parameter value Open
%th.d-none.d-md-table-cell= filterrific_sorting_link(@filterrific, :kind, filterrific_options())
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.