app/controllers/tasks/nomenclature/paper_catalog_controller.rb
Parameter value used in file name Open
Open
send_data(File.read(a), filename: "#{@taxon_name.name}_paper_catalog_#{DateTime.now}.zip", type: 'application/zip') and return- Read upRead up
- Exclude checks
Using user input when accessing files (local or remote) will raise a warning in Brakeman.
For example
File.open("/tmp/#{cookie[:file]}")will raise an error like
Cookie value used in file name near line 4: File.open("/tmp/#{cookie[:file]}")This type of vulnerability can be used to access arbitrary files on a server (including /etc/passwd.
TODO found Open
Open
# TODO: move logic out- Exclude checks