app/controllers/wizard_controller.rb from WikiEducationFoundation/WikiEduDashboard

app/controllers/wizard_controller.rb

0 mins

    all_content = YAML.safe_load(File.read(File.expand_path(content_path, __FILE__)))

Using user input when accessing files (local or remote) will raise a warning in Brakeman.

For example

File.open("/tmp/#{cookie[:file]}")

will raise an error like

Cookie value used in file name near line 4: File.open("/tmp/#{cookie[:file]}")

This type of vulnerability can be used to access arbitrary files on a server (including /etc/passwd.

WikiEducationFoundation/WikiEduDashboard