Sign upLogin

expertiza/expertiza

View on GitHub
Star
app/controllers/reports_controller.rb

Summary

Maintainability
A
0 mins
Test Coverage
F
0%

User controlled method execution
Open

    send(@type.underscore, params, session)
Severity: Critical
Found in app/controllers/reports_controller.rb by brakeman

Using unfiltered user data to select a Class or Method to be dynamically sent is dangerous.

It is much safer to whitelist the desired target or method.

Unsafe use of method:

method = params[:method]
@result = User.send(method.to_sym)

Safe:

method = params[:method] == 1 ? :method_a : :method_b
@result = User.send(method, *args)

Unsafe use of target:

table = params[:table]
model = table.classify.constantize
@result = model.send(:method)

Safe:

target = params[:target] == 1 ? Account : User
@result = target.send(:method, *args)

Including user data in the arguments passed to an Object#send is safe, as long as the method can properly handle potentially bad data.

Safe:

args = params["args"] || []
@result = User.send(:method, *args)

Assignment Branch Condition size for export_details_fields is too high. [15.84/15]
Open

  def self.export_details_fields(detail_options)
    fields = []
    fields << 'Name' if detail_options['name'] == 'true'
    fields << 'UnityID' if detail_options['unity_id'] == 'true'
    fields << 'EmailID' if detail_options['email'] == 'true'
Severity: Minor
Found in app/controllers/reports_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Missing top-level class documentation comment.
Open

class ReportsController < ApplicationController
Severity: Minor
Found in app/controllers/reports_controller.rb by rubocop

This cop checks for missing top-level documentation of classes and modules. Classes with no body are exempt from the check and so are namespace modules - modules that have nothing in their bodies except classes, other modules, or constant definitions.

The documentation requirement is annulled if the class or module has a "#:nodoc:" comment next to it. Likewise, "#:nodoc: all" does the same for all its children.

Example:

# bad
class Person
  # ...
end

# good
# Description/Explanation of Person class
class Person
  # ...
end

There are no issues that match your filters.

Category
Status