Showing 64 of 64 total issues
Method update_whitelist
has a Cognitive Complexity of 10 (exceeds 5 allowed). Consider refactoring. Open
def update_whitelist
authorize! :manage, Whitelist
username = params[:username] ? params[:username].strip : nil
provider = params[:provider]
privilege = params[:privilege]
- Read upRead up
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method update_whitelist
has 27 lines of code (exceeds 25 allowed). Consider refactoring. Open
def update_whitelist
authorize! :manage, Whitelist
username = params[:username] ? params[:username].strip : nil
provider = params[:provider]
privilege = params[:privilege]
Method set_filters
has 27 lines of code (exceeds 25 allowed). Consider refactoring. Open
def set_filters
session[:filters] = session[:filters].merge params.slice(:search, :tags, :sort_by)
if session[:filters][:tags].is_a? String
session[:filters][:tags] = self.class.parse_list session[:filters][:tags]
Method render_from_json
has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring. Open
def self.render_from_json(json_code, uid, prev_uid)
result = ""
return "" if json_code == nil || json_code.length <= 2
json_hash = JSON.parse(json_code)
answers = json_hash["answers"]
- Read upRead up
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Similar blocks of code found in 5 locations. Consider refactoring. Open
$.ajax({
url: $(this).attr('action'),
type: 'PUT',
data: $(this).serialize()
});
- Read upRead up
Duplicated Code
Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:
Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.
When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).
Tuning
This issue has a mass of 50.
We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.
The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.
If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.
See codeclimate-duplication
's documentation for more information about tuning the mass threshold in your .codeclimate.yml
.
Refactorings
- Extract Method
- Extract Class
- Form Template Method
- Introduce Null Object
- Pull Up Method
- Pull Up Field
- Substitute Algorithm
Further Reading
- Don't Repeat Yourself on the C2 Wiki
- Duplicated Code on SourceMaking
- Refactoring: Improving the Design of Existing Code by Martin Fowler. Duplicated Code, p76
Similar blocks of code found in 5 locations. Consider refactoring. Open
$.ajax({
url: $(this).attr('action'),
type: 'PUT',
data: $(this).serialize()
});
- Read upRead up
Duplicated Code
Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:
Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.
When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).
Tuning
This issue has a mass of 50.
We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.
The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.
If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.
See codeclimate-duplication
's documentation for more information about tuning the mass threshold in your .codeclimate.yml
.
Refactorings
- Extract Method
- Extract Class
- Form Template Method
- Introduce Null Object
- Pull Up Method
- Pull Up Field
- Substitute Algorithm
Further Reading
- Don't Repeat Yourself on the C2 Wiki
- Duplicated Code on SourceMaking
- Refactoring: Improving the Design of Existing Code by Martin Fowler. Duplicated Code, p76
Similar blocks of code found in 5 locations. Consider refactoring. Open
$.ajax({
url: $(this).attr('action'),
type: 'PUT',
data: $(this).serialize()
});
- Read upRead up
Duplicated Code
Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:
Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.
When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).
Tuning
This issue has a mass of 50.
We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.
The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.
If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.
See codeclimate-duplication
's documentation for more information about tuning the mass threshold in your .codeclimate.yml
.
Refactorings
- Extract Method
- Extract Class
- Form Template Method
- Introduce Null Object
- Pull Up Method
- Pull Up Field
- Substitute Algorithm
Further Reading
- Don't Repeat Yourself on the C2 Wiki
- Duplicated Code on SourceMaking
- Refactoring: Improving the Design of Existing Code by Martin Fowler. Duplicated Code, p76
Method update_multiple_tags
has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring. Open
def update_multiple_tags
new_tags = self.class.parse_list params[:tag_names]
selected = params[:checked_problems] ? params[:checked_problems].keys : []
if new_tags == []
flash[:error] = "You need to enter a tag."
- Read upRead up
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Similar blocks of code found in 5 locations. Consider refactoring. Open
$.ajax({
url: $(this).attr('action'),
type: 'PUT',
data: $(this).serialize()
});
- Read upRead up
Duplicated Code
Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:
Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.
When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).
Tuning
This issue has a mass of 50.
We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.
The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.
If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.
See codeclimate-duplication
's documentation for more information about tuning the mass threshold in your .codeclimate.yml
.
Refactorings
- Extract Method
- Extract Class
- Form Template Method
- Introduce Null Object
- Pull Up Method
- Pull Up Field
- Substitute Algorithm
Further Reading
- Don't Repeat Yourself on the C2 Wiki
- Duplicated Code on SourceMaking
- Refactoring: Improving the Design of Existing Code by Martin Fowler. Duplicated Code, p76
Similar blocks of code found in 5 locations. Consider refactoring. Open
$.ajax({
url: $(this).attr('action'),
type: 'POST',
data: $(this).serialize()
});
- Read upRead up
Duplicated Code
Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:
Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.
When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).
Tuning
This issue has a mass of 50.
We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.
The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.
If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.
See codeclimate-duplication
's documentation for more information about tuning the mass threshold in your .codeclimate.yml
.
Refactorings
- Extract Method
- Extract Class
- Form Template Method
- Introduce Null Object
- Pull Up Method
- Pull Up Field
- Substitute Algorithm
Further Reading
- Don't Repeat Yourself on the C2 Wiki
- Duplicated Code on SourceMaking
- Refactoring: Improving the Design of Existing Code by Martin Fowler. Duplicated Code, p76
Method export
has a Cognitive Complexity of 7 (exceeds 5 allowed). Consider refactoring. Open
def export(format)
if problems.empty?
return nil
else
if format == 'ruql'
- Read upRead up
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Rails 3.2.16 content_tag does not escape double quotes in attribute values (CVE-2016-6316). Upgrade to 3.2.22.4 Open
rails (3.2.16)
- Read upRead up
- Exclude checks
Rails 3.2.16 has a vulnerability in number helpers (CVE-2014-0081). Upgrade to Rails version 3.2.17 Open
rails (3.2.16)
- Read upRead up
- Exclude checks
Rails 3.2.16 has a denial of service vulnerability (CVE-2014-0082). Upgrade to Rails version 3.2.17 Open
rails (3.2.16)
- Read upRead up
- Exclude checks
Rails 3.2.16 is vulnerable to denial of service via mime type caching (CVE-2016-0751). Upgrade to Rails version 3.2.22.1 Open
rails (3.2.16)
- Read upRead up
- Exclude checks
Unescaped model attribute rendered inline Open
render :text => html_code
- Read upRead up
- Exclude checks
Unescaped model attribute Open
= prob.html5.html_safe
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped model attribute Open
= @problem.html5.html_safe
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Unescaped model attribute Open
= @problem.html5.html_safe
- Read upRead up
- Exclude checks
Cross-site scripting (or XSS) is #3 on the 2013 [OWASP Top Ten](https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS\)) web security risks and it pops up nearly everywhere.
XSS occurs when a user-controlled value is displayed on a web page without properly escaping it, allowing someone to inject Javascript or HTML into the page which will be interpreted and executed by the browser..
In Rails 2.x, values need to be explicitly escaped (e.g., by using the h
method). Since Rails 3.x, auto-escaping in views is enabled by default. However, one can still use the raw
or html_safe
methods to output a value directly.
See the Ruby Security Guide for more details.
Query Parameters and Cookies
ERB example:
<%= params[:query].html_safe %>
Brakeman looks for several situations that can allow XSS. The simplest is like the example above: a value from the params
or cookies
is being directly output to a view. In such cases, it will issue a warning like:
Unescaped parameter value near line 3: params[:query]
By default, Brakeman will also warn when a parameter or cookie value is used as an argument to a method, the result of which is output unescaped to a view.
For example:
<%= raw some_method(cookie[:name]) %>
This raises a warning like:
Unescaped cookie value near line 5: some_method(cookies[:oreo])
However, the confidence level for this warning will be weak, because it is not directly outputting the cookie value.
Some methods are known to Brakeman to either be dangerous (link_to
is one) or safe (escape_once
). Users can specify safe methods using the --safe-methods
option. Alternatively, Brakeman can be set to only warn when values are used directly with the --report-direct
option.
Model Attributes
Because (many) models come from database values, Brakeman mistrusts them by default.
For example, if @user
is an instance of a model set in an action like
def set_user
@user = User.first
end
and there is a view with
<%= @user.name.html_safe %>
Brakeman will raise a warning like
Unescaped model attribute near line 3: User.first.name
If you trust all your data (although you probably shouldn't), this can be disabled with --ignore-model-output
.
Rails 3.2.16 contains a SQL injection vulnerability (CVE-2014-3482). Upgrade to 3.2.19 Open
rails (3.2.16)
- Read upRead up
- Exclude checks