Possible SQL injection Open
selected_model = @base_class.constantize.find(:all, select: "#{select_type}, created_at").last- Read upRead up
- Exclude checks
Injection is #1 on the 2013 OWASP Top Ten web security risks. SQL injection is when a user is able to manipulate a value which is used unsafely inside a SQL query. This can lead to data leaks, data loss, elevation of privilege, and other unpleasant outcomes.
Brakeman focuses on ActiveRecord methods dealing with building SQL statements.
A basic (Rails 2.x) example looks like this:
User.first(:conditions => "username = '#{params[:username]}'")Brakeman would produce a warning like this:
Possible SQL injection near line 30: User.first(:conditions => ("username = '#{params[:username]}'"))The safe way to do this query is to use a parameterized query:
User.first(:conditions => ["username = ?", params[:username]])Brakeman also understands the new Rails 3.x way of doing things (and local variables and concatenation):
username = params[:user][:name].downcase
password = params[:user][:password]
User.first.where("username = '" + username + "' AND password = '" + password + "'")This results in this kind of warning:
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))See the Ruby Security Guide for more information and Rails-SQLi.org for many examples of SQL injection in Rails.
Assignment Branch Condition size for test_format_for_friendly_urls is too high. [28.65/15] Open
def test_format_for_friendly_urls
title_or_name_attr = @base_class == 'Basket' ? :name : :title
model = Module.class_eval(@base_class).create! @new_model
formatted_title = model.format_for_friendly_urls- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Method has too many lines. [12/10] Open
def test_format_for_friendly_urls
title_or_name_attr = @base_class == 'Basket' ? :name : :title
model = Module.class_eval(@base_class).create! @new_model
formatted_title = model.format_for_friendly_urls- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
TODO found Open
# TODO: test case unicode- Exclude checks