Possible unprotected redirect Open
redirect_to Redirect.find_by_from!(params[:id]).to
- Read upRead up
- Exclude checks
Unvalidated redirects and forwards are #10 on the OWASP Top Ten.
Redirects which rely on user-supplied values can be used to "spoof" websites or hide malicious links in otherwise harmless-looking URLs. They can also allow access to restricted areas of a site if the destination is not validated.
Brakeman will raise warnings whenever redirect_to
appears to be used with a user-supplied value that may allow them to change the :host
option.
For example,
redirect_to params.merge(:action => :home)
will create a warning like
Possible unprotected redirect near line 46: redirect_to(params)
This is because params
could contain :host => 'evilsite.com'
which would redirect away from your site and to a malicious site.
If the first argument to redirect_to
is a hash, then adding :only_path => true
will limit the redirect to the current host. Another option is to specify the host explicitly.
redirect_to params.merge(:only_path => true)
redirect_to params.merge(:host => 'myhost.com')
If the first argument is a string, then it is possible to parse the string and extract the path:
redirect_to URI.parse(some_url).path
If the URL does not contain a protocol (e.g., http://
), then you will probably get unexpected results, as redirect_to
will prepend the current host name and a protocol.
Use find_by!
instead of dynamic find_by_permalink!
. Open
@page = Page.find_by_permalink!(params[:id])
- Read upRead up
- Exclude checks
This cop checks dynamic find_by_*
methods.
Use find_by
instead of dynamic method.
See. https://github.com/bbatsov/rails-style-guide#find_by
Example:
# bad
User.find_by_name(name)
# bad
User.find_by_name_and_email(name)
# bad
User.find_by_email!(name)
# good
User.find_by(name: name)
# good
User.find_by(name: name, email: email)
# good
User.find_by!(email: email)
Use find_by!
instead of dynamic find_by_from!
. Open
redirect_to Redirect.find_by_from!(params[:id]).to
- Read upRead up
- Exclude checks
This cop checks dynamic find_by_*
methods.
Use find_by
instead of dynamic method.
See. https://github.com/bbatsov/rails-style-guide#find_by
Example:
# bad
User.find_by_name(name)
# bad
User.find_by_name_and_email(name)
# bad
User.find_by_email!(name)
# good
User.find_by(name: name)
# good
User.find_by(name: name, email: email)
# good
User.find_by!(email: email)
Extra empty line detected before the rescue
. Open
rescue ActiveRecord::RecordNotFound
- Read upRead up
- Exclude checks
This cops checks if empty lines exist around the bodies of begin
sections. This cop doesn't check empty lines at begin
body
beginning/end and around method definition body.
Style/EmptyLinesAroundBeginBody
or Style/EmptyLinesAroundMethodBody
can be used for this purpose.
Example:
# good
begin
do_something
rescue
do_something2
else
do_something3
ensure
do_something4
end
# good
def foo
do_something
rescue
do_something2
end
# bad
begin
do_something
rescue
do_something2
else
do_something3
ensure
do_something4
end
# bad
def foo
do_something
rescue
do_something2
end
Missing magic comment # frozen_string_literal: true
. Open
class PagesController < ApplicationController
- Read upRead up
- Exclude checks
This cop is designed to help upgrade to Ruby 3.0. It will add the
comment # frozen_string_literal: true
to the top of files to
enable frozen string literals. Frozen string literals may be default
in Ruby 3.0. The comment will be added below a shebang and encoding
comment. The frozen string literal comment is only valid in Ruby 2.3+.
Example: EnforcedStyle: when_needed (default)
# The `when_needed` style will add the frozen string literal comment
# to files only when the `TargetRubyVersion` is set to 2.3+.
# bad
module Foo
# ...
end
# good
# frozen_string_literal: true
module Foo
# ...
end
Example: EnforcedStyle: always
# The `always` style will always add the frozen string literal comment
# to a file, regardless of the Ruby version or if `freeze` or `<<` are
# called on a string literal.
# bad
module Bar
# ...
end
# good
# frozen_string_literal: true
module Bar
# ...
end
Example: EnforcedStyle: never
# The `never` will enforce that the frozen string literal comment does
# not exist in a file.
# bad
# frozen_string_literal: true
module Baz
# ...
end
# good
module Baz
# ...
end