brakeman-lib 3.3.1

data/lib/brakeman/checks/check_file_access.rb

@@ -0,0 +1,63 @@
+require 'brakeman/checks/base_check'
+require 'brakeman/processors/lib/processor_helper'
+
+#Checks for user input in methods which open or manipulate files
+class Brakeman::CheckFileAccess < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Finds possible file access using user input"
+
+  def run_check
+    Brakeman.debug "Finding possible file access"
+    methods = tracker.find_call :targets => [:Dir, :File, :IO, :Kernel, :"Net::FTP", :"Net::HTTP", :PStore, :Pathname, :Shell], :methods => [:[], :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
+
+    methods.concat tracker.find_call :target => :YAML, :methods => [:load_file, :parse_file]
+    methods.concat tracker.find_call :target => nil, :method => [:open]
+
+    Brakeman.debug "Finding calls to load()"
+    methods.concat tracker.find_call :target => false, :method => :load
+
+    Brakeman.debug "Finding calls using FileUtils"
+    methods.concat tracker.find_call :target => :FileUtils
+
+    Brakeman.debug "Processing found calls"
+    methods.each do |call|
+      process_result call
+    end
+  end
+
+  def process_result result
+    return if duplicate? result
+    add_result result
+    call = result[:call]
+    file_name = call.first_arg
+
+    if match = has_immediate_user_input?(file_name)
+      confidence = CONFIDENCE[:high]
+    elsif match = has_immediate_model?(file_name)
+      match = Match.new(:model, match)
+      confidence = CONFIDENCE[:med]
+    elsif tracker.options[:check_arguments] and
+      match = include_user_input?(file_name)
+
+      #Check for string building in file name
+      if call?(file_name) and (file_name.method == :+ or file_name.method == :<<)
+        confidence = CONFIDENCE[:high]
+      else
+        confidence = CONFIDENCE[:low]
+      end
+    end
+
+    if match
+      message = "#{friendly_type_of(match).capitalize} used in file name"
+
+      warn :result => result,
+        :warning_type => "File Access",
+        :warning_code => :file_access,
+        :message => message,
+        :confidence => confidence,
+        :code => call,
+        :user_input => match
+    end
+  end
+end

data/lib/brakeman/checks/check_file_disclosure.rb

@@ -0,0 +1,35 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckFileDisclosure < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions with file existence disclosure vulnerability"
+
+  def run_check
+    fix_version = case
+      when version_between?('2.0.0', '2.3.18')
+        '3.2.21'
+      when version_between?('3.0.0', '3.2.20')
+        '3.2.21'
+      when version_between?('4.0.0', '4.0.11')
+        '4.0.12'
+      when version_between?('4.1.0', '4.1.7')
+        '4.1.8'
+      else
+        nil
+      end
+
+    if fix_version and serves_static_assets?
+      warn :warning_type => "File Access",
+        :warning_code => :CVE_2014_7829,
+        :message => "Rails #{rails_version} has a file existence disclosure. Upgrade to #{fix_version} or disable serving static assets",
+        :confidence => CONFIDENCE[:high],
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/msg/rubyonrails-security/23fiuwb1NBA/MQVM1-5GkPMJ"
+    end
+  end
+
+  def serves_static_assets?
+    true? tracker.config.rails[:serve_static_assets]
+  end
+end

data/lib/brakeman/checks/check_filter_skipping.rb

@@ -0,0 +1,31 @@
+require 'brakeman/checks/base_check'
+
+#Check for filter skipping vulnerability
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6
+class Brakeman::CheckFilterSkipping < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions 3.0-3.0.9 which had a vulnerability in filters"
+
+  def run_check
+    if version_between?('3.0.0', '3.0.9') and uses_arbitrary_actions?
+
+      warn :warning_type => "Default Routes",
+        :warning_code => :CVE_2011_2929,
+        :message => "Versions before 3.0.10 have a vulnerability which allows filters to be bypassed: CVE-2011-2929",
+        :confidence => CONFIDENCE[:high],
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/NCCsca7TEtY/discussion"
+    end
+  end
+
+  def uses_arbitrary_actions?
+    tracker.routes.each do |name, actions|
+      if actions.include? :allow_all_actions
+        return true
+      end
+    end
+
+    false
+  end
+end

data/lib/brakeman/checks/check_forgery_setting.rb

@@ -0,0 +1,74 @@
+require 'brakeman/checks/base_check'
+
+#Checks that +protect_from_forgery+ is set in the ApplicationController.
+#
+#Also warns for CSRF weakness in certain versions of Rails:
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2d95a3cc23e03665
+class Brakeman::CheckForgerySetting < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Verifies that protect_from_forgery is enabled in ApplicationController"
+
+  def run_check
+    app_controller = tracker.controllers[:ApplicationController]
+    return unless app_controller and app_controller.ancestor? :"ActionController::Base"
+
+    if tracker.config.allow_forgery_protection?
+      warn :controller => :ApplicationController,
+        :warning_type => "Cross-Site Request Forgery",
+        :warning_code => :csrf_protection_disabled,
+        :message => "Forgery protection is disabled",
+        :confidence => CONFIDENCE[:high],
+        :file => app_controller.file
+
+    elsif app_controller and not app_controller.protect_from_forgery?
+
+      warn :controller => :ApplicationController,
+        :warning_type => "Cross-Site Request Forgery",
+        :warning_code => :csrf_protection_missing,
+        :message => "'protect_from_forgery' should be called in ApplicationController",
+        :confidence => CONFIDENCE[:high],
+        :file => app_controller.file,
+        :line => app_controller.top_line
+
+    elsif version_between? "2.1.0", "2.3.10"
+
+      warn :controller => :ApplicationController,
+        :warning_type => "Cross-Site Request Forgery",
+        :warning_code => :CVE_2011_0447,
+        :message => "CSRF protection is flawed in unpatched versions of Rails #{rails_version} (CVE-2011-0447). Upgrade to 2.3.11 or apply patches as needed",
+        :confidence => CONFIDENCE[:high],
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/LZWjzCPgNmU/discussion"
+
+    elsif version_between? "3.0.0", "3.0.3"
+
+      warn :controller => :ApplicationController,
+        :warning_type => "Cross-Site Request Forgery",
+        :warning_code => :CVE_2011_0447,
+        :message => "CSRF protection is flawed in unpatched versions of Rails #{rails_version} (CVE-2011-0447). Upgrade to 3.0.4 or apply patches as needed",
+        :confidence => CONFIDENCE[:high],
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/LZWjzCPgNmU/discussion"
+    elsif version_between? "4.0.0", "100.0.0" and forgery_opts = app_controller.options[:protect_from_forgery]
+
+      unless forgery_opts.is_a?(Array) and sexp?(forgery_opts.first) and
+          access_arg = hash_access(forgery_opts.first.first_arg, :with) and symbol? access_arg and
+          access_arg.value == :exception
+
+        args = {
+          :controller => :ApplicationController,
+          :warning_type => "Cross-Site Request Forgery",
+          :warning_code => :csrf_not_protected_by_raising_exception,
+          :message => "protect_from_forgery should be configured with 'with: :exception'",
+          :confidence => CONFIDENCE[:med],
+          :file => app_controller.file
+        }
+
+        args.merge!(:code => forgery_opts.first) if forgery_opts.is_a?(Array)
+
+        warn args
+      end
+    end
+  end
+end

data/lib/brakeman/checks/check_header_dos.rb

@@ -0,0 +1,31 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckHeaderDoS < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for header DoS (CVE-2013-6414)"
+
+  def run_check
+    if (version_between? "3.0.0", "3.2.15" or version_between? "4.0.0", "4.0.1") and not has_workaround?
+      message = "Rails #{rails_version} has a denial of service vulnerability (CVE-2013-6414). Upgrade to Rails version "
+
+      if version_between? "3.0.0", "3.2.15"
+        message << "3.2.16"
+      else
+        message << "4.0.2"
+      end
+
+      warn :warning_type => "Denial of Service",
+        :warning_code => :CVE_2013_6414,
+        :message => message,
+        :confidence => CONFIDENCE[:med],
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/msg/ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ"
+    end
+  end
+
+  def has_workaround?
+    tracker.check_initializers(:ActiveSupport, :on_load).any? and
+    tracker.check_initializers(:"ActionView::LookupContext::DetailsKey", :class_eval).any?
+  end
+end

data/lib/brakeman/checks/check_i18n_xss.rb

@@ -0,0 +1,48 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckI18nXSS < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for i18n XSS (CVE-2013-4491)"
+
+  def run_check
+    if (version_between? "3.0.6", "3.2.15" or version_between? "4.0.0", "4.0.1") and not has_workaround?
+      message = "Rails #{rails_version} has an XSS vulnerability in i18n (CVE-2013-4491). Upgrade to Rails version "
+      i18n_gem = tracker.config.gem_version :i18n
+
+      if version_between? "3.0.6", "3.1.99" and version_before i18n_gem, "0.5.1"
+        message << "3.2.16 or i18n 0.5.1"
+      elsif version_between? "3.2.0", "4.0.1" and version_before i18n_gem, "0.6.6"
+        message << "4.0.2 or i18n 0.6.6"
+      else
+        return
+      end
+
+      warn :warning_type => "Cross Site Scripting",
+        :warning_code => :CVE_2013_4491,
+        :message => message,
+        :confidence => CONFIDENCE[:med],
+        :gem_info => gemfile_or_environment(:i18n),
+        :link_path => "https://groups.google.com/d/msg/ruby-security-ann/pLrh6DUw998/bLFEyIO4k_EJ"
+    end
+  end
+
+  def version_before gem_version, target
+    return true unless gem_version
+    gem_version.split('.').map(&:to_i).zip(target.split('.').map(&:to_i)).each do |gv, t|
+      if gv < t
+        return true
+      elsif gv > t
+        return false
+      end
+    end
+
+    false
+  end
+
+  def has_workaround?
+    tracker.check_initializers(:I18n, :const_defined?).any? do |match|
+      match.last.first_arg == s(:lit, :MissingTranslation)
+    end
+  end
+end

data/lib/brakeman/checks/check_jruby_xml.rb

@@ -0,0 +1,38 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckJRubyXML < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions with JRuby XML parsing backend"
+
+  def run_check
+    return unless RUBY_PLATFORM == "java"
+
+    fix_version = case
+      when version_between?('3.0.0', '3.0.99')
+        '3.2.13'
+      when version_between?('3.1.0', '3.1.11')
+        '3.1.12'
+      when version_between?('3.2.0', '3.2.12')
+        '3.2.13'
+      else
+        return
+      end
+
+    #Check for workaround
+    tracker.check_initializers(:"ActiveSupport::XmlMini", :backend=).each do |result|
+      arg = result.call.first_arg
+
+      if string? arg and arg.value == "REXML"
+        return
+      end
+    end
+
+    warn :warning_type => "File Access",
+      :warning_code => :CVE_2013_1856,
+      :message => "Rails #{rails_version} with JRuby has a vulnerability in XML parser: upgrade to #{fix_version} or patch",
+      :confidence => CONFIDENCE[:high],
+      :gem_info => gemfile_or_environment,
+      :link => "https://groups.google.com/d/msg/rubyonrails-security/KZwsQbYsOiI/5kUV7dSCJGwJ"
+  end
+end

data/lib/brakeman/checks/check_json_encoding.rb

@@ -0,0 +1,47 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckJSONEncoding < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for missing JSON encoding (CVE-2015-3226)"
+
+  def run_check
+    if (version_between? "4.1.0", "4.1.10" or version_between? "4.2.0", "4.2.1") and not has_workaround?
+      message = "Rails #{rails_version} does not encode JSON keys (CVE-2015-3226). Upgrade to Rails version "
+
+      if version_between? "4.1.0", "4.1.10"
+        message << "4.1.11"
+      else
+        message << "4.2.2"
+      end
+
+      if tracker.find_call(:methods => [:to_json, :encode]).any?
+        confidence = CONFIDENCE[:high]
+      else
+        confidence = CONFIDENCE[:med]
+      end
+
+      warn :warning_type => "Cross Site Scripting",
+        :warning_code => :CVE_2015_3226,
+        :message => message,
+        :confidence => confidence,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/msg/rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ"
+    end
+  end
+
+  def has_workaround?
+    workaround = s(:module, :ActiveSupport,
+                   s(:module, :JSON,
+                     s(:module, :Encoding,
+                       s(:call, nil, :private),
+                       s(:class, :EscapedString, nil,
+                         s(:defn, :to_s,
+                           s(:args),
+                           s(:self))))))
+
+    tracker.initializers.any? do |name, initializer|
+      initializer == workaround
+    end
+  end
+end

data/lib/brakeman/checks/check_json_parsing.rb

@@ -0,0 +1,107 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckJSONParsing < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for JSON parsing vulnerabilities CVE-2013-0333 and CVE-2013-0269"
+
+  def run_check
+    check_cve_2013_0333
+    check_cve_2013_0269
+  end
+
+  def check_cve_2013_0333
+    return unless version_between? "0.0.0", "2.3.15" or version_between? "3.0.0", "3.0.19"
+
+    unless uses_yajl? or uses_gem_backend?
+      new_version = if version_between? "0.0.0", "2.3.14"
+                      "2.3.16"
+                    elsif version_between? "3.0.0", "3.0.19"
+                      "3.0.20"
+                    end
+
+      message = "Rails #{rails_version} has a serious JSON parsing vulnerability: upgrade to #{new_version} or patch"
+      if uses_yajl?
+        gem_info = gemfile_or_environment(:yajl)
+      else
+        gem_info = gemfile_or_environment
+      end
+
+      warn :warning_type => "Remote Code Execution",
+        :warning_code => :CVE_2013_0333,
+        :message => message,
+        :confidence => CONFIDENCE[:high],
+        :gem_info => gem_info,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/1h2DR63ViGo/discussion"
+    end
+  end
+
+  #Check if `yajl` is included in Gemfile
+  def uses_yajl?
+    tracker.config.has_gem? :yajl
+  end
+
+  #Check for `ActiveSupport::JSON.backend = "JSONGem"`
+  def uses_gem_backend?
+    matches = tracker.check_initializers(:'ActiveSupport::JSON', :backend=)
+
+    unless matches.empty?
+      json_gem = s(:str, "JSONGem")
+
+      matches.each do |result|
+        if result.call.first_arg == json_gem
+          return true
+        end
+      end
+    end
+
+    false
+  end
+
+  def check_cve_2013_0269
+    [:json, :json_pure].each do |name|
+      gem_hash = tracker.config.get_gem name
+      check_json_version name, gem_hash[:version] if gem_hash and gem_hash[:version]
+    end
+  end
+
+  def check_json_version name, version
+    return if version >= "1.7.7" or
+              (version >= "1.6.8" and version < "1.7.0") or
+              (version >= "1.5.5" and version < "1.6.0")
+
+    warning_type = "Denial of Service"
+    confidence = CONFIDENCE[:med]
+    message = "#{name} gem version #{version} has a symbol creation vulnerablity: upgrade to "
+
+    if version >= "1.7.0"
+      confidence = CONFIDENCE[:high]
+      warning_type = "Remote Code Execution"
+      message = "#{name} gem version #{version} has a remote code vulnerablity: upgrade to 1.7.7"
+    elsif version >= "1.6.0"
+      message << "1.6.8"
+    elsif version >= "1.5.0"
+      message << "1.5.5"
+    else
+      confidence = CONFIDENCE[:low]
+      message << "1.5.5"
+    end
+
+    if confidence == CONFIDENCE[:med] and uses_json_parse?
+      confidence = CONFIDENCE[:high]
+    end
+
+    warn :warning_type => warning_type,
+      :warning_code => :CVE_2013_0269,
+      :message => message,
+      :confidence => confidence,
+      :gem_info => gemfile_or_environment(name),
+      :link => "https://groups.google.com/d/topic/rubyonrails-security/4_YvCpLzL58/discussion"
+  end
+
+  def uses_json_parse?
+    return @uses_json_parse unless @uses_json_parse.nil?
+
+    not tracker.find_call(:target => :JSON, :method => :parse).empty?
+  end
+end