brakeman-lib 3.3.1

data/lib/brakeman/checks/check_mime_type_dos.rb

@@ -0,0 +1,39 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckMimeTypeDoS < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for mime type denial of service (CVE-2016-0751)"
+
+  def run_check
+    fix_version = case
+               when version_between?("3.0.0", "3.2.22")
+                 "3.2.22.1"
+               when version_between?("4.0.0", "4.1.14")
+                 "4.1.14.1"
+               when version_between?("4.2.0", "4.2.5")
+                 "4.2.5.1"
+               else
+                 return
+               end
+
+    return if has_workaround?
+
+    message = "Rails #{rails_version} is vulnerable to denial of service via mime type caching (CVE-2016-0751). Upgrade to Rails version #{fix_version}"
+
+    warn :warning_type => "Denial of Service",
+      :warning_code => :CVE_2016_0751,
+      :message => message,
+      :confidence => CONFIDENCE[:med],
+      :gem_info => gemfile_or_environment,
+      :link_path => "https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ"
+  end
+
+  def has_workaround?
+    tracker.check_initializers(:Mime, :const_set).any? do |match|
+      arg = match.call.first_arg
+
+      symbol? arg and arg.value == :LOOKUP
+    end
+  end
+end

data/lib/brakeman/checks/check_model_attr_accessible.rb

@@ -0,0 +1,55 @@
+require 'brakeman/checks/base_check'
+
+# Author: Paul Deardorff (themetric)
+# Checks models to see if important foreign keys
+# or attributes are exposed as attr_accessible when
+# they probably shouldn't be.
+
+class Brakeman::CheckModelAttrAccessible < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Reports models which have dangerous attributes defined under the attr_accessible whitelist."
+
+  SUSP_ATTRS = [
+    [:admin, CONFIDENCE[:high]], # Very dangerous unless some Rails authorization used
+    [:role, CONFIDENCE[:med]],
+    [:banned, CONFIDENCE[:med]],
+    [:account_id, CONFIDENCE[:high]],
+    [/\S*_id(s?)\z/, CONFIDENCE[:low]] # All other foreign keys have weak/low confidence
+  ]
+
+  def run_check
+    check_models do |name, model|
+      model.attr_accessible.each do |attribute|
+        next if role_limited? model, attribute
+
+        SUSP_ATTRS.each do |susp_attr, confidence|
+          if susp_attr.is_a?(Regexp) and susp_attr =~ attribute.to_s or susp_attr == attribute
+            warn :model => name,
+              :file => model.file,
+              :warning_type => "Mass Assignment",
+              :warning_code => :dangerous_attr_accessible,
+              :message => "Potentially dangerous attribute available for mass assignment",
+              :confidence => confidence,
+              :code => Sexp.new(:lit, attribute)
+            break # Prevent from matching single attr multiple times
+          end
+        end
+      end
+    end
+  end
+
+  def role_limited? model, attribute
+    role_accessible = model.role_accessible
+    return if role_accessible.nil?
+    role_accessible.include? attribute
+  end
+
+  def check_models
+    tracker.models.each do |name, model|
+      if !model.attr_accessible.nil?
+        yield name, model
+      end
+    end
+  end
+end

data/lib/brakeman/checks/check_model_attributes.rb

@@ -0,0 +1,119 @@
+require 'brakeman/checks/base_check'
+
+#Check if mass assignment is used with models
+#which inherit from ActiveRecord::Base.
+#
+#If tracker.options[:collapse_mass_assignment] is +true+ (default), all models
+#which do not use attr_accessible will be reported in a single warning
+class Brakeman::CheckModelAttributes < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Reports models which do not use attr_restricted and warns on models that use attr_protected"
+
+  def run_check
+    return if mass_assign_disabled?
+
+    #Roll warnings into one warning for all models
+    if tracker.options[:collapse_mass_assignment]
+      no_accessible_names = []
+      protected_names = []
+
+      check_models do |name, model|
+        if model.attr_protected.nil?
+          no_accessible_names << name.to_s
+        elsif not tracker.options[:ignore_attr_protected]
+          protected_names << name.to_s
+        end
+      end
+
+      unless no_accessible_names.empty?
+        warn :model => no_accessible_names.sort.join(", "),
+          :warning_type => "Attribute Restriction",
+          :warning_code => :no_attr_accessible,
+          :message => "Mass assignment is not restricted using attr_accessible",
+          :confidence => CONFIDENCE[:high]
+      end
+
+      unless protected_names.empty?
+        message, confidence, link = check_for_attr_protected_bypass
+
+        if link
+          warning_code = :CVE_2013_0276
+        else
+          warning_code = :attr_protected_used
+        end
+
+        warn :model => protected_names.sort.join(", "),
+          :warning_type => "Attribute Restriction",
+          :warning_code => warning_code,
+          :message => message,
+          :confidence => confidence,
+          :link => link
+      end
+    else #Output one warning per model
+
+      check_models do |name, model|
+        if model.attr_protected.nil?
+          warn :model => name,
+            :file => model.file,
+            :line => model.top_line,
+            :warning_type => "Attribute Restriction",
+            :warning_code => :no_attr_accessible,
+            :message => "Mass assignment is not restricted using attr_accessible",
+            :confidence => CONFIDENCE[:high]
+        elsif not tracker.options[:ignore_attr_protected]
+          message, confidence, link = check_for_attr_protected_bypass
+
+          if link
+            warning_code = :CVE_2013_0276
+          else
+            warning_code = :attr_protected_used
+          end
+
+          warn :model => name,
+            :file => model.file,
+            :line => model.attr_protected.first.line,
+            :warning_type => "Attribute Restriction",
+            :warning_code => warning_code,
+            :message => message,
+            :confidence => confidence
+        end
+      end
+    end
+  end
+
+  def check_models
+    tracker.models.each do |name, model|
+      if model.unprotected_model?
+        yield name, model
+      end
+    end
+  end
+
+  def check_for_attr_protected_bypass
+    upgrade_version = case
+                      when version_between?("2.0.0", "2.3.16")
+                        "2.3.17"
+                      when version_between?("3.0.0", "3.0.99")
+                        "3.2.11"
+                      when version_between?("3.1.0", "3.1.10")
+                        "3.1.11"
+                      when version_between?("3.2.0", "3.2.11")
+                        "3.2.12"
+                      else
+                        nil
+                      end
+
+    if upgrade_version
+      message = "attr_protected is bypassable in #{rails_version}, use attr_accessible or upgrade to #{upgrade_version}"
+      confidence = CONFIDENCE[:high]
+      link = "https://groups.google.com/d/topic/rubyonrails-security/AFBKNY7VSH8/discussion"
+    else
+      message = "attr_accessible is recommended over attr_protected"
+      confidence = CONFIDENCE[:med]
+      link = nil
+    end
+
+    return message, confidence, link
+  end
+end

data/lib/brakeman/checks/check_model_serialize.rb

@@ -0,0 +1,67 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckModelSerialize < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Report uses of serialize in versions vulnerable to CVE-2013-0277"
+
+  def run_check
+    @upgrade_version = case
+                      when version_between?("2.0.0", "2.3.16")
+                        "2.3.17"
+                      when version_between?("3.0.0", "3.0.99")
+                        "3.2.11"
+                      else
+                        nil
+                      end
+
+    return unless @upgrade_version
+
+    tracker.models.each do |name, model|
+      check_for_serialize model
+    end
+  end
+
+  #High confidence warning on serialized, unprotected attributes.
+  #Medium confidence warning for serialized, protected attributes.
+  def check_for_serialize model
+    if serialized_attrs = model.options[:serialize]
+      attrs = Set.new
+
+      serialized_attrs.each do |arglist|
+        arglist.each do |arg|
+          attrs << arg if symbol? arg
+        end
+      end
+
+      if unsafe_attrs = model.attr_accessible
+        attrs.delete_if { |attr| not unsafe_attrs.include? attr.value }
+      elsif protected_attrs = model.attr_protected
+        safe_attrs = Set.new
+
+        protected_attrs.each do |arglist|
+          arglist.each do |arg|
+            safe_attrs << arg if symbol? arg
+          end
+        end
+
+        attrs.delete_if { |attr| safe_attrs.include? attr }
+      end
+
+      if attrs.empty?
+        confidence = CONFIDENCE[:med]
+      else
+        confidence = CONFIDENCE[:high]
+      end
+
+      warn :model => model.name,
+        :warning_type => "Remote Code Execution",
+        :warning_code => :CVE_2013_0277,
+        :message => "Serialized attributes are vulnerable in Rails #{rails_version}, upgrade to #{@upgrade_version} or patch.",
+        :confidence => confidence,
+        :link => "https://groups.google.com/d/topic/rubyonrails-security/KtmwSbEpzrU/discussion",
+        :file => model.file,
+        :line => model.top_line
+    end
+  end
+end

data/lib/brakeman/checks/check_nested_attributes.rb

@@ -0,0 +1,38 @@
+require 'brakeman/checks/base_check'
+
+#Check for vulnerability in nested attributes in Rails 2.3.9 and 3.0.0
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/f9f913d328dafe0c
+class Brakeman::CheckNestedAttributes < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for nested attributes vulnerability in Rails 2.3.9 and 3.0.0"
+
+  def run_check
+    version = rails_version
+
+    if (version == "2.3.9" or version == "3.0.0") and uses_nested_attributes?
+      message = "Vulnerability in nested attributes (CVE-2010-3933). Upgrade to Rails version "
+
+      if version == "2.3.9"
+        message << "2.3.10"
+      else
+        message << "3.0.1"
+      end
+
+      warn :warning_type => "Nested Attributes",
+        :warning_code => :CVE_2010_3933,
+        :message => message,
+        :confidence => CONFIDENCE[:high],
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/-fkT0yja_gw/discussion"
+    end
+  end
+
+  def uses_nested_attributes?
+    active_record_models.each do |name, model|
+      return true if model.options[:accepts_nested_attributes_for]
+    end
+
+    false
+  end
+end

data/lib/brakeman/checks/check_nested_attributes_bypass.rb

@@ -0,0 +1,58 @@
+require 'brakeman/checks/base_check'
+
+#https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ
+class Brakeman::CheckNestedAttributesBypass < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for nested attributes vulnerability (CVE-2015-7577)"
+
+  def run_check
+    if version_between? "3.1.0", "3.2.22" or
+       version_between? "4.0.0", "4.1.14" or
+       version_between? "4.2.0", "4.2.5"
+
+      unless workaround?
+        check_nested_attributes
+      end
+    end
+  end
+
+  def check_nested_attributes
+    active_record_models.each do |name, model|
+      if opts = model.options[:accepts_nested_attributes_for]
+        opts.each do |args|
+          if args.any? { |a| allow_destroy? a } and args.any? { |a| reject_if? a }
+            warn_about_nested_attributes name, model, args
+          end
+        end
+      end
+    end
+  end
+
+  def warn_about_nested_attributes name, model, args
+    message = "Rails #{rails_version} does not call :reject_if option when :allow_destroy is false (CVE-2015-7577)"
+
+    warn :model => name,
+      :warning_type => "Nested Attributes",
+      :warning_code => :CVE_2015_7577,
+      :message => message,
+      :file => model.file,
+      :line => args.line,
+      :confidence => CONFIDENCE[:med],
+      :link_path => "https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ"
+  end
+
+  def allow_destroy? arg
+    hash? arg and
+      false? hash_access(arg, :allow_destroy)
+  end
+
+  def reject_if? arg
+    hash? arg and
+      hash_access(arg, :reject_if)
+  end
+
+  def workaround?
+    tracker.check_initializers([], :will_be_destroyed?).any?
+  end
+end

data/lib/brakeman/checks/check_number_to_currency.rb

@@ -0,0 +1,74 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckNumberToCurrency < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for number helpers XSS vulnerabilities in certain versions"
+
+  def initialize(*)
+    super
+    @found_any = false
+  end
+
+  def run_check
+    if version_between? "2.0.0", "2.3.18" or
+      version_between? "3.0.0", "3.2.16" or
+      version_between? "4.0.0", "4.0.2"
+
+      return if lts_version? "2.3.18.8"
+
+      check_number_helper_usage
+      generic_warning unless @found_any
+    end
+  end
+
+  def generic_warning
+    message = "Rails #{rails_version} has a vulnerability in number helpers (CVE-2014-0081). Upgrade to Rails version "
+
+    if version_between? "2.3.0", "3.2.16"
+      message << "3.2.17"
+    else
+      message << "4.0.3"
+    end
+
+    warn :warning_type => "Cross Site Scripting",
+      :warning_code => :CVE_2014_0081,
+      :message => message,
+      :confidence => CONFIDENCE[:med],
+      :gem_info => gemfile_or_environment,
+      :link_path => "https://groups.google.com/d/msg/ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ"
+  end
+
+  def check_number_helper_usage
+    number_methods = [:number_to_currency, :number_to_percentage, :number_to_human]
+    tracker.find_call(:target => false, :methods => number_methods).each do |result|
+      arg = result[:call].second_arg
+      next unless arg
+
+      if not check_helper_option(result, arg) and hash? arg
+        hash_iterate(arg) do |key, value|
+          break if check_helper_option(result, value)
+        end
+      end
+    end
+  end
+
+  def check_helper_option result, exp
+    if match = (has_immediate_user_input? exp or has_immediate_model? exp)
+      warn_on_number_helper result, match
+      @found_any = true
+    else
+      false
+    end
+  end
+
+  def warn_on_number_helper result, match
+    warn :result => result,
+      :warning_type => "Cross Site Scripting",
+      :warning_code => :CVE_2014_0081_call,
+      :message => "Format options in #{result[:call].method} are not safe in Rails #{rails_version}",
+      :confidence => CONFIDENCE[:high],
+      :link_path => "https://groups.google.com/d/msg/ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ",
+      :user_input => match
+  end
+end