brakeman-lib 4.2.0 → 4.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a02aad3664741bec5ac0228bb7010df63d372fe2720fa3dde272aed8e92c070
-  data.tar.gz: d882ea01bc6b151920763b3c9f8ca9220c0abfbd6c443c41d72ef447014c6bfa
+  metadata.gz: 7070db1a411e9196bbb90fe7a34209ecd8cf15210e5fa21be1442c668e8f00d0
+  data.tar.gz: 940132f27d3803e1fa445d51c869cf426a712d065892f49b6e138222dc66ba71
 SHA512:
-  metadata.gz: bdce57e4ee118d55722a174c0f411dc19d3cc9a7f636c080124a2ebdc954e8f063e6022460d989c59cf265a7f5ef58978191a06057fb37c5f02e29d120d5b348
-  data.tar.gz: 1ac676aaefc2a521af60b0bf12f9f3dc94df6e0b1925dc0918e41542b2f8f7f79d8d621e00dd3486b3a1205e1992358aa7173dfddd88e0db3bf713f2e13ee3c3
+  metadata.gz: dfbb4f4f11b1e8b00a206a6185e3e58862061f954a43cdf611fb38d6bd97b0e04ef6439adcc68b6ea6dc1675b5853f8a9af03c378be3d7cc6d9f4f49a61f5d5d
+  data.tar.gz: 77cb923ae34ee9a094200e1dc08a120ca001b4f646907fcb896bc147694041c989bfea7dc3023d876c0ee1461bedd5dc35cae53b94ef36ee6971baff980ceaae

data/CHANGES.md

@@ -1,3 +1,10 @@
+# 4.2.1
+
+* Add warning for CVE-2018-3741
+* Add warning for CVE-2018-8048
+* Scan `app/jobs/` directory
+* Handle `template_exists?` in controllers
+
 # 4.2.0
 
 * Avoid warning about symbol DoS on `Model#attributes`

data/lib/brakeman/app_tree.rb

@@ -112,7 +112,8 @@ module Brakeman
     def lib_paths
       @lib_files ||= find_paths("lib").reject { |path| path.include? "/generators/" or path.include? "lib/tasks/" or path.include? "lib/templates/" } +
                      find_additional_lib_paths +
-                     find_helper_paths
+                     find_helper_paths +
+                     find_job_paths
     end
 
   private
@@ -121,6 +122,10 @@ module Brakeman
       find_paths "app/helpers"
     end
 
+    def find_job_paths
+      find_paths "app/jobs"
+    end
+
     def find_additional_lib_paths
       @additional_libs_path.collect{ |path| find_paths path }.flatten
     end

data/lib/brakeman/checks/check_sanitize_methods.rb

@@ -22,12 +22,13 @@ class Brakeman::CheckSanitizeMethods < Brakeman::BaseCheck
     if @fix_version
       check_cve_2013_1855
       check_cve_2013_1857
-    elsif tracker.config.has_gem? :'rails-html-sanitizer' and
-          version_between? "1.0.0", "1.0.2", tracker.config.gem_version(:'rails-html-sanitizer')
+    end
 
-      warn_sanitizer_cve "CVE-2015-7578", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/JbvSRpdbFQAJ"
-      warn_sanitizer_cve "CVE-2015-7580", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ"
+    if tracker.config.has_gem? :'rails-html-sanitizer'
+      check_rails_html_sanitizer
     end
+
+    check_cve_2018_8048
   end
 
   def check_cve_2013_1855
@@ -60,8 +61,46 @@ class Brakeman::CheckSanitizeMethods < Brakeman::BaseCheck
     end
   end
 
-  def warn_sanitizer_cve cve, link
-    message = "rails-html-sanitizer #{tracker.config.gem_version(:'rails-html-sanitizer')} is vulnerable (#{cve}). Upgrade to 1.0.3"
+  def check_rails_html_sanitizer
+    rhs_version = tracker.config.gem_version(:'rails-html-sanitizer')
+
+    if version_between? "1.0.0", "1.0.2", rhs_version
+      warn_sanitizer_cve "CVE-2015-7578", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/JbvSRpdbFQAJ", "1.0.3"
+      warn_sanitizer_cve "CVE-2015-7580", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ", "1.0.3"
+    end
+
+    if version_between? "1.0.0", "1.0.3", rhs_version
+      warn_sanitizer_cve "CVE-2018-3741", "https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ", "1.0.4"
+    end
+  end
+
+  def check_cve_2018_8048
+    if loofah_vulnerable_cve_2018_8048?
+      message = "Loofah #{tracker.config.gem_version(:loofah)} is vulnerable (CVE-2018-8048). Upgrade to 2.1.2"
+
+      if tracker.find_call(:target => false, :method => :sanitize).any?
+        confidence = :high
+      else
+        confidence = :medium
+      end
+
+      warn :warning_type => "Cross-Site Scripting",
+        :warning_code => :CVE_2018_8048,
+        :message => message,
+        :gem_info => gemfile_or_environment,
+        :confidence => confidence,
+        :link_path => "https://github.com/flavorjones/loofah/issues/144"
+    end
+  end
+
+  def loofah_vulnerable_cve_2018_8048?
+    loofah_version = tracker.config.gem_version(:loofah)
+
+    loofah_version and loofah_version < "2.1.2"
+  end
+
+  def warn_sanitizer_cve cve, link, upgrade_version
+    message = "rails-html-sanitizer #{tracker.config.gem_version(:'rails-html-sanitizer')} is vulnerable (#{cve}). Upgrade to #{upgrade_version}"
 
     if tracker.find_call(:target => false, :method => :sanitize).any?
       confidence = :high

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -114,6 +114,8 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
 
     if method == :head
       @rendered = true
+    elsif exp.target.nil? and method == :template_exists?
+      env[exp.first_arg] = Sexp.new(:lit, :"brakeman:existing_template")
     elsif @tracker.options[:interprocedural] and
       @current_method and (exp.target.nil? or exp.target.node_type == :self)
 

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "4.2.0"
+  Version = "4.2.1"
 end

data/lib/brakeman/warning_codes.rb

@@ -107,6 +107,8 @@ module Brakeman::WarningCodes
     :CVE_2016_6317 => 103,
     :divide_by_zero => 104,
     :dangerous_permit_key => 105,
+    :CVE_2018_8048 => 106,
+    :CVE_2018_3741 => 107,
   }
 
   def self.code name

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-lib
 version: !ruby/object:Gem::Version
-  version: 4.2.0
+  version: 4.2.1
 platform: ruby
 authors:
 - Justin Collins
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain:
 - brakeman-public_cert.pem
-date: 2018-02-22 00:00:00.000000000 Z
+date: 2018-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -380,7 +380,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.