brakeman-min 0.3.1 → 0.3.2
Sign up to get free protection for your applications and to get access to all the features.
- data/README.md +4 -4
- data/bin/brakeman +5 -0
- data/lib/checks/check_mass_assignment.rb +3 -1
- data/lib/scanner.rb +1 -1
- data/lib/version.rb +1 -1
- metadata +5 -10
data/README.md
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
|
3
3
|
Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
|
4
4
|
|
5
|
-
It targets Rails versions > 2.0
|
5
|
+
It targets Rails versions > 2.0 with experimental support for Rails 3.x
|
6
6
|
|
7
7
|
# Installation
|
8
8
|
|
@@ -25,7 +25,7 @@ To specify an output file for the results:
|
|
25
25
|
|
26
26
|
brakeman -o output_file app_path
|
27
27
|
|
28
|
-
The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, and `
|
28
|
+
The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `csv`, and `tabs`.
|
29
29
|
|
30
30
|
To suppress informational warnings and just output the report:
|
31
31
|
|
@@ -51,7 +51,7 @@ To indicate certain methods are "safe":
|
|
51
51
|
|
52
52
|
brakeman -s benign_method,totally_safe app_path
|
53
53
|
|
54
|
-
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would a warning:
|
54
|
+
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would cause a warning (Rails 2):
|
55
55
|
|
56
56
|
<%= some_method(:option => params[:input]) %>
|
57
57
|
|
@@ -81,7 +81,7 @@ To only get warnings above a given confidence level:
|
|
81
81
|
|
82
82
|
brakeman -w3 app_path
|
83
83
|
|
84
|
-
The `-w` switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only
|
84
|
+
The `-w` switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only highest confidence warnings).
|
85
85
|
|
86
86
|
# Configuration files
|
87
87
|
|
data/bin/brakeman
CHANGED
@@ -243,6 +243,11 @@ abort("Please supply the path to a Rails application.") unless app_path and File
|
|
243
243
|
|
244
244
|
warn "[Notice] Using Ruby #{RUBY_VERSION}. Please make sure this matches the one used to run your Rails application."
|
245
245
|
|
246
|
+
if File.exist? app_path + "/script/rails"
|
247
|
+
OPTIONS[:rails3] = true
|
248
|
+
warn "[Notice] Detected Rails 3 application. Enabling experimental Rails 3 support."
|
249
|
+
end
|
250
|
+
|
246
251
|
#Load scanner
|
247
252
|
begin
|
248
253
|
require 'scanner'
|
data/lib/scanner.rb
CHANGED
@@ -53,7 +53,7 @@ class Scanner
|
|
53
53
|
@processor.process_config(RubyParser.new.parse(File.read("#@path/config/gems.rb")))
|
54
54
|
end
|
55
55
|
|
56
|
-
if File.exists? "#@path/vendor/plugins/rails_xss"
|
56
|
+
if File.exists? "#@path/vendor/plugins/rails_xss" or OPTIONS[:rails3]
|
57
57
|
tracker.config[:escape_html] = true
|
58
58
|
warn "[Notice] Escaping HTML by default"
|
59
59
|
end
|
data/lib/version.rb
CHANGED
@@ -1 +1 @@
|
|
1
|
-
Version = "0.3.
|
1
|
+
Version = "0.3.2"
|
metadata
CHANGED
@@ -1,13 +1,12 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: brakeman-min
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
|
5
|
-
prerelease:
|
4
|
+
prerelease: false
|
6
5
|
segments:
|
7
6
|
- 0
|
8
7
|
- 3
|
9
|
-
-
|
10
|
-
version: 0.3.
|
8
|
+
- 2
|
9
|
+
version: 0.3.2
|
11
10
|
platform: ruby
|
12
11
|
authors:
|
13
12
|
- Justin Collins
|
@@ -15,7 +14,7 @@ autorequire:
|
|
15
14
|
bindir: bin
|
16
15
|
cert_chain: []
|
17
16
|
|
18
|
-
date: 2011-05-
|
17
|
+
date: 2011-05-12 00:00:00 -07:00
|
19
18
|
default_executable:
|
20
19
|
dependencies:
|
21
20
|
- !ruby/object:Gem::Dependency
|
@@ -26,7 +25,6 @@ dependencies:
|
|
26
25
|
requirements:
|
27
26
|
- - ~>
|
28
27
|
- !ruby/object:Gem::Version
|
29
|
-
hash: 7
|
30
28
|
segments:
|
31
29
|
- 2
|
32
30
|
- 2
|
@@ -41,7 +39,6 @@ dependencies:
|
|
41
39
|
requirements:
|
42
40
|
- - ~>
|
43
41
|
- !ruby/object:Gem::Version
|
44
|
-
hash: 23
|
45
42
|
segments:
|
46
43
|
- 1
|
47
44
|
- 2
|
@@ -122,7 +119,6 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
122
119
|
requirements:
|
123
120
|
- - ">="
|
124
121
|
- !ruby/object:Gem::Version
|
125
|
-
hash: 3
|
126
122
|
segments:
|
127
123
|
- 0
|
128
124
|
version: "0"
|
@@ -131,14 +127,13 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
131
127
|
requirements:
|
132
128
|
- - ">="
|
133
129
|
- !ruby/object:Gem::Version
|
134
|
-
hash: 3
|
135
130
|
segments:
|
136
131
|
- 0
|
137
132
|
version: "0"
|
138
133
|
requirements: []
|
139
134
|
|
140
135
|
rubyforge_project:
|
141
|
-
rubygems_version: 1.
|
136
|
+
rubygems_version: 1.3.7
|
142
137
|
signing_key:
|
143
138
|
specification_version: 3
|
144
139
|
summary: Security vulnerability scanner for Ruby on Rails.
|