brakeman-min 4.2.0 → 4.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98d495bd4d61bf9a6869fcd63254f6e345954b9fba3a6b7c68ff419cce1b5a73
-  data.tar.gz: d6d74d5870d660ee0cb09d5061614fab20a67d7ec0dbcfc97cb5e4f1ec93a0aa
+  metadata.gz: c25dcd77bdcbd0ce5903925da416d31a793bb4069bd65e8a309e15690159f10f
+  data.tar.gz: 328fe0440f586777546a32c5a7924c7d94f5677c4fa69567941b394c16425cfb
 SHA512:
-  metadata.gz: d0015017ca35da328c0484366d91bb4605ab496aff8264ac684fbc2891413616c2046fbf9879e752c5ace0604a26dbe24371601bc4c92249f2f89dfe1c9b8a5b
-  data.tar.gz: 432aa78a3a00b0a7df72f9b50361f77d52c5a1a98ca27fd8cce1ae85eac12405926162c9f3e9b1c377eb597fc120951daf607b75b3db43ce8127e45d1816308b
+  metadata.gz: e6dec2815016e94f993a76c2733fbe701a623439f90934fba5368ba2e403967c805fc70ed5d44224708fc7958c4966edcd3cc896ba8ac9a715f9756731946002
+  data.tar.gz: 481666a3e235794c55d0e582a33ca56fef8d59fe07addc4c9763edd6c0541492c2581788e793df802845d3fcd4a0b05f8332bb35023b2cd8f19a8a9712208e53

data/CHANGES.md

@@ -1,3 +1,10 @@
+# 4.2.1
+
+* Add warning for CVE-2018-3741
+* Add warning for CVE-2018-8048
+* Scan `app/jobs/` directory
+* Handle `template_exists?` in controllers
+
 # 4.2.0
 
 * Avoid warning about symbol DoS on `Model#attributes`

data/lib/brakeman/app_tree.rb

@@ -112,7 +112,8 @@ module Brakeman
     def lib_paths
       @lib_files ||= find_paths("lib").reject { |path| path.include? "/generators/" or path.include? "lib/tasks/" or path.include? "lib/templates/" } +
                      find_additional_lib_paths +
-                     find_helper_paths
+                     find_helper_paths +
+                     find_job_paths
     end
 
   private
@@ -121,6 +122,10 @@ module Brakeman
       find_paths "app/helpers"
     end
 
+    def find_job_paths
+      find_paths "app/jobs"
+    end
+
     def find_additional_lib_paths
       @additional_libs_path.collect{ |path| find_paths path }.flatten
     end

data/lib/brakeman/checks/check_sanitize_methods.rb

@@ -22,12 +22,13 @@ class Brakeman::CheckSanitizeMethods < Brakeman::BaseCheck
     if @fix_version
       check_cve_2013_1855
       check_cve_2013_1857
-    elsif tracker.config.has_gem? :'rails-html-sanitizer' and
-          version_between? "1.0.0", "1.0.2", tracker.config.gem_version(:'rails-html-sanitizer')
+    end
 
-      warn_sanitizer_cve "CVE-2015-7578", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/JbvSRpdbFQAJ"
-      warn_sanitizer_cve "CVE-2015-7580", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ"
+    if tracker.config.has_gem? :'rails-html-sanitizer'
+      check_rails_html_sanitizer
     end
+
+    check_cve_2018_8048
   end
 
   def check_cve_2013_1855
@@ -60,8 +61,46 @@ class Brakeman::CheckSanitizeMethods < Brakeman::BaseCheck
     end
   end
 
-  def warn_sanitizer_cve cve, link
-    message = "rails-html-sanitizer #{tracker.config.gem_version(:'rails-html-sanitizer')} is vulnerable (#{cve}). Upgrade to 1.0.3"
+  def check_rails_html_sanitizer
+    rhs_version = tracker.config.gem_version(:'rails-html-sanitizer')
+
+    if version_between? "1.0.0", "1.0.2", rhs_version
+      warn_sanitizer_cve "CVE-2015-7578", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/JbvSRpdbFQAJ", "1.0.3"
+      warn_sanitizer_cve "CVE-2015-7580", "https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ", "1.0.3"
+    end
+
+    if version_between? "1.0.0", "1.0.3", rhs_version
+      warn_sanitizer_cve "CVE-2018-3741", "https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ", "1.0.4"
+    end
+  end
+
+  def check_cve_2018_8048
+    if loofah_vulnerable_cve_2018_8048?
+      message = "Loofah #{tracker.config.gem_version(:loofah)} is vulnerable (CVE-2018-8048). Upgrade to 2.1.2"
+
+      if tracker.find_call(:target => false, :method => :sanitize).any?
+        confidence = :high
+      else
+        confidence = :medium
+      end
+
+      warn :warning_type => "Cross-Site Scripting",
+        :warning_code => :CVE_2018_8048,
+        :message => message,
+        :gem_info => gemfile_or_environment,
+        :confidence => confidence,
+        :link_path => "https://github.com/flavorjones/loofah/issues/144"
+    end
+  end
+
+  def loofah_vulnerable_cve_2018_8048?
+    loofah_version = tracker.config.gem_version(:loofah)
+
+    loofah_version and loofah_version < "2.1.2"
+  end
+
+  def warn_sanitizer_cve cve, link, upgrade_version
+    message = "rails-html-sanitizer #{tracker.config.gem_version(:'rails-html-sanitizer')} is vulnerable (#{cve}). Upgrade to #{upgrade_version}"
 
     if tracker.find_call(:target => false, :method => :sanitize).any?
       confidence = :high

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -114,6 +114,8 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
 
     if method == :head
       @rendered = true
+    elsif exp.target.nil? and method == :template_exists?
+      env[exp.first_arg] = Sexp.new(:lit, :"brakeman:existing_template")
     elsif @tracker.options[:interprocedural] and
       @current_method and (exp.target.nil? or exp.target.node_type == :self)
 

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "4.2.0"
+  Version = "4.2.1"
 end

data/lib/brakeman/warning_codes.rb

@@ -107,6 +107,8 @@ module Brakeman::WarningCodes
     :CVE_2016_6317 => 103,
     :divide_by_zero => 104,
     :dangerous_permit_key => 105,
+    :CVE_2018_8048 => 106,
+    :CVE_2018_3741 => 107,
   }
 
   def self.code name

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-min
 version: !ruby/object:Gem::Version
-  version: 4.2.0
+  version: 4.2.1
 platform: ruby
 authors:
 - Justin Collins
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain:
 - brakeman-public_cert.pem
-date: 2018-02-22 00:00:00.000000000 Z
+date: 2018-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -272,7 +272,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.