brakeman-min 3.0.4 → 3.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 31a26a3b03270d2eafb08540e523d94c27211d20
-  data.tar.gz: 3fd570c30df5855aebfc9a542e3c54676bacc808
+  metadata.gz: 1ab8f92f7224264621f18aecefd5b06831ad029f
+  data.tar.gz: db8f98753198a72409cd673a4a346f8702cbd3cd
 SHA512:
-  metadata.gz: ea02eed9126d6375399ea7e9a4001978882e2f89c9ba8c90b1467f763aad9691cec19e54dc8cf45efe04d61d39e205d258c2a80b341177d63110868e0e31db39
-  data.tar.gz: d7d24ce1144f1d2db5b74823aeac8f63fef342733537b28929e1d1ba793597eda33fece5fe0fd0c07450d00f7d9435b262b608ac2842215767e853585b10d8c7
+  metadata.gz: 92e31897ee455b1e5e96db7e668b740bddf4ddba338a60cb721e62cbdcf97e9762cd2fc63837b6fcd1754722e9aaccb33f83ccc8c778b62ea98e28cd104e421e
+  data.tar.gz: a13ae68c1d7cfb36ae35e412a50c1c25198492184b593787400ac3855951186c59c8ad7ff22cfe46e2f592ee2e3f6717de87109a074185f3f48ab5a4abe1ffc3

data/CHANGES

@@ -1,3 +1,7 @@
+# 3.0.5
+
+* Fix check for CVE-2015-3227
+
 # 3.0.4
 
 * Add check for CVE-2015-3226 (XSS via JSON keys)

data/lib/brakeman/checks/check_xml_dos.rb

@@ -6,29 +6,37 @@ class Brakeman::CheckXMLDoS < Brakeman::BaseCheck
   @description = "Checks for XML denial of service (CVE-2015-3227)"
 
   def run_check
+    version = tracker.config[:rails_version]
+
     fix_version = case
+                  when version_between?("2.0.0", "3.2.21")
+                    "3.2.22"
                   when version_between?("4.1.0", "4.1.10")
                     "4.1.11"
                   when version_between?("4.2.0", "4.2.1")
                     "4.2.2"
-                  when version_between?("4.1.11", "4.1.99")
-                    return
-                  when version_between?("4.2.2", "9.9.9")
-                    return
-                  when has_workaround?
-                    return
-                  else
+                  when version_between?("4.0.0", "4.0.99")
                     "4.2.2"
+                  when (version.nil? and tracker.options[:rails3])
+                    version = "3.x"
+                    "3.2.22"
+                  when (version.nil? and tracker.options[:rails4])
+                    version = "4.x"
+                    "4.2.2"
+                  else
+                    return
                   end
 
-    message = "Rails #{tracker.config[:rails_version]} is vulnerable to denial of service via XML parsing (CVE-2015-3227). Upgrade to Rails version #{fix_version}"
+    return if has_workaround?
+
+    message = "Rails #{version} is vulnerable to denial of service via XML parsing (CVE-2015-3227). Upgrade to Rails version #{fix_version}"
 
     warn :warning_type => "Denial of Service",
       :warning_code => :CVE_2015_3227,
       :message => message,
       :confidence => CONFIDENCE[:med],
       :gem_info => gemfile_or_environment,
-      :link_path => "repos/canvas-lms/config/application.rb"
+      :link_path => "https://groups.google.com/d/msg/rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J"
   end
 
   def has_workaround?

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "3.0.4"
+  Version = "3.0.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-min
 version: !ruby/object:Gem::Version
-  version: 3.0.4
+  version: 3.0.5
 platform: ruby
 authors:
 - Justin Collins
@@ -30,7 +30,7 @@ cert_chain:
   bxoxp9KNxkO+709YwLO1rYfmcGghg8WV6MYz3PSHdlgWF4KrjRFc/00hXHqVk0Sf
   mREEv2LPwHH2SgpSSab+iawnX4l6lV8XcIrmp/HSMySsPVFBeOmB0c05LpEN8w==
   -----END CERTIFICATE-----
-date: 2015-06-18 00:00:00.000000000 Z
+date: 2015-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: test-unit