brakeman 0.0.2

data/FEATURES

@@ -0,0 +1,16 @@
+Can detect:
+-Possibly unescaped model attributes or parameters in views (Cross Site Scripting)
+-Bad string interpolation in calls to Model.find, Model.last, Model.first, etc., as well as chained calls (SQL Injection)
+-String interpolation in find_by_sql (SQL Injection)
+-String interpolation or params in calls to system, exec, and syscall and `` (Command Injection)
+-Unrestricted mass assignments
+-Global restriction of mass assignment
+-Missing call to protect_from_forgery in ApplicationController (CSRF protection)
+-Default routes, per-controller and globally
+-Redirects based on params (probably too broad currently)
+-Validation regexes not using \A and \z
+-Calls to render with dynamic paths
+
+General capabilities:
+-Search for method calls based on target class and/or method name
+-Determine 'output' of templates using ERB, Erubis, or HAML. Can handle automatic escaping

data/README.md

@@ -0,0 +1,112 @@
+# Brakeman
+
+Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
+
+It targets Rails versions > 2.0 and < 3.0.
+
+# Installation
+
+    gem build brakeman.gemspec
+    gem install brakeman*.gem
+
+# Usage
+
+    brakeman path/to/rails/app/root
+
+# Options
+
+To specify an output file for the results:
+
+    brakeman -o output_file path/to/rails/app/root
+
+The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, and `csv`.
+
+To suppress informational warnings and just output the report:
+
+    brakeman -q path/to/rails/app/root
+
+To see all kinds of debugging information:
+
+    brakeman -d path/to/rails/app/root
+
+Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (`DefaultRoutes`):
+
+    brakeman -x DefaultRoutes path/to/rails/app/root
+
+Multiple checks should be separated by a comma:
+
+    brakeman -x DefaultRoutes,Redirect path/to/rails/app/root
+
+To do the opposite and only run a certain set of tests:
+
+    brakeman -t SQL,ValidationRegex path/to/rails/app/root
+
+To indicate certain methods are "safe":
+
+    brakeman -s benign_method,totally_safe path/to/rails/app/root
+
+By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would a warning:
+
+    <%= some_method(:option => params[:input]) %>
+
+To only raise warnings only when untrusted data is being directly used:
+
+    brakeman -r path/to/rails/app/root
+
+# Warning information
+
+See WARNING_TYPES for more information on the warnings reported by this tool.
+
+# Warning context
+
+The HTML output format provides an excerpt from the original application source where a warning was triggered. Due to the processing done while looking for vulnerabilities, the source may not resemble the reported warning and reported line numbers may be slightly off. However, the context still provides a quick look into the code which raised the warning.
+
+# Confidence levels
+
+Brakeman assigns a confidence level to each warning. This provides a rough estimate of how certain the tool is that a given warning is actually a problem. Naturally, these ratings should not be taken as absolute truth.
+
+There are three levels of confidence:
+
+ + High - Either this is a simple warning (boolean value) or user input is very likely being used in unsafe ways.
+ + Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
+ + Weak - Typically means user input was indirectly used in a potentially unsafe manner.
+
+To only get warnings above a given confidence level:
+
+    brakeman -w3 /path/to/rails/app/root
+
+The `-w` switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only high confidence warnings).
+
+# Configuration files
+
+Brakeman options can stored and read from YAML files. To simplify the process of writing a configuration file, the `-C` option will output the currently set options.
+
+Options passed in on the commandline have priority over configuration files.
+
+The default config locations are `./config.yaml`, `~/.brakeman/`, and `/etc/brakeman/config.yaml`
+
+The `-c` option can be used to specify a configuration file to use.
+
+# License
+
+The MIT License
+
+Copyright (c) 2010, YELLOWPAGES.COM, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/WARNING_TYPES

@@ -0,0 +1,69 @@
+This file describes the various warning types reported by this tool.
+
+# Cross Site Scripting
+
+Cross site scripting warnings are raised when a parameter or model attribute is output through a view without being escaped.
+
+See http://guides.rubyonrails.org/security.html#cross-site-scripting-xss for details.
+
+# SQL Injection
+
+String interpolation or concatenation has been detected in an SQL query. Use parameterized queries instead.
+
+See http://guides.rubyonrails.org/security.html#sql-injection for details.
+
+# Command Injection
+
+Request parameters or string interpolation has been detected in a `system` call. This can lead to someone executing arbitrary commands. Use the safe form of `system` instead, which will pass in arguments safely.
+
+See http://guides.rubyonrails.org/security.html#command-line-injection for details.
+
+# Mass Assignment
+
+Mass assignment is a method for initializing models. If the attributes which are set is not restricted, someone may set the attributes to any value they wish.
+
+Mass assignment can be disabled globally.
+
+Please see http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment for more details.
+
+# Attribute Restriction
+
+This warning comes up if a model does not limit what attributes can be set through mass assignment.
+
+In particular, this check looks for `attr_accessible` inside model definitions. If it is not found, this warning will be issued.
+
+Note that disabling mass assignment globally will suppress these warnings.
+
+# Cross-Site Request Forgery
+
+No call to `protect_from_forgery` was found in `ApplicationController`. This method prevents CSRF.
+
+See http://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf for details.
+
+# Redirect
+
+Redirects which rely on user-supplied values can be used to "spoof" websites or hide malicious links in otherwise harmless-looking URLs. They can also allow access to restricted areas of a site if the destination is not validated.
+
+This warning is shown when request parameters are used inside a call to `redirect_to`.
+
+See http://www.owasp.org/index.php/Top_10_2010-A10 for more information.
+
+# Default Routes
+
+The general default routes warning means there is a call to `map.connect ":controller/:action/:id"` in config/routes.rb. This allows any public method on any controller to be called as an action.
+
+If this warning is reported for a particular controller, it means there is a route to that controller containing `:action`.
+
+Default routes can be dangerous if methods are made public which are not intended to be used as URLs or actions.
+
+# Format Validation
+
+Calls to `validates_format_of ..., :with => //` which do not use `\A` and `\z` as anchors will cause this warning. Using `^` and `$` is not sufficient, as `$` will only match up to a new line. This allows an attacker to put whatever malicious input they would like after a new line character.
+
+See http://guides.rubyonrails.org/security.html#regular-expressions for details.
+
+# Dynamic Render Path
+
+When a call to `render` uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.
+
+This warning is shown whenever the path to be rendered is not a static string or symbol.

data/bin/brakeman

@@ -0,0 +1,266 @@
+#!/usr/bin/env ruby
+require "optparse"
+require 'set'
+require 'yaml'
+
+Version = "0.0.2"
+
+trap("INT") do
+  $stderr.puts "\nInterrupted - exiting."
+  exit!
+end
+
+#Load scanner
+begin
+  require 'scanner'
+rescue LoadError
+  #Try to find lib directory locally
+  $: << "#{File.expand_path(File.dirname(__FILE__))}/../lib"
+
+  begin
+    require 'scanner'
+  rescue LoadError
+    abort "Cannot find lib/ directory."
+  end
+end
+
+#Parse command line options
+options = {}
+
+OptionParser.new do |opts|
+  opts.banner = "Usage: brakeman [options] rails/root/path"
+
+  opts.on "-p", "--path PATH", "Specify path to Rails application" do |path|
+    options[:app_path] = File.expand_path path
+  end
+
+  opts.on "-q", "--quiet", "Suppress informational messages" do
+    options[:quiet] = true
+    $VERBOSE = nil
+  end
+
+  opts.separator ""
+  opts.separator "Scanning options:"
+
+  opts.on "--ignore-model-output", "Consider model attributes XSS-safe" do
+    options[:ignore_model_output] = true
+  end
+
+  opts.on "-r", "--report-direct", "Only report direct use of untrusted data" do |option|
+    options[:check_arguments] = !option
+  end
+
+  opts.on "-s", "--safe-methods meth1,meth2,etc", Array, "Consider the specified methods safe" do |methods|
+    options[:safe_methods] ||= Set.new
+    options[:safe_methods].merge methods.map {|e| e.to_sym }
+  end
+
+  opts.on "-t", "--test Check1,Check2,etc", Array, "Only run the specified checks" do |checks|
+    checks.each_with_index do |s, index|
+      if s[0,5] != "Check"
+        checks[index] = "Check" << s
+      end
+    end
+
+    options[:run_checks] ||= Set.new
+    options[:run_checks].merge checks
+  end
+
+  opts.on "-x", "--except Check1,Check2,etc", Array, "Skip the specified checks" do |skip|
+    skip.each do |s|
+      if s[0,5] != "Check"
+        s = "Check" << s
+      end
+
+      options[:skip_checks] ||= Set.new
+      options[:skip_checks] << s
+    end
+  end
+
+  opts.separator ""
+  opts.separator "Output options:"
+
+  opts.on "-d", "--debug", "Lots of output" do
+    options[:debug] = true 
+  end
+
+  opts.on "-f", 
+    "--format TYPE", 
+    [:pdf, :text, :html, :csv], 
+    "Specify output format. Default is text" do |type|
+    
+    type = "s" if type == :text
+    options[:output_format] = ("to_" << type.to_s).to_sym
+  end
+
+  opts.on "-l", "--[no]-combine-locations", "Combine warning locations (Default)" do |combine|
+    options[:combine_locations] = combine
+  end
+
+  opts.on "-m", "--routes", "Report controller information" do
+    options[:report_routes] = true
+  end
+
+  opts.on "--message-limit LENGTH", "Limit message length in HTML report" do |limit|
+    options[:message_limit] = limit.to_i
+  end
+
+  opts.on "-o", "--output FILE", "Specify file for output. Defaults to stdout" do |file|
+    options[:output_file] = file
+  end
+
+  opts.on "-w", 
+    "--confidence-level LEVEL", 
+    ["1", "2", "3"], 
+    "Set minimal confidence level (1 - 3). Default: 1" do |level|
+
+    options[:min_confidence] =  3 - level.to_i
+  end
+
+  opts.separator ""
+  opts.separator "Configuration files:"
+
+  opts.on "-c", "--config-file FILE", "Use specified configuration file" do |file|
+    options[:config_file] = File.expand_path(file)
+  end
+
+  opts.on "-C", "--create-config [FILE]", "Output configuration file based on options" do |file|
+    if file
+      options[:create_config] = file
+    else
+      options[:create_config] = true
+    end
+  end
+
+  opts.separator ""
+
+  opts.on_tail "-h", "--help", "Display this message" do
+    puts opts
+    exit
+  end
+end.parse!(ARGV)
+
+#Load configuation file
+[File.expand_path(options[:config_file].to_s),
+  File.expand_path("./config.yaml"),
+  File.expand_path("~/.brakeman/config.yaml"),
+  File.expand_path("/etc/brakeman/config.yaml"),
+  "#{File.expand_path(File.dirname(__FILE__))}/../lib/config.yaml"].each do |f|
+
+  if File.exist? f and not File.directory? f
+    warn "[Notice] Using configuration in #{f}" unless options[:quiet]
+    OPTIONS = YAML.load_file f
+    OPTIONS.merge! options
+    OPTIONS.each do |k,v|
+      if v.is_a? Array
+        OPTIONS[k] = Set.new v
+      end
+    end
+    break
+  end
+end
+  
+OPTIONS = options unless defined? OPTIONS
+
+#Set defaults just in case
+{ :skip_checks => Set.new, 
+  :check_arguments => true, 
+  :safe_methods => Set.new,
+  :min_confidence => 2,
+  :combine_locations => true,
+  :collapse_mass_assignment => true,
+  :ignore_redirect_to_model => true,
+  :ignore_model_output => false,
+  :message_limit => 100,
+  :html_style => "#{File.expand_path(File.dirname(__FILE__))}/../lib/format/style.css" 
+}.each do |k,v|
+  OPTIONS[k] = v if OPTIONS[k].nil?
+end
+
+
+#Set output format
+if OPTIONS[:output_format]
+  case OPTIONS[:output_format]
+  when :html, :to_html
+    OPTIONS[:output_format] = :to_html
+  when :csv, :to_csv
+    OPTIONS[:output_format] = :to_csv
+  when :pdf, :to_pdf
+    OPTIONS[:output_format] = :to_pdf
+  else
+    OPTIONS[:output_format] = :to_s
+  end
+else
+  case OPTIONS[:output_file]
+  when /\.html$/i
+    OPTIONS[:output_format] = :to_html
+  when /\.csv$/i
+    OPTIONS[:output_format] = :to_csv
+  when /\.pdf$/i
+    OPTIONS[:output_format] = :to_pdf
+  else
+    OPTIONS[:output_format] = :to_s
+  end
+end
+
+#Output configuration if requested
+if OPTIONS[:create_config]
+
+  if OPTIONS[:create_config].is_a? String
+    file = OPTIONS[:create_config]
+  else
+    file = nil
+  end
+
+  OPTIONS.delete :create_config
+
+  OPTIONS.each do |k,v|
+    if v.is_a? Set
+      OPTIONS[k] = v.to_a
+    end
+  end
+
+  if file
+    File.open file, "w" do |f|
+      YAML.dump OPTIONS, f
+    end
+    puts "Output configuration to #{file}"
+  else
+    puts YAML.dump(OPTIONS)
+  end
+  exit
+end
+
+
+#Check application path
+unless OPTIONS[:app_path]
+  if ARGV[-1].nil?
+    OPTIONS[:app_path] = File.expand_path "."
+  else
+    OPTIONS[:app_path] = File.expand_path ARGV[-1]
+  end
+end
+
+app_path = OPTIONS[:app_path]
+
+abort("Please supply the path to a Rails application.") unless app_path and File.exist? app_path + "/app"
+
+warn "[Notice] Using Ruby #{RUBY_VERSION}. Please make sure this matches the one used to run your Rails application."
+
+#Start scanning
+scanner = Scanner.new app_path
+
+warn "Processing application in #{app_path}"
+tracker = scanner.process
+
+warn "Running checks..."
+tracker.run_checks
+
+warn "Generating report..."
+if OPTIONS[:output_file]
+  File.open OPTIONS[:output_file], "w" do |f|
+    f.puts tracker.report.send(OPTIONS[:output_format])
+  end
+else
+  puts tracker.report.send(OPTIONS[:output_format])
+end