brakeman 4.3.1 → 5.0.0

data/lib/brakeman/checks/check_basic_auth.rb

@@ -57,6 +57,8 @@ class Brakeman::CheckBasicAuth < Brakeman::BaseCheck
 
   # Check if the block of a result contains a comparison of password to string
   def include_password_literal? result
+    return false if result[:block_args].nil?
+
     @password_var = result[:block_args].last
     @include_password = false
     process result[:block]

data/lib/brakeman/checks/check_basic_auth_timing_attack.rb

@@ -25,7 +25,7 @@ class Brakeman::CheckBasicAuthTimingAttack < Brakeman::BaseCheck
       warn :result => result,
         :warning_type => "Timing Attack",
         :warning_code => :CVE_2015_7576,
-        :message => "Basic authentication in Rails #{rails_version} is vulnerable to timing attacks. Upgrade to #@upgrade",
+        :message => msg("Basic authentication in ", msg_version(rails_version), " is vulnerable to timing attacks. Upgrade to ", msg_version(@upgrade)),
         :confidence => :high,
         :link => "https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ"
     end

data/lib/brakeman/checks/check_content_tag.rb

@@ -45,8 +45,17 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
   def process_result result
     return if duplicate? result
 
-    call = result[:call] = result[:call].dup
+    case result[:location][:type]
+    when :template
+      @current_template = result[:location][:template]
+    when :class
+      @current_class = result[:location][:class]
+      @current_method = result[:location][:method]
+    end
+
+    @current_file = result[:location][:file]
 
+    call = result[:call]
     args = call.arglist
 
     tag_name = args[1]
@@ -85,6 +94,8 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
         end
       end
     end
+  ensure
+    @current_template = @current_class = @current_method = @current_file = nil
   end
 
   def check_argument result, exp
@@ -96,7 +107,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
     end
 
     if input = has_immediate_user_input?(arg)
-      message = "Unescaped #{friendly_type_of input} in content_tag"
+      message = msg("Unescaped ", msg_input(input), " in ", msg_code("content_tag"))
 
       add_result result
 
@@ -121,7 +132,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
         warn :result => result,
           :warning_type => "Cross-Site Scripting",
           :warning_code => :xss_content_tag,
-          :message => "Unescaped model attribute in content_tag",
+          :message => msg("Unescaped model attribute in ", msg_code("content_tag")),
           :user_input => match,
           :confidence => confidence,
           :link_path => "content_tag"
@@ -130,7 +141,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
     elsif @matched
       return if @matched.type == :model and tracker.options[:ignore_model_output]
 
-      message = "Unescaped #{friendly_type_of @matched} in content_tag"
+      message = msg("Unescaped ", msg_input(@matched), " in ", msg_code("content_tag"))
 
       add_result result
 
@@ -181,7 +192,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
 
       warn :warning_type => "Cross-Site Scripting",
         :warning_code => :CVE_2016_6316,
-        :message => "Rails #{rails_version} content_tag does not escape double quotes in attribute values (CVE-2016-6316). Upgrade to #{fix_version}",
+        :message => msg(msg_version(rails_version), " ", msg_code("content_tag"), " does not escape double quotes in attribute values ", msg_cve("CVE-2016-6316"), ". Upgrade to ", msg_version(fix_version)),
         :confidence => confidence,
         :gem_info => gemfile_or_environment,
         :link_path => "https://groups.google.com/d/msg/ruby-security-ann/8B2iV2tPRSE/JkjCJkSoCgAJ"

data/lib/brakeman/checks/check_cookie_serialization.rb

@@ -0,0 +1,22 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckCookieSerialization < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Check for use of Marshal for cookie serialization"
+
+  def run_check
+    tracker.find_call(target: :'Rails.application.config.action_dispatch', method: :cookies_serializer=).each do |result|
+      setting = result[:call].first_arg
+
+      if symbol? setting and [:marshal, :hybrid].include? setting.value
+        warn :result => result,
+          :warning_type => "Remote Code Execution",
+          :warning_code => :unsafe_cookie_serialization,
+          :message => msg("Use of unsafe cookie serialization strategy ", msg_code(setting.value.inspect), " might lead to remote code execution"),
+          :confidence => :medium,
+          :link_path => "unsafe_deserialization"
+      end
+    end
+  end
+end

data/lib/brakeman/checks/check_create_with.rb

@@ -16,7 +16,7 @@ class Brakeman::CheckCreateWith < Brakeman::BaseCheck
       return
     end
 
-    @message = "create_with is vulnerable to strong params bypass. Upgrade to Rails #{suggested_version} or patch"
+    @message = msg(msg_code("create_with"), " is vulnerable to strong params bypass. Upgrade to ", msg_version(suggested_version), " or patch")
 
     tracker.find_call(:method => :create_with, :nested => true).each do |result|
       process_result result

data/lib/brakeman/checks/check_cross_site_scripting.rb

@@ -33,6 +33,11 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
   FORM_BUILDER = Sexp.new(:call, Sexp.new(:const, :FormBuilder), :new)
 
+  def initialize *args
+    super
+    @matched = @mark = false
+  end
+
   #Run check
   def run_check
     setup
@@ -57,12 +62,12 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
     if exp.node_type == :output
       out = exp.value
-    elsif exp.node_type == :escaped_output
-      if raw_call? exp
-        out = exp.value.first_arg
-      elsif html_safe_call? exp
-        out = exp.value.target
-      end
+    end
+
+    if raw_call? exp
+      out = exp.value.first_arg
+    elsif html_safe_call? exp
+      out = exp.value.target
     end
 
     return if call? out and ignore_call? out.target, out.method
@@ -70,7 +75,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
     if input = has_immediate_user_input?(out)
       add_result exp
 
-      message = "Unescaped #{friendly_type_of input}"
+      message = msg("Unescaped ", msg_input(input))
 
       warn :template => @current_template,
         :warning_type => "Cross-Site Scripting",
@@ -168,7 +173,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
       if @matched
         unless @matched.type and tracker.options[:ignore_model_output]
-          message = "Unescaped #{friendly_type_of @matched}"
+          message = msg("Unescaped ", msg_input(@matched))
         end
 
         if message and not duplicate? exp
@@ -180,7 +185,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
           if @known_dangerous.include? exp.method
             confidence = :high
             if exp.method == :to_json
-              message += " in JSON hash"
+              message << msg_plain(" in JSON hash")
               link_path += "_to_json"
               warning_code = :xss_to_json
             end
@@ -282,7 +287,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
   def setup
     @ignore_methods = Set[:==, :!=, :button_to, :check_box, :content_tag, :escapeHTML, :escape_once,
-                           :field_field, :fields_for, :h, :hidden_field,
+                           :field_field, :fields_for, :form_for, :h, :hidden_field,
                            :hidden_field, :hidden_field_tag, :image_tag, :label,
                            :link_to, :mail_to, :radio_button, :select,
                            :submit_tag, :text_area, :text_field,
@@ -311,11 +316,11 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
     end
 
     json_escape_on = false
-    initializers = tracker.check_initializers :ActiveSupport, :escape_html_entities_in_json=
-    initializers.each {|result| json_escape_on = true?(result.call.first_arg) }
+    initializers = tracker.find_call(target: :ActiveSupport, method: :escape_html_entities_in_json=)
+    initializers.each {|result| json_escape_on = true?(result[:call].first_arg) }
 
     if tracker.config.escape_html_entities_in_json?
-        json_escape_on = true
+      json_escape_on = true
     elsif version_between? "4.0.0", "9.9.9"
       json_escape_on = true
     end

data/lib/brakeman/checks/check_csrf_token_forgery_cve.rb

@@ -0,0 +1,28 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckCSRFTokenForgeryCVE < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions with CSRF token forgery vulnerability (CVE-2020-8166)"
+
+  def run_check
+    fix_version = case
+      when version_between?('0.0.0', '5.2.4.2')
+        '5.2.4.3'
+      when version_between?('6.0.0', '6.0.3')
+        '6.0.3.1'
+      else
+        nil
+      end
+
+    if fix_version
+      warn :warning_type => "Cross-Site Request Forgery",
+        :warning_code => :CVE_2020_8166,
+        :message => msg(msg_version(rails_version), " has a vulnerability that may allow CSRF token forgery. Upgrade to ", msg_version(fix_version), " or patch"),
+        :confidence => :medium,
+        :gem_info => gemfile_or_environment,
+        :link => "https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw"
+    end
+  end
+end
+

data/lib/brakeman/checks/check_default_routes.rb

@@ -6,6 +6,11 @@ class Brakeman::CheckDefaultRoutes < Brakeman::BaseCheck
 
   @description = "Checks for default routes"
 
+  def initialize *args
+    super
+    @actions_allowed_on_controller = nil
+  end
+
   #Checks for :allow_all_actions globally and for individual routes
   #if it is not enabled globally.
   def run_check
@@ -19,7 +24,7 @@ class Brakeman::CheckDefaultRoutes < Brakeman::BaseCheck
       #Default routes are enabled globally
       warn :warning_type => "Default Routes",
         :warning_code => :all_default_routes,
-        :message => "All public methods in controllers are available as actions in routes.rb",
+        :message => msg("All public methods in controllers are available as actions in ", msg_file("routes.rb")),
         :line => tracker.routes[:allow_all_actions].line,
         :confidence => :high,
         :file => "#{tracker.app_path}/config/routes.rb"
@@ -41,7 +46,7 @@ class Brakeman::CheckDefaultRoutes < Brakeman::BaseCheck
         warn :controller => name,
           :warning_type => "Default Routes",
           :warning_code => :controller_default_routes,
-          :message => "Any public method in #{name} can be used as an action for #{verb} requests.",
+          :message => msg("Any public method in ", msg_code(name), " can be used as an action for ", msg_code(verb), " requests."),
           :line => actions[2],
           :confidence => :medium,
           :file => "#{tracker.app_path}/config/routes.rb"
@@ -74,7 +79,7 @@ class Brakeman::CheckDefaultRoutes < Brakeman::BaseCheck
 
     warn :warning_type => "Remote Code Execution",
       :warning_code => :CVE_2014_0130,
-      :message => "Rails #{rails_version} with globbing routes is vulnerable to directory traversal and remote code execution. Patch or upgrade to #{upgrade}",
+      :message => msg(msg_version(rails_version), " with globbing routes is vulnerable to directory traversal and remote code execution. Patch or upgrade to ", msg_version(upgrade)),
       :confidence => confidence,
       :file => "#{tracker.app_path}/config/routes.rb",
       :link => "http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf"

data/lib/brakeman/checks/check_deserialize.rb

@@ -9,10 +9,27 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
     check_yaml
     check_csv
     check_marshal
+    check_oj
   end
 
   def check_yaml
-    check_methods :YAML, :load, :load_documents, :load_stream, :parse_documents, :parse_stream
+    check_methods :YAML, :load_documents, :load_stream, :parse_documents, :parse_stream
+
+    # Check for safe_yaml gem use with YAML.load(..., safe: true)
+    if uses_safe_yaml?
+      tracker.find_call(target: :YAML, method: :load).each do |result|
+        call = result[:call]
+        options = call.second_arg
+
+        if hash? options and true? hash_access(options, :safe)
+          next
+        else
+          check_deserialize result, :YAML
+        end
+      end
+    else
+      check_methods :YAML, :load
+    end
   end
 
   def check_csv
@@ -23,6 +40,26 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
     check_methods :Marshal, :load, :restore
   end
 
+  def check_oj
+    check_methods :Oj, :object_load # Always unsafe, regardless of mode
+
+    unsafe_mode = :object
+    safe_default = oj_safe_default?
+
+    tracker.find_call(:target => :Oj, :method => :load).each do |result|
+      call = result[:call]
+      options = call.second_arg
+
+      if options and hash? options and mode = hash_access(options, :mode)
+        if symbol? mode and mode.value == unsafe_mode
+          check_deserialize result, :Oj
+        end
+      elsif not safe_default
+        check_deserialize result, :Oj
+      end
+    end
+  end
+
   def check_methods target, *methods
     tracker.find_call(:target => target, :methods => methods ).each do |result|
       check_deserialize result, target
@@ -42,7 +79,7 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
     end
 
     if confidence
-      message = "#{target}.#{method} called with #{friendly_type_of input}"
+      message = msg(msg_code("#{target}.#{method}"), " called with ", msg_input(input))
 
       warn :result => result,
         :warning_type => "Remote Code Execution",
@@ -53,4 +90,36 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
         :link_path => "unsafe_deserialization"
     end
   end
+
+  private
+
+  def oj_safe_default?
+    safe_default = false
+
+    if tracker.find_call(target: :Oj, method: :mimic_JSON).any?
+      safe_default = true
+    elsif result = tracker.find_call(target: :Oj, method: :default_options=).first
+      options = result[:call].first_arg
+
+      if oj_safe_mode? options
+        safe_default = true
+      end
+    end
+
+    safe_default
+  end
+
+  def oj_safe_mode? options
+    if hash? options and mode = hash_access(options, :mode)
+      if symbol? mode and mode != :object
+        return true
+      end
+    end
+
+    false
+  end
+
+  def uses_safe_yaml?
+    tracker.config.has_gem? :safe_yaml
+  end
 end

data/lib/brakeman/checks/check_detailed_exceptions.rb

@@ -39,7 +39,7 @@ class Brakeman::CheckDetailedExceptions < Brakeman::BaseCheck
 
           warn :warning_type => "Information Disclosure",
                :warning_code => :detailed_exceptions,
-               :message => "Detailed exceptions may be enabled in 'show_detailed_exceptions?'",
+               :message => msg("Detailed exceptions may be enabled in ", msg_code("show_detailed_exceptions?")),
                :confidence => confidence,
                :code => src,
                :file => definition[:file]

data/lib/brakeman/checks/check_digest_dos.rb

@@ -6,14 +6,14 @@ class Brakeman::CheckDigestDoS < Brakeman::BaseCheck
   @description = "Checks for digest authentication DoS vulnerability"
 
   def run_check
-    message = "Vulnerability in digest authentication (CVE-2012-3424). Upgrade to Rails version "
+    message = msg("Vulnerability in digest authentication ", msg_cve("CVE-2012-3424"), ". Upgrade to ")
 
     if version_between? "3.0.0", "3.0.15"
-      message << "3.0.16"
+      message << msg_version("3.0.16")
     elsif version_between? "3.1.0", "3.1.6"
-      message << "3.1.7"
+      message << msg_version("3.1.7")
     elsif version_between? "3.2.0", "3.2.5"
-      message << "3.2.7"
+      message << msg_version("3.2.7")
     else
       return
     end

data/lib/brakeman/checks/check_dynamic_finders.rb

@@ -43,6 +43,6 @@ class Brakeman::CheckDynamicFinders < Brakeman::BaseCheck
   end
 
   def potentially_dangerous? method_name
-    method_name.match /^find_by_.*(token|guid|password|api_key|activation|code|private|reset)/
+    method_name.match(/^find_by_.*(token|guid|password|api_key|activation|code|private|reset)/)
   end
 end

data/lib/brakeman/checks/check_escape_function.rb

@@ -12,7 +12,7 @@ class Brakeman::CheckEscapeFunction < Brakeman::BaseCheck
 
       warn :warning_type => 'Cross-Site Scripting',
         :warning_code => :CVE_2011_2932,
-        :message => 'Versions before 2.3.14 have a vulnerability in escape method when used with Ruby 1.8: CVE-2011-2932',
+        :message => msg("Rails versions before 2.3.14 have a vulnerability in the ", msg_code("escape"), " method when used with Ruby 1.8 ", msg_cve("CVE-2011-2932")),
         :confidence => :high,
         :gem_info => gemfile_or_environment,
         :link_path => "https://groups.google.com/d/topic/rubyonrails-security/Vr_7WSOrEZU/discussion"

data/lib/brakeman/checks/check_evaluation.rb

@@ -27,7 +27,6 @@ class Brakeman::CheckEvaluation < Brakeman::BaseCheck
         :warning_type => "Dangerous Eval",
         :warning_code => :code_eval,
         :message => "User input in eval",
-        :code => result[:call],
         :user_input => input,
         :confidence => :high
     end

data/lib/brakeman/checks/check_execute.rb

@@ -18,7 +18,12 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
                   s(:call, s(:const, :Rails), :env),
                   s(:call, s(:const, :Process), :pid)]
 
-  SHELL_ESCAPES = [:escape, :shellescape, :join]
+  SHELL_ESCAPE_MODULE_METHODS = Set[:escape, :join, :shellescape, :shelljoin]
+  SHELL_ESCAPE_MIXIN_METHODS = Set[:shellescape, :shelljoin]
+
+  # These are common shells that are known to allow the execution of commands
+  # via a -c flag. See dash_c_shell_command? for more info.
+  KNOWN_SHELL_COMMANDS = Set["sh", "bash", "ksh", "csh", "tcsh", "zsh"]
 
   SHELLWORDS = s(:const, :Shellwords)
 
@@ -41,6 +46,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     end
   end
 
+  private
+
   #Processes results from Tracker#find_call.
   def process_result result
     call = result[:call]
@@ -49,13 +56,41 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
     case call.method
     when :popen
-      unless array? first_arg
-        failure = include_user_input?(args) || dangerous_interp?(args)
+      # Normally, if we're in a `popen` call, we only are worried about shell
+      # injection when the argument is not an array, because array elements
+      # are always escaped by Ruby. However, an exception is when the array
+      # contains two values are something like "bash -c" because then the third
+      # element is effectively the command being run and might be a malicious
+      # executable if it comes (partially or fully) from user input.
+      if !array?(first_arg)
+        failure = include_user_input?(first_arg) ||
+                  dangerous_interp?(first_arg) ||
+                  dangerous_string_building?(first_arg)
+      elsif dash_c_shell_command?(first_arg[1], first_arg[2])
+        failure = include_user_input?(first_arg[3]) ||
+                  dangerous_interp?(first_arg[3]) ||
+                  dangerous_string_building?(first_arg[3])
       end
     when :system, :exec
-      failure = include_user_input?(first_arg) || dangerous_interp?(first_arg)
+      # Normally, if we're in a `system` or `exec` call, we only are worried
+      # about shell injection when there's a single argument, because comma-
+      # separated arguments are always escaped by Ruby. However, an exception is
+      # when the first two arguments are something like "bash -c" because then
+      # the third argument is effectively the command being run and might be
+      # a malicious executable if it comes (partially or fully) from user input.
+      if dash_c_shell_command?(first_arg, call.second_arg)
+        failure = include_user_input?(args[3]) ||
+                  dangerous_interp?(args[3]) ||
+                  dangerous_string_building?(args[3])
+      else
+        failure = include_user_input?(first_arg) ||
+                  dangerous_interp?(first_arg) ||
+                  dangerous_string_building?(first_arg)
+      end
     else
-      failure = include_user_input?(args) || dangerous_interp?(args)
+      failure = include_user_input?(args) ||
+                dangerous_interp?(args) ||
+                dangerous_string_building?(args)
     end
 
     if failure and original? result
@@ -76,19 +111,46 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     end
   end
 
+  # @return [Boolean] true iff the command given by `first_arg`, `second_arg`
+  #   invokes a new shell process via `<shell_command> -c` (like `bash -c`)
+  def dash_c_shell_command?(first_arg, second_arg)
+    string?(first_arg) &&
+    KNOWN_SHELL_COMMANDS.include?(first_arg.value) &&
+    string?(second_arg) &&
+    second_arg.value == "-c"
+  end
+
   def check_open_calls
     tracker.find_call(:targets => [nil, :Kernel], :method => :open).each do |result|
       if match = dangerous_open_arg?(result[:call].first_arg)
         warn :result => result,
           :warning_type => "Command Injection",
           :warning_code => :command_injection,
-          :message => "Possible command injection in open()",
+          :message => msg("Possible command injection in ", msg_code("open")),
           :user_input => match,
           :confidence => :high
       end
     end
   end
 
+  def include_user_input? exp
+    if node_type? exp, :arglist, :dstr, :evstr, :dxstr
+      exp.each_sexp do |e|
+        if res = include_user_input?(e)
+          return res
+        end
+      end
+
+      false
+    else
+      if shell_escape? exp
+        false
+      else
+        super exp
+      end
+    end
+  end
+
   def dangerous_open_arg? exp
     if string_interp? exp
       # Check for input at start of string
@@ -142,11 +204,12 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
       next if node_type? e, :lit, :str
       next if SAFE_VALUES.include? e
       next if shell_escape? e
+      next if temp_file_path? e
 
       if node_type? e, :if
         # If we're in a conditional, evaluate the `then` and `else` clauses to
         # see if they're dangerous.
-        if res = dangerous?(e.values[1..-1])
+        if res = dangerous?(e.sexp_body.sexp_body)
           return res
         end
       elsif node_type? e, :or, :evstr, :dstr
@@ -175,12 +238,29 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     false
   end
 
+  #Checks if an expression contains string interpolation.
+  #
+  #Returns Match with :interp type if found.
+  def include_interp? exp
+    @string_interp = false
+    process exp
+    @string_interp
+  end
+
+  def dangerous_string_building? exp
+    if string_building?(exp) && res = dangerous?(exp)
+      return Match.new(:interp, res)
+    end
+
+    false
+  end
+
   def shell_escape? exp
     return false unless call? exp
 
-    if exp.target == SHELLWORDS and SHELL_ESCAPES.include? exp.method
+    if exp.target == SHELLWORDS and SHELL_ESCAPE_MODULE_METHODS.include? exp.method
       true
-    elsif exp.method == :shelljoin
+    elsif SHELL_ESCAPE_MIXIN_METHODS.include?(exp.method)
       true
     else
       false