brakeman 4.4.0 → 5.0.0

data/lib/brakeman/checks/check_content_tag.rb

@@ -45,8 +45,17 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
   def process_result result
     return if duplicate? result
 
-    call = result[:call] = result[:call].dup
+    case result[:location][:type]
+    when :template
+      @current_template = result[:location][:template]
+    when :class
+      @current_class = result[:location][:class]
+      @current_method = result[:location][:method]
+    end
+
+    @current_file = result[:location][:file]
 
+    call = result[:call]
     args = call.arglist
 
     tag_name = args[1]
@@ -85,6 +94,8 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
         end
       end
     end
+  ensure
+    @current_template = @current_class = @current_method = @current_file = nil
   end
 
   def check_argument result, exp

data/lib/brakeman/checks/check_cookie_serialization.rb

@@ -0,0 +1,22 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckCookieSerialization < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Check for use of Marshal for cookie serialization"
+
+  def run_check
+    tracker.find_call(target: :'Rails.application.config.action_dispatch', method: :cookies_serializer=).each do |result|
+      setting = result[:call].first_arg
+
+      if symbol? setting and [:marshal, :hybrid].include? setting.value
+        warn :result => result,
+          :warning_type => "Remote Code Execution",
+          :warning_code => :unsafe_cookie_serialization,
+          :message => msg("Use of unsafe cookie serialization strategy ", msg_code(setting.value.inspect), " might lead to remote code execution"),
+          :confidence => :medium,
+          :link_path => "unsafe_deserialization"
+      end
+    end
+  end
+end

data/lib/brakeman/checks/check_cross_site_scripting.rb

@@ -33,6 +33,11 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
   FORM_BUILDER = Sexp.new(:call, Sexp.new(:const, :FormBuilder), :new)
 
+  def initialize *args
+    super
+    @matched = @mark = false
+  end
+
   #Run check
   def run_check
     setup
@@ -57,12 +62,12 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
     if exp.node_type == :output
       out = exp.value
-    elsif exp.node_type == :escaped_output
-      if raw_call? exp
-        out = exp.value.first_arg
-      elsif html_safe_call? exp
-        out = exp.value.target
-      end
+    end
+
+    if raw_call? exp
+      out = exp.value.first_arg
+    elsif html_safe_call? exp
+      out = exp.value.target
     end
 
     return if call? out and ignore_call? out.target, out.method
@@ -282,7 +287,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
   def setup
     @ignore_methods = Set[:==, :!=, :button_to, :check_box, :content_tag, :escapeHTML, :escape_once,
-                           :field_field, :fields_for, :h, :hidden_field,
+                           :field_field, :fields_for, :form_for, :h, :hidden_field,
                            :hidden_field, :hidden_field_tag, :image_tag, :label,
                            :link_to, :mail_to, :radio_button, :select,
                            :submit_tag, :text_area, :text_field,
@@ -311,11 +316,11 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
     end
 
     json_escape_on = false
-    initializers = tracker.check_initializers :ActiveSupport, :escape_html_entities_in_json=
-    initializers.each {|result| json_escape_on = true?(result.call.first_arg) }
+    initializers = tracker.find_call(target: :ActiveSupport, method: :escape_html_entities_in_json=)
+    initializers.each {|result| json_escape_on = true?(result[:call].first_arg) }
 
     if tracker.config.escape_html_entities_in_json?
-        json_escape_on = true
+      json_escape_on = true
     elsif version_between? "4.0.0", "9.9.9"
       json_escape_on = true
     end

data/lib/brakeman/checks/check_csrf_token_forgery_cve.rb

@@ -0,0 +1,28 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckCSRFTokenForgeryCVE < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions with CSRF token forgery vulnerability (CVE-2020-8166)"
+
+  def run_check
+    fix_version = case
+      when version_between?('0.0.0', '5.2.4.2')
+        '5.2.4.3'
+      when version_between?('6.0.0', '6.0.3')
+        '6.0.3.1'
+      else
+        nil
+      end
+
+    if fix_version
+      warn :warning_type => "Cross-Site Request Forgery",
+        :warning_code => :CVE_2020_8166,
+        :message => msg(msg_version(rails_version), " has a vulnerability that may allow CSRF token forgery. Upgrade to ", msg_version(fix_version), " or patch"),
+        :confidence => :medium,
+        :gem_info => gemfile_or_environment,
+        :link => "https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw"
+    end
+  end
+end
+

data/lib/brakeman/checks/check_default_routes.rb

@@ -6,6 +6,11 @@ class Brakeman::CheckDefaultRoutes < Brakeman::BaseCheck
 
   @description = "Checks for default routes"
 
+  def initialize *args
+    super
+    @actions_allowed_on_controller = nil
+  end
+
   #Checks for :allow_all_actions globally and for individual routes
   #if it is not enabled globally.
   def run_check

data/lib/brakeman/checks/check_deserialize.rb

@@ -9,10 +9,27 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
     check_yaml
     check_csv
     check_marshal
+    check_oj
   end
 
   def check_yaml
-    check_methods :YAML, :load, :load_documents, :load_stream, :parse_documents, :parse_stream
+    check_methods :YAML, :load_documents, :load_stream, :parse_documents, :parse_stream
+
+    # Check for safe_yaml gem use with YAML.load(..., safe: true)
+    if uses_safe_yaml?
+      tracker.find_call(target: :YAML, method: :load).each do |result|
+        call = result[:call]
+        options = call.second_arg
+
+        if hash? options and true? hash_access(options, :safe)
+          next
+        else
+          check_deserialize result, :YAML
+        end
+      end
+    else
+      check_methods :YAML, :load
+    end
   end
 
   def check_csv
@@ -23,6 +40,26 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
     check_methods :Marshal, :load, :restore
   end
 
+  def check_oj
+    check_methods :Oj, :object_load # Always unsafe, regardless of mode
+
+    unsafe_mode = :object
+    safe_default = oj_safe_default?
+
+    tracker.find_call(:target => :Oj, :method => :load).each do |result|
+      call = result[:call]
+      options = call.second_arg
+
+      if options and hash? options and mode = hash_access(options, :mode)
+        if symbol? mode and mode.value == unsafe_mode
+          check_deserialize result, :Oj
+        end
+      elsif not safe_default
+        check_deserialize result, :Oj
+      end
+    end
+  end
+
   def check_methods target, *methods
     tracker.find_call(:target => target, :methods => methods ).each do |result|
       check_deserialize result, target
@@ -53,4 +90,36 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
         :link_path => "unsafe_deserialization"
     end
   end
+
+  private
+
+  def oj_safe_default?
+    safe_default = false
+
+    if tracker.find_call(target: :Oj, method: :mimic_JSON).any?
+      safe_default = true
+    elsif result = tracker.find_call(target: :Oj, method: :default_options=).first
+      options = result[:call].first_arg
+
+      if oj_safe_mode? options
+        safe_default = true
+      end
+    end
+
+    safe_default
+  end
+
+  def oj_safe_mode? options
+    if hash? options and mode = hash_access(options, :mode)
+      if symbol? mode and mode != :object
+        return true
+      end
+    end
+
+    false
+  end
+
+  def uses_safe_yaml?
+    tracker.config.has_gem? :safe_yaml
+  end
 end

data/lib/brakeman/checks/check_dynamic_finders.rb

@@ -43,6 +43,6 @@ class Brakeman::CheckDynamicFinders < Brakeman::BaseCheck
   end
 
   def potentially_dangerous? method_name
-    method_name.match /^find_by_.*(token|guid|password|api_key|activation|code|private|reset)/
+    method_name.match(/^find_by_.*(token|guid|password|api_key|activation|code|private|reset)/)
   end
 end

data/lib/brakeman/checks/check_evaluation.rb

@@ -27,7 +27,6 @@ class Brakeman::CheckEvaluation < Brakeman::BaseCheck
         :warning_type => "Dangerous Eval",
         :warning_code => :code_eval,
         :message => "User input in eval",
-        :code => result[:call],
         :user_input => input,
         :confidence => :high
     end

data/lib/brakeman/checks/check_execute.rb

@@ -21,6 +21,10 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
   SHELL_ESCAPE_MODULE_METHODS = Set[:escape, :join, :shellescape, :shelljoin]
   SHELL_ESCAPE_MIXIN_METHODS = Set[:shellescape, :shelljoin]
 
+  # These are common shells that are known to allow the execution of commands
+  # via a -c flag. See dash_c_shell_command? for more info.
+  KNOWN_SHELL_COMMANDS = Set["sh", "bash", "ksh", "csh", "tcsh", "zsh"]
+
   SHELLWORDS = s(:const, :Shellwords)
 
   #Check models, controllers, and views for command injection.
@@ -42,6 +46,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     end
   end
 
+  private
+
   #Processes results from Tracker#find_call.
   def process_result result
     call = result[:call]
@@ -50,13 +56,41 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
     case call.method
     when :popen
-      unless array? first_arg
-        failure = include_user_input?(args) || dangerous_interp?(args)
+      # Normally, if we're in a `popen` call, we only are worried about shell
+      # injection when the argument is not an array, because array elements
+      # are always escaped by Ruby. However, an exception is when the array
+      # contains two values are something like "bash -c" because then the third
+      # element is effectively the command being run and might be a malicious
+      # executable if it comes (partially or fully) from user input.
+      if !array?(first_arg)
+        failure = include_user_input?(first_arg) ||
+                  dangerous_interp?(first_arg) ||
+                  dangerous_string_building?(first_arg)
+      elsif dash_c_shell_command?(first_arg[1], first_arg[2])
+        failure = include_user_input?(first_arg[3]) ||
+                  dangerous_interp?(first_arg[3]) ||
+                  dangerous_string_building?(first_arg[3])
       end
     when :system, :exec
-      failure = include_user_input?(first_arg) || dangerous_interp?(first_arg)
+      # Normally, if we're in a `system` or `exec` call, we only are worried
+      # about shell injection when there's a single argument, because comma-
+      # separated arguments are always escaped by Ruby. However, an exception is
+      # when the first two arguments are something like "bash -c" because then
+      # the third argument is effectively the command being run and might be
+      # a malicious executable if it comes (partially or fully) from user input.
+      if dash_c_shell_command?(first_arg, call.second_arg)
+        failure = include_user_input?(args[3]) ||
+                  dangerous_interp?(args[3]) ||
+                  dangerous_string_building?(args[3])
+      else
+        failure = include_user_input?(first_arg) ||
+                  dangerous_interp?(first_arg) ||
+                  dangerous_string_building?(first_arg)
+      end
     else
-      failure = include_user_input?(args) || dangerous_interp?(args)
+      failure = include_user_input?(args) ||
+                dangerous_interp?(args) ||
+                dangerous_string_building?(args)
     end
 
     if failure and original? result
@@ -77,6 +111,15 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     end
   end
 
+  # @return [Boolean] true iff the command given by `first_arg`, `second_arg`
+  #   invokes a new shell process via `<shell_command> -c` (like `bash -c`)
+  def dash_c_shell_command?(first_arg, second_arg)
+    string?(first_arg) &&
+    KNOWN_SHELL_COMMANDS.include?(first_arg.value) &&
+    string?(second_arg) &&
+    second_arg.value == "-c"
+  end
+
   def check_open_calls
     tracker.find_call(:targets => [nil, :Kernel], :method => :open).each do |result|
       if match = dangerous_open_arg?(result[:call].first_arg)
@@ -90,6 +133,24 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     end
   end
 
+  def include_user_input? exp
+    if node_type? exp, :arglist, :dstr, :evstr, :dxstr
+      exp.each_sexp do |e|
+        if res = include_user_input?(e)
+          return res
+        end
+      end
+
+      false
+    else
+      if shell_escape? exp
+        false
+      else
+        super exp
+      end
+    end
+  end
+
   def dangerous_open_arg? exp
     if string_interp? exp
       # Check for input at start of string
@@ -143,11 +204,12 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
       next if node_type? e, :lit, :str
       next if SAFE_VALUES.include? e
       next if shell_escape? e
+      next if temp_file_path? e
 
       if node_type? e, :if
         # If we're in a conditional, evaluate the `then` and `else` clauses to
         # see if they're dangerous.
-        if res = dangerous?(e.values[1..-1])
+        if res = dangerous?(e.sexp_body.sexp_body)
           return res
         end
       elsif node_type? e, :or, :evstr, :dstr
@@ -176,6 +238,23 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     false
   end
 
+  #Checks if an expression contains string interpolation.
+  #
+  #Returns Match with :interp type if found.
+  def include_interp? exp
+    @string_interp = false
+    process exp
+    @string_interp
+  end
+
+  def dangerous_string_building? exp
+    if string_building?(exp) && res = dangerous?(exp)
+      return Match.new(:interp, res)
+    end
+
+    false
+  end
+
   def shell_escape? exp
     return false unless call? exp
 

data/lib/brakeman/checks/check_file_access.rb

@@ -32,7 +32,7 @@ class Brakeman::CheckFileAccess < Brakeman::BaseCheck
 
     file_name = call.first_arg
 
-    return if called_on_tempfile?(file_name)
+    return if called_on_tempfile?(file_name) || sanitized?(file_name)
 
     if match = has_immediate_user_input?(file_name)
       confidence = :high
@@ -71,6 +71,12 @@ class Brakeman::CheckFileAccess < Brakeman::BaseCheck
     call?(file_name) && file_name.target == s(:const, :Tempfile)
   end
 
+  def sanitized? file
+    call?(file) &&
+      call?(file.target) &&
+      class_name(file.target.target) == :"ActiveStorage::Filename"
+  end
+
   def temp_file_method? exp
     if call? exp
       return true if exp.call_chain.include? :tempfile

data/lib/brakeman/checks/check_force_ssl.rb

@@ -0,0 +1,27 @@
+class Brakeman::CheckForceSSL < Brakeman::BaseCheck
+  Brakeman::Checks.add_optional self
+
+  @description = "Check that force_ssl setting is enabled in production"
+
+  def run_check
+    return if tracker.config.rails.empty? or tracker.config.rails_version.nil?
+    return if tracker.config.rails_version < "3.1.0"
+
+    force_ssl = tracker.config.rails[:force_ssl]
+
+    if false? force_ssl or force_ssl.nil?
+      line = if sexp? force_ssl
+               force_ssl.line
+             else
+               1
+             end
+
+      warn :warning_type => "Missing Encryption",
+        :warning_code => :force_ssl_disabled,
+        :message => msg("The application does not force use of HTTPS: ", msg_code("config.force_ssl"), " is not enabled"),
+        :confidence => :high,
+        :file => "config/environments/production.rb",
+        :line => line
+    end
+  end
+end