brakeman 5.4.0 → 5.4.1

data/lib/brakeman/checks/base_check.rb

@@ -76,7 +76,7 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
         @has_user_input = Match.new(:params, exp)
       elsif cookies? target
         @has_user_input = Match.new(:cookies, exp)
-      elsif request_env? target
+      elsif request_headers? target
         @has_user_input = Match.new(:request, exp)
       elsif sexp? target and model_name? target[1] #TODO: Can this be target.target?
         @has_user_input = Match.new(:model, exp)
@@ -313,7 +313,7 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
         return Match.new(:params, exp)
       elsif cookies? exp
         return Match.new(:cookies, exp)
-      elsif request_env? exp
+      elsif request_headers? exp
         return Match.new(:request, exp)
       else
         has_immediate_user_input? exp.target
@@ -467,7 +467,6 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
     version_between? version, "2.3.18.99", tracker.config.gem_version(:'railslts-version')
   end
 
-
   def version_between? low_version, high_version, current_version = nil
     tracker.config.version_between? low_version, high_version, current_version
   end

data/lib/brakeman/checks/check_redirect.rb

@@ -11,8 +11,6 @@ class Brakeman::CheckRedirect < Brakeman::BaseCheck
   @description = "Looks for calls to redirect_to with user input as arguments"
 
   def run_check
-    Brakeman.debug "Finding calls to redirect_to()"
-
     @model_find_calls = Set[:all, :create, :create!, :find, :find_by_sql, :first, :first!, :last, :last!, :new, :sole]
 
     if tracker.options[:rails3]
@@ -27,7 +25,9 @@ class Brakeman::CheckRedirect < Brakeman::BaseCheck
       @model_find_calls << :find_sole_by
     end
 
-    @tracker.find_call(:target => false, :method => :redirect_to).each do |res|
+    methods = [:redirect_to, :redirect_back, :redirect_back_or_to]
+
+    @tracker.find_call(:target => false, :methods => methods).each do |res|
       process_result res
     end
   end
@@ -36,18 +36,28 @@ class Brakeman::CheckRedirect < Brakeman::BaseCheck
     return unless original? result
 
     call = result[:call]
-    method = call.method
-
     opt = call.first_arg
 
-    if method == :redirect_to and
+    # Location is specified with `fallback_location:`
+    # otherwise the arguments do not contain a location and
+    # the call can be ignored
+    if call.method == :redirect_back
+      if hash? opt and location = hash_access(opt, :fallback_location)
+        opt = location
+      else
+        return
+      end
+    end
+
+    if not protected_by_raise?(call) and
         not only_path?(call) and
         not explicit_host?(opt) and
         not slice_call?(opt) and
         not safe_permit?(opt) and
-        res = include_user_input?(call)
+        not disallow_other_host?(call) and
+        res = include_user_input?(opt)
 
-      if res.type == :immediate
+      if res.type == :immediate and not allow_other_host?(call)
         confidence = :high
       else
         confidence = :weak
@@ -68,42 +78,42 @@ class Brakeman::CheckRedirect < Brakeman::BaseCheck
   #is being output directly. This is necessary because of tracker.options[:check_arguments]
   #which can be used to enable/disable reporting output of method calls which use
   #user input as arguments.
-  def include_user_input? call, immediate = :immediate
+  def include_user_input? opt, immediate = :immediate
     Brakeman.debug "Checking if call includes user input"
 
-    arg = call.first_arg
-
     # if the first argument is an array, rails assumes you are building a
     # polymorphic route, which will never jump off-host
-    return false if array? arg
+    return false if array? opt
 
     if tracker.options[:ignore_redirect_to_model]
-      if model_instance?(arg) or decorated_model?(arg)
+      if model_instance?(opt) or decorated_model?(opt)
         return false
       end
     end
 
-    if res = has_immediate_model?(arg)
-      unless call? arg and arg.method.to_s =~ /_path/
+    if res = has_immediate_model?(opt)
+      unless call? opt and opt.method.to_s =~ /_path/
         return Match.new(immediate, res)
       end
-    elsif call? arg
-      if request_value? arg
-        return Match.new(immediate, arg)
-      elsif request_value? arg.target
-        return Match.new(immediate, arg.target)
-      elsif arg.method == :url_for and include_user_input? arg
-        return Match.new(immediate, arg)
+    elsif call? opt
+      if request_value? opt
+        return Match.new(immediate, opt)
+      elsif opt.method == :url_for and include_user_input? opt.first_arg
+        return Match.new(immediate, opt)
         #Ignore helpers like some_model_url?
-      elsif arg.method.to_s =~ /_(url|path)\z/
+      elsif opt.method.to_s =~ /_(url|path)\z/
+        return false
+      elsif opt.method == :url_from
         return false
       end
-    elsif request_value? arg
-      return Match.new(immediate, arg)
+    elsif request_value? opt
+      return Match.new(immediate, opt)
+    elsif node_type? opt, :or
+      return (include_user_input?(opt.lhs) or include_user_input?(opt.rhs))
     end
 
-    if tracker.options[:check_arguments] and call? arg
-      include_user_input? arg, false  #I'm doubting if this is really necessary...
+    if tracker.options[:check_arguments] and call? opt
+      include_user_input? opt.first_arg, false  #I'm doubting if this is really necessary...
     else
       false
     end
@@ -208,7 +218,7 @@ class Brakeman::CheckRedirect < Brakeman::BaseCheck
   def friendly_model? exp
     call? exp and model_name? exp.target and exp.method == :friendly
   end
-  
+
   #Returns true if exp is (probably) a decorated model instance
   #using the Draper gem
   def decorated_model? exp
@@ -249,7 +259,7 @@ class Brakeman::CheckRedirect < Brakeman::BaseCheck
     if call? exp and params? exp.target and exp.method == :permit
       exp.each_arg do |opt|
         if symbol? opt and DANGEROUS_KEYS.include? opt.value
-          return false 
+          return false
         end
       end
 
@@ -258,4 +268,25 @@ class Brakeman::CheckRedirect < Brakeman::BaseCheck
 
     false
   end
+
+  def protected_by_raise? call
+    raise_on_redirects? and
+      not allow_other_host? call
+  end
+
+  def raise_on_redirects?
+    @raise_on_redirects ||= true?(tracker.config.rails.dig(:action_controller, :raise_on_open_redirects))
+  end
+
+  def allow_other_host? call
+    opt = call.last_arg
+
+    hash? opt and true? hash_access(opt, :allow_other_host)
+  end
+
+  def disallow_other_host? call
+    opt = call.last_arg
+
+    hash? opt and false? hash_access(opt, :allow_other_host)
+  end
 end

data/lib/brakeman/checks/check_unscoped_find.rb

@@ -23,6 +23,14 @@ class Brakeman::CheckUnscopedFind < Brakeman::BaseCheck
     calls.each do |call|
       process_result call
     end
+
+    tracker.find_call(:method => :find_by, :targets => associated_model_names).each do |result|
+      arg = result[:call].first_arg
+
+      if hash? arg and hash_access(arg, :id)
+        process_result result
+      end
+    end
   end
 
   def process_result result

data/lib/brakeman/checks/eol_check.rb

@@ -34,7 +34,7 @@ class Brakeman::EOLCheck < Brakeman::BaseCheck
       warning_code: :"pending_eol_#{library}",
       message: msg("Support for ", msg_version(version, library.capitalize), " ends on #{eol_date}"),
       confidence: confidence,
-      gem_info: gemfile_or_environment,
+      gem_info: gemfile_or_environment(library),
       :cwe_id => [1104]
   end
 
@@ -43,7 +43,7 @@ class Brakeman::EOLCheck < Brakeman::BaseCheck
       warning_code: :"eol_#{library}",
       message: msg("Support for ", msg_version(version, library.capitalize), " ended on #{eol_date}"),
       confidence: :high,
-      gem_info: gemfile_or_environment,
+      gem_info: gemfile_or_environment(library),
       :cwe_id => [1104]
   end
 end