brakeman 0.9.0 → 0.9.1

data/lib/checks/check_translate_bug.rb

@@ -0,0 +1,40 @@
+require 'checks/base_check'
+require 'processors/lib/find_call'
+
+#Check for vulnerability in translate() helper that allows cross-site scripting
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5
+class CheckTranslateBug < BaseCheck
+  Checks.add self
+
+  def run_check
+    if (version_between?('2.3.0', '2.3.99') and OPTIONS[:escape_html]) or 
+        version_between?('3.0.0', '3.0.10') or
+        version_between?('3.1.0', '3.1.1')
+
+      if uses_translate?
+        confidence = CONFIDENCE[:high]
+      else
+        confidence = CONFIDENCE[:med]
+      end
+
+      version = tracker.config[:rails_version]
+
+      if version =~ /^3\.1/
+        message = "Versions before 3.1.2 have a vulnerability in the translate helper."
+      elsif version =~ /^3\.0/
+        message = "Versions before 3.0.11 have a vulnerability in translate helper."
+      else
+        message = "Rails 2.3.x using the rails_xss plugin have a vulnerability in translate helper."
+      end
+
+      warn :warning_type => "Cross Site Scripting",
+        :message => message,
+        :confidence => confidence,
+        :file => gemfile_or_environment
+    end
+  end
+
+  def uses_translate?
+    not tracker.find_call([], :translate).empty?
+  end
+end

data/lib/version.rb

@@ -1 +1 @@
-Version = "0.9.0"
+Version = "0.9.1"

metadata

@@ -1,120 +1,90 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: brakeman
-version: !ruby/object:Gem::Version 
-  prerelease: false
-  segments: 
-  - 0
-  - 9
-  - 0
-  version: 0.9.0
+version: !ruby/object:Gem::Version
+  version: 0.9.1
+  prerelease: 
 platform: ruby
-authors: 
+authors:
 - Justin Collins
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2011-11-16 00:00:00 -08:00
-default_executable: 
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 2011-11-18 00:00:00.000000000Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: activesupport
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
+  requirement: &74757330 !ruby/object:Gem::Requirement
     none: false
-    requirements: 
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        segments: 
-        - 2
-        - 2
-        version: "2.2"
+      - !ruby/object:Gem::Version
+        version: '2.2'
   type: :runtime
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: ruby2ruby
   prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
+  version_requirements: *74757330
+- !ruby/object:Gem::Dependency
+  name: ruby2ruby
+  requirement: &74757080 !ruby/object:Gem::Requirement
     none: false
-    requirements: 
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        segments: 
-        - 1
-        - 2
-        - 4
+      - !ruby/object:Gem::Version
         version: 1.2.4
   type: :runtime
-  version_requirements: *id002
-- !ruby/object:Gem::Dependency 
-  name: ruby_parser
   prerelease: false
-  requirement: &id003 !ruby/object:Gem::Requirement 
+  version_requirements: *74757080
+- !ruby/object:Gem::Dependency
+  name: ruby_parser
+  requirement: &74756850 !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        segments: 
-        - 2
-        - 3
-        - 0
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 2.3.0
   type: :runtime
-  version_requirements: *id003
-- !ruby/object:Gem::Dependency 
-  name: ruport
   prerelease: false
-  requirement: &id004 !ruby/object:Gem::Requirement 
+  version_requirements: *74756850
+- !ruby/object:Gem::Dependency
+  name: ruport
+  requirement: &74756620 !ruby/object:Gem::Requirement
     none: false
-    requirements: 
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        segments: 
-        - 1
-        - 6
-        - 3
+      - !ruby/object:Gem::Version
         version: 1.6.3
   type: :runtime
-  version_requirements: *id004
-- !ruby/object:Gem::Dependency 
-  name: erubis
   prerelease: false
-  requirement: &id005 !ruby/object:Gem::Requirement 
+  version_requirements: *74756620
+- !ruby/object:Gem::Dependency
+  name: erubis
+  requirement: &74756390 !ruby/object:Gem::Requirement
     none: false
-    requirements: 
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        segments: 
-        - 2
-        - 6
-        - 5
+      - !ruby/object:Gem::Version
         version: 2.6.5
   type: :runtime
-  version_requirements: *id005
-- !ruby/object:Gem::Dependency 
-  name: haml
   prerelease: false
-  requirement: &id006 !ruby/object:Gem::Requirement 
+  version_requirements: *74756390
+- !ruby/object:Gem::Dependency
+  name: haml
+  requirement: &74756160 !ruby/object:Gem::Requirement
     none: false
-    requirements: 
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        segments: 
-        - 3
-        - 0
-        - 12
+      - !ruby/object:Gem::Version
         version: 3.0.12
   type: :runtime
-  version_requirements: *id006
-description: Brakeman detects security vulnerabilities in Ruby on Rails applications via static analysis.
+  prerelease: false
+  version_requirements: *74756160
+description: Brakeman detects security vulnerabilities in Ruby on Rails applications
+  via static analysis.
 email: 
-executables: 
+executables:
 - brakeman
 extensions: []
-
 extra_rdoc_files: []
-
-files: 
+files:
 - bin/brakeman
 - WARNING_TYPES
 - FEATURES
@@ -146,6 +116,7 @@ files:
 - lib/processors/erubis_template_processor.rb
 - lib/processors/template_processor.rb
 - lib/checks/check_send_file.rb
+- lib/checks/check_translate_bug.rb
 - lib/checks/check_session_settings.rb
 - lib/checks/check_nested_attributes.rb
 - lib/checks/check_strip_tags.rb
@@ -180,37 +151,28 @@ files:
 - lib/checks.rb
 - lib/processor.rb
 - lib/format/style.css
-has_rdoc: true
 homepage: http://brakemanscanner.org
 licenses: []
-
 post_install_message: 
 rdoc_options: []
-
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
+required_ruby_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      segments: 
-      - 0
-      version: "0"
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
 requirements: []
-
 rubyforge_project: 
-rubygems_version: 1.3.7
+rubygems_version: 1.8.6
 signing_key: 
 specification_version: 3
 summary: Security vulnerability scanner for Ruby on Rails.
 test_files: []
-