brakeman 2.3.1 → 2.4.0

data/CHANGES

@@ -1,3 +1,18 @@
+# 2.4.0 
+
+ * Detect Rails LTS versions
+ * Reduce false positives for SQL injection in string building
+ * More accurate user input marking for SQL injection warnings
+ * Detect SQL injection in `delete_all`/`destroy_all`
+ * Detect SQL injection raw SQL queries using `connection`
+ * Parse exact versions from Gemfile.lock for all gems
+ * Ignore generators
+ * Update to RubyParser 3.4.0
+ * Fix false positives when SQL methods are not called on AR models (Aaron Bedra)
+ * Add check for uses of OpenSSL::SSL::VERIFY_NONE (Aaron Bedra)
+ * No longer raise exceptions if a class name cannot be determined
+ * Fingerprint attribute warnings individually (Case Taintor)
+
 # 2.3.1
 
  * Fix check for CVE-2013-4491 (i18n XSS) to detect workaround

data/README.md

@@ -171,7 +171,7 @@ The `-c` option can be used to specify a configuration file to use.
 * [New Relic](http://newrelic.com)
 * [Twitter](https://twitter.com/)
 
-[..and more!](http://brakeman.org/brakeman_users)
+[..and more!](http://brakemanscanner.org/brakeman_users)
 
 # License
 

data/lib/brakeman/app_tree.rb

@@ -71,7 +71,7 @@ module Brakeman
     end
 
     def lib_paths
-      @lib_files ||= find_paths("lib")
+      @lib_files ||= find_paths("lib").reject { |path| path.include? "/generators/" }
     end
 
   private

data/lib/brakeman/checks/base_check.rb

@@ -432,13 +432,7 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
     if exp.is_a? Symbol
       @models.include? exp
     elsif sexp? exp
-      klass = nil
-      begin
-        klass = class_name exp
-      rescue StandardError
-      end
-
-      klass and @models.include? klass
+      @models.include? class_name(exp)
     else
       false
     end
@@ -458,10 +452,11 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
   #Returns true if low_version <= RAILS_VERSION <= high_version
   #
   #If the Rails version is unknown, returns false.
-  def version_between? low_version, high_version
-    return false unless tracker.config[:rails_version]
+  def version_between? low_version, high_version, current_version = nil
+    current_version ||= tracker.config[:rails_version]
+    return false unless current_version
 
-    version = tracker.config[:rails_version].split(".").map! { |n| n.to_i }
+    version = current_version.split(".").map! { |n| n.to_i }
     low_version = low_version.split(".").map! { |n| n.to_i }
     high_version = high_version.split(".").map! { |n| n.to_i }
 
@@ -484,6 +479,12 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
     true
   end
 
+  def lts_version? version
+    tracker.config[:gems] and
+    tracker.config[:gems][:'railslts-version'] and
+    version_between? version, "2.3.18.99", tracker.config[:gems][:'railslts-version']
+  end
+
   def gemfile_or_environment
     if @app_tree.exists?("Gemfile")
       "Gemfile"

data/lib/brakeman/checks/check_model_attr_accessible.rb

@@ -29,8 +29,9 @@ class Brakeman::CheckModelAttrAccessible < Brakeman::BaseCheck
               :file => model[:file],
               :warning_type => "Mass Assignment",
               :warning_code => :dangerous_attr_accessible,
-              :message => "Potentially dangerous attribute '#{attribute}' available for mass assignment",
-              :confidence => confidence
+              :message => "Potentially dangerous attribute available for mass assignment",
+              :confidence => confidence,
+              :code => Sexp.new(:lit, attribute)
             break # Prevent from matching single attr multiple times
           end
         end

data/lib/brakeman/checks/check_number_to_currency.rb

@@ -6,6 +6,8 @@ class Brakeman::CheckNumberToCurrency < Brakeman::BaseCheck
   @description = "Checks for number_to_currency XSS vulnerability in certain versions"
 
   def run_check
+    return if lts_version? '2.3.18.6'
+
     if (version_between? "2.0.0", "3.2.15" or version_between? "4.0.0", "4.0.1")
       check_number_to_currency_usage
 

data/lib/brakeman/checks/check_sql.rb

@@ -16,20 +16,32 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
   def run_check
     @rails_version = tracker.config[:rails_version]
 
-    @sql_targets = [:all, :average, :calculate, :count, :count_by_sql, :exists?,
+    @sql_targets = [:all, :average, :calculate, :count, :count_by_sql, :exists?, :delete_all, :destroy_all,
       :find, :find_by_sql, :first, :last, :maximum, :minimum, :pluck, :sum, :update_all]
     @sql_targets.concat [:from, :group, :having, :joins, :lock, :order, :reorder, :select, :where] if tracker.options[:rails3]
 
+    @connection_calls = [:delete, :execute, :insert, :select_all, :select_one,
+      :select_rows, :select_value, :select_values]
+
+    if tracker.options[:rails3]
+      @connection_calls.concat [:exec_delete, :exec_insert, :exec_query, :exec_update]
+    else
+      @connection_calls.concat [:add_limit!, :add_offset_limit!, :add_lock!]
+    end
+
     Brakeman.debug "Finding possible SQL calls on models"
     calls = tracker.find_call :targets => active_record_models.keys,
       :methods => @sql_targets,
       :chained => true
 
     Brakeman.debug "Finding possible SQL calls with no target"
-    calls.concat tracker.find_call(:target => nil, :method => @sql_targets)
+    calls.concat tracker.find_call(:target => nil, :methods => @sql_targets)
 
     Brakeman.debug "Finding possible SQL calls using constantized()"
-    calls.concat tracker.find_call(:method => @sql_targets).select { |result| constantize_call? result }
+    calls.concat tracker.find_call(:methods => @sql_targets).select { |result| constantize_call? result }
+
+    connect_targets = active_record_models.keys + [nil, :"ActiveRecord::Base"]
+    calls.concat tracker.find_call(:targets => connect_targets, :methods => @connection_calls, :chained => true).select { |result| connect_call? result }
 
     Brakeman.debug "Finding calls to named_scope or scope"
     calls.concat find_scope_calls
@@ -134,6 +146,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
   #
   def process_result result
     return if duplicate?(result) or result[:call].original_line
+    return if result[:target].nil? && !active_record_models.include?(result[:location][:class])
+
 
     call = result[:call]
     method = call.method
@@ -141,7 +155,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     dangerous_value = case method
                       when :find
                         check_find_arguments call.second_arg
-                      when :exists?
+                      when :exists?, :delete_all, :destroy_all
                         check_find_arguments call.first_arg
                       when :named_scope, :scope
                         check_scope_arguments call
@@ -171,6 +185,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
                         unsafe_sql? call.first_arg
                       when :update_all
                         check_update_all_arguments call.args
+                      when *@connection_calls
+                        check_by_sql_arguments call.first_arg
                       else
                         Brakeman.debug "Unhandled SQL method: #{method}"
                       end
@@ -340,12 +356,46 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
   #unless safe_value? explicitly returns true.
   def check_string_interp arg
     arg.each do |exp|
-      return exp.value if node_type?(exp, :string_eval, :evstr) and not safe_value?(exp.value)
+      if dangerous = unsafe_string_interp?(exp)
+        return dangerous
+      end
     end
 
     nil
   end
 
+  #Returns value if interpolated value is not something safe
+  def unsafe_string_interp? exp
+    if node_type? exp, :string_eval, :evstr
+      value = exp.value
+    else
+      value = exp
+    end
+
+    if not sexp? value
+      nil
+    elsif call? value and value.method == :to_s
+      unsafe_string_interp? value.target
+    else
+      case value.node_type
+      when :or
+        unsafe_string_interp?(value.lhs) || unsafe_string_interp?(value.rhs)
+      when :string_interp, :dstr
+        if dangerous = check_string_interp(value)
+          return dangerous
+        end
+      else
+        if safe_value? value
+          nil
+        elsif string_building? value
+          check_for_string_building value
+        else
+          value
+        end
+      end
+    end
+  end
+
   #Checks the given expression for unsafe SQL values. If an unsafe value is
   #found, returns that value (may be the given _exp_ or a subexpression).
   #
@@ -441,14 +491,47 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
 
     target = exp.target
     method = exp.method
+    arg = exp.first_arg
+
+    if STRING_METHODS.include? method
+      if string? target
+        check_string_arg arg
+      elsif string? arg
+        check_string_arg target
+      elsif call? target
+        check_for_string_building target
+      elsif node_type? target, :string_interp, :dstr or
+            node_type? arg, :string_interp, :dstr
+
+        check_string_arg target and
+        check_string_arg arg
+      end
+    else
+      nil
+    end
+  end
 
-    if string? target or string? exp.first_arg
-      return exp if STRING_METHODS.include? method
-    elsif STRING_METHODS.include? method and call? target
-      return unsafe_sql? target
+  def check_string_arg exp
+    if safe_value? exp
+      nil
+    elsif string_building? exp
+      check_for_string_building exp
+    elsif node_type? exp, :string_interp, :dstr
+      check_string_interp exp
+    elsif call? exp and exp.method == :to_s
+      check_string_arg exp.target
+    else
+      exp
     end
+  end
 
-    nil
+  def string_building? exp
+    return false unless call? exp and STRING_METHODS.include? exp.method
+
+    node_type? exp.target, :str, :dstr, :string_interp or
+    node_type? exp.first_arg, :str, :dstr, :string_interp or
+    string_building? exp.target or
+    string_building? exp.first_arg
   end
 
   IGNORE_METHODS_IN_SQL = Set[:id, :merge_conditions, :table_name, :to_i, :to_f,
@@ -464,7 +547,13 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     when :str, :lit, :const, :colon2, :nil, :true, :false
       true
     when :call
-      IGNORE_METHODS_IN_SQL.include? exp.method
+      if exp.method == :to_s
+        safe_value? exp.target
+      else
+        IGNORE_METHODS_IN_SQL.include? exp.method or
+        quote_call? exp or
+        exp.method.to_s.end_with? "_id"
+      end
     when :if
       safe_value? exp.then_clause and safe_value? exp.else_clause
     when :block, :rlist
@@ -476,6 +565,16 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     end
   end
 
+  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
+
+  def quote_call? exp
+    if call? exp.target
+      exp.target.method == :connection and QUOTE_METHODS.include? exp.method
+    elsif exp.target.nil?
+      exp.method == :quote_value
+    end
+  end
+
   #Check call for string building
   def check_call exp
     return unless call? exp
@@ -521,6 +620,24 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     call? call.target and call.target.method == :constantize
   end
 
+  SELF_CLASS = s(:call, s(:self), :class)
+
+  def connect_call? result
+    call = result[:call]
+    target = call.target
+
+    if call? target and target.method == :connection
+      target = target.target
+      klass = class_name(target)
+
+      target.nil? or
+      target == SELF_CLASS or
+      node_type? target, :self or
+      klass == :"ActiveRecord::Base" or
+      active_record_models.include? klass
+    end
+  end
+
   def upgrade_version? versions
     versions.each do |low, high, upgrade|
       return upgrade if version_between? low, high
@@ -529,8 +646,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     false
   end
 
-def check_rails_versions_against_cve_issues
-    [
+  def check_rails_versions_against_cve_issues
+    issues = [
       {
         :cve => "CVE-2012-2660",
         :versions => [%w[2.0.0 2.3.14 2.3.17], %w[3.0.0 3.0.12 3.0.13], %w[3.1.0 3.1.4 3.1.5], %w[3.2.0 3.2.3 3.2.4]],
@@ -556,12 +673,18 @@ def check_rails_versions_against_cve_issues
         :versions => [%w[2.0.0 2.3.15 2.3.16], %w[3.0.0 3.0.18 3.0.19], %w[3.1.0 3.1.9 3.1.10], %w[3.2.0 3.2.10 3.2.11]],
         :url => "https://groups.google.com/d/topic/rubyonrails-security/c7jT-EeN9eI/discussion"
       },
-      {
+
+    ]
+
+    unless lts_version? '2.3.18.6'
+     issues << {
         :cve => "CVE-2013-6417",
         :versions => [%w[2.0.0 3.2.15 3.2.16], %w[4.0.0 4.0.1 4.0.2]],
         :url => "https://groups.google.com/d/msg/ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ"
-      },
-    ].each do |cve_issue|
+      }
+    end
+
+    issues.each do |cve_issue|
       cve_warning_for cve_issue[:versions], cve_issue[:cve], cve_issue[:url]
     end
   end

data/lib/brakeman/checks/check_ssl_verify.rb

@@ -0,0 +1,31 @@
+require 'brakeman/checks/base_check'
+
+# Checks if verify_mode= is called with OpenSSL::SSL::VERIFY_NONE
+
+class Brakeman::CheckSSLVerify < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  SSL_VERIFY_NONE = s(:colon2, s(:colon2, s(:const, :OpenSSL), :SSL), :VERIFY_NONE)
+
+  @description = "Checks for OpenSSL::SSL::VERIFY_NONE"
+
+  def run_check
+    check_open_ssl_verify_none
+  end
+
+  def check_open_ssl_verify_none
+    tracker.find_call(:method => :verify_mode=).each {|call| process_result(call)}
+  end
+
+  def process_result(result)
+    return if duplicate?(result)
+    if result[:call].last_arg == SSL_VERIFY_NONE
+      add_result result
+      warn :result => result,
+        :warning_type => "SSL Verification Bypass",
+        :warning_code => :ssl_verification_bypass,
+        :message => "SSL certificate verification was bypassed",
+        :confidence => CONFIDENCE[:high]
+    end
+  end
+end

data/lib/brakeman/checks/check_translate_bug.rb

@@ -7,6 +7,7 @@ class Brakeman::CheckTranslateBug < Brakeman::BaseCheck
   @description = "Report XSS vulnerability in translate helper"
 
   def run_check
+    return if lts_version? '2.3.18.6'
     if (version_between?('2.3.0', '2.3.99') and tracker.config[:escape_html]) or
         version_between?('3.0.0', '3.0.10') or
         version_between?('3.1.0', '3.1.1')

data/lib/brakeman/processors/controller_processor.rb

@@ -23,13 +23,7 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
   #s(:class, NAME, PARENT, s(:scope ...))
   def process_class exp
     name = class_name(exp.class_name)
-
-    begin
-      parent = class_name exp.parent_name
-    rescue StandardError => e
-      Brakeman.debug e
-      parent = nil
-    end
+    parent = class_name(exp.parent_name)
 
     #If inside a real controller, treat any other classes as libraries.
     #But if not inside a controller already, then the class may include

data/lib/brakeman/processors/gem_processor.rb

@@ -5,7 +5,7 @@ class Brakeman::GemProcessor < Brakeman::BaseProcessor
 
   def initialize *args
     super
-
+    @gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
     @tracker.config[:gems] ||= {}
   end
 
@@ -13,9 +13,8 @@ class Brakeman::GemProcessor < Brakeman::BaseProcessor
     process src
 
     if gem_lock
-      get_rails_version gem_lock
-      get_json_version gem_lock
-      get_i18n_version gem_lock
+      process_gem_lock gem_lock
+      @tracker.config[:rails_version] = @tracker.config[:gems][:rails]
     elsif @tracker.config[:gems][:rails] =~ /(\d+.\d+.\d+)/
       @tracker.config[:rails_version] = $1
     end
@@ -35,6 +34,8 @@ class Brakeman::GemProcessor < Brakeman::BaseProcessor
   def process_call exp
     if exp.target == nil and exp.method == :gem
       gem_name = exp.first_arg
+      return exp unless string? gem_name
+
       gem_version = exp.second_arg
 
       if string? gem_version
@@ -46,24 +47,17 @@ class Brakeman::GemProcessor < Brakeman::BaseProcessor
 
     exp
   end
-  
-  # Supports .rc2 but not ~>, >=, or <=
-  def get_version name, gem_lock
-    if gem_lock =~ /\s#{name} \((\w(\.\w+)*)\)(?:\n|\r\n)/ 
-      $1
-    end 
-  end
 
-  def get_rails_version gem_lock
-    @tracker.config[:rails_version] = get_version("rails", gem_lock)
-  end
-
-  def get_json_version gem_lock
-    @tracker.config[:gems][:json] = get_version("json", gem_lock)
-    @tracker.config[:gems][:json_pure] = get_version("json_pure", gem_lock)
+  def process_gem_lock gem_lock
+    gem_lock.each_line do |line|
+      set_gem_version line
+    end
   end
 
-  def get_i18n_version gem_lock
-    @tracker.config[:gems][:i18n] = get_version("i18n", gem_lock)
+  # Supports .rc2 but not ~>, >=, or <=
+  def set_gem_version line
+    if line =~ @gem_name_version
+      @tracker.config[:gems][$1.to_sym] = $2
+    end
   end
 end

data/lib/brakeman/processors/lib/find_all_calls.rb

@@ -122,11 +122,7 @@ class Brakeman::FindAllCalls < Brakeman::BaseProcessor
       when :true, :false
         exp[0]
       when :colon2
-        begin
-          class_name exp
-        rescue StandardError
-          exp
-        end
+        class_name exp
       when :self
         @current_class || @current_module || nil
       else

data/lib/brakeman/processors/lib/processor_helper.rb

@@ -52,6 +52,7 @@ module Brakeman::ProcessorHelper
   end
 
   #Returns a class name as a Symbol.
+  #If class name cannot be determined, returns _exp_.
   def class_name exp
     case exp
     when Sexp
@@ -69,14 +70,14 @@ module Brakeman::ProcessorHelper
       when :self
         @current_class || @current_module || nil
       else
-        raise "Error: Cannot get class name from #{exp}"
+        exp
       end
     when Symbol
       exp
     when nil
       nil
     else
-      raise "Error: Cannot get class name from #{exp}"
+      exp
     end
   end
 end

data/lib/brakeman/processors/lib/render_helper.rb

@@ -161,9 +161,10 @@ module Brakeman::RenderHelper
     if call? sexp
       get_class_target sexp.target
     else
-      begin
-        class_name sexp
-      rescue
+      klass = class_name sexp
+      if klass.is_a? Symbol
+        klass
+      else
         nil
       end
     end

data/lib/brakeman/processors/library_processor.rb

@@ -30,12 +30,7 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
     if @tracker.libs[name]
       @current_class = @tracker.libs[name]
     else
-      begin
-        parent = class_name exp.parent_name
-      rescue StandardError => e
-        Brakeman.debug e
-        parent = nil
-      end
+      parent = class_name exp.parent_name
 
       @current_class = { :name => name,
                     :parent => parent,

data/lib/brakeman/processors/model_processor.rb

@@ -27,12 +27,7 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
       Brakeman.debug "[Notice] Skipping inner class: #{name}"
       ignore
     else
-      begin
-        parent = class_name exp.parent_name
-      rescue StandardError => e
-        Brakeman.debug e
-        parent = nil
-      end
+      parent = class_name exp.parent_name
 
       @model = { :name => name,
         :parent => parent,

data/lib/brakeman/processors/template_alias_processor.rb

@@ -85,13 +85,8 @@ class Brakeman::TemplateAliasProcessor < Brakeman::AliasProcessor
 
       if exp.method == :all or exp.method.to_s[0,4] == "find"
         models = Set.new @tracker.models.keys
-
-        begin
-          name = class_name target
-          return target if models.include?(name)
-        rescue StandardError
-        end
-
+        name = class_name target
+        return target if models.include?(name)
       end
 
       return get_model_target(target)

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "2.3.1"
+  Version = "2.4.0"
 end

data/lib/brakeman/warning_codes.rb

@@ -71,6 +71,7 @@ module Brakeman::WarningCodes
     :CVE_2013_6416_call => 68,
     :CVE_2013_6417 => 69,
     :mass_assign_permit! => 70,
+    :ssl_verification_bypass => 71
   }
 
   def self.code name

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: brakeman
 version: !ruby/object:Gem::Version 
-  hash: 1
+  hash: 31
   prerelease: 
   segments: 
   - 2
-  - 3
-  - 1
-  version: 2.3.1
+  - 4
+  - 0
+  version: 2.4.0
 platform: ruby
 authors: 
 - Justin Collins
@@ -36,7 +36,7 @@ cert_chain:
   bdw=
   -----END CERTIFICATE-----
 
-date: 2013-12-13 00:00:00 Z
+date: 2014-02-05 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: ruby_parser
@@ -46,12 +46,12 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 11
+        hash: 23
         segments: 
         - 3
-        - 2
-        - 2
-        version: 3.2.2
+        - 4
+        - 0
+        version: 3.4.0
   type: :runtime
   version_requirements: *id001
 - !ruby/object:Gem::Dependency 
@@ -265,6 +265,7 @@ files:
 - lib/brakeman/checks/check_single_quotes.rb
 - lib/brakeman/checks/check_skip_before_filter.rb
 - lib/brakeman/checks/check_sql.rb
+- lib/brakeman/checks/check_ssl_verify.rb
 - lib/brakeman/checks/check_strip_tags.rb
 - lib/brakeman/checks/check_symbol_dos.rb
 - lib/brakeman/checks/check_translate_bug.rb
@@ -369,7 +370,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.8.25
+rubygems_version: 1.8.15
 signing_key: 
 specification_version: 3
 summary: Security vulnerability scanner for Ruby on Rails.