zuora_connect_ui 0.7.1 → 0.8.0

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_file_access.rb

@@ -0,0 +1,87 @@
+require 'brakeman/checks/base_check'
+require 'brakeman/processors/lib/processor_helper'
+
+#Checks for user input in methods which open or manipulate files
+class Brakeman::CheckFileAccess < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Finds possible file access using user input"
+
+  def run_check
+    Brakeman.debug "Finding possible file access"
+    methods = tracker.find_call :targets => [:Dir, :File, :IO, :Kernel, :"Net::FTP", :"Net::HTTP", :PStore, :Pathname, :Shell], :methods => [:[], :chdir, :chroot, :delete, :entries, :foreach, :glob, :install, :lchmod, :lchown, :link, :load, :load_file, :makedirs, :move, :new, :open, :read, :readlines, :rename, :rmdir, :safe_unlink, :symlink, :syscopy, :sysopen, :truncate, :unlink]
+
+    methods.concat tracker.find_call :target => :YAML, :methods => [:load_file, :parse_file]
+    methods.concat tracker.find_call :target => nil, :method => [:open]
+
+    Brakeman.debug "Finding calls to load()"
+    methods.concat tracker.find_call :target => false, :method => :load
+
+    Brakeman.debug "Finding calls using FileUtils"
+    methods.concat tracker.find_call :target => :FileUtils
+
+    Brakeman.debug "Processing found calls"
+    methods.each do |call|
+      process_result call
+    end
+  end
+
+  def process_result result
+    return unless original? result
+    call = result[:call]
+
+    file_name = call.first_arg
+
+    return if called_on_tempfile?(file_name) || sanitized?(file_name)
+
+    if match = has_immediate_user_input?(file_name)
+      confidence = :high
+    elsif match = has_immediate_model?(file_name)
+      match = Match.new(:model, match)
+      confidence = :medium
+    elsif tracker.options[:check_arguments] and
+      match = include_user_input?(file_name)
+
+      #Check for string building in file name
+      if call?(file_name) and (file_name.method == :+ or file_name.method == :<<)
+        confidence = :high
+      else
+        confidence = :weak
+      end
+    end
+
+    if match and not temp_file_method? match.match
+
+      message = msg(msg_input(match), " used in file name")
+
+      warn :result => result,
+        :warning_type => "File Access",
+        :warning_code => :file_access,
+        :message => message,
+        :confidence => confidence,
+        :code => call,
+        :user_input => match
+    end
+  end
+
+  # When using Tempfile, there is no risk of unauthorized file access, since
+  # Tempfile adds a unique string onto the end of every provided filename, and
+  # ensures that the filename does not already exist in the system.
+  def called_on_tempfile? file_name
+    call?(file_name) && file_name.target == s(:const, :Tempfile)
+  end
+
+  def sanitized? file
+    call?(file) &&
+      call?(file.target) &&
+      class_name(file.target.target) == :"ActiveStorage::Filename"
+  end
+
+  def temp_file_method? exp
+    if call? exp
+      return true if exp.call_chain.include? :tempfile
+
+      params? exp.target and exp.method == :path
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_file_disclosure.rb

@@ -0,0 +1,35 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckFileDisclosure < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = 'Checks for versions with file existence disclosure vulnerability'
+
+  def run_check
+    fix_version = case
+      when version_between?('2.0.0', '2.3.18')
+        '3.2.21'
+      when version_between?('3.0.0', '3.2.20')
+        '3.2.21'
+      when version_between?('4.0.0', '4.0.11')
+        '4.0.12'
+      when version_between?('4.1.0', '4.1.7')
+        '4.1.8'
+      else
+        nil
+      end
+
+    if fix_version and serves_static_assets?
+      warn :warning_type => "File Access",
+        :warning_code => :CVE_2014_7829,
+        :message => msg(msg_version(rails_version), " has a file existence disclosure vulnerability. Upgrade to ", msg_version(fix_version), " or disable serving static assets"),
+        :confidence => :high,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/msg/rubyonrails-security/23fiuwb1NBA/MQVM1-5GkPMJ"
+    end
+  end
+
+  def serves_static_assets?
+    true? tracker.config.rails[:serve_static_assets]
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_filter_skipping.rb

@@ -0,0 +1,31 @@
+require 'brakeman/checks/base_check'
+
+#Check for filter skipping vulnerability
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6
+class Brakeman::CheckFilterSkipping < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions 3.0-3.0.9 which had a vulnerability in filters"
+
+  def run_check
+    if version_between?('3.0.0', '3.0.9') and uses_arbitrary_actions?
+
+      warn :warning_type => "Default Routes",
+        :warning_code => :CVE_2011_2929,
+        :message => msg("Rails versions before 3.0.10 have a vulnerability which allows filters to be bypassed", msg_cve("CVE-2011-2929")),
+        :confidence => :high,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/NCCsca7TEtY/discussion"
+    end
+  end
+
+  def uses_arbitrary_actions?
+    tracker.routes.each do |_name, actions|
+      if actions.include? :allow_all_actions
+        return true
+      end
+    end
+
+    false
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_force_ssl.rb

@@ -0,0 +1,27 @@
+class Brakeman::CheckForceSSL < Brakeman::BaseCheck
+  Brakeman::Checks.add_optional self
+
+  @description = "Check that force_ssl setting is enabled in production"
+
+  def run_check
+    return if tracker.config.rails.empty? or tracker.config.rails_version.nil?
+    return if tracker.config.rails_version < "3.1.0"
+
+    force_ssl = tracker.config.rails[:force_ssl]
+
+    if false? force_ssl or force_ssl.nil?
+      line = if sexp? force_ssl
+               force_ssl.line
+             else
+               1
+             end
+
+      warn :warning_type => "Missing Encryption",
+        :warning_code => :force_ssl_disabled,
+        :message => msg("The application does not force use of HTTPS: ", msg_code("config.force_ssl"), " is not enabled"),
+        :confidence => :high,
+        :file => "config/environments/production.rb",
+        :line => line
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_forgery_setting.rb

@@ -0,0 +1,81 @@
+require 'brakeman/checks/base_check'
+
+#Checks that +protect_from_forgery+ is set in the ApplicationController.
+#
+#Also warns for CSRF weakness in certain versions of Rails:
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2d95a3cc23e03665
+class Brakeman::CheckForgerySetting < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Verifies that protect_from_forgery is enabled in direct subclasses of ActionController::Base"
+
+  def run_check
+    return if tracker.config.default_protect_from_forgery?
+
+    tracker.controllers
+    .select { |_, controller| controller.parent == :"ActionController::Base" }
+    .each do |name, controller|
+      if controller and not controller.protect_from_forgery?
+        csrf_warning :controller => name,
+          :warning_code => :csrf_protection_missing,
+          :message => msg(msg_code("protect_from_forgery"), " should be called in ", msg_code(name)),
+          :file => controller.file,
+          :line => controller.top_line
+      elsif version_between? "4.0.0", "100.0.0" and forgery_opts = controller.options[:protect_from_forgery]
+        unless forgery_opts.is_a?(Array) and sexp?(forgery_opts.first) and
+          access_arg = hash_access(forgery_opts.first.first_arg, :with) and symbol? access_arg and
+          access_arg.value == :exception
+
+          args = {
+            :controller => name,
+            :warning_type => "Cross-Site Request Forgery",
+            :warning_code => :csrf_not_protected_by_raising_exception,
+            :message => msg(msg_code("protect_from_forgery"), " should be configured with ", msg_code("with: :exception")),
+            :confidence => :medium,
+            :file => controller.file
+          }
+
+          args.merge!(:code => forgery_opts.first) if forgery_opts.is_a?(Array)
+
+          csrf_warning args
+        end
+
+      end
+
+      if controller.options[:protect_from_forgery]
+        check_cve_2011_0447
+      end
+    end
+  end
+
+  def csrf_warning opts
+    opts = {
+      :controller => :ApplicationController,
+      :warning_type => "Cross-Site Request Forgery",
+      :confidence => :high
+    }.merge opts
+
+    warn opts
+  end
+
+  def check_cve_2011_0447
+    @warned_cve_2011_0447 ||= false
+    return if @warned_cve_2011_0447
+
+    if version_between? "2.1.0", "2.3.10"
+      new_version = "2.3.11"
+    elsif version_between? "3.0.0", "3.0.3"
+      new_version = "3.0.4"
+    else
+      return
+    end
+
+    @warned_cve_2011_0447 = true # only warn once
+
+    csrf_warning :warning_code => :CVE_2011_0447,
+      :message => msg("CSRF protection is flawed in unpatched versions of ", msg_version(rails_version), " ", msg_cve("CVE-2011-0447"), ". Upgrade to ", msg_version(new_version), " or apply patches as needed"),
+      :gem_info => gemfile_or_environment,
+      :file => nil,
+      :link_path => "https://groups.google.com/d/topic/rubyonrails-security/LZWjzCPgNmU/discussion"
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_header_dos.rb

@@ -0,0 +1,31 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckHeaderDoS < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for header DoS (CVE-2013-6414)"
+
+  def run_check
+    if (version_between? "3.0.0", "3.2.15" or version_between? "4.0.0", "4.0.1") and not has_workaround?
+      message = msg(msg_version(rails_version), " has a denial of service vulnerability ", msg_cve("CVE-2013-6414"), ". Upgrade to ")
+
+      if version_between? "3.0.0", "3.2.15"
+        message << msg_version("3.2.16")
+      else
+        message << msg_version("4.0.2")
+      end
+
+      warn :warning_type => "Denial of Service",
+        :warning_code => :CVE_2013_6414,
+        :message => message,
+        :confidence => :medium,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/msg/ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ"
+    end
+  end
+
+  def has_workaround?
+    tracker.find_call(target: :ActiveSupport, method: :on_load).any? and
+      tracker.find_call(target: :"ActionView::LookupContext::DetailsKey", method: :class_eval).any?
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_i18n_xss.rb

@@ -0,0 +1,48 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckI18nXSS < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for i18n XSS (CVE-2013-4491)"
+
+  def run_check
+    if (version_between? "3.0.6", "3.2.15" or version_between? "4.0.0", "4.0.1") and not has_workaround?
+      i18n_gem = tracker.config.gem_version :i18n
+      message = msg(msg_version(rails_version), " has an XSS vulnerability in ", msg_version(i18n_gem, "i18n"), " ", msg_cve("CVE-2013-4491"), ". Upgrade to ")
+
+      if version_between? "3.0.6", "3.1.99" and version_before i18n_gem, "0.5.1"
+        message << msg_version("3.2.16 or i18n 0.5.1")
+      elsif version_between? "3.2.0", "4.0.1" and version_before i18n_gem, "0.6.6"
+        message << msg_version("4.0.2 or i18n 0.6.6")
+      else
+        return
+      end
+
+      warn :warning_type => "Cross-Site Scripting",
+        :warning_code => :CVE_2013_4491,
+        :message => message,
+        :confidence => :medium,
+        :gem_info => gemfile_or_environment(:i18n),
+        :link_path => "https://groups.google.com/d/msg/ruby-security-ann/pLrh6DUw998/bLFEyIO4k_EJ"
+    end
+  end
+
+  def version_before gem_version, target
+    return true unless gem_version
+    gem_version.split('.').map(&:to_i).zip(target.split('.').map(&:to_i)).each do |gv, t|
+      if gv < t
+        return true
+      elsif gv > t
+        return false
+      end
+    end
+
+    false
+  end
+
+  def has_workaround?
+    tracker.find_call(target: :I18n, method: :const_defined?, chained: true).any? do |match|
+      match[:call].first_arg == s(:lit, :MissingTranslation)
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_jruby_xml.rb

@@ -0,0 +1,36 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckJRubyXML < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions with JRuby XML parsing backend"
+
+  def run_check
+    return unless RUBY_PLATFORM == "java"
+
+    fix_version = case
+      when version_between?('3.0.0', '3.0.99')
+        '3.2.13'
+      when version_between?('3.1.0', '3.1.11')
+        '3.1.12'
+      when version_between?('3.2.0', '3.2.12')
+        '3.2.13'
+      else
+        return
+      end
+
+    #Check for workaround
+    tracker.find_call(target: :"ActiveSupport::XmlMini", method: :backend=, chained: true).each do |result|
+      arg = result[:call].first_arg
+
+      return if string? arg and arg.value == "REXML"
+    end
+
+    warn :warning_type => "File Access",
+      :warning_code => :CVE_2013_1856,
+      :message => msg(msg_version(rails_version), " with JRuby has a vulnerability in XML parser. Upgrade to ", msg_version(fix_version), " or patch"),
+      :confidence => :high,
+      :gem_info => gemfile_or_environment,
+      :link => "https://groups.google.com/d/msg/rubyonrails-security/KZwsQbYsOiI/5kUV7dSCJGwJ"
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_json_encoding.rb

@@ -0,0 +1,47 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckJSONEncoding < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for missing JSON encoding (CVE-2015-3226)"
+
+  def run_check
+    if (version_between? "4.1.0", "4.1.10" or version_between? "4.2.0", "4.2.1") and not has_workaround?
+      message = msg(msg_version(rails_version), " does not encode JSON keys ", msg_cve("CVE-2015-3226"), ". Upgrade to ")
+
+      if version_between? "4.1.0", "4.1.10"
+        message << msg_version("4.1.11")
+      else
+        message << msg_version("4.2.2")
+      end
+
+      if tracker.find_call(:methods => [:to_json, :encode]).any?
+        confidence = :high
+      else
+        confidence = :medium
+      end
+
+      warn :warning_type => "Cross-Site Scripting",
+        :warning_code => :CVE_2015_3226,
+        :message => message,
+        :confidence => confidence,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/msg/rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ"
+    end
+  end
+
+  def has_workaround?
+    workaround = s(:module, :ActiveSupport,
+                   s(:module, :JSON,
+                     s(:module, :Encoding,
+                       s(:call, nil, :private),
+                       s(:class, :EscapedString, nil,
+                         s(:defn, :to_s,
+                           s(:args),
+                           s(:self))))))
+
+    tracker.initializers.any? do |_name, initializer|
+      initializer == workaround
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.6.1/lib/brakeman/checks/check_json_parsing.rb

@@ -0,0 +1,109 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckJSONParsing < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for JSON parsing vulnerabilities CVE-2013-0333 and CVE-2013-0269"
+
+  def initialize *args
+    super
+    @uses_json_parse = nil
+  end
+
+  def run_check
+    check_cve_2013_0333
+    check_cve_2013_0269
+  end
+
+  def check_cve_2013_0333
+    return unless version_between? "0.0.0", "2.3.15" or version_between? "3.0.0", "3.0.19"
+
+    unless uses_yajl? or uses_gem_backend?
+      new_version = if version_between? "0.0.0", "2.3.14"
+                      "2.3.16"
+                    elsif version_between? "3.0.0", "3.0.19"
+                      "3.0.20"
+                    end
+
+      message = msg(msg_version(rails_version), " has a serious JSON parsing vulnerability. Upgrade to ", msg_version(new_version), " or patch")
+      gem_info = gemfile_or_environment
+
+      warn :warning_type => "Remote Code Execution",
+        :warning_code => :CVE_2013_0333,
+        :message => message,
+        :confidence => :high,
+        :gem_info => gem_info,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/1h2DR63ViGo/discussion"
+    end
+  end
+
+  #Check if `yajl` is included in Gemfile
+  def uses_yajl?
+    tracker.config.has_gem? :yajl
+  end
+
+  #Check for `ActiveSupport::JSON.backend = "JSONGem"`
+  def uses_gem_backend?
+    matches = tracker.find_call(target: :'ActiveSupport::JSON', method: :backend=, chained: true)
+
+    unless matches.empty?
+      json_gem = s(:str, "JSONGem")
+
+      matches.each do |result|
+        if result[:call].first_arg == json_gem
+          return true
+        end
+      end
+    end
+
+    false
+  end
+
+  def check_cve_2013_0269
+    [:json, :json_pure].each do |name|
+      gem_hash = tracker.config.get_gem name
+      check_json_version name, gem_hash[:version] if gem_hash and gem_hash[:version]
+    end
+  end
+
+  def check_json_version name, version
+    return if version >= "1.7.7" or
+              (version >= "1.6.8" and version < "1.7.0") or
+              (version >= "1.5.5" and version < "1.6.0")
+
+    warning_type = "Denial of Service"
+    confidence = :medium
+    gem_name = "#{name} gem"
+    message = msg(msg_version(version, gem_name), " has a symbol creation vulnerablity. Upgrade to ")
+
+    if version >= "1.7.0"
+      confidence = :high
+      warning_type = "Remote Code Execution"
+      message = msg(msg_version(version, "json gem"), " has a remote code execution vulnerability. Upgrade to ", msg_version("1.7.7", "json gem"))
+    elsif version >= "1.6.0"
+      message << msg_version("1.6.8", gem_name)
+    elsif version >= "1.5.0"
+      message << msg_version("1.5.5", gem_name)
+    else
+      confidence = :weak
+      message << msg_version("1.5.5", gem_name)
+    end
+
+    if confidence == :medium and uses_json_parse?
+      confidence = :high
+    end
+
+    warn :warning_type => warning_type,
+      :warning_code => :CVE_2013_0269,
+      :message => message,
+      :confidence => confidence,
+      :gem_info => gemfile_or_environment(name),
+      :link => "https://groups.google.com/d/topic/rubyonrails-security/4_YvCpLzL58/discussion"
+  end
+
+  def uses_json_parse?
+    return @uses_json_parse unless @uses_json_parse.nil?
+
+    not tracker.find_call(:target => :JSON, :method => :parse).empty?
+  end
+end