zuora_connect_ui 0.9.0 → 0.9.1

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_mime_type_dos.rb

@@ -0,0 +1,39 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckMimeTypeDoS < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for mime type denial of service (CVE-2016-0751)"
+
+  def run_check
+    fix_version = case
+               when version_between?("3.0.0", "3.2.22")
+                 "3.2.22.1"
+               when version_between?("4.0.0", "4.1.14")
+                 "4.1.14.1"
+               when version_between?("4.2.0", "4.2.5")
+                 "4.2.5.1"
+               else
+                 return
+               end
+
+    return if has_workaround?
+
+    message = msg(msg_version(rails_version), " is vulnerable to denial of service via mime type caching ", msg_cve("CVE-2016-0751"), ". Upgrade to ", msg_version(fix_version))
+
+    warn :warning_type => "Denial of Service",
+      :warning_code => :CVE_2016_0751,
+      :message => message,
+      :confidence => :medium,
+      :gem_info => gemfile_or_environment,
+      :link_path => "https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ"
+  end
+
+  def has_workaround?
+    tracker.find_call(target: :Mime, method: :const_set).any? do |match|
+      arg = match[:call].first_arg
+
+      symbol? arg and arg.value == :LOOKUP
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_model_attr_accessible.rb

@@ -0,0 +1,55 @@
+require 'brakeman/checks/base_check'
+
+# Author: Paul Deardorff (themetric)
+# Checks models to see if important foreign keys
+# or attributes are exposed as attr_accessible when
+# they probably shouldn't be.
+
+class Brakeman::CheckModelAttrAccessible < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Reports models which have dangerous attributes defined under the attr_accessible whitelist."
+
+  SUSP_ATTRS = [
+    [:admin, :high], # Very dangerous unless some Rails authorization used
+    [:role, :medium],
+    [:banned, :medium],
+    [:account_id, :high],
+    [/\S*_id(s?)\z/, :weak] # All other foreign keys have weak/low confidence
+  ]
+
+  def run_check
+    check_models do |name, model|
+      model.attr_accessible.each do |attribute|
+        next if role_limited? model, attribute
+
+        SUSP_ATTRS.each do |susp_attr, confidence|
+          if susp_attr.is_a?(Regexp) and susp_attr =~ attribute.to_s or susp_attr == attribute
+            warn :model => model,
+              :file => model.file,
+              :warning_type => "Mass Assignment",
+              :warning_code => :dangerous_attr_accessible,
+              :message => "Potentially dangerous attribute available for mass assignment",
+              :confidence => confidence,
+              :code => Sexp.new(:lit, attribute)
+            break # Prevent from matching single attr multiple times
+          end
+        end
+      end
+    end
+  end
+
+  def role_limited? model, attribute
+    role_accessible = model.role_accessible
+    return if role_accessible.nil?
+    role_accessible.include? attribute
+  end
+
+  def check_models
+    tracker.models.each do |name, model|
+      if !model.attr_accessible.nil?
+        yield name, model
+      end
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_model_attributes.rb

@@ -0,0 +1,81 @@
+require 'brakeman/checks/base_check'
+
+#Check if mass assignment is used with models
+#which inherit from ActiveRecord::Base.
+class Brakeman::CheckModelAttributes < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Reports models which do not use attr_restricted and warns on models that use attr_protected"
+
+  def run_check
+    return if mass_assign_disabled?
+
+    #Roll warnings into one warning for all models
+    if tracker.options[:collapse_mass_assignment]
+      Brakeman.notify "[Notice] The `collapse_mass_assignment` option has been removed."
+    end
+
+    check_models do |name, model|
+      if model.attr_protected.nil?
+        warn :model => model,
+          :file => model.file,
+          :line => model.top_line,
+          :warning_type => "Attribute Restriction",
+          :warning_code => :no_attr_accessible,
+          :message => msg("Mass assignment is not restricted using ", msg_code("attr_accessible")),
+          :confidence => :high
+      elsif not tracker.options[:ignore_attr_protected]
+        message, confidence, link = check_for_attr_protected_bypass
+
+        if link
+          warning_code = :CVE_2013_0276
+        else
+          warning_code = :attr_protected_used
+        end
+
+        warn :model => model,
+          :file => model.file,
+          :line => model.attr_protected.first.line,
+          :warning_type => "Attribute Restriction",
+          :warning_code => warning_code,
+          :message => message,
+          :confidence => confidence
+      end
+    end
+  end
+
+  def check_models
+    tracker.models.each do |name, model|
+      if model.unprotected_model?
+        yield name, model
+      end
+    end
+  end
+
+  def check_for_attr_protected_bypass
+    upgrade_version = case
+                      when version_between?("2.0.0", "2.3.16")
+                        "2.3.17"
+                      when version_between?("3.0.0", "3.0.99")
+                        "3.2.11"
+                      when version_between?("3.1.0", "3.1.10")
+                        "3.1.11"
+                      when version_between?("3.2.0", "3.2.11")
+                        "3.2.12"
+                      else
+                        nil
+                      end
+
+    if upgrade_version
+      message = msg(msg_code("attr_protected"), " is bypassable in ", msg_version(rails_version), ". Use ", msg_code("attr_accessible"), " or upgrade to ", msg_version(upgrade_version))
+      confidence = :high
+      link = "https://groups.google.com/d/topic/rubyonrails-security/AFBKNY7VSH8/discussion"
+    else
+      message = msg(msg_code("attr_accessible"), " is recommended over ", msg_code("attr_protected"))
+      confidence = :medium
+      link = nil
+    end
+
+    return message, confidence, link
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_model_serialize.rb

@@ -0,0 +1,67 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckModelSerialize < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Report uses of serialize in versions vulnerable to CVE-2013-0277"
+
+  def run_check
+    @upgrade_version = case
+                      when version_between?("2.0.0", "2.3.16")
+                        "2.3.17"
+                      when version_between?("3.0.0", "3.0.99")
+                        "3.2.11"
+                      else
+                        nil
+                      end
+
+    return unless @upgrade_version
+
+    tracker.models.each do |_name, model|
+      check_for_serialize model
+    end
+  end
+
+  #High confidence warning on serialized, unprotected attributes.
+  #Medium confidence warning for serialized, protected attributes.
+  def check_for_serialize model
+    if serialized_attrs = model.options[:serialize]
+      attrs = Set.new
+
+      serialized_attrs.each do |arglist|
+        arglist.each do |arg|
+          attrs << arg if symbol? arg
+        end
+      end
+
+      if unsafe_attrs = model.attr_accessible
+        attrs.delete_if { |attr| not unsafe_attrs.include? attr.value }
+      elsif protected_attrs = model.attr_protected
+        safe_attrs = Set.new
+
+        protected_attrs.each do |arglist|
+          arglist.each do |arg|
+            safe_attrs << arg if symbol? arg
+          end
+        end
+
+        attrs.delete_if { |attr| safe_attrs.include? attr }
+      end
+
+      if attrs.empty?
+        confidence = :medium
+      else
+        confidence = :high
+      end
+
+      warn :model => model,
+        :warning_type => "Remote Code Execution",
+        :warning_code => :CVE_2013_0277,
+        :message => msg("Serialized attributes are vulnerable in ", msg_version(rails_version), ", upgrade to ", msg_version(@upgrade_version), " or patch"),
+        :confidence => confidence,
+        :link => "https://groups.google.com/d/topic/rubyonrails-security/KtmwSbEpzrU/discussion",
+        :file => model.file,
+        :line => model.top_line
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_nested_attributes.rb

@@ -0,0 +1,38 @@
+require 'brakeman/checks/base_check'
+
+#Check for vulnerability in nested attributes in Rails 2.3.9 and 3.0.0
+#http://groups.google.com/group/rubyonrails-security/browse_thread/thread/f9f913d328dafe0c
+class Brakeman::CheckNestedAttributes < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for nested attributes vulnerability in Rails 2.3.9 and 3.0.0"
+
+  def run_check
+    version = rails_version
+
+    if (version == "2.3.9" or version == "3.0.0") and uses_nested_attributes?
+      message = msg("Vulnerability in nested attributes ", msg_cve("CVE-2010-3933"), ". Upgrade to ")
+
+      if version == "2.3.9"
+        message << msg_version("2.3.10")
+      else
+        message << msg_version("3.0.1")
+      end
+
+      warn :warning_type => "Nested Attributes",
+        :warning_code => :CVE_2010_3933,
+        :message => message,
+        :confidence => :high,
+        :gem_info => gemfile_or_environment,
+        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/-fkT0yja_gw/discussion"
+    end
+  end
+
+  def uses_nested_attributes?
+    active_record_models.each do |_name, model|
+      return true if model.options[:accepts_nested_attributes_for]
+    end
+
+    false
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_nested_attributes_bypass.rb

@@ -0,0 +1,58 @@
+require 'brakeman/checks/base_check'
+
+#https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ
+class Brakeman::CheckNestedAttributesBypass < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for nested attributes vulnerability (CVE-2015-7577)"
+
+  def run_check
+    if version_between? "3.1.0", "3.2.22" or
+       version_between? "4.0.0", "4.1.14" or
+       version_between? "4.2.0", "4.2.5"
+
+      unless workaround?
+        check_nested_attributes
+      end
+    end
+  end
+
+  def check_nested_attributes
+    active_record_models.each do |name, model|
+      if opts = model.options[:accepts_nested_attributes_for]
+        opts.each do |args|
+          if args.any? { |a| allow_destroy? a } and args.any? { |a| reject_if? a }
+            warn_about_nested_attributes model, args
+          end
+        end
+      end
+    end
+  end
+
+  def warn_about_nested_attributes model, args
+    message = msg(msg_version(rails_version), " does not call ", msg_code(":reject_if"), " option when ", msg_code(":allow_destroy"), " is ", msg_code("false"), " ", msg_cve("CVE-2015-7577"))
+
+    warn :model => model,
+      :warning_type => "Nested Attributes",
+      :warning_code => :CVE_2015_7577,
+      :message => message,
+      :file => model.file,
+      :line => args.line,
+      :confidence => :medium,
+      :link_path => "https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ"
+  end
+
+  def allow_destroy? arg
+    hash? arg and
+      false? hash_access(arg, :allow_destroy)
+  end
+
+  def reject_if? arg
+    hash? arg and
+      hash_access(arg, :reject_if)
+  end
+
+  def workaround?
+    tracker.find_call(method: :will_be_destroyed?).any?
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_number_to_currency.rb

@@ -0,0 +1,74 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckNumberToCurrency < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for number helpers XSS vulnerabilities in certain versions"
+
+  def initialize(*)
+    super
+    @found_any = false
+  end
+
+  def run_check
+    if version_between? "2.0.0", "2.3.18" or
+      version_between? "3.0.0", "3.2.16" or
+      version_between? "4.0.0", "4.0.2"
+
+      return if lts_version? "2.3.18.8"
+
+      check_number_helper_usage
+      generic_warning unless @found_any
+    end
+  end
+
+  def generic_warning
+    message = msg(msg_version(rails_version), " has a vulnerability in number helpers ", msg_cve("CVE-2014-0081"), ". Upgrade to ")
+
+    if version_between? "2.3.0", "3.2.16"
+      message << msg_version("3.2.17")
+    else
+      message << msg_version("4.0.3")
+    end
+
+    warn :warning_type => "Cross-Site Scripting",
+      :warning_code => :CVE_2014_0081,
+      :message => message,
+      :confidence => :medium,
+      :gem_info => gemfile_or_environment,
+      :link_path => "https://groups.google.com/d/msg/ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ"
+  end
+
+  def check_number_helper_usage
+    number_methods = [:number_to_currency, :number_to_percentage, :number_to_human]
+    tracker.find_call(:target => false, :methods => number_methods).each do |result|
+      arg = result[:call].second_arg
+      next unless arg
+
+      if not check_helper_option(result, arg) and hash? arg
+        hash_iterate(arg) do |_key, value|
+          break if check_helper_option(result, value)
+        end
+      end
+    end
+  end
+
+  def check_helper_option result, exp
+    if match = (has_immediate_user_input? exp or has_immediate_model? exp)
+      warn_on_number_helper result, match
+      @found_any = true
+    else
+      false
+    end
+  end
+
+  def warn_on_number_helper result, match
+    warn :result => result,
+      :warning_type => "Cross-Site Scripting",
+      :warning_code => :CVE_2014_0081_call,
+      :message => msg("Format options in ", msg_code(result[:call].method), " are not safe in ", msg_version(rails_version)),
+      :confidence => :high,
+      :link_path => "https://groups.google.com/d/msg/ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ",
+      :user_input => match
+  end
+end

data/vendor/ruby/2.6.0/gems/brakeman-4.7.0/lib/brakeman/checks/check_permit_attributes.rb

@@ -0,0 +1,43 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckPermitAttributes < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Warn on potentially dangerous attributes whitelisted via permit"
+
+  SUSPICIOUS_KEYS = {
+    admin: :high,
+    account_id: :high,
+    role: :medium,
+    banned: :medium,
+  }
+
+  def run_check
+    tracker.find_call(:method => :permit).each do |result|
+      check_permit result
+    end
+  end
+
+  def check_permit result
+    return unless original? result
+
+    call = result[:call]
+
+    call.each_arg do |arg|
+      if symbol? arg
+        if SUSPICIOUS_KEYS.key? arg.value
+          warn_on_permit_key result, arg
+        end
+      end
+    end
+  end
+
+  def warn_on_permit_key result, key, confidence = nil
+    warn :result => result,
+      :warning_type => "Mass Assignment",
+      :warning_code => :dangerous_permit_key,
+      :message => "Potentially dangerous key allowed for mass assignment",
+      :confidence => (confidence || SUSPICIOUS_KEYS[key.value]),
+      :user_input => key
+  end
+end