oreoshake/brakeman — pull request #1 by oreoshake (2012-02-14 02:26:58+00:00)
Title: Link to href warning

NOTE: Totally a hacky WIP. While this vuln applies to all versions of rails the link_to check only runs on rails 2..2.9.9. Also, the logic about declaring which methods are to ignore during processing is a complete hack (even uses a swap variable!). Just looking to see if I'm headed down the right path. Also, the severities aren't quite right because I just reused the code for the first link_to param! It should probably be its own check or somehow logically separated from the check on the first param, thoughts?

Feature:
Warn when using unsafe hrefs. This is a very specific case that as of now produces a ton of noise. This came out of an xss vuln where the value was escaped but still vulnerable.

link_to 'asdf', h(@scary)

where

@scary = 'javascript:alert(1)'

or

@scary = 'data: # http://palpapers.plynt.com/issues/2010Oct/bypass-xss-filters/

This branch accomplishes slightly intelligent warnings by adding a new command line option to declare methods that make a string URL safe (unless there is already a standard one out there). e.g.:

$ brakeman . --url-safe-methods ensure_valid_protocol!

link_to 'asdf', ensure_valid_protocol!(@scary, :javascript)