presidentbeef/brakeman — pull request #59 by presidentbeef (2012-03-21 04:29:37+00:00)
Title: Fix handling of Erubis templates with xss escaping 

This was broken when Brakeman's Erubis output was changed to match what rails_xss does. Unfortunately, that change broke Brakemans Erubis template handling such that NO output was detected.

Unfortunately, this is kind of a major issue, as it would have hidden many vulnerabilities.

It is possible (but unlikely) that Rails 3 apps were affect, as the Erubis output for Rails 3 is slightly different, and was already being handled properly.

This fix addresses processing the "new" Erubis output and adds tests for the rails_xss plugin.