presidentbeef/brakeman — pull request #262 by presidentbeef (2013-02-13 23:21:02+00:00)
Title: Checks for CVE-2013-02{69, 76, 77}

Add checks for [CVE-2013-0269](https://groups.google.com/d/topic/rubyonrails-security/4_YvCpLzL58/discussion), [CVE-2013-0276](https://groups.google.com/d/topic/rubyonrails-security/AFBKNY7VSH8/discussion), and [CVE-2013-0277](https://groups.google.com/d/topic/rubyonrails-security/KtmwSbEpzrU/discussion).

Upgrades confidence on `attr_protected` to medium and changes warning message if affected by CVE.

Checks for models using `serialize` and warns if affected by CVE. Confidence level is medium if the attributes are protected from mass assignment, high otherwise.

JSON check looks for `json` or `json_pure` gem versions in `Gemfile.lock`. Warning level is based on gem version and whether or not `JSON.parse` is called. Does not check argument to `JSON.parse`, because I don't want to spend too much CPU on a situation where people should really just upgrade anyway.