presidentbeef/brakeman — pull request #290 by presidentbeef (2013-03-18 23:49:34+00:00)
Title: Monday CVEs

Checks for [CVE-2013-1854](https://groups.google.com/d/msg/rubyonrails-security/jgJ4cjjS8FE/BGbHRxnDRTIJ), [CVE-2013-1855](https://groups.google.com/d/msg/rubyonrails-security/4_QHo4BqnN8/_RrdfKk12I4J), [CVE-2013-1856](https://groups.google.com/d/msg/rubyonrails-security/KZwsQbYsOiI/5kUV7dSCJGwJ), and [CVE-2013-1857](https://groups.google.com/d/msg/rubyonrails-security/zAAU7vGTPvI/1vZDWXqBuXgJ).

Does not check for manual patches in initializers.

Check for CVE-2013-1856 assumes if you run Brakeman with JRuby, then you run the app with JRuby.

Also, noticed that Brakeman does not treat `sanitize` or `sanitize_css` as safe anyway. Should it?