presidentbeef/brakeman — pull request #493 by jjarmoc (2014-05-16 18:43:05+00:00)
Title: Improve route checking for HTTP verb routes.

This pull adds checking for verb routes that allow access to all controllers.

Previously, this only worked on match routes like:
```match "/:controller/:action"```
It will now also warn on routes that specify the verb like:
```get "/:controller/:action"```
for example;
```
+SECURITY WARNINGS+

+------------+-------+--------+-----------------+----------------------------------------------------------------->>
| Confidence | Class | Method | Warning Type | Message >>
+------------+-------+--------+-----------------+----------------------------------------------------------------->>
| High | | | Default Routes | All public methods in controllers are available as actions in ro>>
+------------+-------+--------+-----------------+----------------------------------------------------------------->>
```

Furthermore, it will alert on non-default verb routes that allow loose access with a specific controller/verb combo.
```get "/example/:action", controller: 'example' ```
will yield a controller warning
```
Controller Warnings:

+------------+------------+----------------+---------------------------------------------------------------------->>
| Confidence | Controller | Warning Type | Message >>
+------------+------------+----------------+---------------------------------------------------------------------->>
| Medium | example | Default Routes | Any public method in action can be used as an action for get requests>>
+------------+------------+----------------+---------------------------------------------------------------------->>
```
while
```post "/example/:action", controller: 'example'```
gives
```
Controller Warnings:

+------------+------------+----------------+---------------------------------------------------------------------->>
| Confidence | Controller | Warning Type | Message >>
+------------+------------+----------------+---------------------------------------------------------------------->>
| Medium | example | Default Routes | Any public method in example can be used as an action for post reques>>
+------------+------------+----------------+---------------------------------------------------------------------->>
```

I found that this behavior was incomplete when looking at Brakeman's checks related to [CVE-2014-0130](http://weblog.rubyonrails.org/2014/5/6/Rails_3_2_18_4_0_5_and_4_1_1_have_been_released/)