codeforamerica/oakland_answers — pull request #36 by adelevie (2014-05-30 18:42:13+00:00)
Title: Feature/brakeman

Uses the `brakeman` gem to build security warnings into the dev workflow. Contains:

- Specs that check for "high confidence" security warnings. Tests fail if there are any high confidence security warnings.
- Rake tasks that make it easy to debug and learn about the generated warnings.

Sample usage (abridged):
```sh
➜ answers git:(feature/brakeman) rspec spec/security/brakeman_spec.rb
Failures:

1) Answers returns zero high confidence model warnings
Failure/Error: expect(checks.model_warnings.length).to(eq(0), "Run `rake 'security:models[0]'` to debug.")
Run `rake 'security:models[0]'` to debug.
# ./spec/security/brakeman_spec.rb:19:in `block (2 levels) in '

2) Answers returns zero high confidence template warnings
Failure/Error: expect(checks.template_warnings.length).to(eq(0), "Run `rake 'security:template[0]'` to debug.")
Run `rake 'security:template[0]'` to debug.
# ./spec/security/brakeman_spec.rb:23:in `block (2 levels) in '

3) Answers returns zero high confidence other warnings
Failure/Error: expect(checks.other_warnings.length).to(eq(0), "Run `rake 'security:other[0]'` to debug.")
NoMethodError:
undefined method `other_warnings' for #
# ./spec/security/brakeman_spec.rb:27:in `block (2 levels) in '

4 examples, 3 failures
➜ answers git:(feature/brakeman) rake 'security:models[0]'

---------------------------
Warning 1/1 (fingerprint: bc98a5bffaa56ca4e0a4acce14a63d74db49eb35235d120fdeb4da56b0a1a51e)

(High) Attribute Restriction - Mass assignment is not restricted using
attr_accessible in /Users/alandelevie/uscis/answers/app/models/contact.rb

Visit http://brakemanscanner.org/docs/warning_types/attribute_restriction/ to learn more.

Type 'next' to view the next warning.
Type 'open' to open app/models/contact.rb in an editor.
Type 'learn' to open http://brakemanscanner.org/docs/warning_types/attribute_restriction/ in a browser.
Type 'issue' to export this warning as a GitHub issue.

```

The rake tasks are pretty simple and let you check for errors of any minimum confidence level:

```sh
# default to lowest confidence level, 2
rake security:models
rake security:controllers
rake security:templates
rake security:templates
# checks only for highest confidence level, 0 (lowest is highest...)
rake security:models[0]
rake security:controllers[0]
rake security:templates[0]
rake security:templates[0]
# etc
```