Class: Brakeman::CheckJSONEntityEscape

Inherits:
BaseCheck
  • Object
show all
Defined in:
lib/brakeman/checks/check_json_entity_escape.rb

Instance Method Summary collapse

Instance Method Details

#check_config_setting ⇒ Object 



13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/brakeman/checks/check_json_entity_escape.rb', line 13

def check_config_setting
  if false? tracker.config.rails.dig(:active_support, :escape_html_entities_in_json)
    warn :warning_type => "Cross-Site Scripting",
      :warning_code => :json_html_escape_config,
      :message => msg("HTML entities in JSON are not escaped by default"),
      :confidence => :medium,
      :file => "config/environments/production.rb",
      :line => 1,
      :cwe_id => [79]
  end
end

#check_manual_disable ⇒ Object 



25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/brakeman/checks/check_json_entity_escape.rb', line 25

def check_manual_disable
  tracker.find_call(targets: [:ActiveSupport, :'ActiveSupport::JSON::Encoding'], method: :escape_html_entities_in_json=).each do |result|
    setting = result[:call].first_arg

    if false? setting
      warn :result => result,
        :warning_type => "Cross-Site Scripting",
        :warning_code => :json_html_escape_module,
        :message => msg("HTML entities in JSON are not escaped by default"),
        :confidence => :medium,
        :file => "config/environments/production.rb",
        :cwe_id => [79]
    end
  end
end

#run_check ⇒ Object 



8
9
10
11
 
# File 'lib/brakeman/checks/check_json_entity_escape.rb', line 8

def run_check
  check_config_setting
  check_manual_disable
end