Class: Brakeman::CheckValidationRegex

Inherits:
BaseCheck
  • Object
show all
Defined in:
lib/brakeman/checks/check_validation_regex.rb

Overview

Reports any calls to validates_format_of which do not use \A and \z as anchors in the given regular expression.

For example:

#Allows anything after new line validates_format_of :user_name, :with => /^\w+$/

Constant Summary collapse

WITH = 
Sexp.new(:lit, :with)
FORMAT = 
Sexp.new(:lit, :format)
SECURE_REGEXP_PATTERN =

Match secure regexp without extended option

%r{
  \A
  \\A
  .*
  \\[zZ]
  \z
}x
EXTENDED_SECURE_REGEXP_PATTERN =

Match secure of regexp with extended option

%r{
  \A
  \s*
  \\A
  .*
  \\[zZ]
  \s*
  \z
}mx

Instance Method Summary collapse

Instance Method Details

#check_regex(value, validator) ⇒ Object

Issue warning if the regular expression does not use \A and \z



84
85
86
87
88
89
90
91
92
93
94
95
96
97
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 84

def check_regex value, validator
  return unless regexp? value

  regex = value.value
  unless secure_regex?(regex)
    warn :model => @current_model,
    :warning_type => "Format Validation",
    :warning_code => :validation_regex,
    :message => msg("Insufficient validation for ", msg_code(get_name validator), " using ", msg_code(regex.inspect), ". Use ", msg_code("\\A"), " and ", msg_code("\\z"), " as anchors"),
    :line => value.line,
    :confidence => :high,
    :cwe_id => [777]
  end
end

#get_name(validator) ⇒ Object

Get the name of the attribute being validated.



100
101
102
103
104
105
106
107
108
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 100

def get_name validator
  name = validator[1]

  if sexp? name
    name.value
  else
    name
  end
end

#process_validates(validator) ⇒ Object

Check validates ..., :format => ...



47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 47

def process_validates validator
  hash_arg = validator.last
  return unless hash? hash_arg

  value = hash_access(hash_arg, FORMAT)

  if hash? value
    value = hash_access(value, WITH)
  end

  if value
    check_regex value, validator
  end
end

#process_validates_format_of(validator) ⇒ Object

Check validates_format_of



40
41
42
43
44
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 40

def process_validates_format_of validator
  if value = hash_access(validator.last, WITH)
    check_regex value, validator
  end
end

#run_check ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 18

def run_check
  active_record_models.each do |name, model|
    @current_model = model
    format_validations = model.options[:validates_format_of]

    if format_validations
      format_validations.each do |v|
        process_validates_format_of v
      end
    end

    validates = model.options[:validates]

    if validates
      validates.each do |v|
        process_validates v
      end
    end
  end
end