brakeman.ignore 35 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936
  1. {
  2. "ignored_warnings": [
  3. {
  4. "warning_type": "Remote Code Execution",
  5. "warning_code": 24,
  6. "fingerprint": "0fcd117fd53301f531142fc075ee8d30219c1239affce9322f9939ac0572ba3b",
  7. "check_name": "UnsafeReflection",
  8. "message": "Unsafe reflection method `constantize` called on model attribute",
  9. "file": "app/models/ticket/number.rb",
  10. "line": 45,
  11. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  12. "code": "Setting.get(\"ticket_number\").constantize",
  13. "render_path": null,
  14. "location": {
  15. "type": "method",
  16. "class": "Ticket::Number",
  17. "method": "Ticket::Number.adapter"
  18. },
  19. "user_input": "Setting.get(\"ticket_number\")",
  20. "confidence": "Medium",
  21. "cwe_id": [
  22. 470
  23. ],
  24. "note": "Setting.get(\"ticket_number\") returns defined ticket number backend class names"
  25. },
  26. {
  27. "warning_type": "Denial of Service",
  28. "warning_code": 76,
  29. "fingerprint": "15d4ddbc3ac2ae0a0fe27218a42a1920fe2c1868ae5f504422c4af8ffe893beb",
  30. "check_name": "RegexDoS",
  31. "message": "Model attribute used in regular expression",
  32. "file": "app/models/channel/filter/monitoring_base.rb",
  33. "line": 92,
  34. "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
  35. "code": "/#{(Setting.get(\"#{integration_name}_recovery_match\") or \"(OK|UP)\")}/i",
  36. "render_path": null,
  37. "location": {
  38. "type": "method",
  39. "class": "Channel::Filter::MonitoringBase",
  40. "method": "Channel::Filter::MonitoringBase.run"
  41. },
  42. "user_input": "Setting.get(\"#{integration_name}_recovery_match\")",
  43. "confidence": "Medium",
  44. "cwe_id": [
  45. 20,
  46. 185
  47. ],
  48. "note": "Admin configured RegExp"
  49. },
  50. {
  51. "warning_type": "Denial of Service",
  52. "warning_code": 76,
  53. "fingerprint": "15d4ddbc3ac2ae0a0fe27218a42a1920fe2c1868ae5f504422c4af8ffe893beb",
  54. "check_name": "RegexDoS",
  55. "message": "Model attribute used in regular expression",
  56. "file": "app/models/channel/filter/monitoring_base.rb",
  57. "line": 121,
  58. "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
  59. "code": "/#{(Setting.get(\"#{integration_name}_recovery_match\") or \"(OK|UP)\")}/i",
  60. "render_path": null,
  61. "location": {
  62. "type": "method",
  63. "class": "Channel::Filter::MonitoringBase",
  64. "method": "Channel::Filter::MonitoringBase.run"
  65. },
  66. "user_input": "Setting.get(\"#{integration_name}_recovery_match\")",
  67. "confidence": "Medium",
  68. "cwe_id": [
  69. 20,
  70. 185
  71. ],
  72. "note": "Admin configured RegExp"
  73. },
  74. {
  75. "warning_type": "Remote Code Execution",
  76. "warning_code": 24,
  77. "fingerprint": "176994cedb6a57bc52f7a98b0fd93caad211f8f3b48fd010a5db164b37992e1f",
  78. "check_name": "UnsafeReflection",
  79. "message": "Unsafe reflection method `constantize` called on model attribute",
  80. "file": "app/models/avatar.rb",
  81. "line": 427,
  82. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  83. "code": "ObjectLookup.by_id(object_id).constantize",
  84. "render_path": null,
  85. "location": {
  86. "type": "method",
  87. "class": "Avatar",
  88. "method": "Avatar._add_init_avatar"
  89. },
  90. "user_input": "ObjectLookup.by_id(object_id)",
  91. "confidence": "Medium",
  92. "cwe_id": [
  93. 470
  94. ],
  95. "note": "ObjectLookup.by_id works as designed"
  96. },
  97. {
  98. "warning_type": "SQL Injection",
  99. "warning_code": 0,
  100. "fingerprint": "2251415d8897d2c79a5c952dd0fe57dadd5ca96defd67ccefa27fc7b5ab06148",
  101. "check_name": "SQL",
  102. "message": "Possible SQL injection",
  103. "file": "app/services/service/translation/search/collector/model.rb",
  104. "line": 28,
  105. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  106. "code": "Translation.not_customized.where(\"locale = :locale AND (source #{like_operator} :query OR target #{like_operator} :query OR target_initial #{like_operator} :query)\", :locale => locale, :query => like_query)",
  107. "render_path": null,
  108. "location": {
  109. "type": "method",
  110. "class": "Service::Translation::Search::Collector::Model",
  111. "method": "search_by_query"
  112. },
  113. "user_input": "like_operator",
  114. "confidence": "Medium",
  115. "cwe_id": [
  116. 89
  117. ],
  118. "note": ""
  119. },
  120. {
  121. "warning_type": "Redirect",
  122. "warning_code": 18,
  123. "fingerprint": "2ebd9f5e35ae11122d5561fdbbef7432eeef6b34d7c61249365be7dc34cbfb82",
  124. "check_name": "Redirect",
  125. "message": "Possible unprotected redirect",
  126. "file": "app/controllers/external_credentials_controller.rb",
  127. "line": 38,
  128. "link": "https://brakemanscanner.org/docs/warning_types/redirect/",
  129. "code": "redirect_to(ExternalCredential.request_account_to_link(params[:provider].downcase, params)[:authorize_url], :allow_other_host => true)",
  130. "render_path": null,
  131. "location": {
  132. "type": "method",
  133. "class": "ExternalCredentialsController",
  134. "method": "link_account"
  135. },
  136. "user_input": "ExternalCredential.request_account_to_link(params[:provider].downcase, params)[:authorize_url]",
  137. "confidence": "Weak",
  138. "cwe_id": [
  139. 601
  140. ],
  141. "note": ""
  142. },
  143. {
  144. "warning_type": "SQL Injection",
  145. "warning_code": 0,
  146. "fingerprint": "34d5d0f52def9a9fbcb045f4f16b0117cb22d59d8ab6184f3bddd057d81d7cd1",
  147. "check_name": "SQL",
  148. "message": "Possible SQL injection",
  149. "file": "app/models/channel/filter/internal_article_check.rb",
  150. "line": 31,
  151. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  152. "code": "ticket.articles.where(\"ticket_articles.to #{Rails.application.config.db_like} ?\", \"%#{parse_email(mail[:from_email])}%\")",
  153. "render_path": null,
  154. "location": {
  155. "type": "method",
  156. "class": "Channel::Filter::InternalArticleCheck",
  157. "method": "Channel::Filter::InternalArticleCheck.last_outgoing_mail_is_internal?"
  158. },
  159. "user_input": "Rails.application.config.db_like",
  160. "confidence": "Weak",
  161. "cwe_id": [
  162. 89
  163. ],
  164. "note": "The db_like config setting is safe to use in an SQL string."
  165. },
  166. {
  167. "warning_type": "Denial of Service",
  168. "warning_code": 76,
  169. "fingerprint": "381781925211cac1f2592a6537f4abc050f98b081e5554b7d3d70a9454157e35",
  170. "check_name": "RegexDoS",
  171. "message": "Model attribute used in regular expression",
  172. "file": "app/models/ticket/number/increment.rb",
  173. "line": 47,
  174. "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
  175. "code": "/(?<=\\W|^)#{Regexp.quote(Setting.get(\"ticket_hook\"))}\\s{0,2}(#{(\"\" or Setting.get(\"system_id\").to_s)}\\d{2,48})\\b/i",
  176. "render_path": null,
  177. "location": {
  178. "type": "method",
  179. "class": "Ticket::Number::Increment",
  180. "method": "Ticket::Number::Increment.check"
  181. },
  182. "user_input": "Setting.get(\"system_id\").to_s",
  183. "confidence": "Medium",
  184. "cwe_id": [
  185. 20,
  186. 185
  187. ],
  188. "note": "Admin configured RegExp"
  189. },
  190. {
  191. "warning_type": "Remote Code Execution",
  192. "warning_code": 24,
  193. "fingerprint": "3c69accdb245b8493b7455698a454c70c2246c14f46f24e28e1c5329cee9ffac",
  194. "check_name": "UnsafeReflection",
  195. "message": "Unsafe reflection method `constantize` called on model attribute",
  196. "file": "config/initializers/store_provider_check.rb",
  197. "line": 11,
  198. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  199. "code": "\"Store::Provider::#{Setting.get(\"storage_provider\")}\".constantize",
  200. "render_path": null,
  201. "location": null,
  202. "user_input": "Setting.get(\"storage_provider\")",
  203. "confidence": "Medium",
  204. "cwe_id": [
  205. 470
  206. ],
  207. "note": ""
  208. },
  209. {
  210. "warning_type": "SQL Injection",
  211. "warning_code": 0,
  212. "fingerprint": "49c4e60297a41654cfb9d8ac6b8232e0d3a68ee7ebd53f48b7c6d0ec6f830318",
  213. "check_name": "SQL",
  214. "message": "Possible SQL injection",
  215. "file": "app/services/service/translation/search/collector/macro.rb",
  216. "line": 11,
  217. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  218. "code": "::Macro.where(\"name #{like_operator} :query\", :query => like_query)",
  219. "render_path": null,
  220. "location": {
  221. "type": "method",
  222. "class": "Service::Translation::Search::Collector::Macro",
  223. "method": "search_sources"
  224. },
  225. "user_input": "like_operator",
  226. "confidence": "Weak",
  227. "cwe_id": [
  228. 89
  229. ],
  230. "note": ""
  231. },
  232. {
  233. "warning_type": "Denial of Service",
  234. "warning_code": 76,
  235. "fingerprint": "4ea1b96c11cdde309b0f31defd8af9dc39dd7605a7bb18b13b122469a74a5a70",
  236. "check_name": "RegexDoS",
  237. "message": "Model attribute used in regular expression",
  238. "file": "app/models/channel/filter/monitoring_base.rb",
  239. "line": 115,
  240. "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
  241. "code": "/#{(Setting.get(\"#{integration_name}_ignore_match\") or \"\")}/i",
  242. "render_path": null,
  243. "location": {
  244. "type": "method",
  245. "class": "Channel::Filter::MonitoringBase",
  246. "method": "Channel::Filter::MonitoringBase.run"
  247. },
  248. "user_input": "Setting.get(\"#{integration_name}_ignore_match\")",
  249. "confidence": "Medium",
  250. "cwe_id": [
  251. 20,
  252. 185
  253. ],
  254. "note": "Admin configured RegExp"
  255. },
  256. {
  257. "warning_type": "Remote Code Execution",
  258. "warning_code": 24,
  259. "fingerprint": "55248822583e32826f88a68e27568416fe1f101d83b02791c10296d2393b83a5",
  260. "check_name": "UnsafeReflection",
  261. "message": "Unsafe reflection method `constantize` called on model attribute",
  262. "file": "app/models/store/file.rb",
  263. "line": 32,
  264. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  265. "code": "\"Store::Provider::#{(Setting.get(\"storage_provider\") or \"DB\")}\".constantize",
  266. "render_path": null,
  267. "location": {
  268. "type": "method",
  269. "class": "File",
  270. "method": "s(:self).add"
  271. },
  272. "user_input": "Setting.get(\"storage_provider\")",
  273. "confidence": "Medium",
  274. "cwe_id": [
  275. 470
  276. ],
  277. "note": "Setting.get('storage_provider') returns defined Store::Provider backend class names"
  278. },
  279. {
  280. "warning_type": "Remote Code Execution",
  281. "warning_code": 24,
  282. "fingerprint": "582df3b442a09879f0c035b50f6c4fce9aa8285c907737476f16004246c67bc6",
  283. "check_name": "UnsafeReflection",
  284. "message": "Unsafe reflection method `safe_constantize` called on parameter value",
  285. "file": "app/controllers/tests_controller.rb",
  286. "line": 37,
  287. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  288. "code": "params.fetch(:exception, \"StandardError\").safe_constantize",
  289. "render_path": null,
  290. "location": {
  291. "type": "method",
  292. "class": "TestsController",
  293. "method": "error_raised_exception"
  294. },
  295. "user_input": "params.fetch(:exception, \"StandardError\")",
  296. "confidence": "High",
  297. "cwe_id": [
  298. 470
  299. ],
  300. "note": "Only for testing purposes"
  301. },
  302. {
  303. "warning_type": "SQL Injection",
  304. "warning_code": 0,
  305. "fingerprint": "6f9bc95786e5e3904c8cf11eaff8d481d057ac2a15edad0a753587047a9bd785",
  306. "check_name": "SQL",
  307. "message": "Possible SQL injection",
  308. "file": "app/services/service/translation/search/collector/overview.rb",
  309. "line": 11,
  310. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  311. "code": "::Overview.where(\"name #{like_operator} :query\", :query => like_query)",
  312. "render_path": null,
  313. "location": {
  314. "type": "method",
  315. "class": "Service::Translation::Search::Collector::Overview",
  316. "method": "search_sources"
  317. },
  318. "user_input": "like_operator",
  319. "confidence": "Weak",
  320. "cwe_id": [
  321. 89
  322. ],
  323. "note": ""
  324. },
  325. {
  326. "warning_type": "Remote Code Execution",
  327. "warning_code": 24,
  328. "fingerprint": "73999042c4866cd2effe286fdd6a74c51659bc4a5fc760d1b96d35bd11b2bcda",
  329. "check_name": "UnsafeReflection",
  330. "message": "Unsafe reflection method `constantize` called on model attribute",
  331. "file": "lib/transaction_dispatcher.rb",
  332. "line": 37,
  333. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  334. "code": "Setting.get(setting.name).constantize",
  335. "render_path": null,
  336. "location": {
  337. "type": "method",
  338. "class": "TransactionDispatcher",
  339. "method": "s(:self).perform"
  340. },
  341. "user_input": "Setting.get(setting.name)",
  342. "confidence": "Medium",
  343. "cwe_id": [
  344. 470
  345. ],
  346. "note": "Setting.where(area: 'Transaction::Backend::Sync').order(:name) returns defined Transaction backend class names"
  347. },
  348. {
  349. "warning_type": "Remote Code Execution",
  350. "warning_code": 24,
  351. "fingerprint": "7541faf8d3249dc4ac24f9c354024614ae79b0d6cd4c057f034ea88be1154bf7",
  352. "check_name": "UnsafeReflection",
  353. "message": "Unsafe reflection method `constantize` called on model attribute",
  354. "file": "lib/application_lib.rb",
  355. "line": 26,
  356. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  357. "code": "Setting.get(setting).constantize",
  358. "render_path": null,
  359. "location": {
  360. "type": "method",
  361. "class": "ApplicationLib::ClassMethods",
  362. "method": "load_adapter_by_setting"
  363. },
  364. "user_input": "Setting.get(setting)",
  365. "confidence": "Medium",
  366. "cwe_id": [
  367. 470
  368. ],
  369. "note": "ApplicationLib.load_adapter_by_setting works as designed"
  370. },
  371. {
  372. "warning_type": "Denial of Service",
  373. "warning_code": 76,
  374. "fingerprint": "768e035d4bcb32ab79f5f747ccd5561d3c5f3a8ea74b2be08638d892be2249b2",
  375. "check_name": "RegexDoS",
  376. "message": "Model attribute used in regular expression",
  377. "file": "app/models/ticket/number/date.rb",
  378. "line": 49,
  379. "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
  380. "code": "/(?<=\\W|^)#{Regexp.quote(Setting.get(\"ticket_hook\"))}\\s{0,2}(\\d{4,10}#{(Setting.get(\"system_id\") or \"\")}\\d{2,40})\\b/i",
  381. "render_path": null,
  382. "location": {
  383. "type": "method",
  384. "class": "Ticket::Number::Date",
  385. "method": "Ticket::Number::Date.check"
  386. },
  387. "user_input": "Setting.get(\"system_id\")",
  388. "confidence": "Medium",
  389. "cwe_id": [
  390. 20,
  391. 185
  392. ],
  393. "note": "Admin configured RegExp"
  394. },
  395. {
  396. "warning_type": "SSL Verification Bypass",
  397. "warning_code": 71,
  398. "fingerprint": "7d088914c00f93dddb545ad9e567d59bf89dad493884b550ba72c014c0190011",
  399. "check_name": "SSLVerify",
  400. "message": "SSL certificate verification was bypassed",
  401. "file": "lib/user_agent.rb",
  402. "line": 363,
  403. "link": "https://brakemanscanner.org/docs/warning_types/ssl_verification_bypass/",
  404. "code": "(Net::HTTP.Proxy($1, $2, ((options[\"proxy_username\"] or Setting.get(\"proxy_username\")) or nil), ((options[\"proxy_password\"] or Setting.get(\"proxy_password\")) or nil)).new(uri.host, uri.port) or Net::HTTP.new(uri.host, uri.port)).verify_mode = OpenSSL::SSL::VERIFY_NONE",
  405. "render_path": null,
  406. "location": {
  407. "type": "method",
  408. "class": "UserAgent",
  409. "method": "s(:self).get_http"
  410. },
  411. "user_input": null,
  412. "confidence": "High",
  413. "cwe_id": [
  414. 295
  415. ],
  416. "note": "SSL Verification can already be requested from callers. The default value should be switched to true at some point."
  417. },
  418. {
  419. "warning_type": "SQL Injection",
  420. "warning_code": 0,
  421. "fingerprint": "8374304b5866de51754c98208fc3dcd434bc20e02bd4c9713f6d35f831a0ddd7",
  422. "check_name": "SQL",
  423. "message": "Possible SQL injection",
  424. "file": "app/models/pgp_key.rb",
  425. "line": 32,
  426. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  427. "code": "PGPKey.where(([\"#{SqlHelper.new(:object => (PGPKey)).array_contains_one(:email_addresses, uid.downcase)} OR (? LIKE domain_alias)\", SqlHelper.quote_like(uid.downcase)] or SqlHelper.new(:object => (PGPKey)).array_contains_one(:email_addresses, uid.downcase)))",
  428. "render_path": null,
  429. "location": {
  430. "type": "method",
  431. "class": "PGPKey",
  432. "method": "PGPKey.find_all_by_uid"
  433. },
  434. "user_input": "SqlHelper.new(:object => (PGPKey)).array_contains_one(:email_addresses, uid.downcase)",
  435. "confidence": "Medium",
  436. "cwe_id": [
  437. 89
  438. ],
  439. "note": ""
  440. },
  441. {
  442. "warning_type": "Remote Code Execution",
  443. "warning_code": 24,
  444. "fingerprint": "8db3b4731daa1ef96c53729b2fca4cc91b47af058564f61cba24833aacaa55ae",
  445. "check_name": "UnsafeReflection",
  446. "message": "Unsafe reflection method `constantize` called on model attribute",
  447. "file": "app/jobs/transaction_job.rb",
  448. "line": 25,
  449. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  450. "code": "Setting.get(setting.name).constantize",
  451. "render_path": null,
  452. "location": {
  453. "type": "method",
  454. "class": "TransactionJob",
  455. "method": "perform"
  456. },
  457. "user_input": "Setting.get(setting.name)",
  458. "confidence": "Medium",
  459. "cwe_id": [
  460. 470
  461. ],
  462. "note": "Setting.where(area: 'Transaction::Backend::Async').order(:name) returns defined Transaction backend class names"
  463. },
  464. {
  465. "warning_type": "SQL Injection",
  466. "warning_code": 0,
  467. "fingerprint": "9385240f75935e7ed242f9b52cc9471bcbb907d1990a33ec083f303d951df563",
  468. "check_name": "SQL",
  469. "message": "Possible SQL injection",
  470. "file": "app/models/taskbar/has_attachments.rb",
  471. "line": 7,
  472. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  473. "code": "where(\"state LIKE '%#{SqlHelper.quote_like(\"form_id\")}%'\")",
  474. "render_path": null,
  475. "location": {
  476. "type": "method",
  477. "class": "Taskbar::HasAttachments",
  478. "method": null
  479. },
  480. "user_input": "SqlHelper.quote_like(\"form_id\")",
  481. "confidence": "Medium",
  482. "cwe_id": [
  483. 89
  484. ],
  485. "note": ""
  486. },
  487. {
  488. "warning_type": "Denial of Service",
  489. "warning_code": 76,
  490. "fingerprint": "949570adfbda072b1fa14632a6d7a0e829a632c699339dce93e1ff109bf79786",
  491. "check_name": "RegexDoS",
  492. "message": "Model attribute used in regular expression",
  493. "file": "app/models/ticket/number/increment.rb",
  494. "line": 41,
  495. "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
  496. "code": "/(?<=\\W|^)#{Regexp.quote(Setting.get(\"ticket_hook\"))}#{Regexp.quote(Setting.get(\"ticket_hook_divider\").to_s)}(#{(\"\" or Setting.get(\"system_id\").to_s)}\\d{2,48})\\b/i",
  497. "render_path": null,
  498. "location": {
  499. "type": "method",
  500. "class": "Ticket::Number::Increment",
  501. "method": "Ticket::Number::Increment.check"
  502. },
  503. "user_input": "Setting.get(\"system_id\").to_s",
  504. "confidence": "Medium",
  505. "cwe_id": [
  506. 20,
  507. 185
  508. ],
  509. "note": "Admin configured RegExp"
  510. },
  511. {
  512. "warning_type": "SQL Injection",
  513. "warning_code": 0,
  514. "fingerprint": "9ec74dbe0ca90264aab31f05df4f0565f53e28477c93ced418e0249913c519fc",
  515. "check_name": "SQL",
  516. "message": "Possible SQL injection",
  517. "file": "app/models/organization/search.rb",
  518. "line": 133,
  519. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  520. "code": "Organization.select(\"DISTINCT(organizations.id), #{::SqlHelper.new(:object => (self)).get_order_select(::SqlHelper.new(:object => (self)).get_sort_by(params, [\"active\", \"updated_at\"]), ::SqlHelper.new(:object => (self)).get_order_by(params, [\"desc\", \"desc\"]), \"organizations.updated_at\")}\")",
  521. "render_path": null,
  522. "location": {
  523. "type": "method",
  524. "class": "Organization",
  525. "method": "search"
  526. },
  527. "user_input": "::SqlHelper.new(:object => (self)).get_order_select(::SqlHelper.new(:object => (self)).get_sort_by(params, [\"active\", \"updated_at\"]), ::SqlHelper.new(:object => (self)).get_order_by(params, [\"desc\", \"desc\"]), \"organizations.updated_at\")",
  528. "confidence": "Medium",
  529. "cwe_id": [
  530. 89
  531. ],
  532. "note": "SqlHelper does properly escape table and column names."
  533. },
  534. {
  535. "warning_type": "Cross-Site Scripting",
  536. "warning_code": 2,
  537. "fingerprint": "a9e68e841f16226b94c736d272962dd57d02c2333ead2855f2494dfb2c994de7",
  538. "check_name": "CrossSiteScripting",
  539. "message": "Unescaped parameter value",
  540. "file": "app/views/knowledge_base/public/answers/show.html.erb",
  541. "line": 11,
  542. "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
  543. "code": "prepare_rich_text(find_answer(find_category(params[:category]).answers, params[:answer]).translation.content.body_with_urls)",
  544. "render_path": [
  545. {
  546. "type": "controller",
  547. "class": "KnowledgeBase::Public::AnswersController",
  548. "method": "show",
  549. "line": 11,
  550. "file": "app/controllers/knowledge_base/public/answers_controller.rb",
  551. "rendered": {
  552. "name": "knowledge_base/public/answers/show",
  553. "file": "app/views/knowledge_base/public/answers/show.html.erb"
  554. }
  555. }
  556. ],
  557. "location": {
  558. "type": "template",
  559. "template": "knowledge_base/public/answers/show"
  560. },
  561. "user_input": "params[:category]",
  562. "confidence": "Weak",
  563. "cwe_id": [
  564. 79
  565. ],
  566. "note": ""
  567. },
  568. {
  569. "warning_type": "Remote Code Execution",
  570. "warning_code": 24,
  571. "fingerprint": "b4e5b1ad22930f849b12cbdf519dced6ec46b6cc653504f0a8e910c0a9590d61",
  572. "check_name": "UnsafeReflection",
  573. "message": "Unsafe reflection method `constantize` called on model attribute",
  574. "file": "app/models/object_manager/attribute.rb",
  575. "line": 924,
  576. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  577. "code": "ObjectLookup.by_id(object_lookup_id).constantize",
  578. "render_path": null,
  579. "location": {
  580. "type": "method",
  581. "class": "ObjectManager::Attribute",
  582. "method": "check_name"
  583. },
  584. "user_input": "ObjectLookup.by_id(object_lookup_id)",
  585. "confidence": "Medium",
  586. "cwe_id": [
  587. 470
  588. ],
  589. "note": "ObjectLookup.by_id works as designed"
  590. },
  591. {
  592. "warning_type": "Command Injection",
  593. "warning_code": 14,
  594. "fingerprint": "be422b13e9cd280bc5ae570cd575777a4d48d8a53aed09bb59d1db85eee4927b",
  595. "check_name": "Execute",
  596. "message": "Possible command injection",
  597. "file": "lib/mysql_strategy.rb",
  598. "line": 62,
  599. "link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
  600. "code": "system(\"mysqldump #{mysql_arguments} > #{backup_file}\", :exception => true)",
  601. "render_path": null,
  602. "location": {
  603. "type": "method",
  604. "class": "MysqlStrategy",
  605. "method": "s(:self).backup"
  606. },
  607. "user_input": "mysql_arguments",
  608. "confidence": "Medium",
  609. "cwe_id": [
  610. 77
  611. ],
  612. "note": "Mysql arguments are internal / from config."
  613. },
  614. {
  615. "warning_type": "SQL Injection",
  616. "warning_code": 0,
  617. "fingerprint": "c3e251f444d988a200ae5c5e811dc7264337906df99740007bfa499c35e203c9",
  618. "check_name": "SQL",
  619. "message": "Possible SQL injection",
  620. "file": "app/services/service/translation/search/collector/priority.rb",
  621. "line": 11,
  622. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  623. "code": "Ticket::Priority.where(\"name #{like_operator} :query\", :query => like_query)",
  624. "render_path": null,
  625. "location": {
  626. "type": "method",
  627. "class": "Service::Translation::Search::Collector::Priority",
  628. "method": "search_sources"
  629. },
  630. "user_input": "like_operator",
  631. "confidence": "Medium",
  632. "cwe_id": [
  633. 89
  634. ],
  635. "note": ""
  636. },
  637. {
  638. "warning_type": "Command Injection",
  639. "warning_code": 14,
  640. "fingerprint": "c47bddc058fcf0381c1a91f2d107606a76bb1a5c40130c555ff1dfec713f2775",
  641. "check_name": "Execute",
  642. "message": "Possible command injection",
  643. "file": "lib/secure_mailing/pgp/tool/exec/agent.rb",
  644. "line": 32,
  645. "link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
  646. "code": "Open3.capture3(\"GNUPGHOME\" => (@gnupg_home), *([\"#{File.dirname(binary_path)}/gpgconf\"] + cmdline), :binmode => true)",
  647. "render_path": null,
  648. "location": {
  649. "type": "method",
  650. "class": "SecureMailing::PGP::Tool::Exec::Agent",
  651. "method": "gpgconf"
  652. },
  653. "user_input": "File.dirname(binary_path)",
  654. "confidence": "Medium",
  655. "cwe_id": [
  656. 77
  657. ],
  658. "note": "gpg command line tool stuff."
  659. },
  660. {
  661. "warning_type": "Dynamic Render Path",
  662. "warning_code": 15,
  663. "fingerprint": "c52f57d32456c9ab6dba6dfc93bd8effa16829a87a9ce9368da83a35fc6cf1a7",
  664. "check_name": "Render",
  665. "message": "Render path contains parameter value",
  666. "file": "app/controllers/tests_controller.rb",
  667. "line": 13,
  668. "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
  669. "code": "render(action => params[:name], {})",
  670. "render_path": null,
  671. "location": {
  672. "type": "method",
  673. "class": "TestsController",
  674. "method": "show"
  675. },
  676. "user_input": "params[:name]",
  677. "confidence": "High",
  678. "cwe_id": [
  679. 22
  680. ],
  681. "note": "Running QUnit tests"
  682. },
  683. {
  684. "warning_type": "SQL Injection",
  685. "warning_code": 0,
  686. "fingerprint": "c686d86a18e1345c9216a074fb8cd86f1e4d4bc1f6d78c8f00891f4c13dfb849",
  687. "check_name": "SQL",
  688. "message": "Possible SQL injection",
  689. "file": "app/services/service/translation/search/collector/state.rb",
  690. "line": 11,
  691. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  692. "code": "Ticket::State.where(\"name #{like_operator} :query\", :query => like_query)",
  693. "render_path": null,
  694. "location": {
  695. "type": "method",
  696. "class": "Service::Translation::Search::Collector::State",
  697. "method": "search_sources"
  698. },
  699. "user_input": "like_operator",
  700. "confidence": "Medium",
  701. "cwe_id": [
  702. 89
  703. ],
  704. "note": ""
  705. },
  706. {
  707. "warning_type": "SSL Verification Bypass",
  708. "warning_code": 71,
  709. "fingerprint": "c7311ebfec11c51dead99054a31ec84773b4d0d4848c11a15801c439d35d2171",
  710. "check_name": "SSLVerify",
  711. "message": "SSL certificate verification was bypassed",
  712. "file": "app/controllers/integration/exchange_controller.rb",
  713. "line": 93,
  714. "link": "https://brakemanscanner.org/docs/warning_types/ssl_verification_bypass/",
  715. "code": "Autodiscover::Client.new(:email => params[:user], :password => params[:password]).http.ssl_config.verify_mode = OpenSSL::SSL::VERIFY_NONE",
  716. "render_path": null,
  717. "location": {
  718. "type": "method",
  719. "class": "Integration::ExchangeController",
  720. "method": "autodiscover_basic_auth_check"
  721. },
  722. "user_input": null,
  723. "confidence": "High",
  724. "cwe_id": [
  725. 295
  726. ],
  727. "note": "Only if requester sends `:disable_ssl_verify` param"
  728. },
  729. {
  730. "warning_type": "Remote Code Execution",
  731. "warning_code": 24,
  732. "fingerprint": "d48809837203098f7be4803f19b4f180f93361030bcf145560c65582d44f8edc",
  733. "check_name": "UnsafeReflection",
  734. "message": "Unsafe reflection method `constantize` called on model attribute",
  735. "file": "app/models/channel/email_parser.rb",
  736. "line": 162,
  737. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  738. "code": "Setting.get(setting.name).constantize",
  739. "render_path": null,
  740. "location": {
  741. "type": "method",
  742. "class": "Channel::EmailParser",
  743. "method": "_process"
  744. },
  745. "user_input": "Setting.get(setting.name)",
  746. "confidence": "Medium",
  747. "cwe_id": [
  748. 470
  749. ],
  750. "note": "Setting.where(area: 'Postmaster::PreFilter').order(:name) returns defined postmaster backend class names"
  751. },
  752. {
  753. "warning_type": "Remote Code Execution",
  754. "warning_code": 24,
  755. "fingerprint": "d48809837203098f7be4803f19b4f180f93361030bcf145560c65582d44f8edc",
  756. "check_name": "UnsafeReflection",
  757. "message": "Unsafe reflection method `constantize` called on model attribute",
  758. "file": "app/models/channel/email_parser.rb",
  759. "line": 333,
  760. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  761. "code": "Setting.get(setting.name).constantize",
  762. "render_path": null,
  763. "location": {
  764. "type": "method",
  765. "class": "Channel::EmailParser",
  766. "method": "_process"
  767. },
  768. "user_input": "Setting.get(setting.name)",
  769. "confidence": "Medium",
  770. "cwe_id": [
  771. 470
  772. ],
  773. "note": "Setting.where(area: 'Postmaster::PreFilter').order(:name) returns defined postmaster backend class names"
  774. },
  775. {
  776. "warning_type": "Remote Code Execution",
  777. "warning_code": 24,
  778. "fingerprint": "d5d1526bf7a888d1965405d0e3dc5c63f11fe2de47f9704c0e1717ee0410dd6b",
  779. "check_name": "UnsafeReflection",
  780. "message": "Unsafe reflection method `safe_constantize` called on model attribute",
  781. "file": "app/models/online_notification.rb",
  782. "line": 38,
  783. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  784. "code": "ObjectLookup.by_id(object_lookup_id).safe_constantize",
  785. "render_path": null,
  786. "location": {
  787. "type": "method",
  788. "class": "OnlineNotification",
  789. "method": "related_object"
  790. },
  791. "user_input": "ObjectLookup.by_id(object_lookup_id)",
  792. "confidence": "Medium",
  793. "cwe_id": [
  794. 470
  795. ],
  796. "note": ""
  797. },
  798. {
  799. "warning_type": "Denial of Service",
  800. "warning_code": 76,
  801. "fingerprint": "ea2a3af842a48c9ef4dc8d142abd56978baa4823a598d2a76dc8f840799d6967",
  802. "check_name": "RegexDoS",
  803. "message": "Model attribute used in regular expression",
  804. "file": "app/models/ticket/number/date.rb",
  805. "line": 44,
  806. "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
  807. "code": "/(?<=\\W|^)#{Regexp.quote(Setting.get(\"ticket_hook\"))}#{Regexp.quote((Setting.get(\"ticket_hook_divider\") or \"\"))}(\\d{4,10}#{(Setting.get(\"system_id\") or \"\")}\\d{2,40})\\b/i",
  808. "render_path": null,
  809. "location": {
  810. "type": "method",
  811. "class": "Ticket::Number::Date",
  812. "method": "Ticket::Number::Date.check"
  813. },
  814. "user_input": "Setting.get(\"system_id\")",
  815. "confidence": "Medium",
  816. "cwe_id": [
  817. 20,
  818. 185
  819. ],
  820. "note": "Admin configured RegExp"
  821. },
  822. {
  823. "warning_type": "Session Setting",
  824. "warning_code": 29,
  825. "fingerprint": "f0ee1cc1980474c82a013645508f002dcc801e00db5592f7dd8cd6bdb93c73fe",
  826. "check_name": "SessionSettings",
  827. "message": "Session secret should not be included in version control",
  828. "file": "config/secrets.yml",
  829. "line": 2,
  830. "link": "https://brakemanscanner.org/docs/warning_types/session_setting/",
  831. "code": null,
  832. "render_path": null,
  833. "location": null,
  834. "user_input": null,
  835. "confidence": "High",
  836. "cwe_id": [
  837. 798
  838. ],
  839. "note": "Since Sessions are stored in the database and not in cookies, the session secret is not used / not relevant.\""
  840. },
  841. {
  842. "warning_type": "Remote Code Execution",
  843. "warning_code": 24,
  844. "fingerprint": "fc299f57cedf226dc79a25c6bca84ceb85d5896a86820648d49c0e59d865575a",
  845. "check_name": "UnsafeReflection",
  846. "message": "Unsafe reflection method `constantize` called on model attribute",
  847. "file": "app/graphql/gql/resolvers/belongs_to_resolver.rb",
  848. "line": 18,
  849. "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
  850. "code": "ObjectLookup.by_id(object.send(field.through_key)).constantize",
  851. "render_path": null,
  852. "location": {
  853. "type": "method",
  854. "class": "Gql::Resolvers::BelongsToResolver",
  855. "method": "target_object_klass"
  856. },
  857. "user_input": "ObjectLookup.by_id(object.send(field.through_key))",
  858. "confidence": "Medium",
  859. "cwe_id": [
  860. 470
  861. ],
  862. "note": ""
  863. },
  864. {
  865. "warning_type": "SQL Injection",
  866. "warning_code": 0,
  867. "fingerprint": "fcad47a712a324ace0e97560767e5420500df03fd3de3057198800bdea5fd324",
  868. "check_name": "SQL",
  869. "message": "Possible SQL injection",
  870. "file": "lib/models.rb",
  871. "line": 172,
  872. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  873. "code": "model_class.where(\"#{reflection_value.name}_id\" => object_id)",
  874. "render_path": null,
  875. "location": {
  876. "type": "method",
  877. "class": "Models",
  878. "method": "s(:self).references"
  879. },
  880. "user_input": "reflection_value.name",
  881. "confidence": "Weak",
  882. "cwe_id": [
  883. 89
  884. ],
  885. "note": "Reflections come from the models themselves and are thus safe to use."
  886. },
  887. {
  888. "warning_type": "SQL Injection",
  889. "warning_code": 0,
  890. "fingerprint": "fcad47a712a324ace0e97560767e5420500df03fd3de3057198800bdea5fd324",
  891. "check_name": "SQL",
  892. "message": "Possible SQL injection",
  893. "file": "lib/models.rb",
  894. "line": 185,
  895. "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
  896. "code": "model_class.where(\"#{reflection_value.name}_id\" => object_id)",
  897. "render_path": null,
  898. "location": {
  899. "type": "method",
  900. "class": "Models",
  901. "method": "s(:self).references"
  902. },
  903. "user_input": "reflection_value.name",
  904. "confidence": "Weak",
  905. "cwe_id": [
  906. 89
  907. ],
  908. "note": "Reflections come from the models themselves and are thus safe to use."
  909. },
  910. {
  911. "warning_type": "Command Injection",
  912. "warning_code": 14,
  913. "fingerprint": "fe15417756eed2c518c355309ee042b57df5f88a5410858dce3fa9fe9c893b84",
  914. "check_name": "Execute",
  915. "message": "Possible command injection",
  916. "file": "lib/mysql_strategy.rb",
  917. "line": 54,
  918. "link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
  919. "code": "system(\"mysql #{mysql_arguments} < #{backup_file}\", :exception => true)",
  920. "render_path": null,
  921. "location": {
  922. "type": "method",
  923. "class": "MysqlStrategy",
  924. "method": "s(:self).rollback"
  925. },
  926. "user_input": "mysql_arguments",
  927. "confidence": "Medium",
  928. "cwe_id": [
  929. 77
  930. ],
  931. "note": "Mysql arguments are internal / from config."
  932. }
  933. ],
  934. "updated": "2024-04-09 13:31:02 +0200",
  935. "brakeman_version": "6.1.2"
  936. }