Class: Brakeman::CheckSQL

Inherits:
BaseCheck show all
Defined in:
lib/brakeman/checks/check_sql.rb

Overview

This check tests for find calls which do not use Rails’ auto SQL escaping

For example: Project.find(:all, :conditions => “name = ‘” + params + “’”)

Project.find(:all, :conditions => “name = ‘#:name’”)

User.find_by_sql(“SELECT * FROM projects WHERE name = ‘#:name’”)

Constant Summary collapse

STRING_METHODS = 


IGNORE_METHODS_IN_SQL =





QUOTE_METHODS =



[:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]


SELF_CLASS =



s(:call, s(:self), :class)




Constants inherited
from BaseCheck


BaseCheck::CONFIDENCE


Constants included
from Util


Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP


Constants inherited
from SexpProcessor


SexpProcessor::VERSION


Instance Attribute Summary


Attributes inherited from BaseCheck


#tracker, #warnings


Attributes inherited from SexpProcessor


#context, #env, #expected



Instance Method Summary
collapse




Methods inherited from BaseCheck


#add_result, inherited, #initialize, #process_call, #process_cookies, #process_default, #process_if, #process_params, #process_string_interp


Methods included from Util


#array?, #block?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #true?, #truncate_table, #underscore


Methods included from ProcessorHelper


#class_name, #process_all, #process_all!, #process_call_args, #process_module


Methods inherited from SexpProcessor


#error_handler, #in_context, #initialize, #process, #process_dummy, #scope




Constructor Details


This class inherits a constructor from Brakeman::BaseCheck






Instance Method Details





#ar_scope_calls(symbol_name = :named_scope, &block) ⇒ Object










88
89
90
91
92
93
94
95
96
97
98
99
100




# File 'lib/brakeman/checks/check_sql.rb', line 88

def ar_scope_calls(symbol_name = :named_scope, &block)
  return_array = []
  active_record_models.each do |name, model|
    model_args = model[:options][symbol_name]
    if model_args
      model_args.each do |args|
        yield name, args
        return_array << [name, args]
      end
    end
  end
  return_array
end












#check_by_sql_arguments(arg) ⇒ Object







find_by_sql and count_by_sql can take either a straight SQL string or an array with values to bind.















297
298
299
300
301
302
303




# File 'lib/brakeman/checks/check_sql.rb', line 297

def check_by_sql_arguments arg
  return unless sexp? arg

  #This is kind of unnecessary, because unsafe_sql? will handle an array
  #correctly, but might be better to be explicit.
  array?(arg) ? unsafe_sql?(arg[1]) : unsafe_sql?(arg)
end












#check_call(exp) ⇒ Object







Check call for string building















581
582
583
584
585
586
587
588
589
590
591
592




# File 'lib/brakeman/checks/check_sql.rb', line 581

def check_call exp
  return unless call? exp
  unsafe = check_for_string_building exp

  if unsafe
    unsafe
  elsif call? exp.target
    check_call exp.target
  else
    nil
  end
end












#check_CVE_2014_0080 ⇒ Object







TODO: Move all SQL CVE checks to separate class















644
645
646
647
648
649
650
651
652
653
654




# File 'lib/brakeman/checks/check_sql.rb', line 644

def check_CVE_2014_0080
  return unless version_between? "4.0.0", "4.0.2" and
                @tracker.config[:gems].include? :pg

  warn :warning_type => 'SQL Injection',
    :warning_code => :CVE_2014_0080,
    :message => "Rails #{tracker.config[:rails_version]} contains a SQL injection vulnerability (CVE-2014-0080) with PostgreSQL. Upgrade to 4.0.3",
    :confidence => CONFIDENCE[:high],
    :file => gemfile_or_environment,
    :link_path => "https://groups.google.com/d/msg/rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ"
end












#check_find_arguments(arg) ⇒ Object







The ‘find’ methods accept a number of different types of parameters:


  • 

    The first argument might be :all, :first, or :last
    

  • 

    The first argument might be an integer ID or an array of IDs
    

  • 

    The second argument might be a hash of options, some of which are dangerous and some of which are not
    

  • 

    The second argument might contain SQL fragments as values
    

  • 

    The second argument might contain properly parameterized SQL fragments in arrays
    

  • 

    The second argument might contain improperly parameterized SQL fragments in arrays
    



This method should only be passed the second argument.















243
244
245
246
247




# File 'lib/brakeman/checks/check_sql.rb', line 243

def check_find_arguments arg
  return nil if not sexp? arg or node_type? arg, :lit, :string, :str, :true, :false, :nil

  unsafe_sql? arg
end












#check_for_limit_or_offset_vulnerability(options) ⇒ Object







Prior to Rails 2.1.1, the :offset and :limit parameters were not escaping input properly.


www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter/















598
599
600
601
602
603
604




# File 'lib/brakeman/checks/check_sql.rb', line 598

def check_for_limit_or_offset_vulnerability options
  return false if @rails_version.nil? or @rails_version >= "2.1.1" or not hash?(options)

  return true if hash_access(options, :limit) or hash_access(options, :offset)

  false
end












#check_for_string_building(exp) ⇒ Object










491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514




# File 'lib/brakeman/checks/check_sql.rb', line 491

def check_for_string_building exp
  return unless call? exp

  target = exp.target
  method = exp.method
  arg = exp.first_arg

  if STRING_METHODS.include? method
    if string? target
      check_string_arg arg
    elsif string? arg
      check_string_arg target
    elsif call? target
      check_for_string_building target
    elsif node_type? target, :string_interp, :dstr or
          node_type? arg, :string_interp, :dstr

      check_string_arg target and
      check_string_arg arg
    end
  else
    nil
  end
end












#check_hash_keys(exp) ⇒ Object







Check hash keys for user input. (Seems unlikely, but if a user can control the column names queried, that could be bad)















344
345
346
347
348
349
350
351
352
353




# File 'lib/brakeman/checks/check_sql.rb', line 344

def check_hash_keys exp
  hash_iterate(exp) do |key, value|
    unless symbol?(key)
      unsafe_key = unsafe_sql? value
      return unsafe_key if unsafe_key
    end
  end

  false
end












#check_hash_values(exp) ⇒ Object







Checks hash values associated with these keys:


  • 

    conditions
    

  • 

    order
    

  • 

    having
    

  • 

    joins
    

  • 

    select
    

  • 

    from
    

  • 

    lock
    
















464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487




# File 'lib/brakeman/checks/check_sql.rb', line 464

def check_hash_values exp
  hash_iterate(exp) do |key, value|
    if symbol? key
      unsafe = case key.value
               when :conditions, :having, :select
                 check_query_arguments value
               when :order, :group
                 check_order_arguments value
               when :joins
                 check_joins_arguments value
               when :lock
                 check_lock_arguments value
               when :from
                 unsafe_sql? value
               else
                 nil
               end

      return unsafe if unsafe
    end
  end

  false
end












#check_joins_arguments(arg) ⇒ Object







joins can take a string, hash of associations, or an array of both(?) We only care about the possible string values.















307
308
309
310
311
312
313
314
315
316
317
318
319
320




# File 'lib/brakeman/checks/check_sql.rb', line 307

def check_joins_arguments arg
  return unless sexp? arg and not node_type? arg, :hash, :string, :str

  if array? arg
    arg.each do |a|
      unsafe_arg = check_joins_arguments a
      return unsafe_arg if unsafe_arg
    end

    nil
  else
    unsafe_sql? arg
  end
end












#check_lock_arguments(arg) ⇒ Object







Model#lock essentially only cares about strings. But those strings can be any SQL fragment. This does not apply to all databases. (For those who do not support it, the lock method does nothing).















334
335
336
337
338




# File 'lib/brakeman/checks/check_sql.rb', line 334

def check_lock_arguments arg
  return unless sexp? arg and not node_type? arg, :hash, :array, :string, :str

  unsafe_sql?(arg, :ignore_hash)
end












#check_order_arguments(args) ⇒ Object







Checks each argument to order/reorder/group for possible SQL. Anything used with these methods is passed in verbatim.















285
286
287
288
289
290
291
292
293




# File 'lib/brakeman/checks/check_sql.rb', line 285

def check_order_arguments args
  return unless sexp? args

  if node_type? args, :arglist
    check_update_all_arguments(args)
  else
    unsafe_sql? args
  end
end












#check_query_arguments(arg) ⇒ Object










255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281




# File 'lib/brakeman/checks/check_sql.rb', line 255

def check_query_arguments arg
  return unless sexp? arg
  first_arg = arg[1]

  if node_type? arg, :arglist
    if arg.length > 2 and node_type? first_arg, :string_interp, :dstr
      # Model.where("blah = ?", blah)
      return check_string_interp first_arg
    else
      arg = first_arg
    end
  end

  if request_value? arg
    # Model.where(params[:where])
    arg
  elsif hash? arg
    #This is generally going to be a hash of column names and values, which
    #would escape the values. But the keys _could_ be user input.
    check_hash_keys arg
  elsif node_type? arg, :lit, :str
    nil
  else
    #Hashes are safe...but we check above for hash, so...?
    unsafe_sql? arg, :ignore_hash
  end
end












#check_rails_versions_against_cve_issues ⇒ Object










664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705




# File 'lib/brakeman/checks/check_sql.rb', line 664

def check_rails_versions_against_cve_issues
  issues = [
    {
      :cve => "CVE-2012-2660",
      :versions => [%w[2.0.0 2.3.14 2.3.17], %w[3.0.0 3.0.12 3.0.13], %w[3.1.0 3.1.4 3.1.5], %w[3.2.0 3.2.3 3.2.4]],
      :url => "https://groups.google.com/d/topic/rubyonrails-security/8SA-M3as7A8/discussion"
    },
    {
      :cve => "CVE-2012-2661",
      :versions => [%w[3.0.0 3.0.12 3.0.13], %w[3.1.0 3.1.4 3.1.5], %w[3.2.0 3.2.3 3.2.5]],
      :url => "https://groups.google.com/d/topic/rubyonrails-security/dUaiOOGWL1k/discussion"
    },
    {
      :cve => "CVE-2012-2695",
      :versions => [%w[2.0.0 2.3.14 2.3.15], %w[3.0.0 3.0.13 3.0.14], %w[3.1.0 3.1.5 3.1.6], %w[3.2.0 3.2.5 3.2.6]],
      :url => "https://groups.google.com/d/topic/rubyonrails-security/l4L0TEVAz1k/discussion"
    },
    {
      :cve => "CVE-2012-5664",
      :versions => [%w[2.0.0 2.3.14 2.3.15], %w[3.0.0 3.0.17 3.0.18], %w[3.1.0 3.1.8 3.1.9], %w[3.2.0 3.2.9 3.2.18]],
      :url => "https://groups.google.com/d/topic/rubyonrails-security/DCNTNp_qjFM/discussion"
    },
    {
      :cve => "CVE-2013-0155",
      :versions => [%w[2.0.0 2.3.15 2.3.16], %w[3.0.0 3.0.18 3.0.19], %w[3.1.0 3.1.9 3.1.10], %w[3.2.0 3.2.10 3.2.11]],
      :url => "https://groups.google.com/d/topic/rubyonrails-security/c7jT-EeN9eI/discussion"
    },

  ]

  unless lts_version? '2.3.18.6'
   issues << {
      :cve => "CVE-2013-6417",
      :versions => [%w[2.0.0 3.2.15 3.2.16], %w[4.0.0 4.0.1 4.0.2]],
      :url => "https://groups.google.com/d/msg/ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ"
    }
  end

  issues.each do |cve_issue|
    cve_warning_for cve_issue[:versions], cve_issue[:cve], cve_issue[:url]
  end
end












#check_scope_arguments(call) ⇒ Object










249
250
251
252
253




# File 'lib/brakeman/checks/check_sql.rb', line 249

def check_scope_arguments call
  scope_arg = call.second_arg #first arg is name of scope

  node_type?(scope_arg, :iter) ? unsafe_sql?(scope_arg.block) : unsafe_sql?(scope_arg)
end












#check_string_arg(exp) ⇒ Object










516
517
518
519
520
521
522
523
524
525
526
527
528




# File 'lib/brakeman/checks/check_sql.rb', line 516

def check_string_arg exp
  if safe_value? exp
    nil
  elsif string_building? exp
    check_for_string_building exp
  elsif node_type? exp, :string_interp, :dstr
    check_string_interp exp
  elsif call? exp and exp.method == :to_s
    check_string_arg exp.target
  else
    exp
  end
end












#check_string_interp(arg) ⇒ Object







Check an interpolated string for dangerous values.


This method assumes values interpolated into strings are unsafe by default, unless safe_value? explicitly returns true.















359
360
361
362
363
364
365
366
367




# File 'lib/brakeman/checks/check_sql.rb', line 359

def check_string_interp arg
  arg.each do |exp|
    if dangerous = unsafe_string_interp?(exp)
      return dangerous
    end
  end

  nil
end












#check_update_all_arguments(args) ⇒ Object










322
323
324
325
326
327
328
329




# File 'lib/brakeman/checks/check_sql.rb', line 322

def check_update_all_arguments args
  args.each do |arg|
    unsafe_arg = unsafe_sql? arg
    return unsafe_arg if unsafe_arg
  end

  nil
end












#connect_call?(result) ⇒ Boolean













Returns:


    

  • 
(Boolean)

    • 










627
628
629
630
631
632
633
634
635
636
637
638
639
640
641




# File 'lib/brakeman/checks/check_sql.rb', line 627

def connect_call? result
  call = result[:call]
  target = call.target

  if call? target and target.method == :connection
    target = target.target
    klass = class_name(target)

    target.nil? or
    target == SELF_CLASS or
    node_type? target, :self or
    klass == :"ActiveRecord::Base" or
    active_record_models.include? klass
  end
end












#constantize_call?(result) ⇒ Boolean







Look for something like this:


params.constantize.find(‘something’)


s(:call,


s(:call,
  s(:call,
    s(:call, nil, :params, s(:arglist)),
    :[],
    s(:arglist, s(:lit, :x))),
  :constantize,
  s(:arglist)),
:find,
s(:arglist, s(:str, "something")))









Returns:


    

  • 
(Boolean)

    • 










620
621
622
623




# File 'lib/brakeman/checks/check_sql.rb', line 620

def constantize_call? result
  call = result[:call]
  call? call.target and call.target.method == :constantize
end












#cve_warning_for(versions, cve, link) ⇒ Object










707
708
709
710
711
712
713
714
715
716
717
718
719




# File 'lib/brakeman/checks/check_sql.rb', line 707

def cve_warning_for versions, cve, link
  upgrade_version = upgrade_version? versions
  return unless upgrade_version

  code = cve.tr('-', '_').to_sym

  warn :warning_type => 'SQL Injection',
    :warning_code => code,
    :message => "Rails #{tracker.config[:rails_version]} contains a SQL injection vulnerability (#{cve}). Upgrade to #{upgrade_version}",
    :confidence => CONFIDENCE[:high],
    :file => gemfile_or_environment,
    :link_path => link
end












#find_dangerous_value(exp, ignore_hash) ⇒ Object







Check exp for dangerous values. Used by unsafe_sql?















413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453




# File 'lib/brakeman/checks/check_sql.rb', line 413

def find_dangerous_value exp, ignore_hash
  case exp.node_type
  when :lit, :str, :const, :colon2, :true, :false, :nil
    nil
  when :array
    #Assume this is an array like
    #
    #  ["blah = ? AND thing = ?", ...]
    #
    #and check first value
    unsafe_sql? exp[1]
  when :string_interp, :dstr
    check_string_interp exp
  when :hash
    check_hash_values exp unless ignore_hash
  when :if
    unsafe_sql? exp.then_clause or unsafe_sql? exp.else_clause
  when :call
    unless IGNORE_METHODS_IN_SQL.include? exp.method
      if has_immediate_user_input? exp or has_immediate_model? exp
        exp
      else
        check_call exp
      end
    end
  when :or
    if unsafe = (unsafe_sql?(exp.lhs) || unsafe_sql?(exp.rhs))
      unsafe
    else
      nil
    end
  when :block, :rlist
    unsafe_sql? exp.last
  else
    if has_immediate_user_input? exp or has_immediate_model? exp
      exp
    else
      nil
    end
  end
end












#find_scope_calls ⇒ Object







Find calls to named_scope() or scope() in models RP 3 TODO















60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86




# File 'lib/brakeman/checks/check_sql.rb', line 60

def find_scope_calls
  scope_calls = []

  if version_between?("2.1.0", "3.0.9")
    ar_scope_calls(:named_scope) do |name, args|
      call = make_call(nil, :named_scope, args).line(args.line)
      scope_calls << scope_call_hash(call, name, :named_scope)
    end
  elsif version_between?("3.1.0", "3.9.9")
    ar_scope_calls(:scope) do |name, args|
      second_arg = args[2]
      next unless sexp? second_arg

      if second_arg.node_type == :iter and node_type? second_arg.block, :block, :call
        process_scope_with_block(name, args)
      elsif second_arg.node_type == :call
        call = second_arg
        scope_calls << scope_call_hash(call, name, call.method)
      else
        call = make_call(nil, :scope, args).line(args.line)
        scope_calls << scope_call_hash(call, name, :scope)
      end
    end
  end

  scope_calls
end












#process_result(result) ⇒ Object







Process possible SQL injection sites:


Model#find


Model#(named_)scope


Model#(find|count)_by_sql


Model#all


Rails 3


Model#(where|having) Model#(order|group)


Find Options Hash


Dangerous keys that accept SQL:


  • 

    conditions
    

  • 

    order
    

  • 

    having
    

  • 

    joins
    

  • 

    select
    

  • 

    from
    

  • 

    lock
    
















149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229




# File 'lib/brakeman/checks/check_sql.rb', line 149

def process_result result
  return if duplicate?(result) or result[:call].original_line
  return if result[:target].nil? && !active_record_models.include?(result[:location][:class])


  call = result[:call]
  method = call.method

  dangerous_value = case method
                    when :find
                      check_find_arguments call.second_arg
                    when :exists?, :delete_all, :destroy_all
                      check_find_arguments call.first_arg
                    when :named_scope, :scope
                      check_scope_arguments call
                    when :find_by_sql, :count_by_sql
                      check_by_sql_arguments call.first_arg
                    when :calculate
                      check_find_arguments call.third_arg
                    when :last, :first, :all
                      check_find_arguments call.first_arg
                    when :average, :count, :maximum, :minimum, :sum
                      if call.length > 5
                        unsafe_sql?(call.first_arg) or check_find_arguments(call.last_arg)
                      else
                        check_find_arguments call.last_arg
                      end
                    when :where, :having
                      check_query_arguments call.arglist
                    when :order, :group, :reorder
                      check_order_arguments call.arglist
                    when :joins
                      check_joins_arguments call.first_arg
                    when :from, :select
                      unsafe_sql? call.first_arg
                    when :lock
                      check_lock_arguments call.first_arg
                    when :pluck
                      unsafe_sql? call.first_arg
                    when :update_all
                      check_update_all_arguments call.args
                    when *@connection_calls
                      check_by_sql_arguments call.first_arg
                    else
                      Brakeman.debug "Unhandled SQL method: #{method}"
                    end

  if dangerous_value
    add_result result

    input = include_user_input? dangerous_value
    if input
      confidence = CONFIDENCE[:high]
      user_input = input.match
    else
      confidence = CONFIDENCE[:med]
      user_input = dangerous_value
    end

    warn :result => result,
      :warning_type => "SQL Injection",
      :warning_code => :sql_injection,
      :message => "Possible SQL injection",
      :user_input => user_input,
      :confidence => confidence
  end

  if check_for_limit_or_offset_vulnerability call.last_arg
    if include_user_input? call.last_arg
      confidence = CONFIDENCE[:high]
    else
      confidence = CONFIDENCE[:low]
    end

    warn :result => result,
      :warning_type => "SQL Injection",
      :warning_code => :sql_injection_limit_offset,
      :message => "Upgrade to Rails >= 2.1.2 to escape :limit and :offset. Possible SQL injection",
      :confidence => confidence
  end
end












#process_scope_with_block(model_name, args) ⇒ Object










107
108
109
110
111
112
113
114
115
116
117
118
119
120




# File 'lib/brakeman/checks/check_sql.rb', line 107

def process_scope_with_block model_name, args
  scope_name = args[1][1]
  block = args[-1][-1]

  # Search lambda for calls to query methods
  if block.node_type == :block
    find_calls = Brakeman::FindAllCalls.new(tracker)
    find_calls.process_source(block, :class => model_name, :method => scope_name)
    find_calls.calls.each { |call| process_result(call) if @sql_targets.include?(call[:method]) }
  elsif block.node_type == :call
    process_result :target => block.target, :method => block.method, :call => block,
      :location => { :type => :class, :class => model_name, :method => scope_name }
  end
end












#quote_call?(exp) ⇒ Boolean













Returns:


    

  • 
(Boolean)

    • 










572
573
574
575
576
577
578




# File 'lib/brakeman/checks/check_sql.rb', line 572

def quote_call? exp
  if call? exp.target
    exp.target.method == :connection and QUOTE_METHODS.include? exp.method
  elsif exp.target.nil?
    exp.method == :quote_value
  end
end












#run_check ⇒ Object










16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56




# File 'lib/brakeman/checks/check_sql.rb', line 16

def run_check
  @rails_version = tracker.config[:rails_version]

  @sql_targets = [:all, :average, :calculate, :count, :count_by_sql, :exists?, :delete_all, :destroy_all,
    :find, :find_by_sql, :first, :last, :maximum, :minimum, :pluck, :sum, :update_all]
  @sql_targets.concat [:from, :group, :having, :joins, :lock, :order, :reorder, :select, :where] if tracker.options[:rails3]

  @connection_calls = [:delete, :execute, :insert, :select_all, :select_one,
    :select_rows, :select_value, :select_values]

  if tracker.options[:rails3]
    @connection_calls.concat [:exec_delete, :exec_insert, :exec_query, :exec_update]
  else
    @connection_calls.concat [:add_limit!, :add_offset_limit!, :add_lock!]
  end

  Brakeman.debug "Finding possible SQL calls on models"
  calls = tracker.find_call :targets => active_record_models.keys,
    :methods => @sql_targets,
    :chained => true

  Brakeman.debug "Finding possible SQL calls with no target"
  calls.concat tracker.find_call(:target => nil, :methods => @sql_targets)

  Brakeman.debug "Finding possible SQL calls using constantized()"
  calls.concat tracker.find_call(:methods => @sql_targets).select { |result| constantize_call? result }

  connect_targets = active_record_models.keys + [nil, :"ActiveRecord::Base"]
  calls.concat tracker.find_call(:targets => connect_targets, :methods => @connection_calls, :chained => true).select { |result| connect_call? result }

  Brakeman.debug "Finding calls to named_scope or scope"
  calls.concat find_scope_calls

  Brakeman.debug "Checking version of Rails for CVE issues"
  check_rails_versions_against_cve_issues

  Brakeman.debug "Processing possible SQL calls"
  calls.each { |call| process_result call }

  check_CVE_2014_0080
end












#safe_value?(exp) ⇒ Boolean













Returns:


    

  • 
(Boolean)

    • 










545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568




# File 'lib/brakeman/checks/check_sql.rb', line 545

def safe_value? exp
  return true unless sexp? exp

  case exp.node_type
  when :str, :lit, :const, :colon2, :nil, :true, :false
    true
  when :call
    if exp.method == :to_s
      safe_value? exp.target
    else
      IGNORE_METHODS_IN_SQL.include? exp.method or
      quote_call? exp or
      exp.method.to_s.end_with? "_id"
    end
  when :if
    safe_value? exp.then_clause and safe_value? exp.else_clause
  when :block, :rlist
    safe_value? exp.last
  when :or
    safe_value? exp.lhs and safe_value? exp.rhs
  else
    false
  end
end












#scope_call_hash(call, name, method) ⇒ Object










102
103
104




# File 'lib/brakeman/checks/check_sql.rb', line 102

def scope_call_hash(call, name, method)
  { :call => call, :location => { :type => :class, :class => name }, :method => :named_scope }
end












#string_building?(exp) ⇒ Boolean













Returns:


    

  • 
(Boolean)

    • 










530
531
532
533
534
535
536
537




# File 'lib/brakeman/checks/check_sql.rb', line 530

def string_building? exp
  return false unless call? exp and STRING_METHODS.include? exp.method

  node_type? exp.target, :str, :dstr, :string_interp or
  node_type? exp.first_arg, :str, :dstr, :string_interp or
  string_building? exp.target or
  string_building? exp.first_arg
end












#unsafe_sql?(exp, ignore_hash = false) ⇒ Boolean







Checks the given expression for unsafe SQL values. If an unsafe value is found, returns that value (may be the given exp or a subexpression).


Otherwise, returns false/nil.








Returns:


    

  • 
(Boolean)

    • 










405
406
407
408
409
410




# File 'lib/brakeman/checks/check_sql.rb', line 405

def unsafe_sql? exp, ignore_hash = false
  return unless sexp?(exp)

  dangerous_value = find_dangerous_value exp, ignore_hash
  safe_value?(dangerous_value) ? false : dangerous_value
end












#unsafe_string_interp?(exp) ⇒ Boolean







Returns value if interpolated value is not something safe








Returns:


    

  • 
(Boolean)

    • 










370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399




# File 'lib/brakeman/checks/check_sql.rb', line 370

def unsafe_string_interp? exp
  if node_type? exp, :string_eval, :evstr
    value = exp.value
  else
    value = exp
  end

  if not sexp? value
    nil
  elsif call? value and value.method == :to_s
    unsafe_string_interp? value.target
  else
    case value.node_type
    when :or
      unsafe_string_interp?(value.lhs) || unsafe_string_interp?(value.rhs)
    when :string_interp, :dstr
      if dangerous = check_string_interp(value)
        return dangerous
      end
    else
      if safe_value? value
        nil
      elsif string_building? value
        check_for_string_building value
      else
        value
      end
    end
  end
end












#upgrade_version?(versions) ⇒ Boolean













Returns:


    

  • 
(Boolean)

    • 










656
657
658
659
660
661
662




# File 'lib/brakeman/checks/check_sql.rb', line 656

def upgrade_version? versions
  versions.each do |low, high, upgrade|
    return upgrade if version_between? low, high
  end

  false
end