Class: Brakeman::CheckValidationRegex

Inherits:
BaseCheck show all
Defined in:
lib/brakeman/checks/check_validation_regex.rb

Overview

Reports any calls to validates_format_of which do not use \A and \z as anchors in the given regular expression.

For example:

#Allows anything after new line validates_format_of :user_name, :with => /^w+$/

Constant Summary collapse

WITH = 
Sexp.new(:lit, :with)
FORMAT = 
Sexp.new(:lit, :format)

Constants inherited from BaseCheck

BaseCheck::CONFIDENCE

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from BaseCheck

#tracker, #warnings

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseCheck

#add_result, inherited, #initialize, #process_call, #process_cookies, #process_default, #process_dstr, #process_if, #process_params

Methods included from Util

#array?, #block?, #call?, #camelize, #class_name, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module

Methods inherited from SexpProcessor

#in_context, #initialize, #process, processors, #scope

Constructor Details

This class inherits a constructor from Brakeman::BaseCheck

Instance Method Details

#check_regex(value, validator) ⇒ Object

Issue warning if the regular expression does not use \A and \z



64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 64

def check_regex value, validator
  return unless regexp? value

  regex = value.value.inspect
  unless regex =~ /\A\/\\A.*\\(z|Z)\/(m|i|x|n|e|u|s|o)*\z/
    warn :model => @current_model,
    :warning_type => "Format Validation",
    :warning_code => :validation_regex,
    :message => "Insufficient validation for '#{get_name validator}' using #{regex}. Use \\A and \\z as anchors",
    :line => value.line,
    :confidence => CONFIDENCE[:high]
  end
end

#get_name(validator) ⇒ Object

Get the name of the attribute being validated.



79
80
81
82
83
84
85
86
87
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 79

def get_name validator
  name = validator[1]

  if sexp? name
    name.value
  else
    name
  end
end

#process_validates(validator) ⇒ Object

Check validates …, :format => …



47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 47

def process_validates validator
  hash_arg = validator.last
  return unless hash? hash_arg

  value = hash_access(hash_arg, FORMAT)

  if hash? value
    value = hash_access(value, WITH)
  end

  if value
    check_regex value, validator
  end
end

#process_validates_format_of(validator) ⇒ Object

Check validates_format_of



40
41
42
43
44
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 40

def process_validates_format_of validator
  if value = hash_access(validator.last, WITH)
    check_regex value, validator
  end
end

#run_check ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/brakeman/checks/check_validation_regex.rb', line 18

def run_check
  active_record_models.each do |name, model|
    @current_model = name
    format_validations = model.options[:validates_format_of]

    if format_validations
      format_validations.each do |v|
        process_validates_format_of v
      end
    end

    validates = model.options[:validates]

    if validates
      validates.each do |v|
        process_validates v
      end
    end
  end
end