Class: RuboCop::Cop::GitlabSecurity::DeepMunge

Inherits:
Cop
  • Object
show all
Defined in:
lib/rubocop/cop/gitlab-security/deep_munge.rb

Overview

Checks for disabling the deep munge security control.

Disabling this security setting can leave the application open to unsafe query generation

See CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.

Examples:


# bad
config.action_dispatch.perform_deep_munge = false

Constant Summary collapse

MSG = 
'Never disable the deep munge security option.'.freeze

Instance Method Summary collapse

Instance Method Details

#on_send(node) ⇒ Object 



22
23
24
25
26
 
# File 'lib/rubocop/cop/gitlab-security/deep_munge.rb', line 22

def on_send(node)
  return unless disable_deep_munge?(node)

  add_offense(node, location: :selector)
end