Class: Spektr::Checks::JsonEntityEscape

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/json_entity_escape.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #full_receiver, #model_attribute?, #receivers_for, #should_run?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ JsonEntityEscape 



5
6
7
8
9
10
 
# File 'lib/spektr/checks/json_entity_escape.rb', line 5

def initialize(app, target)
  super
  @name = "HTML escaping is disabled for JSON output"
  @type = "Cross-Site Scripting"
  @targets = ["Spektr::Targets::Config", "Spektr::Targets::Base"]
end

Instance Method Details

#run ⇒ Object 



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
 
# File 'lib/spektr/checks/json_entity_escape.rb', line 12

def run
  return unless super
  if @app.production_config
    config = @app.production_config.find_calls(:escape_html_entities_in_json=).first
  end
  if config and full_receiver(config) == "config.active_support" && config.arguments.arguments.first.type == :false_node
    warn! @app.production_config.path, self, nil, "HTML entities in JSON are not escaped by default"
  end

  if @target.find_calls(:escape_html_entities_in_json=, 'ActiveSupport'.to_sym).any?
    warn! @target, self, calls.first.location, "HTML entities in JSON are not escaped by default"
  end
  calls = @target.find_calls(:escape_html_entities_in_json=, 'JSON::Encoding'.to_sym)
  calls.each do |call|
    if full_receiver(call) == 'ActiveSupport.JSON.Encoding'
      warn! @target, self, calls.first.location, "HTML entities in JSON are not escaped by default"
    end
  end
end