Class: Spektr::Checks::LinkToHref

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/link_to_href.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #full_receiver, #model_attribute?, #receivers_for, #should_run?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ LinkToHref

Returns a new instance of LinkToHref.



4
5
6
7
8
9
 
# File 'lib/spektr/checks/link_to_href.rb', line 4

def initialize(app, target)
  super
  @name = "XSS in href param of link_to"
  @type = "Cross-Site Scripting"
  @targets = ["Spektr::Targets::Base", "Spektr::Targets::Controller", "Spektr::Targets::View"]
end

Instance Method Details

#run ⇒ Object

TODO: check for user supplied model attributes too



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
# File 'lib/spektr/checks/link_to_href.rb', line 12

def run
  return unless super
  block_locations = []
  @target.find_calls_with_block(:link_to).each do |call|
    block_locations << call.location
    next unless call.arguments.arguments.first
    ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments.first.inspect}"
    if user_input? call.arguments.arguments.first
      warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
    end
  end

  @target.find_calls(:link_to).each do |call|
    next if block_locations.include? call.location
    next unless call.arguments
    ::Spektr.logger.debug "#{@target.path}  #{call.location.start_line} #{call.arguments.arguments[1].inspect}"
    next unless call.arguments.arguments[1]
    require 'byebug'
    if call.arguments.arguments[1] && call.arguments.arguments[1].respond_to?(:name)
      name = call.arguments.arguments[1].name
    end
    next if name && name =~ /_url$|_path$/
    if user_input? call.arguments.arguments[1]
      warn! @target, self, call.location, "Cross-Site Scripting: Unsafe user supplied value in link_to"
    end
  end
end