brakeman.html

<!DOCTYPE HTML SYSTEM>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Brakeman Report</title>
  <script>
    function toggle(context) {
      var elem = document.getElementById(context);

      if (elem.style.display != "block")
        elem.style.display = "block";
      else
        elem.style.display = "none";

      elem.parentNode.scrollIntoView();
    }
  </script>
  <style>
    /* CSS style used for HTML reports */

body {
  font-family: sans-serif;
  color: #161616;
}

a {
  color: #161616;
}

p {
  font-weight: bold;
  font-size: 11pt;
  color: #2D0200;
 }

 th {
   background-color: #980905;
   border-bottom: 5px solid #530200;
   color: white;
   font-size: 11pt;
   padding: 1px 8px 1px 8px;
 }

 td {
   border-bottom: 2px solid white;
   font-family: monospace;
   padding: 5px 8px 1px 8px;
 }

 table {
   background-color: #FCF4D4;
   border-collapse: collapse;
 }

 h1 {
   color: #2D0200;
   font-size: 14pt;
 }

 h2 {
   color: #2D0200;
   font-size: 12pt;
 }

 span.high-confidence {
   font-weight:bold;
   color: red;
 }

 span.med-confidence {
 }

 span.weak-confidence {
   color:gray;
 }

 div.warning_message {
   cursor: pointer;
 }

 div.warning_message:hover {
   background-color: white;
 }

 table caption {
   background-color: #FFE;
   padding: 2px;
 }

 table.context {
   margin-top: 5px;
   margin-bottom: 5px;
   border-left: 1px solid #90e960;
   color: #212121;
 }

 tr.context {
   background-color: white;
 }

 tr.first {
   border-top: 1px solid #7ecc54;
   padding-top: 2px;
 }

 tr.error {
  background-color: #f4c1c1 !important
 }

 tr.near_error {
  background-color: #f4d4d4 !important
 }

 tr.alt {
   background-color: #e8f4d4;
 }

 td.context {
   padding: 2px 10px 0px 6px;
   border-bottom: none;
 }

 td.context_line {
   padding: 2px 8px 0px 7px;
   border-right: 1px solid #b3bda4;
   border-bottom: none;
   color: #6e7465;
 }

 pre.context {
   margin-bottom: 1px;
 }

 .user_input {
   background-color: #fcecab;
 }

 div.render_path {
   display: none;
   background-color: #ffe;
   padding: 5px;
   margin: 2px 0px 2px 0px;
 }

 div.template_name {
   cursor: pointer;
 }

 div.template_name:hover {
   background-color: white;
 }

  </style>
</head>
<body>

<h1>Brakeman Report</h1>
<table>
  <tr>
    <th>Application Path</th>
    <th>Rails Version</th>
    <th>Brakeman Version</th>
    <th>Report Time</th>
    <th>Checks Performed</th>
  </tr>
  <tr>
    <td>/Users/renee/Spring2014UWClass/class_mngmt</td>
    <td>4.0.4</td>
    <td>2.5.0
    <td>
      2014-05-29 23:05:45 -0400<br><br>
      1.82014 seconds
    </td>
    <td>BasicAuth, ContentTag, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NumberToCurrency, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, ResponseSplitting, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing</td>
  </tr>
</table>
<br>
<h2 id='summary'>Summary</h2>
<table>
  <tr>
    <th>Scanned/Reported</th>
    <th>Total</th>
  </tr>
  <tr>
    <td>Controllers</td>
    <td>5</td>
  </tr>
  <tr>
    <td>Models</td>
    <td>3</td>
  </tr>
  <tr>
    <td>Templates</td>
    <td>17</td>
  </tr>
  <tr>
    <td>Errors</td>
    <td>0</td>
  </tr>
  <tr>
    <td>Security Warnings</td>
    <td>3 <span class='high-confidence'>(2)</span></td>
  </tr>
  
  <tr>
    <td>Ignored Warnings</td>
    <td>0</td>
  </tr>
  
</table>
<br>
<table>
  <tr>
    <th>Warning Type</th>
    <th>Total</th>
  </tr>
  
  <tr>
    <td>Cross Site Scripting</td>
    <td>1</td>
  </tr>
  
  <tr>
    <td>Dangerous Eval</td>
    <td>1</td>
  </tr>
  
  <tr>
    <td>Session Setting</td>
    <td>1</td>
  </tr>
  
</table>
<br>
<h2>Security Warnings</h2>  
<table>
  <tr>
    <th>Confidence</th>
    <th>Class</th>
    <th>Method</th>
    <th>Warning Type</th>
    <th>Message</th>
  </tr>
  
  <tr>
    <td><span class='high-confidence'>High</span></td>
    <td>StudentsController</td>
    <td>index</td>
    <td><a rel="no-referrer" href="http://brakemanscanner.org/docs/warning_types/dangerous_eval/">Dangerous Eval</a></td>
    <td><div class='warning_message' onClick="toggle('context1');toggle('message1');toggle('full_message1')" >User input in eval near line 9: eval(<span class="user_input">params[:test].to_s</span>)<table id='context1' class='context' style='display:none'><caption>app/controllers/students_controller.rb</caption>        <tr class='context first'>
          <td class='context_line'>
            <pre class='context'>4</pre>
          </td>
          <td class='context'>
            <pre class='context'>  before_action :set_student, only: [:show, :edit, :update, :destroy]</pre>
          </td>
        </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>6</pre>
            </td>
            <td class='context'>
              <pre class='context'>  # GET /students</pre>
            </td>
          </tr>
          <tr class='context'>
            <td class='context_line'>
              <pre class='context'>7</pre>
            </td>
            <td class='context'>
              <pre class='context'>  # GET /students.json</pre>
            </td>
          </tr>
          <tr class='context alt near_error'>
            <td class='context_line'>
              <pre class='context'>8</pre>
            </td>
            <td class='context'>
              <pre class='context'>  def index</pre>
            </td>
          </tr>
          <tr class='context error'>
            <td class='context_line'>
              <pre class='context'>9</pre>
            </td>
            <td class='context'>
              <pre class='context'>    eval params[:test].to_s</pre>
            </td>
          </tr>
          <tr class='context alt near_error'>
            <td class='context_line'>
              <pre class='context'>10</pre>
            </td>
            <td class='context'>
              <pre class='context'>    &quot;{hello: &#39;world&#39;}&quot;</pre>
            </td>
          </tr>
          <tr class='context'>
            <td class='context_line'>
              <pre class='context'>11</pre>
            </td>
            <td class='context'>
              <pre class='context'>    #Student.find_by_sql &#39;drop table students;&#39;</pre>
            </td>
          </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>12</pre>
            </td>
            <td class='context'>
              <pre class='context'>    @students = Student.all</pre>
            </td>
          </tr>
          <tr class='context'>
            <td class='context_line'>
              <pre class='context'>13</pre>
            </td>
            <td class='context'>
              <pre class='context'>    @title = &quot;Students Page&quot;</pre>
            </td>
          </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>14</pre>
            </td>
            <td class='context'>
              <pre class='context'>    @read_more = params[:read_more]</pre>
            </td>
          </tr>
</table></div></td>
  </tr>
  
  <tr>
    <td><span class='high-confidence'>High</span></td>
    <td></td>
    <td></td>
    <td><a rel="no-referrer" href="http://brakemanscanner.org/docs/warning_types/session_setting/">Session Setting</a></td>
    <td><div class='warning_message' onClick="toggle('context2');toggle('message2');toggle('full_message2')" >Session secret should not be included in version control near line 12<table id='context2' class='context' style='display:none'><caption>config/initializers/secret_token.rb</caption>        <tr class='context first'>
          <td class='context_line'>
            <pre class='context'>7</pre>
          </td>
          <td class='context'>
            <pre class='context'># no regular words or you&#39;ll be exposed to dictionary attacks.</pre>
          </td>
        </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>8</pre>
            </td>
            <td class='context'>
              <pre class='context'># You can use `rake secret` to generate a secure secret key.</pre>
            </td>
          </tr>
          <tr class='context'>
            <td class='context_line'>
              <pre class='context'>10</pre>
            </td>
            <td class='context'>
              <pre class='context'># Make sure your secret_key_base is kept private</pre>
            </td>
          </tr>
          <tr class='context alt near_error'>
            <td class='context_line'>
              <pre class='context'>11</pre>
            </td>
            <td class='context'>
              <pre class='context'># if you&#39;re sharing your code publicly.</pre>
            </td>
          </tr>
          <tr class='context error'>
            <td class='context_line'>
              <pre class='context'>12</pre>
            </td>
            <td class='context'>
              <pre class='context'>ClassMngmt::Application.config.secret_key_base = &#39;382c8d064008e1d907f2e82820f51798f5e3d5ea81bd5b0aeff3a6fa3164a09cb024195072a10f552c3ab2f7d31574beaba90c2e8910c295b6d055de650c603c&#39;</pre>
            </td>
          </tr>
</table></div></td>
  </tr>
  
</table>
<p>View Warnings</p>
<table>
  <tr>
    <th>Confidence</th>
    <th>Template</th>
    <th>Warning Type</th>
    <th>Message</th>
  </tr>

  <tr>
    <td><span class='weak-confidence'>Weak</span></td>
    <td>
      
        students/index (StudentsController#index)
      
    </td>
    <td><a rel="no-referrer" href="http://brakemanscanner.org/docs/warning_types/cross_site_scripting">Cross Site Scripting</a></td>
    <td><div class='warning_message' onClick="toggle('context3');toggle('message3');toggle('full_message3')" >Unescaped model attribute near line 27: short_bio(<span class="user_input">Student.new</span>)<table id='context3' class='context' style='display:none'><caption>app/views/students/index.html.erb</caption>        <tr class='context first'>
          <td class='context_line'>
            <pre class='context'>22</pre>
          </td>
          <td class='context'>
            <pre class='context'>  &lt;tbody&gt;</pre>
          </td>
        </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>23</pre>
            </td>
            <td class='context'>
              <pre class='context'>    &lt;% @students.each do |student| %&gt;</pre>
            </td>
          </tr>
          <tr class='context'>
            <td class='context_line'>
              <pre class='context'>24</pre>
            </td>
            <td class='context'>
              <pre class='context'>      &lt;tr&gt;</pre>
            </td>
          </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>25</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= student.full_name %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
          <tr class='context near_error'>
            <td class='context_line'>
              <pre class='context'>26</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= student.age %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
          <tr class='context alt error'>
            <td class='context_line'>
              <pre class='context'>27</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= raw short_bio student %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
          <tr class='context near_error'>
            <td class='context_line'>
              <pre class='context'>28</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= student.profession %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>29</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= student.favorite_ice_cream_flavor %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
          <tr class='context'>
            <td class='context_line'>
              <pre class='context'>30</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= student.email %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
          <tr class='context alt'>
            <td class='context_line'>
              <pre class='context'>31</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= link_to &#39;Show&#39;, student %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
          <tr class='context'>
            <td class='context_line'>
              <pre class='context'>32</pre>
            </td>
            <td class='context'>
              <pre class='context'>        &lt;td&gt;&lt;%= link_to &#39;Edit&#39;, edit_student_path(student) %&gt;&lt;/td&gt;</pre>
            </td>
          </tr>
</table></div></td>
  </tr>

</table>
</body></html>