class Brakeman::CheckPathname
Public Instance Methods
check_pathname_join()
click to toggle source
# File lib/brakeman/checks/check_pathname.rb, line 20 def check_pathname_join pathname_methods = [ :'Pathname.new', :'Pathname.getwd', :'Pathname.glob', :'Pathname.pwd', ] tracker.find_call(targets: pathname_methods, method: :join, nested: true).each do |result| check_result result end end
check_rails_root_join()
click to toggle source
# File lib/brakeman/checks/check_pathname.rb, line 14 def check_rails_root_join tracker.find_call(target: :'Rails.root', method: :join, nested: true).each do |result| check_result result end end
check_result(result)
click to toggle source
# File lib/brakeman/checks/check_pathname.rb, line 33 def check_result result return unless original? result result[:call].each_arg do |arg| if match = has_immediate_user_input?(arg) warn :result => result, :warning_type => "Path Traversal", :warning_code => :pathname_traversal, :message => "Absolute paths in `Pathname#join` cause the entire path to be relative to the absolute path, ignoring any prior values", :user_input => match, :confidence => :high, :cwe_id => [22] end end end
run_check()
click to toggle source
# File lib/brakeman/checks/check_pathname.rb, line 8 def run_check check_rails_root_join check_pathname_join end