# Brakeman Report

Application Path | Rails Version | Brakeman Version | Report Time | Checks Performed
--- | --- | --- | --- | ---
/Users/cktricky/tmp/railsgoat | 3.2.11 | 2.6.1 | 2014-07-29 12:41:05 -0500 2.412842 seconds | BasicAuth, ContentTag, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NumberToCurrency, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, ResponseSplitting, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing

## Summary

Scanned/Reported | Total
--- | ---
Controllers | 17
Models | 11
Templates | 73
Errors | 0
Security Warnings | 27 (16)
Ignored Warnings | 0

Warning Type | Total
--- | ---
Attribute Restriction | 1
Command Injection | 1
Cross Site Scripting | 5
Cross-Site Request Forgery | 1
Denial of Service | 2
File Access | 1
Format Validation | 1
Mass Assignment | 5
Remote Code Execution | 5
SQL Injection | 3
Session Setting | 2

## Security Warnings

Confidence | Class | Method | Warning Type | Message
--- | --- | --- | --- | ---
High | BenefitFormsController | download | File Access | Parameter value used in file name near line 11: send_file(params[:type].constantize.new(params[:name]...Parameter value used in file name near line 11: send_file(params[:type].constantize.new(params[:name]), :disposition => "attachment")
app/controllers/benefit_forms_controller.rb
    7
      def download
    8
       begin
    9
         path = params[:name]
    10
         file = params[:type].constantize.new(path)
    11
         send_file file, :disposition => 'attachment'
    12
       rescue
    13
         redirect_to user_benefit_forms_path(:user_id => current_user.user_id)
    14
       end
    15
      end
High | Api::V1::MobileController | show | Remote Code Execution | Unsafe reflection method constantize called with parameter value near line 9: params[:class].classify...Unsafe reflection method constantize called with parameter value near line 9: params[:class].classify.constantize
app/controllers/api/v1/mobile_controller.rb
    5
      respond_to :json
    7
      def show
    8
        if params[:class]
    9
          model = params[:class].classify.constantize
    10
          respond_with model.find(params[:id]).to_json
    11
        end
    12
      end
    14
      def index
High | Api::V1::MobileController | index | Remote Code Execution | Unsafe reflection method constantize called with parameter value near line 16: params[:class].classif...Unsafe reflection method constantize called with parameter value near line 16: params[:class].classify.constantize
app/controllers/api/v1/mobile_controller.rb
    11
        end
    12
      end
    14
      def index
    15
        if params[:class]
    16
          model = params[:class].classify.constantize
    17
          respond_with model.all.to_json
    18
        else
    19
          respond_with nil.to_json
    20
        end
    21
      end
High | BenefitFormsController | download | Remote Code Execution | Unsafe reflection method constantize called with parameter value near line 10: params[:type].constant...Unsafe reflection method constantize called with parameter value near line 10: params[:type].constantize
app/controllers/benefit_forms_controller.rb
    5
      end
    7
      def download
    8
       begin
    9
         path = params[:name]
    10
         file = params[:type].constantize.new(path)
    11
         send_file file, :disposition => 'attachment'
    12
       rescue
    13
         redirect_to user_benefit_forms_path(:user_id => current_user.user_id)
    14
       end
    15
      end
High |  |  | Session Setting | Session cookies should be set to HTTP only near line 3
config/initializers/session_store.rb
    1
    # Be sure to restart your server when you modify this file.
    3
    Railsgoat::Application.config.session_store :cookie_store, key: '_railsgoat_session', httponly: false
    5
    # Use the database for sessions instead of the cookie-based default,
    6
    # which shouldn't be used to store highly confidential information
    7
    # (create the session table with "rails generate session_migration")
    8
    # Railsgoat::Application.config.session_store :active_record_store
High |  |  | Session Setting | Session secret should not be included in version control near line 7
config/initializers/secret_token.rb
    3
    # Your secret key for verifying the integrity of signed cookies.
    4
    # If you change this key, all old signed cookies will become invalid!
    5
    # Make sure the secret is at least 30 characters and all random,
    6
    # no regular words or you'll be exposed to dictionary attacks.
    7
    Railsgoat::Application.config.secret_token = '2f1d90a26236c3245d96f5606c201a780dc9ca687e5ed82b45e211bb5dc84c1870f61ca9e002dad5dd8a149c9792d8f07f31a9575065cca064bd6af44f8750e4'
High | UsersController | update | SQL Injection | Possible SQL injection near line 34: User.find(:first, :conditions => ("user_id = '#{params[:user][:u...Possible SQL injection near line 34: User.find(:first, :conditions => ("user_id = '#{params[:user][:user_id]}'"))
app/controllers/users_controller.rb
    29
        # user = current_user
    31
        # Still an Insecure DoR vulnerability
    32
        #user = User.find(:first, :conditions => ["user_id = ?", "#{params[:user][:user_id]}"])
    34
        user = User.find(:first, :conditions => "user_id = '#{params[:user][:user_id]}'")
    35
        if user
    36
          user.skip_user_id_assign = true
    37
          user.skip_hash_password = true
    38
          user.update_attributes(params[:user].reject { |k| %w(password password_confirmation user_id).include? k })
    39
          if !(params[:user][:password].empty?) && (params[:user][:password] == params[:user][:password_confirmation])
High |  |  | SQL Injection | Rails 3.2.11 contains a SQL injection vulnerability (CVE-2013-6417). Upgrade to 3.2.16
Medium | Benefits | Benefits.make_backup | Command Injection | Possible command injection near line 15: system("cp #{(local full_file_name)} #{(local data_path)}/ba...Possible command injection near line 15: system("cp #{(local full_file_name)} #{(local data_path)}/bak#{Time.now.to_i}_#{(local file).original_filename}")
app/models/benefits.rb
    10
        make_backup(file, data_path, full_file_name) if backup == "true"
    11
      end
    13
      def self.make_backup(file, data_path, full_file_name)
    14
        if File.exists?(full_file_name)
    15
          silence_streams(STDERR) { system("cp #{full_file_name} #{data_path}/bak#{Time.now.to_i}_#{file.original_filename}") }
    16
        end
    17
      end
    19
    =begin
    20
      def self.make_backup(file, data_path, full_file_name)
Medium |  |  | Denial of Service | Rails 3.2.11 has a denial of service vulnerability in ActiveRecord: upgrade to 3.2.13 or patch
Medium |  |  | Remote Code Execution | Rails 3.2.11 with globbing routes is vulnerable to directory traversal and remote code execution. Pat...Rails 3.2.11 with globbing routes is vulnerable to directory traversal and remote code execution. Patch or upgrade to 3.2.18
config/routes.rb
Medium | Analytics | hits_by_ip | SQL Injection | Possible SQL injection near line 4: select("#{(local col)}")
app/models/analytics.rb
    1
    class Analytics < ActiveRecord::Base
    2
      attr_accessible :ip_address, :referrer, :user_agent
    4
      scope :hits_by_ip, ->(ip,col="*") { select("#{col}").where(:ip_address => ip).order("id DESC")}
    6
      def self.count_by_col(col)
    7
        calculate(:count, col)
    8
      end
Medium | PasswordResetsController | reset_password | Remote Code Execution | Marshal.load called with parameter value near line 5: Marshal.load(Base64.decode64(params[:user]))
app/controllers/password_resets_controller.rb
    1
    class PasswordResetsController < ApplicationController
    2
      skip_before_filter :authenticated
    4
      def reset_password
    5
        user = Marshal.load(Base64.decode64(params[:user])) unless params[:user].nil?
    7
        if user && params[:password] && params[:confirm_password] && params[:password] == params[:confirm_password]
    8
          user.password = params[:password]
    9
          user.save!
    10
          flash[:success] = "Your password has been reset please login"
Medium |  |  | Cross Site Scripting | Rails 3.2.11 has a vulnerability in number helpers (CVE-2014-0081). Upgrade to Rails version 3.2.17
Medium |  |  | Denial of Service | Rails 3.2.11 has a denial of service vulnerability (CVE-2013-6414). Upgrade to Rails version 3.2.16

Controller Warnings

Confidence | Controller | Warning Type | Message
--- | --- | --- | ---
High | ApplicationController | Cross-Site Request Forgery | 'protect_from_forgery' should be called in ApplicationController

Model Warnings

Confidence | Model | Warning Type | Message
--- | --- | --- | ---
High | Benefits | Attribute Restriction | Mass assignment is not restricted using attr_accessible
High | User | Format Validation | Insufficient validation for 'email' using /.+@.+\..+/i. Use \A and \z as anchors near line 12
app/models/user.rb
    7
                           :length => {:within => 6..40},
    8
                           :on => :create,
    9
                           :if => :password
    10
    =begin
    11
      validates :password, :presence => true,
    12
                            :confirmation => true,
    13
                            :if => :password,
    14
                            :format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/}
    15
    =end
    16
      validates_presence_of :email
    17
      validates_uniqueness_of :email
High | User | Mass Assignment | Potentially dangerous attribute available for mass assignment: :admin
Weak | KeyManagement | Mass Assignment | Potentially dangerous attribute available for mass assignment: :user_id
Weak | Message | Mass Assignment | Potentially dangerous attribute available for mass assignment: :creator_id
Weak | Message | Mass Assignment | Potentially dangerous attribute available for mass assignment: :receiver_id
Weak | User | Mass Assignment | Potentially dangerous attribute available for mass assignment: :user_id

View Warnings

Confidence | Template | Warning Type | Message
--- | --- | --- | ---
High | layouts/application (AdminController#dashboard) | Cross Site Scripting | Unescaped cookie value near line 12: cookies[:font]
app/views/layouts/application.html.erb
    7
      <%= csrf_meta_tags %> <!-- <~ What is this for? I hear it helps w/ JS and Sea-surfing.....whatevz -->
    8
      <!-- bootstrap css -->
    9
    <%
    10
    if cookies[:font]
    11
    %>
    12
    <style>body { font-size:<%= raw cookies[:font] %> !important;}</style>
    13
    <%
    14
    end
    15
    %>
    17
    </head>
High | pay/index (PayController#index) | Cross Site Scripting | Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 188: sanitize(user...Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 188: sanitize(user_pay_path(:format => "json", :user_id => (current_user.user_id), :id => (current_user.user_id)).inspect)
app/views/pay/index.html.erb
    183
      endpoint to retrieve direct deposit entries and finally, provide parseDirectDepositInfo
    184
      with the response from the endpoint in order to populate the data table.
    185
    */
    186
    function populateTable() {
    187
      $('#data_table').dataTable().fnClearTable();
    188
      $.ajax({
    189
          url: <%= sanitize(user_pay_path(:format => "json", :user_id => current_user.user_id, :id => current_user.user_id).inspect) %>,
    190
        type: "GET",
    191
        success: function(response) {
    192
        parseDirectDepostInfo(response);
    193
        },
High | pay/index (PayController#index) | Cross Site Scripting | Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 239: sanitize(decr...Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 239: sanitize(decrypted_bank_acct_num_user_pay_index_path(:format => "json", :user_id => (current_user.user_id)).inspect)
app/views/pay/index.html.erb
    234
      then passed to decryptShow();
    235
    */
    236
    $("#decrypt_btn").click(function(event){
    237
      var valuesToSubmit = $("#decrypt_form").serialize();
    238
      event.preventDefault();
    239
      $.ajax({
    240
          url: <%= sanitize(decrypted_bank_acct_num_user_pay_index_path(:format => "json", :user_id => current_user.user_id).inspect) %>,
    241
        data: valuesToSubmit,
    242
        type: "POST",
    243
        success: function(response) {
    244
        $('#success').show(500).delay(1500).fadeOut();
High | pay/index (PayController#index) | Cross Site Scripting | Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 261: sanitize(upda...Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 261: sanitize(update_dd_info_user_pay_index_path(:format => "json").inspect)
app/views/pay/index.html.erb
    256
      is called in order to update the dataTable on the page to reflect the latest entry.
    257
    */
    258
    $("#dd_form_btn").click(function(event) {
    259
         var valuesToSubmit = $("#bank_info_form").serialize();
    260
         event.preventDefault();
    261
         $.ajax({
    262
          url: <%= sanitize(update_dd_info_user_pay_index_path(:format => "json").inspect) %>,
    263
        data: valuesToSubmit,
    264
        type: "POST",
    265
        success: function(response) {
    266
        $('#success').show(500).delay(1500).fadeOut();