From 88ed0e2b500ce775a7f2eaacb8a524cf8b7ca452 Mon Sep 17 00:00:00 2001 From: cktricky Date: Tue, 29 Jul 2014 17:56:33 -0500 Subject: [PATCH] need to create the bar graph version, write up the remaining parts of the tutorial, and ensure it did not break the DOM vuln --- app/controllers/dashboard_controller.rb | 14 + app/views/dashboard/home.html.erb | 43 +- .../layouts/dashboard/_bar_graph.html.erb | 1 + .../dashboard/_dashboard_stats.html.erb | 114 +- config/routes.rb | 1 + report.html | 1606 +++++++++++++++++ 6 files changed, 1714 insertions(+), 65 deletions(-) create mode 100644 app/views/layouts/dashboard/_bar_graph.html.erb create mode 100644 report.html diff --git a/app/controllers/dashboard_controller.rb b/app/controllers/dashboard_controller.rb index 4bb1c20..8b351bf 100755 --- a/app/controllers/dashboard_controller.rb +++ b/app/controllers/dashboard_controller.rb @@ -9,4 +9,18 @@ class DashboardController < ApplicationController cookies[:font] = params[:font] end end + + def change_graph + self.try(params[:graph]) + end + + def bar_graph + render :partial => "layouts/dashboard/bar_graph" + end + + def pie_charts + @user = current_user + render :partial => "layouts/dashboard/dashboard_stats" + end + end diff --git a/app/views/dashboard/home.html.erb b/app/views/dashboard/home.html.erb index 8fc9788..48ef2e3 100755 --- a/app/views/dashboard/home.html.erb +++ b/app/views/dashboard/home.html.erb @@ -2,9 +2,34 @@
- <% if @user.paid_time_off %> - <%= render :partial => "layouts/dashboard/dashboard_stats"%> - <% end %> +
+
+
+ Current Statistics +
+ +
+
+ + + + + + +
+
+ +
+
+ <% if @user.paid_time_off %> + <%= render :partial => "layouts/dashboard/dashboard_stats"%> + <% end %> +
+
+
+
+
+
@@ -159,9 +184,21 @@ function pieChartHome() { } +$("#change_to_bar_graph").click(function(event) { + event.preventDefault(); + $("#charts_body").load(<%= sanitize change_graph_dashboard_index_path(:graph => "bar_graph").inspect %>); + +}) + +$("#change_to_pie_charts").click(function(event) { + event.preventDefault(); + $("#charts_body").load(<%= sanitize change_graph_dashboard_index_path(:graph => "pie_charts").inspect %>); +}) + $(document).ready( makeActive, pieChartHome() ); + diff --git a/app/views/layouts/dashboard/_bar_graph.html.erb b/app/views/layouts/dashboard/_bar_graph.html.erb new file mode 100644 index 0000000..92e293d --- /dev/null +++ b/app/views/layouts/dashboard/_bar_graph.html.erb @@ -0,0 +1 @@ +

Hello

\ No newline at end of file diff --git a/app/views/layouts/dashboard/_dashboard_stats.html.erb b/app/views/layouts/dashboard/_dashboard_stats.html.erb index f2d9c2f..3345ff0 100755 --- a/app/views/layouts/dashboard/_dashboard_stats.html.erb +++ b/app/views/layouts/dashboard/_dashboard_stats.html.erb @@ -1,64 +1,54 @@ -
-
-
- Current Statistics -
- -
-
- - - -
-
- -
-
-
-
-
- <%= @user.paid_time_off.pto_days_remaining %> -
-
- Available PTO -
-
-
-
- <%= @user.paid_time_off.sick_days_taken %> -
-
- Sick Days Taken -
-
-
-
- <%= @user.work_info.income %> -
-
- Income -
-
-
-
- <%= @user.performance.last.score %> -
-
- Performance Score -
-
-
-
- <%= @user.retirement.total %> -
-
- 401k -
-
-
-
-
-
-
+ +
+
+
+ <%= @user.paid_time_off.pto_days_remaining %> +
+
+ Available PTO +
+
+
+
+ <%= @user.paid_time_off.sick_days_taken %> +
+
+ Sick Days Taken +
+
+
+
+ <%= @user.work_info.income %> +
+
+ Income +
+
+
+
+ <%= @user.performance.last.score %> +
+
+ Performance Score +
+
+
+
+ <%= @user.retirement.total %> +
+
+ 401k +
+
+
+
+
+ + + diff --git a/config/routes.rb b/config/routes.rb index 72f97a4..35ef733 100755 --- a/config/routes.rb +++ b/config/routes.rb @@ -88,6 +88,7 @@ Railsgoat::Application.routes.draw do resources :dashboard do collection do get "home" + get "change_graph" end end diff --git a/report.html b/report.html new file mode 100644 index 0000000..d0b0aeb --- /dev/null +++ b/report.html @@ -0,0 +1,1606 @@ + + + + +Brakeman Report + + + + + +

Brakeman Report

+ + + + + + + + + + + + + + +
Application PathRails VersionBrakeman VersionReport TimeChecks Performed
/Users/cktricky/tmp/railsgoat3.2.112.6.1 + + 2014-07-29 12:41:05 -0500

+ 2.412842 seconds + 		BasicAuth, ContentTag, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NumberToCurrency, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, ResponseSplitting, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing
+
+

Summary

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Scanned/ReportedTotal
Controllers17
Models11
Templates73
Errors0
Security Warnings27 (16)
Ignored Warnings0
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Warning TypeTotal
Attribute Restriction1
Command Injection1
Cross Site Scripting5
Cross-Site Request Forgery1
Denial of Service2
File Access1
Format Validation1
Mass Assignment5
Remote Code Execution5
SQL Injection3
Session Setting2
+
+

Security Warnings

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ConfidenceClassMethodWarning TypeMessage
HighBenefitFormsControllerdownloadFile Access
Parameter value used in file name near line 11: send_file(params[:type].constantize.new(params[:name]... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HighApi::V1::MobileControllershowRemote Code Execution
Unsafe reflection method constantize called with parameter value near line 9: params[:class].classify... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HighApi::V1::MobileControllerindexRemote Code Execution
Unsafe reflection method constantize called with parameter value near line 16: params[:class].classif... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HighBenefitFormsControllerdownloadRemote Code Execution
Unsafe reflection method constantize called with parameter value near line 10: params[:type].constant... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HighSession Setting
Session cookies should be set to HTTP only near line 3 + + + + + + + + + + + + + + + + + + + + + + + +
HighSession Setting
Session secret should not be included in version control near line 7 + + + + + + + + + + + + + + + + + + + +
HighUsersControllerupdateSQL Injection
Possible SQL injection near line 34: User.find(:first, :conditions => ("user_id = '#{params[:user][:u... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HighSQL InjectionRails 3.2.11 contains a SQL injection vulnerability (CVE-2013-6417). Upgrade to 3.2.16
MediumBenefitsBenefits.make_backupCommand Injection
Possible command injection near line 15: system("cp #{(local full_file_name)} #{(local data_path)}/ba... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
MediumDenial of ServiceRails 3.2.11 has a denial of service vulnerability in ActiveRecord: upgrade to 3.2.13 or patch
MediumRemote Code Execution
Rails 3.2.11 with globbing routes is vulnerable to directory traversal and remote code execution. Pat...
MediumAnalyticshits_by_ipSQL Injection
Possible SQL injection near line 4: select("#{(local col)}") + + + + + + + + + + + + + + + + + + + + + + + +
MediumPasswordResetsControllerreset_passwordRemote Code Execution
Marshal.load called with parameter value near line 5: Marshal.load(Base64.decode64(params[:user])) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
MediumCross Site ScriptingRails 3.2.11 has a vulnerability in number helpers (CVE-2014-0081). Upgrade to Rails version 3.2.17
MediumDenial of ServiceRails 3.2.11 has a denial of service vulnerability (CVE-2013-6414). Upgrade to Rails version 3.2.16
+

Controller Warnings

+ + + + + + + + + + + + + + + +
ConfidenceControllerWarning TypeMessage
HighApplicationControllerCross-Site Request Forgery'protect_from_forgery' should be called in ApplicationController

Model Warnings

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ConfidenceModelWarning TypeMessage
HighBenefitsAttribute RestrictionMass assignment is not restricted using attr_accessible
HighUserFormat Validation
Insufficient validation for 'email' using /.+@.+\..+/i. Use \A and \z as anchors near line 12 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HighUserMass AssignmentPotentially dangerous attribute available for mass assignment: :admin
WeakKeyManagementMass AssignmentPotentially dangerous attribute available for mass assignment: :user_id
WeakMessageMass AssignmentPotentially dangerous attribute available for mass assignment: :creator_id
WeakMessageMass AssignmentPotentially dangerous attribute available for mass assignment: :receiver_id
WeakUserMass AssignmentPotentially dangerous attribute available for mass assignment: :user_id

View Warnings

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ConfidenceTemplateWarning TypeMessage
High + + layouts/application (AdminController#dashboard) + + Cross Site Scripting
Unescaped cookie value near line 12: cookies[:font] + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
High + + pay/index (PayController#index) + + Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 188: sanitize(user... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
High + + pay/index (PayController#index) + + Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 239: sanitize(decr... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
High + + pay/index (PayController#index) + + Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 261: sanitize(upda... + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ \ No newline at end of file