diff --git a/Gemfile b/Gemfile index 9b3796e..b610803 100755 --- a/Gemfile +++ b/Gemfile @@ -1,7 +1,7 @@ source 'https://rubygems.org' #don't upgrade -gem 'rails', '4.0.12' +gem 'rails', '4.0.13' ruby '2.1.5' diff --git a/Gemfile.lock b/Gemfile.lock index 752a1e0..1ade5ae 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,25 +1,25 @@ GEM remote: https://rubygems.org/ specs: - actionmailer (4.0.12) - actionpack (= 4.0.12) + actionmailer (4.0.13) + actionpack (= 4.0.13) mail (~> 2.5, >= 2.5.4) - actionpack (4.0.12) - activesupport (= 4.0.12) + actionpack (4.0.13) + activesupport (= 4.0.13) builder (~> 3.1.0) erubis (~> 2.7.0) rack (~> 1.5.2) rack-test (~> 0.6.2) - activemodel (4.0.12) - activesupport (= 4.0.12) + activemodel (4.0.13) + activesupport (= 4.0.13) builder (~> 3.1.0) - activerecord (4.0.12) - activemodel (= 4.0.12) + activerecord (4.0.13) + activemodel (= 4.0.13) activerecord-deprecated_finders (~> 1.0.2) - activesupport (= 4.0.12) + activesupport (= 4.0.13) arel (~> 4.0.0) activerecord-deprecated_finders (1.0.3) - activesupport (4.0.12) + activesupport (4.0.13) i18n (~> 0.6, >= 0.6.9) minitest (~> 4.2) multi_json (~> 1.3) @@ -32,13 +32,13 @@ GEM cucumber (>= 1.1.1) rspec-expectations (>= 2.7.0) bcrypt (3.1.9) - better_errors (2.1.0) + better_errors (2.1.1) coderay (>= 1.0.0) erubis (>= 2.6.6) rack (>= 0.9.0) binding_of_caller (0.7.2) debug_inspector (>= 0.0.1) - brakeman (2.6.3) + brakeman (3.0.0) erubis (~> 2.6) fastercsv (~> 1.5) haml (>= 3.0, < 5.0) @@ -79,7 +79,7 @@ GEM multi_json (>= 1.7.5, < 2.0) multi_test (>= 0.1.1) daemons (1.1.9) - database_cleaner (1.3.0) + database_cleaner (1.4.0) debug_inspector (0.0.2) diff-lcs (1.2.5) docile (1.1.5) @@ -92,7 +92,7 @@ GEM execjs (2.2.2) fastercsv (1.5.5) ffi (1.9.6) - foreman (0.76.0) + foreman (0.77.0) dotenv (~> 1.0.2) thor (~> 0.19.1) formatador (0.2.5) @@ -103,12 +103,14 @@ GEM trollop (~> 2.0) gherkin (2.12.2) multi_json (~> 1.3) - guard (2.10.5) + guard (2.11.1) formatador (>= 0.2.4) listen (~> 2.7) lumberjack (~> 1.0) nenv (~> 0.1) + notiffany (~> 0.0) pry (>= 0.9.12) + shellany (~> 0.0) thor (>= 0.18.1) guard-brakeman (0.8.3) brakeman (>= 2.1.1) @@ -131,18 +133,18 @@ GEM hitimes (1.2.2) http_parser.rb (0.6.0) i18n (0.7.0) - jquery-fileupload-rails (0.4.1) + jquery-fileupload-rails (0.4.2) actionpack (>= 3.1) railties (>= 3.1) jquery-rails (3.1.2) railties (>= 3.0, < 5.0) thor (>= 0.14, < 2.0) - json (1.8.1) + json (1.8.2) kgio (2.9.2) launchy (2.4.3) addressable (~> 2.3) libv8 (3.16.14.7) - listen (2.8.4) + listen (2.8.5) celluloid (>= 0.15.2) rb-fsevent (>= 0.9.3) rb-inotify (>= 0.9) @@ -169,6 +171,9 @@ GEM nenv (0.1.1) nokogiri (1.6.1) mini_portile (~> 0.5.0) + notiffany (0.0.3) + nenv (~> 0.1) + shellany (~> 0.0) poltergeist (1.5.1) capybara (~> 2.1) cliver (~> 0.3.1) @@ -185,19 +190,19 @@ GEM rack rack-protection (1.5.3) rack - rack-test (0.6.2) + rack-test (0.6.3) rack (>= 1.0) - rails (4.0.12) - actionmailer (= 4.0.12) - actionpack (= 4.0.12) - activerecord (= 4.0.12) - activesupport (= 4.0.12) + rails (4.0.13) + actionmailer (= 4.0.13) + actionpack (= 4.0.13) + activerecord (= 4.0.13) + activesupport (= 4.0.13) bundler (>= 1.3.0, < 2.0) - railties (= 4.0.12) + railties (= 4.0.13) sprockets-rails (~> 2.0) - railties (4.0.12) - actionpack (= 4.0.12) - activesupport (= 4.0.12) + railties (4.0.13) + actionpack (= 4.0.13) + activesupport (= 4.0.13) rake (>= 0.8.7) thor (>= 0.18.1, < 2.0) raindrops (0.13.0) @@ -210,7 +215,7 @@ GEM rspec-core (~> 2.14.0) rspec-expectations (~> 2.14.0) rspec-mocks (~> 2.14.0) - rspec-core (2.14.8) + rspec-core (2.14.0) rspec-expectations (2.14.5) diff-lcs (>= 1.1.3, < 2.0) rspec-mocks (2.14.6) @@ -235,6 +240,7 @@ GEM sprockets-rails (>= 2.0, < 4.0) tilt (~> 1.1) sexp_processor (4.4.4) + shellany (0.0.1) simplecov (0.9.1) docile (~> 1.1.0) multi_json (~> 1.0) @@ -279,11 +285,11 @@ GEM hitimes travis-lint (2.0.0) json - trollop (2.0) + trollop (2.1.1) turbolinks (2.5.3) coffee-rails tzinfo (0.3.42) - uglifier (2.6.0) + uglifier (2.7.0) execjs (>= 0.3.0) json (>= 1.8.0) unicorn (4.8.3) @@ -325,7 +331,7 @@ DEPENDENCIES powder pry rack-livereload - rails (= 4.0.12) + rails (= 4.0.13) rb-fsevent rspec-rails (= 2.14.2) sass-rails diff --git a/app/models/user.rb b/app/models/user.rb index 263b56d..9aae72e 100755 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -76,7 +76,11 @@ class User < ActiveRecord::Base def assign_user_id unless @skip_user_id_assign.present? || self.user_id.present? user = User.order("user_id").last - uid = user.user_id.to_i + 1 if user && user.user_id && !(User.exists?(:user_id => "#{user.user_id.to_i + 1}")) + uid = if user && user.user_id && !(User.exists?(:user_id => "#{user.user_id.to_i + 1}")) + user.user_id.to_i + 1 + else + 1 + end self.user_id = uid.to_s if uid end end diff --git a/app/views/layouts/shared/_footer.html.erb b/app/views/layouts/shared/_footer.html.erb index 1c1a443..4bb925f 100755 --- a/app/views/layouts/shared/_footer.html.erb +++ b/app/views/layouts/shared/_footer.html.erb @@ -1,6 +1,6 @@ diff --git a/config/environments/test.rb b/config/environments/test.rb index f63436d..3b1eb20 100755 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -18,8 +18,8 @@ Railsgoat::Application.configure do # Raise exceptions instead of rendering exception templates. config.action_dispatch.show_exceptions = false - # Disable request forgery protection in test environment. - config.action_controller.allow_forgery_protection = false + # Disable request forgery protection in test environment + config.action_controller.allow_forgery_protection = true # Tell Action Mailer not to deliver emails to the real world. # The :test delivery method accumulates sent emails in the diff --git a/report.html b/report.html deleted file mode 100644 index c8c5512..0000000 --- a/report.html +++ /dev/null @@ -1,1606 +0,0 @@ - - - - -Brakeman Report - - - - - -

Brakeman Report

- - - - - - - - - - - - - - -
Application PathRails VersionBrakeman VersionReport TimeChecks Performed
/Users/cktricky/tmp/railsgoat3.2.112.6.1 - - 2014-07-29 12:41:05 -0500

- 2.412842 seconds - 		BasicAuth, ContentTag, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NumberToCurrency, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, ResponseSplitting, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing
-
-

Summary

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Scanned/ReportedTotal
Controllers17
Models11
Templates73
Errors0
Security Warnings27 (16)
Ignored Warnings0
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Warning TypeTotal
Attribute Restriction1
Command Injection1
Cross Site Scripting5
Cross-Site Request Forgery1
Denial of Service2
File Access1
Format Validation1
Mass Assignment5
Remote Code Execution5
SQL Injection3
Session Setting2
-
-

Security Warnings

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ConfidenceClassMethodWarning TypeMessage
HighBenefitFormsControllerdownloadFile Access
Parameter value used in file name near line 11: send_file(params[:type].constantize.new(params[:name]... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighApi::V1::MobileControllershowRemote Code Execution
Unsafe reflection method constantize called with parameter value near line 9: params[:class].classify... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighApi::V1::MobileControllerindexRemote Code Execution
Unsafe reflection method constantize called with parameter value near line 16: params[:class].classif... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighBenefitFormsControllerdownloadRemote Code Execution
Unsafe reflection method constantize called with parameter value near line 10: params[:type].constant... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighSession Setting
Session cookies should be set to HTTP only near line 3 - - - - - - - - - - - - - - - - - - - - - - - -
HighSession Setting
Session secret should not be included in version control near line 7 - - - - - - - - - - - - - - - - - - - -
HighUsersControllerupdateSQL Injection
Possible SQL injection near line 34: User.find(:first, :conditions => ("user_id = '#{params[:user][:u... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighSQL InjectionRails 3.2.11 contains a SQL injection vulnerability (CVE-2013-6417). Upgrade to 3.2.16
MediumBenefitsBenefits.make_backupCommand Injection
Possible command injection near line 15: system("cp #{(local full_file_name)} #{(local data_path)}/ba... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
MediumDenial of ServiceRails 3.2.11 has a denial of service vulnerability in ActiveRecord: upgrade to 3.2.13 or patch
MediumRemote Code Execution
Rails 3.2.11 with globbing routes is vulnerable to directory traversal and remote code execution. Pat...
MediumAnalyticshits_by_ipSQL Injection
Possible SQL injection near line 4: select("#{(local col)}") - - - - - - - - - - - - - - - - - - - - - - - -
MediumPasswordResetsControllerreset_passwordRemote Code Execution
Marshal.load called with parameter value near line 5: Marshal.load(Base64.decode64(params[:user])) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
MediumCross Site ScriptingRails 3.2.11 has a vulnerability in number helpers (CVE-2014-0081). Upgrade to Rails version 3.2.17
MediumDenial of ServiceRails 3.2.11 has a denial of service vulnerability (CVE-2013-6414). Upgrade to Rails version 3.2.16
-

Controller Warnings

- - - - - - - - - - - - - - - -
ConfidenceControllerWarning TypeMessage
HighApplicationControllerCross-Site Request Forgery'protect_from_forgery' should be called in ApplicationController

Model Warnings

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ConfidenceModelWarning TypeMessage
HighBenefitsAttribute RestrictionMass assignment is not restricted using attr_accessible
HighUserFormat Validation
Insufficient validation for 'email' using /.+@.+\..+/i. Use \A and \z as anchors near line 12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighUserMass AssignmentPotentially dangerous attribute available for mass assignment: :admin
WeakKeyManagementMass AssignmentPotentially dangerous attribute available for mass assignment: :user_id
WeakMessageMass AssignmentPotentially dangerous attribute available for mass assignment: :creator_id
WeakMessageMass AssignmentPotentially dangerous attribute available for mass assignment: :receiver_id
WeakUserMass AssignmentPotentially dangerous attribute available for mass assignment: :user_id

View Warnings

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ConfidenceTemplateWarning TypeMessage
High - - layouts/application (AdminController#dashboard) - - Cross Site Scripting
Unescaped cookie value near line 12: cookies[:font] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
High - - pay/index (PayController#index) - - Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 188: sanitize(user... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
High - - pay/index (PayController#index) - - Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 239: sanitize(decr... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
High - - pay/index (PayController#index) - - Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 261: sanitize(upda... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- diff --git a/spec/support/user_fixture.rb b/spec/support/user_fixture.rb index 8a5f182..bb71be2 100644 --- a/spec/support/user_fixture.rb +++ b/spec/support/user_fixture.rb @@ -5,14 +5,14 @@ class UserFixture end def self.normal_user - password = 'aoeuaoeu' + password = 'thi$ 1s cOmplExEr' user = User.new(:first_name => 'Joe', :last_name => 'Schmoe', :email => 'joe@schmoe.com', :password => password, :password_confirmation => password) def user.clear_password - 'aoeuaoeu' + 'thi$ 1s cOmplExEr' end user.build_benefits_data user.save! user end -end \ No newline at end of file +end