Skip to content

Commit cd40f76

Browse files
nacchan99nacchan99
authored
Merge pull request #1727 from coderdojo-japan/add-brakeman-ci
Brakeman を CI で実行する設定
2 parents 088d081 + 452b4d3 commit cd40f76

File tree

5 files changed

+304
-1
lines changed

5 files changed

+304
-1
lines changed

‎.github/workflows/brakeman.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Brakeman Security Scan
2+
3+
on:
4+
pull_request:
5+
workflow_dispatch:
6+
7+
jobs:
8+
brakeman:
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Checkout repository
13+
uses: actions/checkout@v4
14+
15+
- name: Set up Ruby
16+
uses: ruby/setup-ruby@v1
17+
with:
18+
ruby-version: .ruby-version
19+
bundler-cache: true
20+
21+
- name: Install dependencies
22+
run: bundle install --jobs 4 --retry 3
23+
24+
- name: Run Brakeman
25+
run: bundle exec brakeman --ignore-config config/brakeman.ignore --exit-on-warn --quiet

‎Gemfile

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,4 +79,6 @@ group :development, :test do
7979
# NOTE: This enable GitHub Codespaces. Uncomment for YAGNI.
8080
# https://github.com/coderdojo-japan/coderdojo.jp/pull/1526
8181
#gem 'mini_racer'
82+
83+
gem 'brakeman', require: false
8284
end

‎Gemfile.lock

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ GEM
109109
bootstrap-sass (3.4.1)
110110
autoprefixer-rails (>= 5.2.1)
111111
sassc (>= 2.0.0)
112+
brakeman (7.1.0)
113+
racc
112114
builder (3.3.0)
113115
capybara (3.40.0)
114116
addressable
@@ -489,6 +491,7 @@ DEPENDENCIES
489491
aws-sdk-s3 (~> 1)
490492
bootsnap
491493
bootstrap-sass
494+
brakeman
492495
capybara
493496
connpass_api_v2
494497
csv

‎app/views/pokemons/show.html.erb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<p style="padding-top: 20px;">
1313
ボタンをクリックして、<br class="ignore-pc" />ポケモン素材をダウンロードしよう！
1414
</p>
15-
<%=# link_to @presigned_url, class: "btn-blue", style: "max-width:320px; display:block; margin:20px auto 100px;" do %>
15+
<% # link_to @presigned_url, class: "btn-blue", style: "max-width:320px; display:block; margin:20px auto 100px;" do %>
1616
<i class="fas fa-folder-download white"></i>
1717
ポケモン素材をダウンロードする
1818
<%# end %>

‎config/brakeman.ignore

Lines changed: 273 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,273 @@
1+
{
2+
"ignored_warnings": [
3+
{
4+
"warning_type": "Dynamic Render Path",
5+
"warning_code": 15,
6+
"fingerprint": "69b5a133fab8ea617d2581423cefaf077b9366e683c5fac715647bddeec7f50a",
7+
"check_name": "Render",
8+
"message": "Render path contains parameter value",
9+
"file": "app/controllers/sotechsha_pages_controller.rb",
10+
"line": 5,
11+
"link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
12+
"code": "render(action => \"sotechsha_pages/#{params[:page]}\", {})",
13+
"render_path": null,
14+
"location": {
15+
"type": "method",
16+
"class": "SotechshaPagesController",
17+
"method": "show"
18+
},
19+
"user_input": "params[:page]",
20+
"confidence": "Medium",
21+
"cwe_id": [
22+
22
23+
],
24+
"note": ""
25+
},
26+
{
27+
"warning_type": "Command Injection",
28+
"warning_code": 14,
29+
"fingerprint": "7307f11036b1ab86f410d8d967d3972618705df73cafdd17f8e311c10c76c1f1",
30+
"check_name": "Execute",
31+
"message": "Possible command injection",
32+
"file": "lib/statistics/aggregation.rb",
33+
"line": 163,
34+
"link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
35+
"code": "`curl -X POST -H 'Content-type: application/json' --data '{\"text\":\"#{msg}\"}' #{slack_hook_url} -o /dev/null -w \"slack: %{http_code}\"`",
36+
"render_path": null,
37+
"location": {
38+
"type": "method",
39+
"class": "Statistics::Statistics::Aggregation::Notifier",
40+
"method": "s(:self).notify"
41+
},
42+
"user_input": "msg",
43+
"confidence": "Medium",
44+
"cwe_id": [
45+
77
46+
],
47+
"note": ""
48+
},
49+
{
50+
"warning_type": "Cross-Site Scripting",
51+
"warning_code": 4,
52+
"fingerprint": "8ba988098c444755698e4e65d38a94f4095948c1a9bc6220c7e2a4636c3c04d7",
53+
"check_name": "LinkToHref",
54+
"message": "Potentially unsafe model attribute in `link_to` href",
55+
"file": "app/views/shared/_dojo.html.erb",
56+
"line": 6,
57+
"link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
58+
"code": "link_to(\"#{Dojo.new.name} (#{Dojo.new.prefecture.name})\", Dojo.new.url, :target => \"_blank\", :rel => \"external noopener\")",
59+
"render_path": [
60+
{
61+
"type": "controller",
62+
"class": "HomeController",
63+
"method": "show",
64+
"line": 7,
65+
"file": "app/controllers/home_controller.rb",
66+
"rendered": {
67+
"name": "home/show",
68+
"file": "app/views/home/show.html.erb"
69+
}
70+
},
71+
{
72+
"type": "template",
73+
"name": "home/show",
74+
"line": 161,
75+
"file": "app/views/home/show.html.erb",
76+
"rendered": {
77+
"name": "shared/_dojos",
78+
"file": "app/views/shared/_dojos.html.erb"
79+
}
80+
},
81+
{
82+
"type": "template",
83+
"name": "shared/_dojos",
84+
"line": 2,
85+
"file": "app/views/shared/_dojos.html.erb",
86+
"rendered": {
87+
"name": "shared/_dojo",
88+
"file": "app/views/shared/_dojo.html.erb"
89+
}
90+
}
91+
],
92+
"location": {
93+
"type": "template",
94+
"template": "shared/_dojo"
95+
},
96+
"user_input": "Dojo.new.url",
97+
"confidence": "Weak",
98+
"cwe_id": [
99+
79
100+
],
101+
"note": ""
102+
},
103+
{
104+
"warning_type": "Cross-Site Scripting",
105+
"warning_code": 2,
106+
"fingerprint": "b22a549fb14a7e6b3a9c34991ffcacd354dc768d74d50a8f6901e23c3ea19538",
107+
"check_name": "CrossSiteScripting",
108+
"message": "Unescaped model attribute",
109+
"file": "app/views/podcasts/show.html.erb",
110+
"line": 39,
111+
"link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
112+
"code": "Rinku.auto_link(Kramdown::Document.new(self.convert_shownote(Podcast.find_by(:id => params[:id]).content), :input => \"GFM\").to_html)",
113+
"render_path": [
114+
{
115+
"type": "controller",
116+
"class": "PodcastsController",
117+
"method": "show",
118+
"line": 31,
119+
"file": "app/controllers/podcasts_controller.rb",
120+
"rendered": {
121+
"name": "podcasts/show",
122+
"file": "app/views/podcasts/show.html.erb"
123+
}
124+
}
125+
],
126+
"location": {
127+
"type": "template",
128+
"template": "podcasts/show"
129+
},
130+
"user_input": "Podcast.find_by(:id => params[:id]).content",
131+
"confidence": "Weak",
132+
"cwe_id": [
133+
79
134+
],
135+
"note": ""
136+
},
137+
{
138+
"warning_type": "Cross-Site Scripting",
139+
"warning_code": 4,
140+
"fingerprint": "b29f98f4da690ffb7c663390c21db3a71174dae17d06234deab9d6655af6babe",
141+
"check_name": "LinkToHref",
142+
"message": "Potentially unsafe model attribute in `link_to` href",
143+
"file": "app/views/shared/_dojo.html.erb",
144+
"line": 3,
145+
"link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
146+
"code": "link_to(lazy_image_tag(Dojo.new.logo, :alt => (\"CoderDojo #{Dojo.new.name}\"), :class => \"dojo-picture\"), Dojo.new.url, :target => \"_blank\", :rel => \"external noopener\")",
147+
"render_path": [
148+
{
149+
"type": "controller",
150+
"class": "HomeController",
151+
"method": "show",
152+
"line": 7,
153+
"file": "app/controllers/home_controller.rb",
154+
"rendered": {
155+
"name": "home/show",
156+
"file": "app/views/home/show.html.erb"
157+
}
158+
},
159+
{
160+
"type": "template",
161+
"name": "home/show",
162+
"line": 161,
163+
"file": "app/views/home/show.html.erb",
164+
"rendered": {
165+
"name": "shared/_dojos",
166+
"file": "app/views/shared/_dojos.html.erb"
167+
}
168+
},
169+
{
170+
"type": "template",
171+
"name": "shared/_dojos",
172+
"line": 2,
173+
"file": "app/views/shared/_dojos.html.erb",
174+
"rendered": {
175+
"name": "shared/_dojo",
176+
"file": "app/views/shared/_dojo.html.erb"
177+
}
178+
}
179+
],
180+
"location": {
181+
"type": "template",
182+
"template": "shared/_dojo"
183+
},
184+
"user_input": "Dojo.new.url",
185+
"confidence": "Weak",
186+
"cwe_id": [
187+
79
188+
],
189+
"note": ""
190+
},
191+
{
192+
"warning_type": "Dynamic Render Path",
193+
"warning_code": 15,
194+
"fingerprint": "c54623ebce2c2053b95088b9da8112aee962e7cadd79bd9b4b9afdedaddc15b1",
195+
"check_name": "Render",
196+
"message": "Render path contains parameter value",
197+
"file": "app/controllers/sotechsha2_pages_controller.rb",
198+
"line": 5,
199+
"link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
200+
"code": "render(action => \"sotechsha2_pages/#{params[:page]}\", {})",
201+
"render_path": null,
202+
"location": {
203+
"type": "method",
204+
"class": "Sotechsha2PagesController",
205+
"method": "show"
206+
},
207+
"user_input": "params[:page]",
208+
"confidence": "Medium",
209+
"cwe_id": [
210+
22
211+
],
212+
"note": ""
213+
},
214+
{
215+
"warning_type": "Cross-Site Scripting",
216+
"warning_code": 2,
217+
"fingerprint": "e4187193a881ef4e98b77f205c86fcafbef3d65d9269bba30e8612f6a59273ed",
218+
"check_name": "CrossSiteScripting",
219+
"message": "Unescaped model attribute",
220+
"file": "app/views/docs/show.html.erb",
221+
"line": 12,
222+
"link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
223+
"code": "Kramdown::Document.new(Document.new(params[:id]).content, :input => \"GFM\").to_html",
224+
"render_path": [
225+
{
226+
"type": "controller",
227+
"class": "DocsController",
228+
"method": "show",
229+
"line": 42,
230+
"file": "app/controllers/docs_controller.rb",
231+
"rendered": {
232+
"name": "docs/show",
233+
"file": "app/views/docs/show.html.erb"
234+
}
235+
}
236+
],
237+
"location": {
238+
"type": "template",
239+
"template": "docs/show"
240+
},
241+
"user_input": "Document.new(params[:id]).content",
242+
"confidence": "Weak",
243+
"cwe_id": [
244+
79
245+
],
246+
"note": ""
247+
},
248+
{
249+
"warning_type": "Command Injection",
250+
"warning_code": 14,
251+
"fingerprint": "e5394a11f2e9bb6bc213b7ebd34fbcead20048858592aa19e5ae2961f33c636d",
252+
"check_name": "Execute",
253+
"message": "Possible command injection",
254+
"file": "lib/upcoming_events/aggregation.rb",
255+
"line": 89,
256+
"link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
257+
"code": "`curl -X POST -H 'Content-type: application/json' --data '{\"text\":\"#{msg}\"}' #{slack_hook_url} -o /dev/null -w \"slack: %{http_code}\"`",
258+
"render_path": null,
259+
"location": {
260+
"type": "method",
261+
"class": "UpcomingEvents::UpcomingEvents::Aggregation::Notifier",
262+
"method": "s(:self).notify"
263+
},
264+
"user_input": "msg",
265+
"confidence": "Medium",
266+
"cwe_id": [
267+
77
268+
],
269+
"note": ""
270+
}
271+
],
272+
"brakeman_version": "7.1.0"
273+
}

0 commit comments

Comments
 (0)