|
1 | 1 | { |
2 | 2 | "ignored_warnings": [ |
| 3 | + { |
| 4 | + "warning_type": "Command Injection", |
| 5 | + "warning_code": 14, |
| 6 | + "fingerprint": "386b18e7b0e504ea42e4ba89ee6cb1b353a9177c7fa58439553cb92abb3d5364", |
| 7 | + "check_name": "Execute", |
| 8 | + "message": "Possible command injection", |
| 9 | + "file": "app/models/repo.rb", |
| 10 | + "line": 21, |
| 11 | + "link": "https://brakemanscanner.org/docs/warning_types/command_injection/", |
| 12 | + "code": "`(cd #{root} && #{command}) 2>/dev/null`", |
| 13 | + "render_path": null, |
| 14 | + "location": { |
| 15 | + "type": "method", |
| 16 | + "class": "Repo", |
| 17 | + "method": "run" |
| 18 | + }, |
| 19 | + "user_input": "root", |
| 20 | + "confidence": "Medium", |
| 21 | + "cwe_id": [ |
| 22 | + 77 |
| 23 | + ], |
| 24 | + "note": "" |
| 25 | + }, |
3 | 26 | { |
4 | 27 | "warning_type": "Dynamic Render Path", |
5 | 28 | "warning_code": 15, |
6 | | - "fingerprint": "690098d85fc8739353285debac5a26f57148c6150eac806a1ce8574d8b3db76f", |
| 29 | + "fingerprint": "8fef72728237431ad41e05126612820980b845a5fb952aac35e89b120b93c59b", |
7 | 30 | "check_name": "Render", |
8 | 31 | "message": "Render path contains parameter value", |
9 | | - "file": "app/views/pwa/installation_instructions/_installation_instructions.html.erb", |
10 | | - "line": 6, |
| 32 | + "file": "app/views/author/polls/show.html.erb", |
| 33 | + "line": 8, |
11 | 34 | "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/", |
12 | | - "code": "render(action => (if params[:user_agent_nickname] then\n Pwa::NamedInstallationInstructions.find(params[:user_agent_nickname])\nelse\n Honeybadger.event(\"installation_instructions_controller.show\", :user_agent => request.user_agent)\n Pwa::UserAgentInstallationInstructions.new(request.user_agent)\nend).partial_name, { :installation_instructions => installation_instructions })", |
| 35 | + "code": "render(action => Current.user.polls.find(params[:id]).questions.includes(:answers).ordered, { :poll => Current.user.polls.find(params[:id]) })", |
13 | 36 | "render_path": [ |
14 | 37 | { |
15 | 38 | "type": "controller", |
16 | | - "class": "Pwa::InstallationInstructionsController", |
| 39 | + "class": "Author::PollsController", |
17 | 40 | "method": "show", |
18 | | - "line": 4, |
19 | | - "file": "app/controllers/pwa/installation_instructions_controller.rb", |
| 41 | + "line": 15, |
| 42 | + "file": "app/controllers/author/polls_controller.rb", |
20 | 43 | "rendered": { |
21 | | - "name": "pwa/installation_instructions/show", |
22 | | - "file": "app/views/pwa/installation_instructions/show.html.erb" |
23 | | - } |
24 | | - }, |
25 | | - { |
26 | | - "type": "template", |
27 | | - "name": "pwa/installation_instructions/show", |
28 | | - "line": 3, |
29 | | - "file": "app/views/pwa/installation_instructions/show.html.erb", |
30 | | - "rendered": { |
31 | | - "name": "pwa/installation_instructions/_installation_instructions", |
32 | | - "file": "app/views/pwa/installation_instructions/_installation_instructions.html.erb" |
| 44 | + "name": "author/polls/show", |
| 45 | + "file": "app/views/author/polls/show.html.erb" |
33 | 46 | } |
34 | 47 | } |
35 | 48 | ], |
36 | 49 | "location": { |
37 | 50 | "type": "template", |
38 | | - "template": "pwa/installation_instructions/_installation_instructions" |
| 51 | + "template": "author/polls/show" |
39 | 52 | }, |
40 | | - "user_input": "params[:user_agent_nickname]", |
| 53 | + "user_input": "params[:id]", |
41 | 54 | "confidence": "Weak", |
42 | 55 | "cwe_id": [ |
43 | 56 | 22 |
44 | 57 | ], |
45 | 58 | "note": "" |
46 | | - }, |
47 | | - { |
48 | | - "warning_type": "SQL Injection", |
49 | | - "warning_code": 0, |
50 | | - "fingerprint": "75fc982bf0fdc1992076ca5a34bdf947d7cdc80b38d207e9b712fb6d8ae2af38", |
51 | | - "check_name": "SQL", |
52 | | - "message": "Possible SQL injection", |
53 | | - "file": "app/models/concerns/searchable.rb", |
54 | | - "line": 47, |
55 | | - "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/", |
56 | | - "code": "joins(\"JOIN #{search_table_name} ON #{table_name}.id = #{search_table_name}.#{search_table_foreign_key}\")", |
57 | | - "render_path": null, |
58 | | - "location": { |
59 | | - "type": "method", |
60 | | - "class": "Searchable::ClassMethods", |
61 | | - "method": "search" |
62 | | - }, |
63 | | - "user_input": "search_table_name", |
64 | | - "confidence": "Medium", |
65 | | - "cwe_id": [ |
66 | | - 89 |
67 | | - ], |
68 | | - "note": "" |
69 | | - }, |
70 | | - { |
71 | | - "warning_type": "Command Injection", |
72 | | - "warning_code": 14, |
73 | | - "fingerprint": "ee467aaea70b8a7b361ef6e8ee6c5082b3ff265dc67d798ea3f24c1687ff4584", |
74 | | - "check_name": "Execute", |
75 | | - "message": "Possible command injection", |
76 | | - "file": "app/models/examples/app_file.rb", |
77 | | - "line": 91, |
78 | | - "link": "https://brakemanscanner.org/docs/warning_types/command_injection/", |
79 | | - "code": "`(cd #{ENV.fetch(\"REPOSITORY_ROOT\", \".\")} && git show #{@revision}:#{@path}) 2>/dev/null`", |
80 | | - "render_path": null, |
81 | | - "location": { |
82 | | - "type": "method", |
83 | | - "class": "Examples::AppFile", |
84 | | - "method": "git_read" |
85 | | - }, |
86 | | - "user_input": "ENV.fetch(\"REPOSITORY_ROOT\", \".\")", |
87 | | - "confidence": "Medium", |
88 | | - "cwe_id": [ |
89 | | - 77 |
90 | | - ], |
91 | | - "note": "" |
92 | 59 | } |
93 | 60 | ], |
94 | | - "updated": "2024-11-01 07:34:07 -0400", |
95 | | - "brakeman_version": "6.2.2" |
| 61 | + "brakeman_version": "7.0.0" |
96 | 62 | } |
0 commit comments