✨ Combustion & Appraisals #5
Conversation
…-based implementation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| def update | ||
| respond_to do |format| | ||
| if site.update_attributes(site_params) | ||
| if site.update(site_params) |
Check failure
Code scanning / CodeQL
Insecure Mass Assignment Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the problem, we need to explicitly specify which keys are permitted within the properties hash. This can be done by listing the allowed keys in the permit method. This change should be made in the site_params method in the app/controllers/masq/sites_controller.rb file.
- Identify the keys that are allowed within the
propertieshash. - Update the
site_paramsmethod to explicitly permit only those keys.
| @@ -56,3 +56,3 @@ | ||
| def site_params | ||
| params.require(:site).permit(:persona_id, :url, properties: {}) | ||
| params.require(:site).permit(:persona_id, :url, properties: [:key1, :key2, :key3]) | ||
| end |
|
|
||
| # Encrypts some data with the salt. | ||
| def encrypt(password, salt) | ||
| Digest::SHA1.hexdigest("--#{salt}--#{password}--") |
Check failure
Code scanning / CodeQL
Use of a broken or weak cryptographic hashing algorithm on sensitive data High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the problem, we need to replace the use of the weak SHA-1 hashing algorithm with a stronger, more secure algorithm suitable for password hashing. One of the best options for password hashing is the Argon2 algorithm, which is designed to be computationally expensive and includes a per-password salt by default.
To implement the fix, we will:
- Replace the
encryptmethod to use Argon2 for hashing passwords. - Add the necessary import for the
argon2gem. - Ensure that the
authenticatemethod verifies the password using Argon2.
| @@ -1,2 +1,2 @@ | ||
| require "digest/sha1" | ||
| require "argon2" | ||
|
|
||
| @@ -73,3 +73,3 @@ | ||
| if !a.nil? && a.active? && a.enabled | ||
| if a.authenticated?(password) || (Masq::Engine.config.masq["trust_basic_auth"] && basic_auth_used) | ||
| if Argon2::Password.verify_password(password, a.encrypted_password) || (Masq::Engine.config.masq["trust_basic_auth"] && basic_auth_used) | ||
| a.last_authenticated_at = Time.now.utc | ||
| @@ -82,5 +82,5 @@ | ||
|
|
||
| # Encrypts some data with the salt. | ||
| # Encrypts some data with Argon2. | ||
| def encrypt(password, salt) | ||
| Digest::SHA1.hexdigest("--#{salt}--#{password}--") | ||
| Argon2::Password.create(password) | ||
| end |
| @@ -50 +50,3 @@ | ||
| gem "rails", "~> 8.0", ">= 8.0.2" | ||
|
|
||
| gem "argon2", "2.3.2" |
| Package | Version | Security advisories |
| argon2 (rubygems) | 2.3.2 | None |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5 +/- ##
=======================================
Coverage ? 88.33%
=======================================
Files ? 28
Lines ? 917
Branches ? 290
=======================================
Hits ? 810
Misses ? 107
Partials ? 0 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Attempt to keep Rails 5.2 and 6.0 support