Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not treat sanitize_sql_like as safe #1657

Merged
merged 1 commit into from Dec 16, 2021
Merged

Do not treat sanitize_sql_like as safe #1657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/brakeman/checks/check_sql.rb
View file
Open in desktop
Expand Up @@ -584,7 +584,7 @@ def check_string_arg exp
end

IGNORE_METHODS_IN_SQL = Set[:id, :merge_conditions, :table_name, :quoted_table_name,
:quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array, :sanitize_sql_like,
:quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array,
:sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
:sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
:to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
Expand Down
2 changes: 1 addition & 1 deletion test/tests/github_output.rb
View file
Open in desktop
Expand Up @@ -6,7 +6,7 @@ def setup
end

def test_report_format
assert_equal 40, @@report.lines.count, "Did you add vulnerabilities to the Rails 6 app? Update this test please!"
assert_equal 41, @@report.lines.count, "Did you add vulnerabilities to the Rails 6 app? Update this test please!"
@@report.lines.each do |line|
assert line.start_with?('::'), 'Every line must start with `::`'
assert_equal 2, line.scan('::').count, 'Every line must have exactly 2 `::`'
Expand Down
4 changes: 2 additions & 2 deletions test/tests/rails6.rb
View file
Open in desktop
Expand Up @@ -13,7 +13,7 @@ def expected
:controller => 0,
:model => 0,
:template => 4,
:generic => 34
:generic => 35
}
end

Expand Down Expand Up @@ -148,7 +148,7 @@ def test_sql_injection_date_integer_target_false_positive
end

def test_sql_injection_sanitize_sql_like
assert_no_warning :type => :warning,
assert_warning :type => :warning,
:warning_code => 0,
:fingerprint => "8dde11c95a0f3acb4f982ff6554ac3ba821334ee04aee7f1fb0ea01c8919baad",
:warning_type => "SQL Injection",
Expand Down