This is a small release to add checks for the Rails vulnerabilities reported last week.
Changes since 1.7.0:
- Add check for CVE-2012-3463
- Add check for CVE-2012-3464
- Add check for CVE-2012-3465
- Add charset to HTML report (hooopo)
- Report XSS in select() for Rails 2
CVE-2012-3463 - XSS in select_tag Prompt
In Rails 3.x, values supplied to the
:prompt option in the
select_tag helper are not escaped, leading to a cross-site scripting vulnerability.
Brakeman will warn on all uses of
select_tag with unescaped user input in the
CVE-2012-3464 - Single Quotes are Unescaped
This is pretty much a known issue (example from 2008), but Rails 3.2.8 fixes it.
Single quotes are most dangerous when interpolating values into HTML attributes that use single quotes, which is why it is often recommended to always use double quotes in HTML.
There is a provided workaround for earlier versions of Rails which replaces
Rack::Utils.escape_html. This method adds escaping for both single quotes (
') and forward slashes (
If the provided workaround is used in an initializer, as suggested, then Brakeman will not generate a warning for this vulnerability. Otherwise, Brakeman will generate a warning for affected versions.
CVE-2012-3465 - XSS in strip_tags
Another vulnerability has been reported for
strip_tags (earlier report was CVE-2011-2931).
Brakeman will warn on affected versions if uses of
strip_tags are detected.
XSS in select Helper
This vulnerability was reported a while ago, but it was unclear if it applied to Rails 2.x or just Rails 3. Thanks to Neil Matatall, it has been confirmed to be an issue in Rails 2.x as well.
Therefore, Brakeman will be reporting the vulnerability (
select does not escape options list if supplied as a straight string) for Rails 2.x as well.
Please report any issues with this release!
Also consider joining the mailing list or following @brakeman on Twitter.