Brakeman 4.2.1 Released

This is a small release to add warnings for CVE-2018-3741 and CVE-2018-8048.

Please note there have been a number of vulnerabilities in the Rails HTML sanitization methods over the years. Only use sanitization when an application must accept and render HTML from an untrusted source. Otherwise, escape outputs instead.

CVE-2018-3741

CVE-2018-3741 is a vulnerability in the rails-html-sanitizer gem which may allow bypassing attribute whitelists and therefore cross-site scripting.

(changes)

CVE-2018-8048

CVE-2018-8048 is a similar vulnerability in the loofah gem.

(changes)

Scan Jobs

Brakeman will now scan files in the app/jobs/ directory and treat them as additional libraries.

(changes)

Template Guard Condition

Brakeman will no longer warn about dynamic render paths if template_exists? is used as a guard condition.

(changes)

A Note on Vulnerabilities in Depdendencies

Brakeman does not warn about all CVEs in application dependencies. There are many better tools that track and detect vulnerable dependencies.

Brakeman only includes warnings about vulnerabilities announced on the Rails Security Mailing List.