Brakeman 5.4.1 Released

Several changes in this release are updates to Brakeman’s open redirect check.

Rails 6.1 and Rails 7.0 Defaults

The default configuration values for Rails 6.1 and Rails 7.0 have been added to Brakeman.

(changes)

Open Redirect Updates

Rails 7 introduced a new protection against open directs.

If config.action_controller.raise_on_open_redirects is set to true, then Rails prevents redirects that redirect to a different domain than request.host. This protection can be bypassed by passing in allow_other_host: true to redirect_to.

(changes)

Lachlan Sylvester pointed out it’s also possible to use url_from to ensure a URL is for the same host. So redirect_to(url_from(params[:url])) is safe.

(changes)

This release also expands the open redirect check to redirect_back and redirect_back_or_to which have options for a fallback URL.

(changes)

More Unscoped Finds

Brakeman will now warn about use of find_by(id: ...) the same way it would warn about find_by_id for “unscoped finds” (i.e., possible insecure direct object references).

(changes)

Presence Method Support

Brakeman now handles presence, presence_in, and in? methods.

Since presence_in and in? are often used for guard clauses, this fixes some false positives.

(changes)

File/Line for End-Of-Life Warnings

March is nearly here, which means support for Ruby 2.7 is ending!

Thanks to Jon Burns for pointing out Brakeman was reporting the wrong file and/or line number for EOL Ruby warnings.

(changes)