demarches-normaliennes/config/brakeman.ignore

86 lines
3.5 KiB
Text
Raw Normal View History

2018-01-11 15:54:39 +01:00
{
"ignored_warnings": [
2018-10-17 12:02:34 +02:00
{
"warning_type": "Cross-Site Scripting",
"warning_code": 2,
"fingerprint": "0d61a1267d264f1e61cc2398a2683703ac60878129dc9515542f246a80ad575b",
"check_name": "CrossSiteScripting",
"message": "Unescaped model attribute",
"file": "app/views/champs/carto/show.js.erb",
"line": 5,
"link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
"code": "geo_data((Champ.joins(:dossier).where(:dossiers => ({ :user_id => logged_user_ids })).find_by(:id => params.permit(:champ_id)) or CartoChamp.new))",
"render_path": [{"type":"controller","class":"Champs::CartoController","method":"show","line":48,"file":"app/controllers/champs/carto_controller.rb"}],
"location": {
"type": "template",
"template": "champs/carto/show"
},
"user_input": "Champ.joins(:dossier).where(:dossiers => ({ :user_id => logged_user_ids }))",
"confidence": "Weak",
"note": "Not an injection because logged_user_ids have no user input"
},
2018-10-05 16:15:19 +02:00
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "1840f5340630814ea86311e850ebd91b966e6bccd0b6856133528e7745c0695a",
2018-10-05 16:15:19 +02:00
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/procedure_presentation.rb",
"line": 90,
2018-10-05 16:15:19 +02:00
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "dossiers.order(\"#{sanitized_column(sort)} #{sort[\"order\"]}\")",
2018-10-05 16:15:19 +02:00
"render_path": null,
"location": {
"type": "method",
"class": "ProcedurePresentation",
"method": "sorted_ids"
},
"user_input": "sanitized_column(sort)",
"confidence": "Weak",
"note": "Not an injection because of `sanitized_column`"
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "b2feda5e5ae668cdbf0653f134c40bcb9e45499c1b607450e43a0166c4098364",
2018-10-05 16:15:19 +02:00
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/procedure_presentation.rb",
"line": 96,
2018-10-05 16:15:19 +02:00
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "dossiers.includes(((\"type_de_champ\" == \"type_de_champ\") ? (:champs) : (:champs_private))).where(\"champs.type_de_champ_id = #{sort[\"column\"].to_i}\").order(\"champs.value #{sort[\"order\"]}\")",
2018-10-05 16:15:19 +02:00
"render_path": null,
"location": {
"type": "method",
"class": "ProcedurePresentation",
"method": "sorted_ids"
},
"user_input": "sort[\"order\"]",
2018-10-05 16:15:19 +02:00
"confidence": "Weak",
"note": "Not an injection because `sort[\"order\"]` has passed `check_allowed_sort_order`"
2018-10-05 16:15:19 +02:00
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "e0e5b55126891df8fe144835ea99367ffd7a92ae6d7227a923fe79f4a79f67f4",
2018-10-05 16:15:19 +02:00
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/procedure_presentation.rb",
"line": 101,
2018-10-05 16:15:19 +02:00
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "dossiers.includes(\"user\").order(\"#{sanitized_column(sort)} #{sort[\"order\"]}\")",
2018-10-05 16:15:19 +02:00
"render_path": null,
"location": {
"type": "method",
"class": "ProcedurePresentation",
"method": "sorted_ids"
},
"user_input": "sanitized_column(sort)",
2018-10-05 16:15:19 +02:00
"confidence": "Weak",
"note": "Not an injection because of `sanitized_column`"
2018-10-05 16:15:19 +02:00
}
2018-01-11 15:54:39 +01:00
],
2018-10-17 12:02:34 +02:00
"updated": "2018-10-16 11:28:34 +0300",
"brakeman_version": "4.3.1"
2018-01-11 15:54:39 +01:00
}