提交 9fec336e 编写于 作者: J Justin Collins

Fix warning code on low confidence XSS warnings

上级 870b815c
......@@ -173,11 +173,14 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
add_result exp
link_path = "cross_site_scripting"
warning_code = :cross_site_scripting
if @known_dangerous.include? exp.method
confidence = CONFIDENCE[:high]
if exp.method == :to_json
message += " in JSON hash"
link_path += "_to_json"
warning_code = :xss_to_json
end
else
confidence = CONFIDENCE[:low]
......@@ -185,7 +188,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
warn :template => @current_template,
:warning_type => "Cross Site Scripting",
:warning_code => :xss_to_json,
:warning_code => warning_code,
:message => message,
:code => exp,
:user_input => @matched.match,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册