Security Warnings

[boringmachine]

brakeman Karoshi

+SUMMARY+

+-------------------+--------+
| Scanned/Reported | Total |
+-------------------+--------+
| Controllers | 14 |
| Models | 10 |
| Templates | 90 |
| Errors | 0 |
| Security Warnings | 17 (1) |
+-------------------+--------+

+----------------------+-------+
| Warning Type | Total |
+----------------------+-------+
| Cross Site Scripting | 1 |
| Mass Assignment | 15 |
| Session Setting | 1 |
+----------------------+-------+

+SECURITY WARNINGS+

+------------+-------+--------+-----------------+------------------------------------------------------------->>
| Confidence | Class | Method | Warning Type | Message >>
+------------+-------+--------+-----------------+------------------------------------------------------------->>
| High | | | Session Setting | Session secret should not be included in version control nea>>
+------------+-------+--------+-----------------+------------------------------------------------------------->>

Model Warnings:

+------------+------------+-----------------+----------------------------------------------------------------->>
| Confidence | Model | Warning Type | Message >>
+------------+------------+-----------------+----------------------------------------------------------------->>
| Weak | Comment | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | Comment | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | Group | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | GroupTopic | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | GroupTopic | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | GroupUser | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | GroupUser | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | Post | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | Post | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | Post | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | Post | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | Post | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | PostTag | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | PostTag | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
| Weak | User | Mass Assignment | Potentially dangerous attribute available for mass assignment: :>>
+------------+------------+-----------------+----------------------------------------------------------------->>

View Warnings:

+------------+-------------------------------------+----------------------+----------------------------------->>
| Confidence | Template | Warning Type | Message >>
+------------+-------------------------------------+----------------------+----------------------------------->>
| Medium | groups/edit (GroupsController#edit) | Cross Site Scripting | Unsafe parameter value in link_to >>
+------------+-------------------------------------+----------------------+----------------------------------->>

[boringmachine]

1, upgrade rails
2, remove "link_to" from group/edit
3, add "config/sectets.yml" to .gitignore and remove old secret_token file
4, remove config/secrets.yml and config/initializers/secret_token.rb from all history
now, the report is this:

+BRAKEMAN REPORT+
Application path:****
Rails version: 4.1.5
Brakeman version: 2.6.2
Started at 2014-09-06 14:09:09 +0900
Duration: 1.738345008 seconds
Checks run: BasicAuth, ContentTag, CreateWith, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NumberToCurrency, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, ResponseSplitting, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing

+SUMMARY+

+-------------------+-------+
| Scanned/Reported | Total |
+-------------------+-------+
| Controllers | 14 |
| Models | 10 |
| Templates | 90 |
| Errors | 0 |
| Security Warnings | 0 (0) |
+-------------------+-------+