Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Rails support #8

Open
mschwager opened this issue Jun 27, 2023 · 0 comments
Open

Improve Rails support #8

mschwager opened this issue Jun 27, 2023 · 0 comments

Comments

@mschwager
Copy link
Owner

mschwager commented Jun 27, 2023

Ruby Rails support for route detection and authn/authz detection is currently limited. This is primarily due to two factors:

  • Convention over configuration. This means Rails' connection between a route and its controller is implicitly defined. And authn/authz properties are often defined interprocedurally in the controller, so connecting that information to a route requires connecting the controller. This makes it challenging for route-detect to connect a route with its authn/authz information.
  • The implicit nature of route definitions. For example, "A single call to resources can declare all of the necessary routes for your index, show, new, edit, create, update, and destroy actions." This is exacerbated by nested definitions, only: filtering, concern:, shallow:, etc.

For more information, see the paper route-detect is based on.

In short, there's a lot of automagic functionality going on behind the scenes in Rails routing that makes statically analyzing it via Semgrep rules challenging. This issue exists to document this shortcoming and brainstorm possibilities for improvement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant