Brakemanによるセキュリティ警告の対処

web-k · Mar 13, 2018 · ff13f9a · ff13f9a
1 parent c35f3bc
commit ff13f9a
Show file tree

Hide file tree

Showing 7 changed files with 14 additions and 16 deletions.
diff --git a/.gitignore b/.gitignore
@@ -16,3 +16,6 @@
 *.swp
 /nbproject
 /public/assets/*
+
+# Old(Rails < 4.1) Secret Token
+config/initializers/secret_token.rb
diff --git a/Gemfile b/Gemfile
@@ -41,6 +41,11 @@ group :development, :test do
   gem 'cucumber'
   gem 'cucumber-rails', :require => false
 end
+
+group :development do
+  gem 'brakeman'
+end
+
 gem 'pusher'
 
 gem 'therubyracer'

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -42,6 +42,7 @@ GEM
       public_suffix (>= 2.0.2, < 4.0)
     arel (8.0.0)
     backports (3.11.1)
+    brakeman (4.2.0)
     builder (3.2.3)
     capybara (2.18.0)
       addressable
@@ -247,6 +248,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  brakeman
   capybara
   coffee-rails
   cucumber

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
@@ -1,5 +1,5 @@
 class ApplicationController < ActionController::Base
-  protect_from_forgery
+  protect_from_forgery with: :exception
   include ERB::Util
 
   def login?

diff --git a/app/controllers/authentication_controller.rb b/app/controllers/authentication_controller.rb
@@ -1,4 +1,4 @@
-class AuthenticationController < ActionController::Base
+class AuthenticationController < ApplicationController
   def index
     @callback_url = params[:callback]
     render layout: 'top'

diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
@@ -40,8 +40,8 @@
                 </div>
               <% end %>
 
-              <div id="channel_name_static" style="display:inline;"><%== @channel.name %></div>
-              <div id="channel_name_edit" style="display:none;"><%== f.text_field :name %></div>
+              <div id="channel_name_static" style="display:inline;"><%= @channel.name %></div>
+              <div id="channel_name_edit" style="display:none;"><%= f.text_field :name %></div>
             <% end %><% end %>
           </div>
           <p class="nav pull-right logout">

diff --git a/config/initializers/secret_token.rb b/config/initializers/secret_token.rb