groupon/codeburner

Security-focused static code analysis for everyone

codeburner's Issues

Docker file needs 'apt-get clean' at start

I was attempting to deploy with the docker-build script and kept receiving an error about failing to retrieve specific dependencies. This is likely due to an old base layer docker image and updated dependencies.

Adding 'apt-get clean' to the beginning of the Dockerfile allowed me to successfully complete the Docker deployment.

Cross-Site Request Forgery

Codeburner identified the following vulnerability in codeburner-public release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: Cross-Site Request Forgery
Severity:       Medium
Details:         protect_from_forgery should be configured with 'with: :exception'
http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/
Scanner:       Brakeman
File:               app/controllers/application_controller.rb, Line: 27
Code:

protect_from_forgery(:with => :null_session)

Insecure GEM Source

Codeburner identified the following vulnerability in groupon/codeburner release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: Insecure GEM Source
Severity:       High
Details:         Insecure Source URI found: http://rubygems.org/ - use git or https
Scanner:       BundleAudit
File:               Gemfile.lock

SQL Injection

Codeburner identified the following vulnerability in codeburner-public release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: SQL Injection
Severity:       Medium
Details:         Possible SQL injection
http://brakemanscanner.org/docs/warning_types/sql_injection/
Scanner:       Brakeman
File:               app/models/service.rb, Line: 65
Code:

where("#{attribute} LIKE ?", value)

Unscoped Find

Codeburner identified the following vulnerability in groupon/codeburner release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: Unscoped Find
Severity:       Low
Details:         Unscoped call to Filter#find
http://brakemanscanner.org/docs/warning_types/unscoped_find/
Scanner:       Brakeman
File:               app/controllers/api/filter_controller.rb, Line: 239
Code:

Filter.find(params[:id])

SQL Injection

Codeburner identified the following vulnerability in codeburner-public release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: SQL Injection
Severity:       Medium
Details:         Possible SQL injection
http://brakemanscanner.org/docs/warning_types/sql_injection/
Scanner:       Brakeman
File:               app/models/service.rb, Line: 59
Code:

where("#{attribute} LIKE '%'")

Update FSB to 1.7.1

There were many important updates to FSB

codeburner/Dockerfile

Line 7 in ae67ef0

RUN wget -q https://github.com/find-sec-bugs/find-sec-bugs/releases/download/version-1.4.5/findsecbugs-cli-1.4.5.zip -O findsecbugs.zip

Latest cli package:
https://github.com/find-sec-bugs/find-sec-bugs/releases/download/version-1.7.1/findsecbugs-cli-1.7.1.zip

Unscoped Find

Codeburner identified the following vulnerability in groupon/codeburner release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: Unscoped Find
Severity:       Low
Details:         Unscoped call to Filter#find
http://brakemanscanner.org/docs/warning_types/unscoped_find/
Scanner:       Brakeman
File:               app/controllers/api/filter_controller.rb, Line: 128
Code:

Filter.find(params[:id])

Link to “Installation Guide” in README broken

Should be http://groupon.github.io/codeburner/setup/installation/

Unscoped Find

Codeburner identified the following vulnerability in groupon/codeburner release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: Unscoped Find
Severity:       Low
Details:         Unscoped call to Finding#find
http://brakemanscanner.org/docs/warning_types/unscoped_find/
Scanner:       Brakeman
File:               app/controllers/api/finding_controller.rb, Line: 225
Code:

Finding.find(params[:id])

Unscoped Find

Codeburner identified the following vulnerability in codeburner-public release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: Unscoped Find
Severity:       Low
Details:         Unscoped call to Finding#find
http://brakemanscanner.org/docs/warning_types/unscoped_find/
Scanner:       Brakeman
File:               app/controllers/api/finding_controller.rb, Line: 225
Code:

Finding.find(params[:id])

SQL Injection

Codeburner identified the following vulnerability in codeburner-public release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: SQL Injection
Severity:       Medium
Details:         Possible SQL injection
http://brakemanscanner.org/docs/warning_types/sql_injection/
Scanner:       Brakeman
File:               app/models/burn.rb, Line: 53
Code:

where("#{attribute} LIKE '%'")

Add snyk.io to pipeline?

A bit of a shameless plug, as I work on Snyk, but I believe it fits.
Snyk works off an open source vuln DB (https://github.com/Snyk/vulndb), and includes patches (typically reduced & back-ported versions of the original fix), that make remediation very actionable.

SQL Injection

Codeburner identified the following vulnerability in codeburner-public release a5dee0f228f0fce09d1ebbd31d3fa0e4ae23ee26:

Description: SQL Injection
Severity:       Medium
Details:         Possible SQL injection
http://brakemanscanner.org/docs/warning_types/sql_injection/
Scanner:       Brakeman
File:               app/models/finding.rb, Line: 81
Code:

where("#{attribute} LIKE '%'")