brakeman | static analysis security vulnerability scanner for Ruby | Security library

At the moment there's no plugin for that, but there's a feature request on RubyMine's tracker for adding support to Brakeman so your vote is welcome: https://youtrack.jetbrains.com/issue/RUBY-17517

I think it is not a good idea to test standard library methods. Just cover it with

The main problem in your code is that params[:referer] can be set by your user (or an attacker forging a link for your user) to an arbitrary value by appending ?referer=https://malicious.site to the url. You will then redirect to that, which is an open redirect vulnerability.

You could also argue that the referer header is technically user input, and you will be redirecting to it, but I would say in most cases and modern browsers that would probably be an acceptable risk, because an attacker does not really have a way to exploit it (but it might depend on the exact circumstances).

One solution that immediately comes to mind for similar cases would be the session - but on the one hand this is a rest api if I understand correctly, so there is no session, and on the other hand, it would still not be secure against an attacker linking to your #new endpoint from a malicious domain.

I think you should validate the domain before you redirect to it. If there is a common pattern (like for example if all of these are subdomains of yourdomain.com), validate for that. Or you could have your users register their domains first before you redirect to it (see how OAuth2 works for example, you have to register your app domain first before the user can get redirected there with a token).

If your user might just come from anywhere to #new and you want to send them back wherever they came from - that I think is not a good requirement, you should probably not do that, or you should carefully assess the risk and consciously accept it if you want to for some reason. In most cases there is a more secure solution.

Try running command in the project root

Is there a better method for implementing this? Maybe some kind of generic transition action in the controller that has the transition passed in? Seems cleaner, interested to hear if anyone else has taken this approach.

How about something along the lines of:

The problem is the interpolation you're doing to create the statement.

I would suggest you to update your bundle by running "bundle update" than run bundle install

It's raising that error because the latest version of Brakeman (4.5.1) changed the class of warning.file from a String to a Brakeman::FilePath.

guard-brakeman really should have been using Brakeman::Warning#relative_path all along, but unfortunately it was (wrongly) removed in Brakeman 4.5.1.

In short, please try pinning to Brakeman 4.5.0 for now and wait for either the next Brakeman or guard-brakeman release to address this issue.

I have opened https://github.com/guard/guard-brakeman/pull/36 and https://github.com/presidentbeef/brakeman/pull/1365.

Issues like this should probably be reported as bugs to the projects instead of being asked on StackOverflow.

Update: guard-brakeman 0.8.4 fixes this issue.

From ruby on rails guides regular expressions

To fix the regular expression, \A and \z should be used instead of ^ and $, like

/\A[a-zA-Z0-9_\.]*\z/