mirror of
https://0xacab.org/sutty/sutty
synced 2024-11-23 00:26:22 +00:00
Merge branch 'issue-14956' into 'rails'
fix: ignorar alertas de brakeman See merge request sutty/sutty!238
This commit is contained in:
commit
9e04d6a235
5 changed files with 290 additions and 28 deletions
|
|
@ -23,7 +23,39 @@ module Api
|
||||||
# XXX: Por alguna razón Airbrake envía los datos con Content-Type:
|
# XXX: Por alguna razón Airbrake envía los datos con Content-Type:
|
||||||
# text/plain.
|
# text/plain.
|
||||||
def airbrake_params
|
def airbrake_params
|
||||||
@airbrake_params ||= params.merge!(FastJsonparser.parse(request.raw_post) || {}).permit!
|
@airbrake_params ||=
|
||||||
|
params.merge!(FastJsonparser.parse(request.raw_post) || {})
|
||||||
|
.permit(
|
||||||
|
{
|
||||||
|
errors: [
|
||||||
|
:type,
|
||||||
|
:message,
|
||||||
|
{ backtrace: %i[file line column function] }
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
context: [
|
||||||
|
:url,
|
||||||
|
:language,
|
||||||
|
:severity,
|
||||||
|
:userAgent,
|
||||||
|
:windowError,
|
||||||
|
:rootDirectory,
|
||||||
|
{
|
||||||
|
history: [
|
||||||
|
:date,
|
||||||
|
:type,
|
||||||
|
:severity,
|
||||||
|
:target,
|
||||||
|
:method,
|
||||||
|
:duration,
|
||||||
|
:statusCode,
|
||||||
|
{ arguments: [] }
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
)
|
||||||
end
|
end
|
||||||
|
|
||||||
def site
|
def site
|
||||||
|
|
|
||||||
|
|
@ -110,27 +110,6 @@ class SitesController < ApplicationController
|
||||||
redirect_to sites_path
|
redirect_to sites_path
|
||||||
end
|
end
|
||||||
|
|
||||||
# Obtiene y streamea archivos estáticos desde el repositorio mismo,
|
|
||||||
# pero sólo los públicos (es decir los archivos subidos desde Sutty).
|
|
||||||
def static_file
|
|
||||||
authorize site
|
|
||||||
|
|
||||||
file = params.require(:file) + '.' + params.require(:format)
|
|
||||||
|
|
||||||
raise ActionController::RoutingError.new(nil, nil) unless file.start_with? 'public/'
|
|
||||||
|
|
||||||
path = site.relative_path file
|
|
||||||
|
|
||||||
raise ActionController::RoutingError.new(nil, nil) unless File.exist? path
|
|
||||||
|
|
||||||
# TODO: Hacer esto usa recursos, pero menos que generar el sitio
|
|
||||||
# cada vez. Para poder usar X-Accel tendríamos que montar los
|
|
||||||
# repositorios en el servidor web, cosa que no queremos, o hacer
|
|
||||||
# links simbólicos desde todos los public, o usar un servidor web
|
|
||||||
# local que soporte sendfile mejor que Rails (nghttpd?)
|
|
||||||
send_file path
|
|
||||||
end
|
|
||||||
|
|
||||||
private
|
private
|
||||||
|
|
||||||
def site
|
def site
|
||||||
|
|
|
||||||
|
|
@ -103,8 +103,10 @@ class Post
|
||||||
src = element.attributes['src']
|
src = element.attributes['src']
|
||||||
|
|
||||||
next unless src&.value&.start_with? 'public/'
|
next unless src&.value&.start_with? 'public/'
|
||||||
|
file = MetadataFile.new(site: site, post: self, document: document, layout: layout)
|
||||||
|
file.value['path'] = src.value
|
||||||
|
|
||||||
src.value = Rails.application.routes.url_helpers.site_static_file_url(site, file: src.value)
|
src.value = Rails.application.routes.url_helpers.url_for(file.static_file)
|
||||||
end
|
end
|
||||||
|
|
||||||
# Notificar a les usuaries que están viendo una previsualización
|
# Notificar a les usuaries que están viendo una previsualización
|
||||||
|
|
|
||||||
252
config/brakeman.ignore
Normal file
252
config/brakeman.ignore
Normal file
|
|
@ -0,0 +1,252 @@
|
||||||
|
{
|
||||||
|
"ignored_warnings": [
|
||||||
|
{
|
||||||
|
"warning_type": "Redirect",
|
||||||
|
"warning_code": 18,
|
||||||
|
"fingerprint": "0ae5c3990d49dfbfd4fd61874451f7a576d5056aca913068adf58c314625f810",
|
||||||
|
"check_name": "Redirect",
|
||||||
|
"message": "Possible unprotected redirect",
|
||||||
|
"file": "app/controllers/api/v1/posts_controller.rb",
|
||||||
|
"line": 20,
|
||||||
|
"link": "https://brakemanscanner.org/docs/warning_types/redirect/",
|
||||||
|
"code": "redirect_to((params[:redirect_to] or origin.to_s))",
|
||||||
|
"render_path": null,
|
||||||
|
"location": {
|
||||||
|
"type": "method",
|
||||||
|
"class": "Api::V1::PostsController",
|
||||||
|
"method": "create"
|
||||||
|
},
|
||||||
|
"user_input": "params[:redirect_to]",
|
||||||
|
"confidence": "High",
|
||||||
|
"cwe_id": [
|
||||||
|
601
|
||||||
|
],
|
||||||
|
"note": ""
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"warning_type": "Denial of Service",
|
||||||
|
"warning_code": 76,
|
||||||
|
"fingerprint": "1947d1a2ae6e4bf718d0cc563e660efca96897165e9a8dd18186c1d7abe6ddf6",
|
||||||
|
"check_name": "RegexDoS",
|
||||||
|
"message": "Model attribute used in regular expression",
|
||||||
|
"file": "app/controllers/api/v1/base_controller.rb",
|
||||||
|
"line": 20,
|
||||||
|
"link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
|
||||||
|
"code": "/\\.#{Site.domain}\\z/",
|
||||||
|
"render_path": null,
|
||||||
|
"location": {
|
||||||
|
"type": "method",
|
||||||
|
"class": "Api::V1::BaseController",
|
||||||
|
"method": "site_id"
|
||||||
|
},
|
||||||
|
"user_input": "Site.domain",
|
||||||
|
"confidence": "Medium",
|
||||||
|
"cwe_id": [
|
||||||
|
20,
|
||||||
|
185
|
||||||
|
],
|
||||||
|
"note": "No es un atributo, es una variable de entorno"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"warning_type": "Cross-Site Scripting",
|
||||||
|
"warning_code": 4,
|
||||||
|
"fingerprint": "28d98d08a15c4b3ad94a2cfa20a12573de12d99f1a30b3ca51074ee1f1886592",
|
||||||
|
"check_name": "LinkToHref",
|
||||||
|
"message": "Potentially unsafe model attribute in `link_to` href",
|
||||||
|
"file": "app/views/layouts/_breadcrumb.haml",
|
||||||
|
"line": 19,
|
||||||
|
"link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
|
||||||
|
"code": "link_to(t(\".tienda\"), Site.find(params[:site_id]).tienda_url, :role => \"button\", :class => \"btn\")",
|
||||||
|
"render_path": [
|
||||||
|
{
|
||||||
|
"type": "controller",
|
||||||
|
"class": "Api::V1::NoticesController",
|
||||||
|
"method": "site",
|
||||||
|
"line": 31,
|
||||||
|
"file": "app/controllers/api/v1/notices_controller.rb",
|
||||||
|
"rendered": {
|
||||||
|
"name": "layouts/application",
|
||||||
|
"file": "app/views/layouts/application.html.haml"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "template",
|
||||||
|
"name": "layouts/application",
|
||||||
|
"line": 25,
|
||||||
|
"file": "app/views/layouts/application.html.haml",
|
||||||
|
"rendered": {
|
||||||
|
"name": "layouts/_breadcrumb",
|
||||||
|
"file": "app/views/layouts/_breadcrumb.haml"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"location": {
|
||||||
|
"type": "template",
|
||||||
|
"template": "layouts/_breadcrumb"
|
||||||
|
},
|
||||||
|
"user_input": "Site.find(params[:site_id]).tienda_url",
|
||||||
|
"confidence": "Weak",
|
||||||
|
"cwe_id": [
|
||||||
|
79
|
||||||
|
],
|
||||||
|
"note": ""
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"warning_type": "Redirect",
|
||||||
|
"warning_code": 18,
|
||||||
|
"fingerprint": "5034e51aaa1bac06d15fdde5956edffbfd65f94f5620a409526bbea896dc7b5f",
|
||||||
|
"check_name": "Redirect",
|
||||||
|
"message": "Possible unprotected redirect",
|
||||||
|
"file": "app/controllers/api/v1/contact_controller.rb",
|
||||||
|
"line": 26,
|
||||||
|
"link": "https://brakemanscanner.org/docs/warning_types/redirect/",
|
||||||
|
"code": "redirect_to((params[:redirect] or origin.to_s))",
|
||||||
|
"render_path": null,
|
||||||
|
"location": {
|
||||||
|
"type": "method",
|
||||||
|
"class": "Api::V1::ContactController",
|
||||||
|
"method": "receive"
|
||||||
|
},
|
||||||
|
"user_input": "params[:redirect]",
|
||||||
|
"confidence": "High",
|
||||||
|
"cwe_id": [
|
||||||
|
601
|
||||||
|
],
|
||||||
|
"note": ""
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"warning_type": "Mass Assignment",
|
||||||
|
"warning_code": 70,
|
||||||
|
"fingerprint": "50582f39f8dfa900d3f2b5b9908b1592f8b8bd9e2d0b9d1cc05d77e5ede2d94e",
|
||||||
|
"check_name": "MassAssignment",
|
||||||
|
"message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
|
||||||
|
"file": "app/views/layouts/_link_rel_alternate.haml",
|
||||||
|
"line": 2,
|
||||||
|
"link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
|
||||||
|
"code": "params.permit!",
|
||||||
|
"render_path": [
|
||||||
|
{
|
||||||
|
"type": "controller",
|
||||||
|
"class": "Api::V1::BaseController",
|
||||||
|
"method": "site_id",
|
||||||
|
"line": 20,
|
||||||
|
"file": "app/controllers/api/v1/base_controller.rb",
|
||||||
|
"rendered": {
|
||||||
|
"name": "layouts/application",
|
||||||
|
"file": "app/views/layouts/application.html.haml"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "template",
|
||||||
|
"name": "layouts/application",
|
||||||
|
"line": 21,
|
||||||
|
"file": "app/views/layouts/application.html.haml",
|
||||||
|
"rendered": {
|
||||||
|
"name": "layouts/_link_rel_alternate",
|
||||||
|
"file": "app/views/layouts/_link_rel_alternate.haml"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"location": {
|
||||||
|
"type": "template",
|
||||||
|
"template": "layouts/_link_rel_alternate"
|
||||||
|
},
|
||||||
|
"user_input": null,
|
||||||
|
"confidence": "Medium",
|
||||||
|
"cwe_id": [
|
||||||
|
915
|
||||||
|
],
|
||||||
|
"note": ""
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"warning_type": "Mass Assignment",
|
||||||
|
"warning_code": 70,
|
||||||
|
"fingerprint": "b8e0aa898288bebb614ccc1340d169caa196d315c6ac2e4744081cc892c2ae97",
|
||||||
|
"check_name": "MassAssignment",
|
||||||
|
"message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
|
||||||
|
"file": "app/views/layouts/_breadcrumb.haml",
|
||||||
|
"line": 30,
|
||||||
|
"link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
|
||||||
|
"code": "params.permit!",
|
||||||
|
"render_path": [
|
||||||
|
{
|
||||||
|
"type": "controller",
|
||||||
|
"class": "Api::V1::BaseController",
|
||||||
|
"method": "site_id",
|
||||||
|
"line": 20,
|
||||||
|
"file": "app/controllers/api/v1/base_controller.rb",
|
||||||
|
"rendered": {
|
||||||
|
"name": "layouts/application",
|
||||||
|
"file": "app/views/layouts/application.html.haml"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "template",
|
||||||
|
"name": "layouts/application",
|
||||||
|
"line": 25,
|
||||||
|
"file": "app/views/layouts/application.html.haml",
|
||||||
|
"rendered": {
|
||||||
|
"name": "layouts/_breadcrumb",
|
||||||
|
"file": "app/views/layouts/_breadcrumb.haml"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"location": {
|
||||||
|
"type": "template",
|
||||||
|
"template": "layouts/_breadcrumb"
|
||||||
|
},
|
||||||
|
"user_input": null,
|
||||||
|
"confidence": "Medium",
|
||||||
|
"cwe_id": [
|
||||||
|
915
|
||||||
|
],
|
||||||
|
"note": ""
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"warning_type": "Cross-Site Scripting",
|
||||||
|
"warning_code": 4,
|
||||||
|
"fingerprint": "c051421c7cf4c2706b8e27bfd2f3b0661ec6a6df873da322a6b634b59e80351b",
|
||||||
|
"check_name": "LinkToHref",
|
||||||
|
"message": "Potentially unsafe model attribute in `link_to` href",
|
||||||
|
"file": "app/views/sites/_form.haml",
|
||||||
|
"line": 74,
|
||||||
|
"link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
|
||||||
|
"code": "link_to(t(\".design.url\"), (Unresolved Model).new.url, :target => \"_blank\", :class => \"btn\")",
|
||||||
|
"render_path": [
|
||||||
|
{
|
||||||
|
"type": "controller",
|
||||||
|
"class": "SitesController",
|
||||||
|
"method": "new",
|
||||||
|
"line": 31,
|
||||||
|
"file": "app/controllers/sites_controller.rb",
|
||||||
|
"rendered": {
|
||||||
|
"name": "sites/new",
|
||||||
|
"file": "app/views/sites/new.haml"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "template",
|
||||||
|
"name": "sites/new",
|
||||||
|
"line": 6,
|
||||||
|
"file": "app/views/sites/new.haml",
|
||||||
|
"rendered": {
|
||||||
|
"name": "sites/_form",
|
||||||
|
"file": "app/views/sites/_form.haml"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"location": {
|
||||||
|
"type": "template",
|
||||||
|
"template": "sites/_form"
|
||||||
|
},
|
||||||
|
"user_input": "(Unresolved Model).new.url",
|
||||||
|
"confidence": "Weak",
|
||||||
|
"cwe_id": [
|
||||||
|
79
|
||||||
|
],
|
||||||
|
"note": ""
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"updated": "2024-01-11 18:12:14 -0300",
|
||||||
|
"brakeman_version": "5.4.1"
|
||||||
|
}
|
||||||
|
|
@ -28,9 +28,6 @@ Rails.application.routes.draw do
|
||||||
# alias en nginx sin tener que usar expresiones regulares para
|
# alias en nginx sin tener que usar expresiones regulares para
|
||||||
# detectar el nombre del sitio.
|
# detectar el nombre del sitio.
|
||||||
get '/sites/private/:site_id(*file)', to: 'private#show', constraints: { site_id: %r{[^/]+} }
|
get '/sites/private/:site_id(*file)', to: 'private#show', constraints: { site_id: %r{[^/]+} }
|
||||||
# Obtener archivos estáticos desde el directorio público
|
|
||||||
get '/sites/:site_id/static_file/(*file)', to: 'sites#static_file', as: 'site_static_file',
|
|
||||||
constraints: { site_id: %r{[^/]+} }
|
|
||||||
get '/env.js', to: 'env#index'
|
get '/env.js', to: 'env#index'
|
||||||
|
|
||||||
match '/api/v3/projects/:site_id/notices' => 'api/v1/notices#create', via: %i[post]
|
match '/api/v3/projects/:site_id/notices' => 'api/v1/notices#create', via: %i[post]
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue