From d179adde05a0140f424d1a4eebc1603200c4e8e1 Mon Sep 17 00:00:00 2001 From: Janell-Huyck Date: Thu, 7 Sep 2023 10:32:19 -0400 Subject: [PATCH] remove brakeman file --- brakeman.html | 643 -------------------------------------------------- 1 file changed, 643 deletions(-) delete mode 100644 brakeman.html diff --git a/brakeman.html b/brakeman.html deleted file mode 100644 index a621d503..00000000 --- a/brakeman.html +++ /dev/null @@ -1,643 +0,0 @@ - - - - -Brakeman Report - - - - - - - -

Brakeman Report

- - - - - - - - - - - - - - - - - - -
Application PathRails VersionBrakeman VersionReport TimeChecks Performed
/Users/huyckjl/Codebases/aaec6.1.7.66.0.1 - - 2023-09-07 10:18:36 -0400

- 0.874537 seconds - 		BasicAuth, BasicAuthTimingAttack, CSRFTokenForgeryCVE, ContentTag, CookieSerialization, CreateWith, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, DynamicFinders, EOLRails, EOLRuby, EscapeFunction, Evaluation, Execute, FileAccess, FileDisclosure, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONEncoding, JSONEntityEscape, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, MimeTypeDoS, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NestedAttributesBypass, NumberToCurrency, PageCachingCVE, Pathname, PermitAttributes, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, RenderInline, ResponseSplitting, RouteDoS, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeConfigCve, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionManipulation, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, SprocketsPathTraversal, StripTags, SymbolDoSCVE, TemplateInjection, TranslateBug, UnsafeReflection, UnsafeReflectionMethods, ValidationRegex, VerbConfusion, WeakRSAKey, WithoutProtection, XMLDoS, YAMLParsing
-
-

Summary

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Scanned/ReportedTotal
Controllers19
Models16
Templates89
Errors0
Security Warnings4 (3)
Ignored Warnings0
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Warning TypeTotal
Dynamic Render Path1
File Access1
Format Validation1
Remote Code Execution1
-
-

Security Warnings

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ConfidenceClassMethodWarning TypeCWE IDMessage
HighPagesControllervalid_page?File Access[22]
Parameter value used in file name near line 17: Pathname.new((Rails.root + "app/views/pages/#{params[:page]}.html.erb")) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighAdminControllercsvRemote Code Execution[470]
Unsafe reflection method const_get called with parameter value near line 18: Object.const_get(params[:controller_name].classify) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
MediumPagesControllershowDynamic Render Path[22]
Render path contains parameter value near line 8: render(template => "pages/#{params[:page]}", {}) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-

Model Warnings

- - - - - - - - - - - - - - - - - - - - - -
ConfidenceModelWarning TypeCWE IDMessage
HighSubmitterFormat Validation[777]
Insufficient validation for phone_number using /\d{3}-\d{3}-\d{4}/. Use \A and \z as anchors near line 8 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
\ No newline at end of file