Packages
sobelow
0.10.2
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/xss/send_resp.ex
defmodule Sobelow.XSS.SendResp do
use Sobelow.Finding
@finding_type "XSS.SendResp: XSS in `send_resp`"
def run(fun, meta_file) do
Finding.init(@finding_type, meta_file.filename, nil)
|> Finding.multi_from_def(fun, parse_def(fun))
|> Stream.map(&set_confidence/1)
|> Stream.reject(&nil_confidence?/1)
|> Enum.each(&Print.add_finding(&1))
end
def parse_def(fun) do
Parse.get_fun_vars_and_meta(fun, 2, :send_resp, :Conn)
end
def details() do
Sobelow.XSS.details()
end
@doc false
def get_content_type({:put_resp_content_type, _, opts}), do: hd(opts)
def get_content_type({{_, _, [_, :put_resp_content_type]}, _, opts}), do: hd(opts)
@doc false
def set_confidence(%Finding{} = finding) do
content_types =
finding.fun_source
|> Parse.get_funs_of_type(:put_resp_content_type)
|> Kernel.++(
Parse.get_aliased_funs_of_type(finding.fun_source, :put_resp_content_type, :Conn)
)
|> Enum.map(&get_content_type/1)
%{finding | confidence: get_confidence(finding, content_types)}
end
defp get_confidence(finding, content_types) do
cond do
length(content_types) == 0 ->
finding.confidence
Enum.any?(content_types, &(!is_binary(&1))) ->
:low
Enum.all?(content_types, &contains_html?/1) ->
finding.confidence
Enum.any?(content_types, &contains_html?/1) ->
:low
true ->
nil
end
end
defp contains_html?(content_type) do
content_type
|> String.downcase()
|> String.contains?("html")
end
@doc false
def nil_confidence?(%Finding{confidence: nil}), do: true
def nil_confidence?(_), do: false
end