Packages
sobelow
0.2.6
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/xss/raw.ex
defmodule Sobelow.XSS.Raw do
alias Sobelow.Utils
use Sobelow.Finding
def run(fun, filename, web_root, controller) do
render_funs = parse_render_def(fun)
Enum.each render_funs, fn {template_name, ref_vars, vars, params, {fun_name, [{_, line_no}]}} ->
if is_atom(template_name) do
template_name = Atom.to_string(template_name) <> ".html"
end
if is_list(template_name) do
template_name = ".html"
end
p = web_root <> "templates/" <> controller <> "/" <> template_name <> ".eex"
if File.exists?(p) do
raw_vals = Utils.get_template_raw_vars(p)
Enum.each(ref_vars, fn var ->
if Enum.member?(raw_vals, var) do
t_name = String.replace_prefix(Path.expand(p, ""), "/", "")
print_finding(t_name, line_no, filename, fun_name, fun, var, :high)
end
end)
Enum.each(vars, fn var ->
if Enum.member?(raw_vals, var) do
t_name = String.replace_prefix(Path.expand(p, ""), "/", "")
print_finding(t_name, line_no, filename, fun_name, fun, var, :medium)
end
end)
end
end
end
def parse_render_def(fun) do
{params, {fun_name, line_no}} = Utils.get_fun_declaration(fun)
Utils.get_funs_of_type(fun, :render)
|> Enum.map(&Utils.parse_render_opts(&1, params, {fun_name, line_no}))
end
def get_details() do
Sobelow.XSS.details()
end
defp print_finding(t_name, line_no, con, fun_name, fun, var, severity) do
{color, confidence} = case severity do
:high -> {IO.ANSI.red(), "High"}
:medium -> {IO.ANSI.yellow(), "Medium"}
:low -> {IO.ANSI.green(), "Low"}
end
IO.puts color <> "XSS - #{confidence} Confidence" <> IO.ANSI.reset()
IO.puts "File: #{con} - #{fun_name}:#{line_no}"
IO.puts "Template: #{t_name} - @#{var}"
if Sobelow.get_env(:with_code), do: Utils.print_code(fun, var, :render)
IO.puts "\n-----------------------------------------------\n"
end
end