Packages
sobelow
0.3.5
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/config/https.ex
defmodule Sobelow.Config.HTTPS do
@moduledoc """
# HTTPS
Without HTTPS, attackers in a priveleged network position can
intercept and modify traffic. The HTTP Strict Transport Security
(HSTS) header helps defend against man-in-the-middle attacks by
preventing unencrypted connections.
Sobelow detects missing HTTPS/HSTS by checking the prod
configuration.
HTTPS/HSTS checks can be ignored with the following command:
$ mix sobelow -i Config.HTTPS
"""
alias Sobelow.Config
alias Sobelow.Utils
use Sobelow.Finding
@prod_path "config/prod.exs"
def run(root) do
Config.get_configs_by_file(:https, root <> @prod_path)
|> handle_https(root <> @prod_path)
end
defp handle_https(opts, file) do
if length(opts) === 0 do
Sobelow.log_finding("HTTPS", :high)
print_finding(:https)
else
if length(Utils.get_configs(:force_ssl, file)) === 0 do
Sobelow.log_finding("HSTS", :high)
print_finding(:hsts)
end
end
end
defp print_finding(:https) do
IO.puts IO.ANSI.red() <> "HTTPS Not Enabled - High Confidence" <> IO.ANSI.reset()
if Sobelow.get_env(:with_code), do: print_info("HTTPS")
IO.puts "\n-----------------------------------------------\n"
end
defp print_finding(:hsts) do
IO.puts IO.ANSI.yellow() <> "HSTS Not Enabled - Medium Confidence" <> IO.ANSI.reset()
if Sobelow.get_env(:with_code), do: print_info("HSTS")
IO.puts "\n-----------------------------------------------\n"
end
defp print_info(type) do
IO.puts "\n#{type} configuration details could not be found in `prod.exs` or `prod.secret.exs`."
end
end