Packages
sobelow
0.4.0
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/xss/send_resp.ex
defmodule Sobelow.XSS.SendResp do
alias Sobelow.Utils
use Sobelow.Finding
def run(fun, filename) do
{ref_vars, is_html, params, {fun_name, [{_, line_no}]}} = parse_send_resp_def(fun)
Enum.each ref_vars, fn var ->
if is_list(var) do
Enum.each var, fn v ->
if (Enum.member?(params, v) || v === "conn.params") && is_html do
print_resp_finding(line_no, filename, fun_name, fun, v, :high)
end
if is_html && !Enum.member?(params, v) do
print_resp_finding(line_no, filename, fun_name, fun, v, :medium)
end
end
else
if (Enum.member?(params, var) || var === "conn.params") && is_html do
print_resp_finding(line_no, filename, fun_name, fun, var, :high)
end
if is_html && !Enum.member?(params, var) && var != "conn.params" do
print_resp_finding(line_no, filename, fun_name, fun, var, :medium)
end
end
end
end
defp parse_send_resp_def(fun) do
{vars, params, {fun_name, line_no}} = Utils.get_fun_vars_and_meta(fun, 2, :send_resp)
{aliased_vars,_,_} = Utils.get_fun_vars_and_meta(fun, 2, :send_resp, [:Plug, :Conn])
is_html = Utils.get_funs_of_type(fun, :put_resp_content_type)
|> Enum.any?(&Utils.is_content_type_html/1)
{vars ++ aliased_vars, is_html, params, {fun_name, line_no}}
end
def get_details() do
Sobelow.XSS.details()
end
defp print_resp_finding(line_no, filename, fun_name, fun, var, severity) do
Utils.add_finding(line_no, filename, fun,
fun_name, var, severity,
"XSS in `send_resp`", :send_resp, [:Plug, :Conn])
end
end