Packages
sobelow
0.4.9
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/config/headers.ex
defmodule Sobelow.Config.Headers do
@moduledoc """
# Missing Secure HTTP Headers
By default, Phoenix HTTP responses contain a number of
secure HTTP headers that attempt to mitigate XSS,
click-jacking, and content-sniffing attacks.
Missing Secure HTTP Headers is flagged by `sobelow` when
a pipeline accepts "html" requests, but does not implement
the `:put_secure_browser_headers` plug.
Secure Headers checks can be ignored with the following
command:
$ mix sobelow -i Config.Headers
"""
alias Sobelow.Utils
use Sobelow.Finding
def run(router, _) do
Utils.get_pipelines(router)
|> Enum.each(&is_vuln_pipeline/1)
end
defp is_vuln_pipeline(pipeline) do
if Utils.is_vuln_pipeline(pipeline, :headers) do
add_finding(pipeline)
end
end
defp add_finding({:pipeline, [line: line_no], [pipeline_name, _]} = pipeline) do
type = "Missing Secure Browser Headers"
case Sobelow.format() do
"json" ->
finding = [
type: type,
pipeline: "#{pipeline_name}:#{line_no}"
]
Sobelow.log_finding(finding, :high)
"txt" ->
Sobelow.log_finding(type, :high)
IO.puts IO.ANSI.red() <> type <> " - High Confidence" <> IO.ANSI.reset()
IO.puts "Pipeline: #{pipeline_name}:#{line_no}"
if Sobelow.get_env(:with_code), do: Utils.print_code(pipeline, pipeline_name)
IO.puts "\n-----------------------------------------------\n"
"compact" ->
Utils.log_compact_finding(type, :high)
_ ->
Sobelow.log_finding(type, :high)
end
end
end