Packages

sobelow

0.4.9
0.14.1 0.14.0 0.13.0 0.12.2 0.12.1 0.12.0 0.11.1 0.11.0 0.10.6 0.10.5 0.10.4 0.10.3 0.10.2 0.10.1 0.10.0 0.9.3 0.9.2 0.9.1 0.9.0 0.8.0 0.7.8 0.7.7 0.7.6 0.7.5 0.7.4 0.7.3 0.7.2 0.7.1 0.7.0 0.6.9 0.6.8 0.6.7 0.6.6 0.6.5 0.6.4 0.6.3 0.6.2 0.6.1 0.6.0 0.5.4 0.5.3 0.5.2 0.5.1 0.5.0 0.4.9 0.4.8 0.4.7 0.4.6 0.4.5 0.4.4 0.4.3 0.4.2 0.4.1 0.4.0 0.3.12 0.3.11 0.3.10 0.3.9 0.3.8 0.3.7 0.3.6 0.3.5 0.3.4 0.3.3 0.3.2 0.3.1 0.3.0 0.2.8 0.2.7 0.2.6 0.2.5 0.2.4 0.2.3

Security-focused static analysis for Elixir & the Phoenix framework

HexDocs

Current section

Files

Jump to
Readme
73 Versions
0 Dependencies
8 Dependants
Files
Activity
sobelow lib sobelow traversal file_module.ex
Raw

lib/sobelow/traversal/file_module.ex 

defmodule Sobelow.Traversal.FileModule do
  alias Sobelow.Utils
  use Sobelow.Finding
  @file_funcs [:read,
               :read!,
               :write,
               :write!,
               :rm,
               :rm!,
               :rm_rf]
  def run(fun, filename) do
    severity = if String.ends_with?(filename, "_controller.ex"), do: false, else: :low
    Enum.each @file_funcs, fn(file_func) ->
      {vars, params, {fun_name, [{_, line_no}]}} = parse_file_def(fun, file_func)
      Enum.each vars, fn var ->
        if Enum.member?(params, var) || var === "conn.params" do
          add_finding(line_no, filename, fun_name, fun, var, file_func, severity || :high)
        else
          add_finding(line_no, filename, fun_name, fun, var, file_func, severity || :medium)
        end
      end
    end
  end
  def parse_file_def(fun, type) do
    Utils.get_fun_vars_and_meta(fun, 0, type, [:File])
  end
  def add_finding(line_no, filename, fun_name, fun, var, type, severity) do
    title = "Directory Traversal in `File.#{type}`"
    Utils.add_finding(line_no, filename, fun,
                      fun_name, var, severity,
                      title, type, [:File])
  end
  def get_details() do
    Sobelow.Traversal.details()
  end
end