Packages
sobelow
0.7.4
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/config/headers.ex
defmodule Sobelow.Config.Headers do
@moduledoc """
# Missing Secure HTTP Headers
By default, Phoenix HTTP responses contain a number of
secure HTTP headers that attempt to mitigate XSS,
click-jacking, and content-sniffing attacks.
Missing Secure HTTP Headers is flagged by `sobelow` when
a pipeline accepts "html" requests, but does not implement
the `:put_secure_browser_headers` plug.
Secure Headers checks can be ignored with the following
command:
$ mix sobelow -i Config.Headers
"""
alias Sobelow.Utils
use Sobelow.Finding
@finding_type "Missing Secure Browser Headers"
def run(router, _) do
Utils.get_pipelines(router)
|> Enum.each(fn pipeline ->
if is_vuln_pipeline?(pipeline) do
add_finding(pipeline, router)
end
end)
end
defp is_vuln_pipeline?(pipeline) do
Utils.is_vuln_pipeline?(pipeline, :headers)
end
defp add_finding({:pipeline, [line: line_no], [pipeline_name, _]} = pipeline, router) do
router_path = "File: #{Utils.normalize_path(router)}"
custom_header = "Pipeline: #{pipeline_name}:#{line_no}"
case Sobelow.format() do
"json" ->
finding = [
type: @finding_type,
pipeline: "#{pipeline_name}:#{line_no}"
]
Sobelow.log_finding(finding, :high)
"txt" ->
Sobelow.log_finding(@finding_type, :high)
Utils.print_custom_finding_metadata(
pipeline,
:put_secure_browser_headers,
:high,
@finding_type,
[router_path, custom_header]
)
"compact" ->
Utils.log_compact_finding(@finding_type, :high)
_ ->
Sobelow.log_finding(@finding_type, :high)
end
end
end