Packages
sobelow
0.8.0
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/config/csrf.ex
defmodule Sobelow.Config.CSRF do
@moduledoc """
# Cross-Site Request Forgery
In a Cross-Site Request Forgery (CSRF) attack, an untrusted
application can cause a user's browser to submit requests or perform
actions on the user's behalf.
Read more about CSRF here:
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
Cross-Site Request Forgery is flagged by `sobelow` when
a pipeline fetches a session, but does not implement the
`:protect_from_forgery` plug.
CSRF checks can be ignored with the following command:
$ mix sobelow -i Config.CSRF
"""
alias Sobelow.{Config, Parse, Print, Utils}
use Sobelow.Finding
@finding_type "Config.CSRF: Missing CSRF Protections"
def run(router, _) do
Config.get_pipelines(router)
|> Enum.each(fn pipeline ->
if is_vuln_pipeline?(pipeline) do
add_finding(pipeline, router)
end
end)
end
defp is_vuln_pipeline?(pipeline) do
Config.is_vuln_pipeline?(pipeline, :csrf)
end
defp add_finding({:pipeline, _, [pipeline_name, _]} = pipeline, router) do
line_no = Parse.get_fun_line(pipeline)
router_path = Utils.normalize_path(router)
file_header = "File: #{router_path}"
pipeline_header = "Pipeline: #{pipeline_name}"
line_header = "Line: #{line_no}"
case Sobelow.format() do
"json" ->
finding = [
type: @finding_type,
file: router_path,
pipeline: pipeline_name,
line: line_no
]
Sobelow.log_finding(finding, :high)
"txt" ->
Sobelow.log_finding(@finding_type, :high)
Print.print_custom_finding_metadata(
pipeline,
pipeline_name,
:high,
@finding_type,
[file_header, pipeline_header, line_header]
)
"compact" ->
Print.log_compact_finding(@finding_type, :high)
_ ->
Sobelow.log_finding(@finding_type, :high)
end
end
end