Packages
sobelow
0.8.0
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/config/cswh.ex
defmodule Sobelow.Config.CSWH do
@moduledoc """
# Cross-Site Websocket Hijacking
Websocket connections are not bound by the same-origin policy.
Connections that do not validate the origin may leak information
to an attacker.
More information can be found here: https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html
Cross-Site Websocket Hijacking checks can be disabled with
the following command:
$ mix sobelow -i Config.CSWH
"""
alias Sobelow.{Parse, Print, Utils}
use Sobelow.Finding
@finding_type "Config.CSWH: Cross-Site Websocket Hijacking"
def run(endpoint) do
Parse.ast(endpoint)
|> Parse.get_funs_of_type(:socket)
|> handle_sockets(endpoint)
end
defp handle_sockets(sockets, endpoint) do
Enum.each(sockets, fn socket ->
check_socket(socket)
|> add_finding(socket, endpoint)
end)
end
def check_socket({_, _, [_, _, options]}) do
check_socket_options(options)
end
def check_socket(_), do: {false, :high}
defp check_socket_options([{:websocket, options} | _]) when is_list(options) do
case options[:check_origin] do
false -> {true, :high}
_ -> {true, :low}
end
end
defp check_socket_options([_ | t]), do: check_socket_options(t)
defp check_socket_options([]), do: {false, :high}
defp add_finding(nil, _, _), do: nil
defp add_finding({false, _}, _, _), do: nil
defp add_finding({true, confidence}, socket, endpoint) do
line_no = Parse.get_fun_line(socket)
endpoint_path = Utils.normalize_path(endpoint)
file_header = "File: #{endpoint_path}"
line_header = "Line: #{line_no}"
case Sobelow.format() do
"json" ->
finding = [
type: @finding_type,
file: endpoint_path,
line: line_no
]
Sobelow.log_finding(finding, confidence)
"txt" ->
Sobelow.log_finding(@finding_type, confidence)
Print.print_custom_finding_metadata(
socket,
:highlight_all,
confidence,
@finding_type,
[file_header, line_header]
)
"compact" ->
Print.log_compact_finding(@finding_type, confidence)
_ ->
Sobelow.log_finding(@finding_type, confidence)
end
end
end