From 74903af7ce6a0622752e19b1e0b326ecfa0463cb Mon Sep 17 00:00:00 2001 From: Matt Jankowski Date: Fri, 28 Jul 2023 17:17:53 -0400 Subject: [PATCH] Ignore the brakeman `PermitAttributes` check (#25915) --- config/brakeman.ignore | 92 ------------------------------------------ config/brakeman.yml | 3 ++ 2 files changed, 3 insertions(+), 92 deletions(-) create mode 100644 config/brakeman.yml diff --git a/config/brakeman.ignore b/config/brakeman.ignore index 9b9330a758..02ce23a075 100644 --- a/config/brakeman.ignore +++ b/config/brakeman.ignore @@ -57,75 +57,6 @@ ], "note": "" }, - { - "warning_type": "Mass Assignment", - "warning_code": 105, - "fingerprint": "874be88fedf4c680926845e9a588d3197765a6ccbfdd76466b44cc00151c612e", - "check_name": "PermitAttributes", - "message": "Potentially dangerous key allowed for mass assignment", - "file": "app/controllers/api/v1/admin/reports_controller.rb", - "line": 88, - "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/", - "code": "params.permit(:resolved, :account_id, :target_account_id)", - "render_path": null, - "location": { - "type": "method", - "class": "Api::V1::Admin::ReportsController", - "method": "filter_params" - }, - "user_input": ":account_id", - "confidence": "High", - "cwe_id": [ - 915 - ], - "note": "" - }, - { - "warning_type": "Mass Assignment", - "warning_code": 105, - "fingerprint": "ab5035dd1a9f8c3a8d92fb2c37e8fe86fede4f87c91b71aa32e89c9eede602fc", - "check_name": "PermitAttributes", - "message": "Potentially dangerous key allowed for mass assignment", - "file": "app/controllers/api/v1/notifications_controller.rb", - "line": 77, - "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/", - "code": "params.permit(:account_id, :types => ([]), :exclude_types => ([]))", - "render_path": null, - "location": { - "type": "method", - "class": "Api::V1::NotificationsController", - "method": "browserable_params" - }, - "user_input": ":account_id", - "confidence": "High", - "cwe_id": [ - 915 - ], - "note": "" - }, - { - "warning_type": "Mass Assignment", - "warning_code": 105, - "fingerprint": "b0dd0a26d24f5ede9713fe49210e9638be5f5548af9eee0b5a16fe9dbc80ffcd", - "check_name": "PermitAttributes", - "message": "Potentially dangerous key allowed for mass assignment", - "file": "app/controllers/api/v2/search_controller.rb", - "line": 42, - "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/", - "code": "params.permit(:type, :offset, :min_id, :max_id, :account_id, :following)", - "render_path": null, - "location": { - "type": "method", - "class": "Api::V2::SearchController", - "method": "search_params" - }, - "user_input": ":account_id", - "confidence": "High", - "cwe_id": [ - 915 - ], - "note": "" - }, { "warning_type": "Cross-Site Scripting", "warning_code": 4, @@ -158,29 +89,6 @@ 79 ], "note": "" - }, - { - "warning_type": "Mass Assignment", - "warning_code": 105, - "fingerprint": "d0511f0287aea4ed9511f5a744f880cb15af77a8ec88f81b7365b00b642cf427", - "check_name": "PermitAttributes", - "message": "Potentially dangerous key allowed for mass assignment", - "file": "app/controllers/api/v1/reports_controller.rb", - "line": 26, - "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/", - "code": "params.permit(:account_id, :comment, :category, :forward, :forward_to_domains => ([]), :status_ids => ([]), :rule_ids => ([]))", - "render_path": null, - "location": { - "type": "method", - "class": "Api::V1::ReportsController", - "method": "report_params" - }, - "user_input": ":account_id", - "confidence": "High", - "cwe_id": [ - 915 - ], - "note": "" } ], "updated": "2023-07-12 11:20:51 -0400", diff --git a/config/brakeman.yml b/config/brakeman.yml new file mode 100644 index 0000000000..95ebc13865 --- /dev/null +++ b/config/brakeman.yml @@ -0,0 +1,3 @@ +--- +:skip_checks: + - CheckPermitAttributes