Re: [brakeman] Parameter value used in file name Question

[Justin Collins]

Hi Vasanth,

There is no preferred way to resolve this such that Brakeman won't warn 
about it. If you are satisfied that your code does not allow access to 
files it shouldn't, then adding to brakeman.ignore is an acceptable 
approach.

Thanks,
Justin

On 11/19/2014 10:35 AM, Vasanth Pappu wrote:
> I have come across this warning:
>
> "Parameter value used in file name"
>
> I read the documentation here:
> http://brakemanscanner.org/docs/warning_types/file_access/
>
> But I'm not sure how to go about making this more secure.
>
> Code looks like this:
>
>5   before_filter :load_thing, only: [:show, :edit, :update, :destroy]
>6
>7   def show
>8 send_file @thing.file.path,
>9   disposition: :inline,
>   10   filename: @thing.file_name
>   11   end
> ...
>   23   private
>   24
>   25   def load_thing
>   26 @thing = @widget.stuffs.find params[:id]
>   27   end
>
> My thoughts are that since a private method is where @thing is
> determined from the params, that it would not be possible to access a
> file maliciously.
>
> I am thinking to add an object in brakeman.ignore for this, but if there
> is a preferred way to resolve this warning, any feedback would be
> appreciated.
>
> Thanks,
> Vasanth
>

[brakeman] Parameter value used in file name Question

[Vasanth Pappu]

I have come across this warning:

"Parameter value used in file name"

I read the documentation here:
http://brakemanscanner.org/docs/warning_types/file_access/

But I'm not sure how to go about making this more secure.

Code looks like this:

  5   before_filter :load_thing, only: [:show, :edit, :update, :destroy]
  6
  7   def show
  8 send_file @thing.file.path,
  9   disposition: :inline,
 10   filename: @thing.file_name
 11   end
...
 23   private
 24
 25   def load_thing
 26 @thing = @widget.stuffs.find params[:id]
 27   end

My thoughts are that since a private method is where @thing is determined
from the params, that it would not be possible to access a file maliciously.

I am thinking to add an object in brakeman.ignore for this, but if there is
a preferred way to resolve this warning, any feedback would be appreciated.

Thanks,
Vasanth