> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="cookie-serialization">
    Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="ruby-eval">
    Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="dangerous-open3-pipeline">
    Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="mass-assignment-vuln">
    Checks for calls to without\_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without\_protection => true. Instead, configure attr\_accessible to control attribute access.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
    <br />**OWASP**: <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="ssl-mode-no-verify">
    Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY\_PEER' instead.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-295: Improper Certificate Validation
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A07:2021 - Identification and Authentication Failures
  </Accordion>

  <Accordion title="dangerous-subshell">
    Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="dangerous-syscall">
    'syscall' is essentially unsafe and unportable. The DL ([https://apidock.com/ruby/Fiddle](https://apidock.com/ruby/Fiddle)) library is preferred for safer and a bit more portable programming.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="md5-used-as-password">
    It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="weak-hashes-sha1">
    Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-328: Use of Weak Hash
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="bad-deserialization-yaml">
    Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object\_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading YAML from a static file is not dangerous and should not be flagged.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-502: Deserialization of Untrusted Data
    <br />**OWASP**: <br />- A08:2017 - Insecure Deserialization
    <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="file-disclosure">
    Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve\_static\_assets = false.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="create-with">
    Checks for strong parameter bypass through usage of create\_with. Create\_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create\_with calls or use the permit function to specify tags that are allowed to be set.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
    <br />**OWASP**: <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="divide-by-zero">
    Detected a possible ZeroDivisionError.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-369: Divide By Zero
  </Accordion>

  <Accordion title="hardcoded-http-auth-in-controller">
    Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.<br />**Likelihood**: MEDIUM<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-798: Use of Hard-coded Credentials
    <br />**OWASP**: <br />- A07:2021 - Identification and Authentication Failures
  </Accordion>

  <Accordion title="force-ssl-false">
    Checks for configuration setting of force\_ssl to false. Force\_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force\_ssl = true.<br />**Likelihood**: LOW<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-311: Missing Encryption of Sensitive Data
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="hardcoded-secret-rsa-passphrase">
    Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.<br />**Likelihood**: MEDIUM<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-798: Use of Hard-coded Credentials
    <br />**OWASP**: <br />- A07:2021 - Identification and Authentication Failures
  </Accordion>

  <Accordion title="dangerous-exec">
    Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="model-attributes-attr-accessible">
    Checks for models that do not use attr\_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong\_attributes.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
    <br />**OWASP**: <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="bad-deserialization">
    Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object\_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-502: Deserialization of Untrusted Data
    <br />**OWASP**: <br />- A08:2017 - Insecure Deserialization
    <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="model-attr-accessible">
    Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr\_accessible are checked for allowance of dangerous attributes admin, banned, role, and account\_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account\_id using permit or attr\_accessible.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
    <br />**OWASP**: <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="bad-deserialization-env">
    Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object\_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-502: Deserialization of Untrusted Data
    <br />**OWASP**: <br />- A08:2017 - Insecure Deserialization
    <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="json-entity-escape">
    Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="dangerous-open">
    Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="insufficient-rsa-key-size">
    The RSA key size \$SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher.<br />**Likelihood**: HIGH<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="bad-send">
    Checks for unsafe use of Object#send, try, **send**, and public\_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="filter-skipping">
    Checks for use of action in Ruby routes. This can cause Rails to render an arbitrary view if an attacker creates an URL accurately. Affects 3.0 applications. Can avoid the vulnerability by providing additional constraints.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-1021: Improper Restriction of Rendered UI Layers or Frames
    <br />**OWASP**: <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="missing-csrf-protection">
    Detected controller which does not enable cross-site request forgery protections using 'protect\_from\_forgery'. Add 'protect\_from\_forgery :with => :exception' to your controller class.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-352: Cross-Site Request Forgery (CSRF)
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="weak-hashes-md5">
    Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-328: Use of Weak Hash
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="mass-assignment-protection-disabled">
    Mass assignment protection disabled for '\$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr\_accessible' for the model or disable mass assigment using 'config.active\_record.whitelist\_attributes = true'. ':without\_protection => true' must be removed for this to take effect.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
    <br />**OWASP**: <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>
</AccordionGroup>