Keeping Rails Applications on Track with Brakeman. Justin RailsConf 2012

Transcription

1 Keeping Rails Applications on Track with Brakeman Justin RailsConf

2 Everyone knows they should worry about security 2

3 But when should you worry? 3

4 Idealized Software Development Write Run Commit Push to Code QA Deploy tests CI server review Testing 4

5 Cost to Fix Defects Write Run Commit Push to Code QA Deploy tests CI server review Testing 5

6 Cost to Fix Defects Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

7 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

8 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

9 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

10 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

11 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

12 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

13 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

14 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing 6

15 Cost to Fix Defects Security Review Write Run Commit Push to Code QA Deploy tests CI server review Testing Save 6

16 brakemanscanner.org 7

17 zero configuration security scanning 8

18 gem install brakeman cd my_rails_app/ brakeman 9

19 10

20 gem install brakeman cd my_rails_app/ brakeman -o report.html 11

21 12

22 Confidence View Warning Type Render Location Line Number Code Snippet 13

23 Line 5 14

24 Static Analysis Detour 15

25 Static Analysis Anything that can be determined about a program without actually executing it 16

26 But Ruby is way too dynamic for that! 17

27 eval(file.read(gets.strip)) 18

28 We don t have to know everything 19

29 Most of the Action Happens Here Filters Controller View Partials 20

30 Start Simple: User Input in Views <%= params[:user][:name] %> View 21

31 Next: From Controllers to = params[:user] Controller %> View 22

32 Next: From Controllers to = params[:user] Controller %> View 22

33 Next: From Controllers to = params[:user] Controller <%= params[:user][:name] %> View 23

34 Really Simple Data Flow user = params[:user] user_id = = 24

35 Really Simple Data Flow user = params[:user] user_id = = 24

36 Really Simple Data Flow user = params[:user] user_id = = 25

37 Really Simple Data Flow user = params[:user] user_id = = 25

38 Really Simple Data Flow user = params[:user] user_id = = 26

39 Really Simple Data Flow user = params[:user] user_id = = 26

40 Really Simple Data Flow user = params[:user] user_id = = User.find(params[:user][:id]) User.find(params[:user][:id]).update_attributes(user) 27

41 Really Simple Data Flow user = params[:user] user_id = = User.find(params[:user][:id]) User.find(params[:user][:id]).update_attributes(user) 27

42 Really Simple Data Flow user = params[:user] user_id = = User.find(params[:user][:id]) User.find(params[:user][:id]).update_attributes(params[:user]) 28

43 Really Simple Data Flow user = params[:user] user_id = = User.find(params[:user][:id]) User.find(params[:user][:id]).update_attributes(params[:user]) Mass Assignment 28

44 Brakeman Can Detect... Cross site scripting SQL injection Command injection Unrestricted mass assignment Unprotected redirects Unsafe file access Version-specific security issues Dangerous use of eval Dangerous use of send Default routes Dynamic render paths and more! Insufficient model validation 29

45 Performance Twitter Main App < 2m nventory (66c, 58m, 688t) Redmine (50c, 77m, 256t) Typo (34c, 47m, 113t) ~1m ~20s ~5s Brakeman 1.6.0, Ruby p125 30

46 Back to SDLC Write Run Commit Push to Code QA Deploy tests CI server review Testing 31

47 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 32

48 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 32

49 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 32

50 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 32

51 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 32

52 Brakeman + jenkins-ci.org open source CI server 33

53 Brakeman + 34

54 Brakeman + 35

55 Brakeman Programatically require brakeman Brakeman.run myapp 36

56 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 37

57 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 37

58 Run Brakeman Anytime Write Run Commit Push to Code QA Deploy tests CI server review Testing 37

59 Brakeman + Rake brakeman --rake rake brakeman:run 38

60 Hardcore Mode brakeman -z 39

61 Comparing Brakeman Results brakeman -o report.json brakeman --compare report.json 40

62 Brakeman...All the Time? Write Run Commit Push to Code QA Deploy tests CI server review Testing 41

63 Brakeman...All the Time? Write Run Commit Push to Code QA Deploy tests CI server review Testing Save 41

64 Fast Rescanning Brakeman supports fast rescanning of changed files* 42

65 Fast Rescanning *If scan is kept in memory 43

66 Brakeman + Guard group :development do end gem 'guard-brakeman' 44

67 Brakeman + Guard guard init brakeman guard 45

68 Brakeman + Guard Demo watch?v=cmgycr9_ons 46

69 Caveats 47

70 warnings!= vulnerabilities 48

71 zero warnings does not mean zero vulnerabilities 49

72 Brakeman is not omniscient 50

73 Supports Rails 2.x & 3.x Ruby & 1.9.x JRuby 51

74 brakemanscanner.org 52