force-ssl-false-ruby

Sakshis · Sakshis · commit 91fec185cebd · 2024-12-11T11:14:04.000Z
diff --git a/rules/ruby/security/force-ssl-false-ruby.yml b/rules/ruby/security/force-ssl-false-ruby.yml
@@ -0,0 +1,13 @@
+id: force-ssl-false-ruby
+language: ruby
+severity: warning
+message: >-
+  Checks for configuration setting of force_ssl to false. Force_ssl
+  forces usage of HTTPS, which could lead to network interception of
+  unencrypted application traffic. To fix, set config.force_ssl = true.
+note: >-
+  [CWE-311] Missing Encryption of Sensitive Data.
+  [REFERENCES]
+      - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb
+rule:
+  pattern: config.force_ssl = false
diff --git a/tests/__snapshots__/force-ssl-false-ruby-snapshot.yml b/tests/__snapshots__/force-ssl-false-ruby-snapshot.yml
@@ -0,0 +1,11 @@
+id: force-ssl-false-ruby
+snapshots:
+  ? |
+    def bad_ssl
+    config.force_ssl = false
+    end
+  : labels:
+    - source: config.force_ssl = false
+      style: primary
+      start: 12
+      end: 36
diff --git a/tests/ruby/force-ssl-false-ruby-test.yml b/tests/ruby/force-ssl-false-ruby-test.yml
@@ -0,0 +1,11 @@
+id: force-ssl-false-ruby
+valid:
+  - |
+    def bad_ssl
+    config.force_ssl = true
+    end
+invalid:
+  - |
+    def bad_ssl
+    config.force_ssl = false
+    end
