Skip to content

Issues: presidentbeef/brakeman

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

91 Open 671 Closed
91 Open 671 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

Accept ActiveStorage::Filename#sanitized and to_i as safe
#1883 opened Nov 7, 2024 by bb
2
Doubt about an XSS warning
#1871 opened Oct 10, 2024 by dgarofoli1987
1
Brakeman dynamic render path error when finding records inside components
#1870 opened Sep 16, 2024 by anthonyshchang
Possible issue with --skip-files on folders containing symlinks in 6.2.1
#1866 opened Aug 23, 2024 by schinery
1
Ability to include multiple brakeman.ignore files via cmd
#1856 opened Jul 8, 2024 by Karl-H
1
Unvalidated redirect_back false negatives
#1851 opened Jun 14, 2024 by mattyb
2
brakeman still references haml 4 - which is a bit long in the tooth (Haml::Filter::Coffee class vs. module)
#1841 opened Apr 30, 2024 by kwerle
Support non-standard gemfile naming for dual booting Rails apps
#1840 opened Apr 25, 2024 by eliotsykes
1
False negatives due to --skip-libs ignoring app/ files.
#1839 opened Apr 23, 2024 by kevinjacobs 7.0
2
with_content for ViewComponent flagged as dynamic render path
#1832 opened Mar 2, 2024 by gavingmiller
4
Check Graphql end-point for vulnerabilities
#1831 opened Feb 29, 2024 by palexvs
1
Controller with "log" in pathname excluded from scan
#1830 opened Feb 8, 2024 by scottwillson 7.0
2
1
UnsafeReflection requires array to be defined with values strictly in the context of the execution
#1816 opened Jan 1, 2024 by zhisme 7.0
4
Check for signed_id/Global ID usage without specified purpose
#1769 opened Mar 24, 2023 by bdewater
1
False Positive 'Unescaped model attribute' when using safe '_html' i18n key
#1754 opened Jan 13, 2023 by jtomson
False Positive on Faraday delete method with interpolation string
#1750 opened Dec 27, 2022 by nut707
Is it possible to enforce sanitization for all title attributes using #h or #html_safe?
#1741 opened Nov 18, 2022 by ndbroadbent
1
safe-methods: pass "pointed" methods? help wanted
#1738 opened Nov 9, 2022 by akimd
1
Add Check: REDoS from match/match? coercing unsafe strings to regular expressions
#1714 opened Jun 8, 2022 by bensheldon
1
Apparently never ending "Indexing call sites..."
#1694 opened Mar 30, 2022 by akimd
12
Possible unprotected redirect for URL
#1687 opened Feb 23, 2022 by QuentinBonnafet
2
Trigger Mass Assignment rule on other foreign keys than account_id
#1685 opened Feb 21, 2022 by Owpac-doctolib
1
SQL injection false negative for connections on complex objects
#1678 opened Feb 9, 2022 by EQuincerot
2
dynamic render path check fires on component inheriting from ViewComponent::Base (but from a gem)
#1677 opened Feb 9, 2022 by dgholz
2
I get false positives for SQL injection on none AR classes on count.
#1667 opened Jan 12, 2022 by thijsnado
1
ProTip! What’s not been updated in a month: updated:<2024-10-16.