The document discusses Brakeman, a static analysis security vulnerability scanner for Ruby on Rails applications. It begins by noting common web application vulnerabilities like cross-site scripting and SQL injection. It then demonstrates examples of these vulnerabilities in Rails code and outlines Rails' built-in security strategies. The document promotes using the Brakeman gem to scan Rails apps for security issues with no configuration required. It claims Brakeman can detect a variety of vulnerability types and integrates with Jenkins. Finally, it cautions that passing a Brakeman scan does not guarantee an app is vulnerability-free.

1. Brakeman
Scan security of your Rails app
Romain Sempé
@rsempe
https://github.com/rsempe

2. Web vulnerabilities
Results of a recent survey on web apps:
- 68% Cross site scripting issues
- 32% SQL Injection
Harder to manually test the security when apps
grow larger!

3. E.g SQL Injection
User.first("login = '#{params[:name]}' AND
password = '#{params[:password]}'")
Inputs: ' OR '1' = '1
SQL query result:
SELECT * FROM users WHERE login = ' ' OR '1'='1'
AND password = ' ' OR '1'='1' LIMIT 1;

4. E.g Cross Site Scripting
(XSS)
<%= "Hello #{params[:name]}" %>
Input: <script>alert('attacked')</script>

5. Rails secure strategy
XSS protection: sanitize by default, otherwise
html_safe.

6. Rails secure strategy
XSS protection: sanitize by default, otherwise
html_safe.
Mass assignment strategy update (not
whitelisted by default).

7. Rails secure strategy
XSS protection: sanitize by default, otherwise
html_safe.
Mass assignment strategy update (not
whitelisted by default).
CRSF protection by default with
authenticity_token.

8. Rails secure strategy
XSS protection: sanitize by default, otherwise
html_safe.
Mass assignment strategy update (not
whitelisted by default).
CRSF protection by default with
authenticity_token.
Secure encryption with bcrypt (password_digest).

9. Rails secure strategy
XSS protection: sanitize by default, otherwise
html_safe.
Mass assignment strategy update (not
whitelisted by default).
CRSF protection by default with
authenticity_token.
Secure encryption with bcrypt (password_digest).
force_ssl method to ensure https.

10. Rails secure strategy
XSS protection: sanitize by default, otherwise
html_safe.
Mass assignment strategy update (not
whitelisted by default).
CRSF protection by default with
authenticity_token.
Secure encryption with bcrypt (password_digest).
force_ssl method to ensure https.
No more SQL Injections with ActiveRecord.

11. Rails secure strategy
XSS protection: sanitize by default, otherwise
html_safe.
Mass assignment strategy update (not
whitelisted by default).
CRSF protection by default with
authenticity_token.
Secure encryption with bcrypt (password_digest).
force_ssl method to ensure https.
No more SQL Injections with ActiveRecord.
And much more...

12. A lot of commits about
security each month on
Rails!

13. But how/when
measuring the security
issues of our Rails

14. Brakeman gem
Only compatible with Rails.
Inspect the source code and produce a report.
Zero configuration required.
Can be run at any stage of the development.

15. Brakeman detections
- Cross Site scripting
- SQL Injection / Commands Injection
- Unrestricted Mass assignments
- Unsafe redirects
- Unsafe file access
- Insufficient model validations
- ... and so on!

16. Cost to fix defects
Picture from RailsConf 2012
http://brakemanscanner.org/docs/presentations/
Brakeman-RailsConf2012.pdf

17. $ gem install brakeman
$ brakeman (-o report.html)

20. Now, coding!

21. Jenkins Integration

22. « Zero warnings does
not mean zero
vulnerabilities »
Justin Collins - RailsConf 2012
http://brakemanscanner.org/docs/presentations/
Brakeman-RailsConf2012.pdf

23. http://brakemanscanner.org/
https://github.com/presidentbeef/brakeman
@brakeman
http://brakemanscanner.org/docs/presentations/
Brakeman-RailsConf2012.pdf
http://railscasts.com/episodes/358-brakeman