Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XSS false positive. Is haml v6 supported? #1914

Open
AkshayGoyal022 opened this issue Jan 21, 2025 · 0 comments
Open

XSS false positive. Is haml v6 supported? #1914

AkshayGoyal022 opened this issue Jan 21, 2025 · 0 comments

Comments

@AkshayGoyal022
Copy link

Background

Brakeman version: 6.1.2
Rails version: 7.1.5
Ruby version: 3.3.1

False Positive

Full warning from Brakeman:

Confidence: Medium
Category: Cross-Site Scripting
Check: CrossSiteScripting
Message: Unescaped model attribute
Code: Setup.hostname
File: app/views/layouts/_i18n_settings.html.haml
Line: 3

Relevant code:

# app/views/layouts/_i18n_settings.html.haml

:javascript
  $(document).ready(function() {
    var domain = '#{Setup.hostname}' # Fetch value from db
    # ...
  });

Why might this be a false positive?
We recently upgrade to haml 6.3.0 (from haml v5.2.0 ) and we are getting CrossSiteScripting warning for above code. Same warning doesn't come up with haml v5.2.0. Wondering if haml v6 is supported?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant