presidentbeef
commented
3 years ago Hi @coding-bunny - thank you for the details, but what really matters is what production.rb looks like 😄 in order to determine why brakeman isn't picking it up.
Closed coding-bunny closed 3 years ago
presidentbeef
commented
3 years ago Hi @coding-bunny - thank you for the details, but what really matters is what production.rb looks like 😄 in order to determine why brakeman isn't picking it up.
coding-bunny
commented
3 years ago Here's the production.rb:
# frozen_string_literal: true
::Rails.application.configure do
# Prepare the ingress controller used to receive mail
# config.action_mailbox.ingress = :relay
# Settings specified here will take precedence over those in config/application.rb.
# Code is not reloaded between requests.
config.cache_classes = true
# Eager load code on boot. This eager loads most of Rails and
# your application in memory, allowing both threaded web servers
# and those relying on copy on write to perform better.
# Rake tasks automatically ignore this option for performance.
config.eager_load = true
# Full error reports are disabled and caching is turned on.
config.consider_all_requests_local = false
config.action_controller.perform_caching = true
# Ensures that a master key has been made available in either ENV["RAILS_MASTER_KEY"]
# or in config/master.key. This key is used to decrypt credentials (and other encrypted files).
# config.require_master_key = true
# Disable serving static files from the `/public` folder by default since
# Apache or NGINX already handles this.
config.public_file_server.enabled = ::ENV['RAILS_SERVE_STATIC_FILES'].present?
if ::ENV['RAILS_SERVE_STATIC_FILES'].present?
config.public_file_server.headers = { 'Cache-Control' => "public, max-age=#{1.year.to_i}" }
end
# Compress CSS using a preprocessor.
# config.assets.css_compressor = :sass
# Do not fallback to assets pipeline if a precompiled asset is missed.
config.assets.compile = false
# Enable serving of images, stylesheets, and JavaScripts from an asset server.
# config.action_controller.asset_host = 'http://assets.example.com'
# Specifies the header that your server uses for sending files.
# config.action_dispatch.x_sendfile_header = 'X-Sendfile' # for Apache
# config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for NGINX
# Store uploaded files on the local file system (see config/storage.yml for options).
config.active_storage.service = :local
# Mount Action Cable outside main process or domain.
# config.action_cable.mount_path = nil
# config.action_cable.url = 'wss://example.com/cable'
# config.action_cable.allowed_request_origins = [ 'http://example.com', /http:\/\/example.*/ ]
# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
config.force_ssl = true
# Use the lowest log level to ensure availability of diagnostic information
# when problems arise.
config.log_level = :debug
# Prepend all log lines with the following tags.
config.log_tags = [:request_id]
# Use a different cache store in production.
# config.cache_store = :mem_cache_store
# Use a real queuing backend for Active Job (and separate queues per environment).
# config.active_job.queue_adapter = :resque
# config.active_job.queue_name_prefix = "custom_ink_international_production"
config.action_mailer.perform_caching = false
config.action_mailer.asset_host = 'https://checkout.customink.com'
config.action_mailer.default_url_options = { host: 'https://checkout.customink.com' }
config.action_mailer.delivery_method = :smtp
config.action_mailer.smtp_settings = {
user_name: 'apikey',
password: ::ENV.fetch('SENDGRID_API_KEY', ''),
address: 'smtp.sendgrid.net',
domain: 'checkout.customink.com',
port: '587',
authentication: :plain
}
# Ignore bad email addresses and do not raise email delivery errors.
# Set this to true and configure the email server for immediate delivery to raise delivery errors.
# config.action_mailer.raise_delivery_errors = false
# Enable locale fallbacks for I18n (makes lookups for any locale fall back to
# the I18n.default_locale when a translation cannot be found).
config.i18n.fallbacks = true
# Send deprecation notices to registered listeners.
config.active_support.deprecation = :notify
# Use default logging formatter so that PID and timestamp are not suppressed.
config.log_formatter = ::Logger::Formatter.new
# Use a different logger for distributed setups.
# require 'syslog/logger'
# config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new 'app-name')
if ::ENV['RAILS_LOG_TO_STDOUT'].present?
logger = ::ActiveSupport::Logger.new($stdout)
logger.formatter = config.log_formatter
config.logger = ::ActiveSupport::TaggedLogging.new(logger)
end
# Do not dump schema after migrations.
config.active_record.dump_schema_after_migration = false
# Inserts middleware to perform automatic connection switching.
# The `database_selector` hash is used to pass options to the DatabaseSelector
# middleware. The `delay` is used to determine how long to wait after a write
# to send a subsequent read to the primary.
#
# The `database_resolver` class is used by the middleware to determine which
# database is appropriate to use based on the time delay.
#
# The `database_resolver_context` class is used by the middleware to set
# timestamps for the last write to the primary. The resolver uses the context
# class timestamps to determine how long to wait before reading from the
# replica.
#
# By default Rails will store a last write timestamp in the session. The
# DatabaseSelector middleware is designed as such you can define your own
# strategy for connection switching and pass that into the middleware through
# these configuration options.
# config.active_record.database_selector = { delay: 2.seconds }
# config.active_record.database_resolver = ActiveRecord::Middleware::DatabaseSelector::Resolver
# config.active_record.database_resolver_context = ActiveRecord::Middleware::DatabaseSelector::Resolver::Session
endAlso it only seems to be happening for this specific file, because it works just fine in another project I have.... So I'm wondering if it's getting confused somewhere by a specific line or something.
presidentbeef
commented
3 years ago Thank you for providing that!
The issue was the use of ::Rails instead of Rails.
Background
Brakeman version: 5.0.0 Rails version: 6.1.3.1 Ruby version: 3.0.0
Link to Rails application code: Private Commercial Project
Issue
Brakeman does not detect that the
config.force_sslfeature is enabled.Other Error
Run Brakeman with
--debugto see the full stack trace.Stack trace:
Additional Info
Just running
bundle exec brakemandoes not perform the check for SSL. Only when using the-Aflag. The setting is clearly enabled in myconfig/production.rb