Brakeman not detecting force_ssl #1584
Comments
|
Hi @coding-bunny - thank you for the details, but what really matters is what |
|
Here's the # frozen_string_literal: true
::Rails.application.configure do
# Prepare the ingress controller used to receive mail
# config.action_mailbox.ingress = :relay
# Settings specified here will take precedence over those in config/application.rb.
# Code is not reloaded between requests.
config.cache_classes = true
# Eager load code on boot. This eager loads most of Rails and
# your application in memory, allowing both threaded web servers
# and those relying on copy on write to perform better.
# Rake tasks automatically ignore this option for performance.
config.eager_load = true
# Full error reports are disabled and caching is turned on.
config.consider_all_requests_local = false
config.action_controller.perform_caching = true
# Ensures that a master key has been made available in either ENV["RAILS_MASTER_KEY"]
# or in config/master.key. This key is used to decrypt credentials (and other encrypted files).
# config.require_master_key = true
# Disable serving static files from the `/public` folder by default since
# Apache or NGINX already handles this.
config.public_file_server.enabled = ::ENV['RAILS_SERVE_STATIC_FILES'].present?
if ::ENV['RAILS_SERVE_STATIC_FILES'].present?
config.public_file_server.headers = { 'Cache-Control' => "public, max-age=#{1.year.to_i}" }
end
# Compress CSS using a preprocessor.
# config.assets.css_compressor = :sass
# Do not fallback to assets pipeline if a precompiled asset is missed.
config.assets.compile = false
# Enable serving of images, stylesheets, and JavaScripts from an asset server.
# config.action_controller.asset_host = 'http://assets.example.com'
# Specifies the header that your server uses for sending files.
# config.action_dispatch.x_sendfile_header = 'X-Sendfile' # for Apache
# config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for NGINX
# Store uploaded files on the local file system (see config/storage.yml for options).
config.active_storage.service = :local
# Mount Action Cable outside main process or domain.
# config.action_cable.mount_path = nil
# config.action_cable.url = 'wss://example.com/cable'
# config.action_cable.allowed_request_origins = [ 'http://example.com', /http:\/\/example.*/ ]
# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
config.force_ssl = true
# Use the lowest log level to ensure availability of diagnostic information
# when problems arise.
config.log_level = :debug
# Prepend all log lines with the following tags.
config.log_tags = [:request_id]
# Use a different cache store in production.
# config.cache_store = :mem_cache_store
# Use a real queuing backend for Active Job (and separate queues per environment).
# config.active_job.queue_adapter = :resque
# config.active_job.queue_name_prefix = "custom_ink_international_production"
config.action_mailer.perform_caching = false
config.action_mailer.asset_host = 'https://checkout.customink.com'
config.action_mailer.default_url_options = { host: 'https://checkout.customink.com' }
config.action_mailer.delivery_method = :smtp
config.action_mailer.smtp_settings = {
user_name: 'apikey',
password: ::ENV.fetch('SENDGRID_API_KEY', ''),
address: 'smtp.sendgrid.net',
domain: 'checkout.customink.com',
port: '587',
authentication: :plain
}
# Ignore bad email addresses and do not raise email delivery errors.
# Set this to true and configure the email server for immediate delivery to raise delivery errors.
# config.action_mailer.raise_delivery_errors = false
# Enable locale fallbacks for I18n (makes lookups for any locale fall back to
# the I18n.default_locale when a translation cannot be found).
config.i18n.fallbacks = true
# Send deprecation notices to registered listeners.
config.active_support.deprecation = :notify
# Use default logging formatter so that PID and timestamp are not suppressed.
config.log_formatter = ::Logger::Formatter.new
# Use a different logger for distributed setups.
# require 'syslog/logger'
# config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new 'app-name')
if ::ENV['RAILS_LOG_TO_STDOUT'].present?
logger = ::ActiveSupport::Logger.new($stdout)
logger.formatter = config.log_formatter
config.logger = ::ActiveSupport::TaggedLogging.new(logger)
end
# Do not dump schema after migrations.
config.active_record.dump_schema_after_migration = false
# Inserts middleware to perform automatic connection switching.
# The `database_selector` hash is used to pass options to the DatabaseSelector
# middleware. The `delay` is used to determine how long to wait after a write
# to send a subsequent read to the primary.
#
# The `database_resolver` class is used by the middleware to determine which
# database is appropriate to use based on the time delay.
#
# The `database_resolver_context` class is used by the middleware to set
# timestamps for the last write to the primary. The resolver uses the context
# class timestamps to determine how long to wait before reading from the
# replica.
#
# By default Rails will store a last write timestamp in the session. The
# DatabaseSelector middleware is designed as such you can define your own
# strategy for connection switching and pass that into the middleware through
# these configuration options.
# config.active_record.database_selector = { delay: 2.seconds }
# config.active_record.database_resolver = ActiveRecord::Middleware::DatabaseSelector::Resolver
# config.active_record.database_resolver_context = ActiveRecord::Middleware::DatabaseSelector::Resolver::Session
end |
|
Also it only seems to be happening for this specific file, because it works just fine in another project I have.... |
|
Thank you for providing that! The issue was the use of |
Repository owner
locked and limited conversation to collaborators
Jan 30, 2022
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Background
Brakeman version: 5.0.0
Rails version: 6.1.3.1
Ruby version: 3.0.0
Link to Rails application code: Private Commercial Project
Issue
Brakeman does not detect that the
config.force_sslfeature is enabled.Other Error
Run Brakeman with
--debugto see the full stack trace.Stack trace:
Additional Info
Just running
bundle exec brakemandoes not perform the check for SSL.Only when using the
-Aflag.The setting is clearly enabled in my
config/production.rbThe text was updated successfully, but these errors were encountered: