hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20550 from github/smowton/admin/document-rails-5-csrf

Browse Source 
Ruby: Update CSRF protection notes in documentation
This commit is contained in:
Chris Smowton
2025-10-27 12:19:16 +00:00
committed by GitHub
parent 47b26ddea4 ff4b97bf2d
commit 2e0e9e0834
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.qhelp
View File

@@ -58,6 +58,11 @@
for example if parts of the session are memoized. Calling for example if parts of the session are memoized. Calling
<code>protect_from_forgery with: :exception</code> can help to avoid this <code>protect_from_forgery with: :exception</code> can help to avoid this
by raising an exception on an invalid CSRF token instead. by raising an exception on an invalid CSRF token instead.
Note this remains true even in Rails version 5 and later: these versions
automatically run <code>protect_from_forgery with: :exception</code>
by default, but manually calling <code>protect_from_forgery</code> with
no <code>with</code> argument will still downgrade protection to provide an
empty session rather than raise an exception.
</p> </p>
</example> </example>

6
ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp
View File

@@ -42,6 +42,12 @@
vulnerability - for example if parts of the session are memoized. Calling vulnerability - for example if parts of the session are memoized. Calling
<code>protect_from_forgery with: :exception</code> can help to avoid this <code>protect_from_forgery with: :exception</code> can help to avoid this
by raising an exception on an invalid CSRF token instead. by raising an exception on an invalid CSRF token instead.
Note that Rails versions 5 and later
automatically run <code>protect_from_forgery with: :exception</code>
by default, but manually calling <code>protect_from_forgery</code> with
no <code>with</code> argument will downgrade protection to provide an empty
session rather than raise an exception.
</p> </p>
</recommendation> </recommendation>