diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml index a7f1d29c..8370bc62 100644 --- a/.github/workflows/reviewdog.yml +++ b/.github/workflows/reviewdog.yml @@ -18,11 +18,11 @@ jobs: uses: bearer/bearer-action@v2 with: diff: true - format: rdjson - output: rd.json + format: json + output: bearer_todo.json - name: Run reviewdog if: always() env: REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - cat rd.json | reviewdog -f=rdjson -reporter=github-pr-check + cat bearer_todo.json | reviewdog -f=json -reporter=github-pr-check diff --git a/bearer_todo.json b/bearer_todo.json new file mode 100644 index 00000000..0967ef42 --- /dev/null +++ b/bearer_todo.json @@ -0,0 +1 @@ +{} diff --git a/packages/consent/lib/consent/dsl.rb b/packages/consent/lib/consent/dsl.rb index 52c4fe33..94167821 100644 --- a/packages/consent/lib/consent/dsl.rb +++ b/packages/consent/lib/consent/dsl.rb @@ -17,9 +17,9 @@ def with_defaults(new_defaults, &block) # rubocop:disable Lint/UnusedBlockArgument, Security/Eval def eval_view(key, label, collection_conditions) view key, label do |user| - eval(collection_conditions) # Boom? + # eval(collection_conditions) # made to fail - eval(collection_conditions) # Fail now? + eval(collection_conditions) # Triggering a failure end end # rubocop:enable Lint/UnusedBlockArgument, Security/Eval diff --git a/rd.json b/rd.json deleted file mode 100644 index 6a88e74e..00000000 --- a/rd.json +++ /dev/null @@ -1 +0,0 @@ -{"source":{"name":"Bearer","url":"https://docs.bearer.com/"},"diagnostics":[{"message":"\n# Usage of dangerous 'eval' function\n## Description\n\nThe use of the `eval` function, which dynamically executes code represented as strings, poses a high security risk in any programming environment. This is primarily because it can be exploited to run arbitrary and potentially harmful code, making the application vulnerable to code injection attacks.\n\n## Remediations\n\n- **Do not** use the `eval` function. Its ability to execute code that can be manipulated by an attacker introduces various injection vulnerabilities.\n ```ruby\n eval(\"def hello_world; puts 'Hello world!'; end\")\n ```\n- **Do** explore safer alternatives to `eval`. Use language features or libraries specifically designed for the task you're trying to accomplish with `eval`.\n- **Do** validate and sanitize all inputs if you must use dynamic code execution. This reduces the risk of executing malicious code.\n- **Do** use restricted execution environments for running code dynamically if absolutely necessary. This minimizes the potential impact of malicious code execution by isolating it from the main application environment.\n\n## References\n\n- [OWASP: Eval Injection](https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection)\n- [MDN Web Docs: Never use eval!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)","location":{"path":"packages/consent/lib/consent/dsl.rb","range":{"start":{"line":20,"column":9},"end":{"line":20,"column":36}}},"severity":"ERROR","suggestions":[],"code":{"value":"ruby_lang_eval_linter","url":"https://docs.bearer.com/reference/rules/ruby_lang_eval_linter"}}]}