.svg){kind=logo}
This article covers Ruby support and vulnerability detection for Mend SAST.
Mend SAST-supported Ruby file types
|
File Type |
|---|
|
.erb * |
|
.rb |
|
.rhtm * |
|
.rhtml * |
* Note: These extensions are marked as ‘Secondary’ file extensions.
They will only be scanned if at least one file with any of the other ‘Primary’ file extensions is present to identify the language as the relevant language.
Mend SAST-supported Ruby frameworks
|
Framework |
|---|
|
CWE-22 (Path Traversal): Ruby core/stdlib (File, Dir, Kernel, IO, Pathname, Tempfile, FileUtils, CSV, YAML/Psych, Zlib); Rack, Sinatra, Roda, Hanami::Controller, Grape (web frameworks); Rails ActionPack/ActiveStorage; RubyZip, Archive::Zip, Archive::Tar::Minitar (archive extraction); CarrierWave, Shrine, Paperclip (file-upload libraries) |
|
CWE-78 (Command Injection): Ruby core/stdlib (Kernel backtick/system/exec/spawn, Open3, PTY, Process, Shellwords, IO.popen); mixlib-shellout, posix-spawn, subprocess, tty-command, terrapin (shell-execution wrappers); net-ssh, sshkit (remote command execution) |
|
CWE-79 (XSS): Rack, Sinatra, Roda, Grape (routing/web frameworks); Rails (ActionView, ActionPack/ActionDispatch, ActiveSupport); Hanami (View, Controller); CGI, ERB (stdlib); ActionView-adjacent template engines; Phlex (component-based view templating, unsafe_raw); Redcarpet (Markdown-to-HTML rendering); Liquid (template engine) |
|
CWE-89 (SQL Injection): ActiveRecord, Arel (Rails ORM); Sequel (incl. raw Sequel.lit); ROM (rom-rb); DataObjects, DBI; raw DB drivers — mysql/mysql2, pg, sqlite3, oci8, tiny_tds |
|
CWE-90 (LDAP Injection): net-ldap, ruby-ldap; devise_ldap_authenticatable, omniauth-ldap (LDAP-backed auth gems) |
|
CWE-94 (Code Injection): Ruby core (Kernel#eval, BasicObject#instance_eval, Module#class_eval/#module_eval, Binding#eval); the send-family payload leg (send/__send__/public_send/try arg #2, when arg #1 is a code evaluator); Ruby core metaprogramming (define_method, alias_method, instance_variable_set/_get, const_get/const_set, attr_*); Rails ActiveSupport constantize/safe_constantize; ERB, Erubi, Erubis, Tilt, Haml (template-engine code generation); Rails ActionPack (AbstractController), ActionView (render inline:) |
|
CWE-295 (Improper Certificate Validation): curb, Faraday, httpclient, httpx, mechanize, net/http (stdlib), rest-client, Savon |
|
CWE-327 (Weak Crypto): OpenSSL (stdlib); ruby-jwt, json-jwt (JWT signing/verification); ruby-rc4 (RC4 cipher); symmetric-encryption, encryptor (encryption wrapper gems); Rails ActiveSupport (MessageEncryptor/MessageVerifier) |
|
CWE-328 (Weak Hash): Digest (stdlib: MD5/SHA1); OpenSSL (stdlib); Rails ActiveSupport digest helpers |
|
CWE-400 (Sleep DoS): Ruby stdlib (Kernel#sleep, Thread, Thread::Mutex, Thread::ConditionVariable, Thread::Queue/SizedQueue, IO, Net::HTTP); Timeout (stdlib); concurrent-ruby; Faraday; http.rb; connection_pool. ActiveSupport's Numeric#seconds/#minutes/#hours/#days are recognized as taint-preserving transformers feeding these sinks, not sinks themselves. |
|
CWE-502 (Deserialization of Untrusted Data): Ruby core Marshal; YAML/Psych, JSON/Oj (unsafe load); PStore (stdlib); ActiveSupport Hash-based coders; RocketAMF; Plist; php-serialize (PHP-format deserialization); delayed_job (YAML/Psych-backed job payloads) |
|
CWE-601 (Open Redirect): Rack, Sinatra, Roda, Cuba, Padrino (padrino-core), Grape, Hanami::Controller (web frameworks); Rails ActionPack; OmniAuth |
|
CWE-611 (XXE): Nokogiri (Nokogiri::XML/Document/Reader/DocumentFragment parse-input entry points); libxml-ruby (LibXML::XML::Document/Parser/Reader) |
|
CWE-643 (XPath Injection): Nokogiri, REXML (stdlib, incl. REXML::XPath), Ox, Oga, libxml-ruby, the xpath gem; Capybara, Mechanize (as XPath-query call sites) |
|
CWE-798 (Hard-Coded Credentials): Ruby core (File, IO); Net::POP3, Net::SMTP, Net::FTP, Net::IMAP, Net::LDAP/ruby-ldap (net-* stdlib/gems); pg, mysql (raw DB drivers); Elasticsearch client gem; Faraday; rack-test |
|
CWE-918 (Server-Side Request Forgery): stdlib: net/http, open-uri. Third-party HTTP clients: async-http, curb, em-http-request, excon, Faraday, http.rb, HTTParty, httpclient, httpx, Patron, rest-client, Typhoeus. Fetch wrappers / Rails integrations: ActiveResource, CarrierWave, Down, Mechanize, Shrine |
|
CWE-943 (NoSQL Injection): Mongo, Mongoid + BSON (MongoDB); Redis + redis-client; Elasticsearch::API/OpenSearch-Ruby, Elasticsearch::Model, Searchkick, Chewy (Elasticsearch/OpenSearch); aws-sdk-dynamodb + Dynamoid (DynamoDB); cassandra-driver + Cequel (Cassandra); neo4j-ruby-driver + ActiveGraph (Neo4j); Couchbase + Couchbase-ORM; Google Cloud Firestore + Google Cloud Datastore; Plucky + MongoMapper (delegated MongoDB DSLs); RSolr + Sunspot (Solr); InfluxDB + influxdb-client; NoBrainer + RethinkDB; Riak-client; ArangoRB (ArangoDB AQL); Rails ActionController, Roda, Padrino (as call-site frameworks, not the injected store) |
|
CWE-1333 (ReDoS): Regexp engine via CGI, ERB, StringScanner (strscan) call sites (stdlib) |
Mend SAST-supported Ruby vulnerability types
The Ruby vulnerability types detected by SAST are provided below and are organized by CWE ID within each of their identified severities.
Ruby high-severity vulnerability types
|
CWE |
Vulnerability Type |
Low Probability Impact |
|---|---|---|
|
CWE-22 |
Path Traversal |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-78 |
Command Injection |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-79 |
XSS |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-89 |
SQL Injection |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-94 |
Code Injection |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-502 |
Deserialization of Untrusted Data |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-643 |
XPath Injection |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-918 |
Server-Side Request Forgery |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-943 |
NoSQL Injection |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
Ruby medium-severity vulnerability types
|
CWE |
Vulnerability Type |
Low Probability Impact |
|---|---|---|
|
CWE-90 |
LDAP Injection |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-295 |
Improper Certificate Validation |
|
|
CWE-327 |
Weak Crypto |
|
|
CWE-400 |
Sleep DoS |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-611 |
XXE |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-798 |
Hard-Coded Credentials |
Additional Taint Sources: Assignments of hard-coded strings to variables/attributes with credential-like names (password, secret, apikey, token, …) or credential-shaped values — no high-probability counterpart |
Ruby low-severity vulnerability types
|
CWE |
Vulnerability Type |
Low Probability Impact |
|---|---|---|
|
CWE-328 |
Weak Hash |
|
|
CWE-601 |
Open Redirect |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |
|
CWE-1333 |
ReDoS |
Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access) |