Add check for Host Authorization middleware

The Host Authorization middleware protects against DNS rebinding. This middleware is primarily targeted at the development environment: > It is included in the development environment by default ... In other environments Rails.application.config.hosts is empty and no Host header checks will be done. rails/rails#33145 If someone decides to call `config.hosts.clear` because it's "only development", we should warn them they are vulnerable to DNS rebinding.
presidentbeef · Aug 23, 2021 · 95f66bb · 95f66bb
1 parent 69101ca
commit 95f66bb
Show file tree

Hide file tree

Showing 4 changed files with 43 additions and 2 deletions.
diff --git a/lib/brakeman/checks/check_hosts.rb b/lib/brakeman/checks/check_hosts.rb
@@ -0,0 +1,27 @@
+class Brakeman::CheckHosts < Brakeman::BaseCheck
+  Brakeman::Checks.add_optional self
+
+  @description = "Check that hosts setting is not empty in development"
+
+  def run_check
+    return if tracker.config.rails.empty? or tracker.config.rails_version.nil?
+    return if tracker.config.rails_version < "6"
+
+    hosts = tracker.config.rails[:hosts]
+
+    if hosts.nil? || hosts.empty?
+      line = if sexp? hosts
+               hosts.line
+             else
+               1
+             end
+
+      warn :warning_type => "DNS rebinding",
+        :warning_code => :hosts_empty,
+        :message => msg("The application does not guard against DNS rebinding: ", msg_code("config.hosts"), " is empty"),
+        :confidence => :high,
+        :file => "config/environments/development.rb",
+        :line => line
+    end
+  end
+end
diff --git a/lib/brakeman/warning_codes.rb b/lib/brakeman/warning_codes.rb
@@ -121,6 +121,7 @@ module Brakeman::WarningCodes
     :erb_template_injection => 117,
     :http_verb_confusion => 118,
     :unsafe_method_reflection => 119,
+    :hosts_empty => 120,
 
     :custom_check => 9090,
   }

diff --git a/test/tests/rails5.rb b/test/tests/rails5.rb
@@ -12,7 +12,7 @@ def expected
     @@expected ||= {
       :controller => 0,
       :model => 0,
-      :template => 19,
+      :template => 20,
       :generic => 24
     }
   end

diff --git a/test/tests/rails6.rb b/test/tests/rails6.rb
@@ -13,7 +13,7 @@ def expected
       :controller => 0,
       :model => 0,
       :template => 4,
-      :generic => 34
+      :generic => 35
     }
   end
 
@@ -332,6 +332,19 @@ def test_cross_site_scripting_4
       :user_input => nil
   end
 
+  def test_dns_rebinding_config
+    assert_warning :type => :warning,
+      :warning_code => 120,
+      :fingerprint => "34dfccb87369f7f659bb31070c4d33ccf06d5d1a45e0402a518ddfd25cfe7a9b",
+      :warning_type => "DNS rebinding",
+      :line => 1,
+      :message => /^The\ application\ does\ not\ guard\ against/,
+      :confidence => 0,
+      :relative_path => "config/environments/development.rb",
+      :code => nil,
+      :user_input => nil
+  end
+
   def test_cross_site_scripting_json_escape_config
     assert_warning :type => :warning,
       :warning_code => 113,