Upgrading brakeman 0.9 to 1
Breaking0.9.2 → 1.9.5Breaking2Security20New50Changed67Fixed91Other9
BreakingUpgrade verdict
2 breaking changes and 20 security fixes.
In plain terms
- The regex search feature on CallIndex is gone.
- Low-confidence warnings no longer appear at all, so results may contain fewer warnings than before.
- Brakeman now flags code affected by a known Rails security vulnerability.
- Brakeman now flags code affected by a known Rails security vulnerability.
Must act Top 5 of 22 that need code or config changes
What you must change
Breaking2
Removes the "find by regex" feature from
CallIndex.CallIndexWarnings below the minimum confidence are now dropped completely instead of being retained.
Security20
Adds a check for CVE-2013-1854.
Adds a check for CVE-2013-1855.
Adds a check for CVE-2013-1856.
Adds a check for CVE-2013-1857.
Adds a check for CVE-2013-0269.
Adds a check for CVE-2013-0276.
Adds a check for CVE-2013-0277.
Adds a check for CVE-2013-0333.
Adds a check for CVE-2012-5664.
Adds a check for CVE-2013-0155.
Adds a check for CVE-2013-0156.
Adds a check for unsafe
YAML.load.YAML.loadAdds a check for CVE-2012-3463.
Adds a check for CVE-2012-3464.
Adds a check for CVE-2012-3465.
Adds a check for CVE-2012-3424.
Adds checks for CVE-2012-2660, CVE-2012-2661, CVE-2012-2694, and CVE-2012-2695.
Adds a version check for the SafeBuffer vulnerability.
Adds a check for the select vulnerability in Rails 3.
select()Adds a check for skipping CSRF protection with a blacklist.