Skip to content

Upgrading brakeman 1 to 2

Breaking1.9.5 → 2.6.3Breaking5Security20New25Changed8Fixed30Other39

Full comparisonBack to brakeman
BreakingUpgrade verdict

5 breaking changes and 20 security fixes.

In plain terms
  • Remove unused warning codes (Bill Fischer).
  • Remove rescue Exception.
  • Remove fuzzy matching on dangerous attr_accessible values.
  • Remove "timestamp" key from JSON reports.
Must act Top 5 of 25 that need code or config changes

Requires Ruby >= 0 from 2.4.2 (none stated before).

What you must change

Breaking5
Remove unused warning codes (Bill Fischer).
2.6.1GitHub ReleaseOriginalView source
Remove rescue Exception.
2.4.2GitHub ReleaseOriginalView source
Remove fuzzy matching on dangerous attr_accessible values.
2.1.2GitHub ReleaseOriginalView source
Remove "timestamp" key from JSON reports.
2.0.0GitHub ReleaseOriginalView source
Remove deprecated config file locations.
2.0.0GitHub ReleaseOriginalView source
Security20
Whitelist exists arel method from SQL injection check.
exists
2.6.3GitHub ReleaseOriginalView source
Add check for CVE-2014-3514.
2.6.2GitHub ReleaseOriginalView source
Fix SQL injection detection in deep nested string building.
2.6.2GitHub ReleaseOriginalView source
Add check for CVE-2014-3482 and CVE-2014-3483.
2.6.1GitHub ReleaseOriginalView source
Add check for CVE-2014-0130.
2.6.0GitHub ReleaseOriginalView source
Add check for regex denial of service (Ben Toews).
2.5.0GitHub ReleaseOriginalView source
Add check for CVE-2014-0082.
2.4.1GitHub ReleaseOriginalView source
Add check for CVE-2014-0081, replaces CVE-2013-6415.
2.4.1GitHub ReleaseOriginalView source
Add check for CVE-2014-0080.
2.4.1GitHub ReleaseOriginalView source
Add check for CVE-2013-4491 (i18n XSS).
2.3.0GitHub ReleaseOriginalView source
Add check for CVE-2013-6414 (header DoS).
2.3.0GitHub ReleaseOriginalView source
Add check for CVE-2013-6415 (number_to_currency).
2.3.0GitHub ReleaseOriginalView source
Add check for CVE-2013-6416 (simple_format XSS).
2.3.0GitHub ReleaseOriginalView source
Add check for CVE-2013-6417 (query generation).
2.3.0GitHub ReleaseOriginalView source
Fix Slim XSS false positives (Noah Davis).
2.3.0GitHub ReleaseOriginalView source
Reduce command injection false positives.
2.2.0GitHub ReleaseOriginalView source
Do not warn about to_json XSS in Rails 4.
to_json
2.1.2GitHub ReleaseOriginalView source
Refactor of SQL injection check code (Bart ten Brinke).
2.1.0GitHub ReleaseOriginalView source
Fix detection of duplicate XSS warnings.
2.1.0GitHub ReleaseOriginalView source
Add more methods to check for command injection.
2.1.0GitHub ReleaseOriginalView source