Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Find security issues in your Rails applications

Avatar for Takayuki Matsubara Takayuki Matsubara
May 16, 2014
Programming
1
17k

Find security issues in your Rails applications

Introduce Brakeman - Rails security scanner
#m3dev M3 Tech Talk #24
Avatar for Takayuki Matsubara

Takayuki Matsubara

May 16, 2014
Tweet

More Decks by Takayuki Matsubara

See All by Takayuki Matsubara
Rails Web Development with AWS Lambda
Avatar for Takayuki Matsubara ma2gedev
0
280
Coding Challenge Advent of Code 2019
Avatar for Takayuki Matsubara ma2gedev
0
130
Developer Experience in GraphQL Schema-first Development
Avatar for Takayuki Matsubara ma2gedev
0
2.2k
Dependency Inversion Principle in Keyboard Firmware
Avatar for Takayuki Matsubara ma2gedev
0
480
OSSの歩き方 / Walking with OSS
Avatar for Takayuki Matsubara ma2gedev
10
2.6k
GraphQL 開発で必要になったこと / What we needed for GraphQL development
Avatar for Takayuki Matsubara ma2gedev
0
1.2k
キーボードをカスタムしてプログラミング環境を良くした話 / Improved programming environment with customizing keybords
Avatar for Takayuki Matsubara ma2gedev
0
1.3k
Translating "Erlang in Anger" with Erlang & Elixir community members
Avatar for Takayuki Matsubara ma2gedev
0
2.8k
Dive into Elixir v1.6 Code Formatter
Avatar for Takayuki Matsubara ma2gedev
1
170

Other Decks in Programming

See All in Programming
ReadMoreTextView
Avatar for Sungyong An fornewid
1
440
Perlで痩せる
Avatar for Yuuki Shimizu yuukis
1
690
iOSアプリ開発で 関数型プログラミングを実現する The Composable Architectureの紹介
Avatar for yimajo yimajo
2
210
Development of an App for Intuitive AI Learning - Blockly Summit 2025
Avatar for Teba_eleven teba_eleven
0
120
C++20 射影変換
Avatar for Akira Takahashi faithandbrave
0
480
エラーって何種類あるの？
Avatar for Takuma Kajikawa kajitack
5
150
Java on Azure で LangGraph！
Avatar for Kohei Saito kohei3110
0
140
複数アプリケーションを育てていくための共通化戦略
Avatar for irof irof
10
3.9k
KotlinConf 2025 現地参加の土産話
Avatar for Takehata Naoto n_takehata
0
100
TypeScript LSP の今までとこれから
Avatar for Yosuke Kurami quramy
1
500
從零到一：搭建你的第一個 Observability 平台
Avatar for Blueswen blueswen
1
940
機械学習って何？ 5分で解説頑張ってみる
Avatar for Kazuki Ishikawa kuroneko2828
0
210

Featured

See All Featured
BBQ
Avatar for Matthew Crist matthewcrist
89
9.7k
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
42
7.5k
Fireside Chat
Avatar for paigeccino paigeccino
37
3.5k
StorybookのUI Testing Handbookを読んだ
Avatar for Shingo Yamazaki zakiyama
30
5.8k
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
29
1.8k
XXLCSS - How to scale CSS and keep your sanity
Avatar for Zaharenia Atzitzikaki sugarenia
248
1.3M
Bootstrapping a Software Product
Avatar for Garrett Dimon garrettdimon
PRO
307
110k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
181
53k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
281
13k
Designing Experiences People Love
Avatar for Jonathan Moore moore
142
24k
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
367
19k
The Pragmatic Product Professional
Avatar for Laura Van Doore lauravandoore
35
6.7k

Transcript

  1. Find security issues in your Rails applications

  2. self-introduction » ma2ge @twitter » ma2gedev @github

  3. Find security issues in your Rails applications

  4. !"#

  5. None

  6. Brakeman

  7. ⭐1.6k

  8. None

  9. How to use $ gem i brakeman $ brakeman -o

    output.html

  10. Let's try !

  11. class FeaturesController < ApplicationController def vulnerable eval params[:code] end end

  12. None

  13. Let's try next case !

  14. class FeaturesController < ApplicationController def vulnerable @unsafe_value = params[:code] end

    end # in view <%= eval @unsafe_value %>
  15. None
  16. None

  17. Brakeman Plugin https://wiki.jenkins-ci.org/ display/JENKINS/Brakeman +Plugin

  18. None

  19. !"

  20. Resources » http://brakemanscanner.org/ » https://github.com/presidentbeef/brakeman » http://brakemanscanner.org/docs/jenkins/

  21. end