Lock in $30 Savings on PRO—Offer Ends Soon! ⏳

Find security issues in your Rails applications

Avatar for Takayuki Matsubara Takayuki Matsubara
May 16, 2014
Programming
1
18k

Find security issues in your Rails applications

Introduce Brakeman - Rails security scanner
#m3dev M3 Tech Talk #24

Avatar for Takayuki Matsubara

Takayuki Matsubara

May 16, 2014
Tweet

More Decks by Takayuki Matsubara

See All by Takayuki Matsubara
Rails Web Development with AWS Lambda
Avatar for Takayuki Matsubara ma2gedev
0
320
Coding Challenge Advent of Code 2019
Avatar for Takayuki Matsubara ma2gedev
0
150
Developer Experience in GraphQL Schema-first Development
Avatar for Takayuki Matsubara ma2gedev
0
2.3k
Dependency Inversion Principle in Keyboard Firmware
Avatar for Takayuki Matsubara ma2gedev
0
510
OSSの歩き方 / Walking with OSS
Avatar for Takayuki Matsubara ma2gedev
10
2.6k
GraphQL 開発で必要になったこと / What we needed for GraphQL development
Avatar for Takayuki Matsubara ma2gedev
0
1.2k
キーボードをカスタムしてプログラミング環境を良くした話 / Improved programming environment with customizing keybords
Avatar for Takayuki Matsubara ma2gedev
0
1.4k
Translating "Erlang in Anger" with Erlang & Elixir community members
Avatar for Takayuki Matsubara ma2gedev
0
2.9k
Dive into Elixir v1.6 Code Formatter
Avatar for Takayuki Matsubara ma2gedev
1
180

Other Decks in Programming

See All in Programming
しっかり学ぶ java.lang.*
Avatar for nagise nagise
1
460
GraalVM Native Image トラブルシューティング機能の最新状況（2025年版）
Avatar for NTTドコモソリューションズ　Java担当 ntt_dsol_java
0
170
ソフトウェア設計の課題・原則・実践技法
Avatar for 増田 亨 masuda220
PRO
24
19k
開発15年のAIネイティブでない 巨大サービスのAI最適化
Avatar for わたり rapicro
0
110
Web エンジニアが JavaScript で AI Agent を作る / JSConf JP 2025 sponsor session
Avatar for izumin5210 izumin5210
4
2.1k
モダンJSフレームワークのビルドプロセス 〜なぜReactは503行、Svelteは12行なのか〜
Avatar for Maple fuuki12
0
140
All(?) About Point Sets
Avatar for hole hole
0
230
2025 컴포즈 마법사
Avatar for Ji Sungbin jisungbin
0
160
複数人でのCLI/Infrastructure as Codeの暮らしを良くする
Avatar for Shoma Okamoto shmokmt
4
1.5k
CSC305 Lecture 17
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
0
200
Full-Cycle Reactivity in Angular: SignalStore mit Signal Forms und Resources
Avatar for Manfred Steyer manfredsteyer
PRO
0
150
無秩序からの脱却 / Emergence from chaos
Avatar for nrs nrslib
2
10k

Featured

See All Featured
[RailsConf 2023 Opening Keynote] The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
31
9.8k
The Language of Interfaces
Avatar for Des Traynor destraynor
162
25k
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
84
9.3k
XXLCSS - How to scale CSS and keep your sanity
Avatar for Zaharenia Atzitzikaki sugarenia
249
1.3M
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
127
17k
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
6.7k
Fireside Chat
Avatar for paigeccino paigeccino
41
3.7k
Faster Mobile Websites
Avatar for Dean Hume deanohume
310
31k
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
210
24k
Building Flexible Design Systems
Avatar for Yesenia Perez-Cruz yeseniaperezcruz
329
39k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.6k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
57k

Transcript

  1. Find security issues in your Rails applications

  2. self-introduction » ma2ge @twitter » ma2gedev @github

  3. Find security issues in your Rails applications

  4. !"#

  5. None

  6. Brakeman

  7. ⭐1.6k

  8. None

  9. How to use $ gem i brakeman $ brakeman -o

    output.html

  10. Let's try !

  11. class FeaturesController < ApplicationController def vulnerable eval params[:code] end end

  12. None

  13. Let's try next case !

  14. class FeaturesController < ApplicationController def vulnerable @unsafe_value = params[:code] end

    end # in view <%= eval @unsafe_value %>
  15. None
  16. None

  17. Brakeman Plugin https://wiki.jenkins-ci.org/ display/JENKINS/Brakeman +Plugin

  18. None

  19. !"

  20. Resources » http://brakemanscanner.org/ » https://github.com/presidentbeef/brakeman » http://brakemanscanner.org/docs/jenkins/

  21. end