Expertiza_Wiki - User contributions [en]

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T19:08:44Z

Jhkhamba: /* Servo */

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

''Task Supervision Diagram''

[[File:Diagram1.jpg]]

''Task Projection Diagram''

[[File:Diagram2.jpg]]

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ Created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ Created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ Modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T19:08:24Z

Jhkhamba: /* Servo */

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

''Task Supervision Diagram''
[[File:Diagram1.jpg]]

''Task Projection Diagram''
[[File:Diagram2.jpg]]

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ Created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ Created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ Modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T19:06:55Z

Jhkhamba: /* Servo */

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

[[File:Diagram1.jpg]]

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ Created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ Created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ Modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T19:06:32Z

Jhkhamba: /* Servo */

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

[[File:Example1.jpg]]

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ Created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ Created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ Modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T19:05:02Z

Jhkhamba: /* Servo */

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

[[File:Example.jpg]]

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ Created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ Created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ Modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T19:02:59Z

Jhkhamba: /* Servo */

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

[[https://github.com/mozilla/servo/wiki/tasks-sup.png]]

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ Created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ Created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ Modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T19:02:44Z

Jhkhamba:

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

[[File:https://github.com/mozilla/servo/wiki/tasks-sup.png]]

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ Created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ Created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ Modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:45:24Z

Jhkhamba: /* Background Information */

= Integrating an XML Parser =

__TOC__

= Background Information =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

We are planning to use parameterized variation of factory method design pattern to create instances of either html parser or Xml parser based on the HTTP Content-Type header. In html.rs file, instead of directly creating instances of ServoHtmlParser(like ServoHtmlParser::new..) ,we would be calling a function like build_parser by passing in HTTP Content-Type header as parameter. This build_parser method will return either instance of ServoHtmlParser or XML Parser based on the content type parameter. Here, build_parser will be acting as factory method .

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:45:13Z

Jhkhamba: /* Integrating an XML Parser */

= Integrating an XML Parser =

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

We are planning to use parameterized variation of factory method design pattern to create instances of either html parser or Xml parser based on the HTTP Content-Type header. In html.rs file, instead of directly creating instances of ServoHtmlParser(like ServoHtmlParser::new..) ,we would be calling a function like build_parser by passing in HTTP Content-Type header as parameter. This build_parser method will return either instance of ServoHtmlParser or XML Parser based on the content type parameter. Here, build_parser will be acting as factory method .

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:40:10Z

Jhkhamba:

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, Mozilla are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= Design Patterns =
We have followed “Programming to Interfaces, not an implementation” design principle while implementing initial step of our project. We have modified the code of html.rs to invoke Parser trait’s parse_chunk method instead of directly invoking instead of directly invoking the methods of ServoHtmlParser .Thereby in future , if in case we use any other parser instance instead of ServoHtmlParser , we need not modify the invocation logic in html.rs function.(Traits are similar to interfaces in other languages).

We are planning to use parameterized variation of factory method design pattern to create instances of either html parser or Xml parser based on the HTTP Content-Type header. In html.rs file, instead of directly creating instances of ServoHtmlParser(like ServoHtmlParser::new..) ,we would be calling a function like build_parser by passing in HTTP Content-Type header as parameter. This build_parser method will return either instance of ServoHtmlParser or XML Parser based on the content type parameter. Here, build_parser will be acting as factory method .

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:36:05Z

Jhkhamba: /* Servo */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:35:41Z

Jhkhamba: /* Background Information */

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
[https://github.com/servo/servo Servo] is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= References =
<references></references>

CSC/ECE 517 Fall 2014

2014-10-27T18:34:49Z

Jhkhamba:

*[[CSC/ECE_517_Fall_2014/sample_page]]
*[[CSC/ECE_517_Fall_2014/ch1a 22 as]]
*[[CSC/ECE 517 Fall 2014/ch1a 19 mx]]
*[[CSC/ECE 517 Fall 2014/ch1a 3 zq]]
*[[CSC/ECE 517 Fall 2014/ch1a 4 lf]]
*[[CSC/ECE 517 Fall 2014/ch1a 4 wl]]
*[[CSC/ECE 517 Fall 2014/ch1a a7 ch]]
*[[CSC/ECE 517 Fall 2014/ch1a 25 rs]]
*[[CSC/ECE 517 Fall 2014/ch1a 25 jf]]
*[[CSC/ECE 517 Fall 2014/ch1a 8 os]]
*[[CSC/ECE 517 Fall 2014/ch1a 8 sn]]
*[[CSC/ECE 517 Fall 2014/ch1a 15 gs]]
*[[CSC/ECE 517 Fall 2014/ch1a 10 hu]]
*[[CSC/ECE 517 Fall 2014/ch1a 20 kv]]
*[[CSC/ECE 517 Fall 2014/ch1a 21 as]]
*[[CSC/ECE 517 Fall 2014/ch1a 24 sa]]
*[[CSC/ECE 517 Fall 2014/ch1a 26 sn]]
*[[CSC/ECE 517 Fall 2014/ch1a 6 rl]]
*[[CSC/ECE 517 Fall 2014/ch1a 2 ss]]
*[[CSC/ECE 517 Fall 2014/ch1a 16 av]]
*[[CSC/ECE 517 Fall 2014/ch1a 1 rm]]
*[[CSC/ECE 517 Fall 2014/ch1a 1 sj]]
*[[CSC/ECE 517 Fall 2014/ch1a 23 ss]]
*[[CSC/ECE 517 Fall 2014/ch1a 20 rn]]
*[[CSC/ECE 517 Fall 2014/ch1a 22 sp]]
*[[CSC/ECE 517 Fall 2014/ch1a 26 gn]]

*[[CSC/ECE 517 Fall 2014/ch1a 13 va]]
*[[CSC/ECE 517 Fall 2014/ch1a 9 aa]]
*[[CSC/ECE 517 Fall 2014/ch1a 9 kn]]
*[[CSC/ECE 517 Fall 2014/ch1a 11 ap]]
*[[CSC/ECE 517 Fall 2014/ch1a 25 ks]]
*[[CSC/ECE 517 Fall 2014/ch1a 7 kz]]
*[[CSC/ECE_517_Fall_2014/ch1a_6_bn]]
*[[CSC/ECE_517_Fall_2014/ch1a 10 zz]]
*[[CSC/ECE_517_Fall_2014/ch1a 16 va]]
*[[CSC/ECE_517_Fall_2014/ch1a F1415 rv]]
*[[CSC/ECE_517_Fall_2014/ch1a_3_cp]]
*[[CSC/ECE 517 Fall 2014/ch1b 26 sa]]
*[[CSC/ECE_517_Fall_2014/ch1b_28_cg]]
*[[CSC/ECE_517_Fall_2014/ch1b 29 ry]]
*[[CSC/ECE_517_Fall_2014/ch1b 30 cs]]
*[[CSC/ECE_517_Fall_2014/ch1b_33_jy]]
*[[CSC/ECE_517_Fall_2014/ch1b_27_js]]
*[[CSC/ECE 517 Fall 2014/oss E1465 oak]]
*[[CSC/ECE 517 Fall 2014/oss_M1456_kdv]]
*[[CSC/ECE 517 Fall 2014/oss_M1453_sst]]
*[[CSC/ECE 517 Fall 2014/oss_E1456_akk]]
*[[CSC/ECE_517_Fall_2014/oss_M1455_asa]]
*[[CSC/ECE_517_Fall_2014/oss_E1458_sst]]
*[[CSC/ECE_517_Fall_2014/oss_E1457_ags]]
*[[CSC/ECE_517_Fall_2014/OSS_E1466_gjf]]
*[[CSC/ECE_517_Fall_2014/oss_M1452_jns]]

CSC/ECE 517 Fall 2014

2014-10-27T18:34:23Z

Jhkhamba:

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:28:08Z

Jhkhamba: /* Steps of Implementation */

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo <code>/components/script/dom/servohtmlparser.rs</code>

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified <code>servo/components/script/parse/html.rs</code> to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:27:32Z

Jhkhamba: /* Steps of Implementation */

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: <code> servo/components/script/parse/mod.rs</code>

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo </components/script/dom/servohtmlparser.rs

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified servo/components/script/parse/html.rs to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:26:37Z

Jhkhamba: /* Steps of Implementation */

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: servo/components/script/parse/mod.rs

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

pub mod html;
pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo /components/script/dom/servohtmlparser.rs

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified servo/components/script/parse/html.rs to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:26:20Z

Jhkhamba: /* Steps of Implementation */

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: servo/components/script/parse/mod.rs

→ We have created a Parser Trait with the parse_chunk method in this mod.rs
pub mod html;

pub trait Parser {
fn parse_chunk(&self,input: String);
fn finish(&self);
}

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo /components/script/dom/servohtmlparser.rs

impl Parser for ServoHTMLParser{
fn parse_chunk(&self, input: String) {
self.tokenizer().borrow_mut().feed(input);
}
fn finish(&self){
self.tokenizer().borrow_mut().end();
}
}

→ We have modified servo/components/script/parse/html.rs to invoke the parse_chunk method appropriately.

InputString(s) => {
parser.parse_chunk(s);
}

InputUrl(url) => {
let load_response = load_response.unwrap();
match load_response.metadata.content_type {
Some((ref t, _)) if t.as_slice().eq_ignore_ascii_case("image") => {
let page = format!("<html><body><img src='{:s}' /></body></html>", base_url.as_ref().unwrap().serialize());
parser.parse_chunk(page);
},

Payload(data) => {
// FIXME: use Vec<u8> (html5ever #34)
let data = UTF_8.decode(data.as_slice(), DecodeReplace).unwrap();
parser.parse_chunk(data);
}

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:15:43Z

Jhkhamba: /* Steps of Implementation */

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

→ We created a new file mod.rs in the following directory: servo/components/script/parse/mod.rs

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo / components/script/dom/servohtmlparser.rs

→ We have modified servo/components/script/parse/html.rs to invoke the parse_chunk method appropriately.

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:15:01Z

Jhkhamba:

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

= Prerequisites =
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

= Steps of Implementation =

We created a new file mod.rs in the following directory: servo/components/script/parse/mod.rs

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo / components/script/dom/servohtmlparser.rs

→ We have modified servo/components/script/parse/html.rs to invoke the parse_chunk method appropriately.

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:14:33Z

Jhkhamba: /* Background Information */

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

== Prerequisites ==
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

== Steps of Implementation ==

We created a new file mod.rs in the following directory: servo/components/script/parse/mod.rs

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo / components/script/dom/servohtmlparser.rs

→ We have modified servo/components/script/parse/html.rs to invoke the parse_chunk method appropriately.

= References =
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:14:03Z

Jhkhamba:

= Integrating an XML Parser =
Servo is an experimental web browser layout engine being developed by Mozilla Research. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed.

__TOC__

= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

== Prerequisites ==
'''Installing Dependencies for Servo'''

The list of commands to install the dependencies on various platforms are<ref name = github>[https://github.com/servo/servo Servo Github]</ref>

On OS X (homebrew):

brew install automake pkg-config python glfw3 cmake
pip install virtualenv

On OS X (MacPorts):

sudo port install python27 py27-virtualenv cmake

On Debian-based Linuxes:

sudo apt-get install curl freeglut3-dev \
libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \
msttcorefonts gperf g++ cmake python-virtualenv \
libssl-dev libglfw-dev

On Fedora:

sudo yum install curl freeglut-devel libtool gcc-c++ libXi-devel \
freetype-devel mesa-libGL-devel glib2-devel libX11-devel libXrandr-devel gperf \
fontconfig-devel cabextract ttmkfdir python python-virtualenv expat-devel \
rpm-build openssl-devel glfw-devel cmake
pushd .
cd /tmp
wget http://corefonts.sourceforge.net/msttcorefonts-2.5-1.spec
rpmbuild -bb msttcorefonts-2.5-1.spec
sudo yum install $HOME/rpmbuild/RPMS/noarch/msttcorefonts-2.5-1.noarch.rpm
popd

On Arch Linux:

sudo pacman -S base-devel git python2 python2-virtualenv mesa glfw ttf-font cmake

'''Building Servo'''

''Normal Build''

git clone https://github.com/servo/servo
cd servo
./mach build
./mach run tests/html/about-mozilla.html

''Building for Android target''

git clone https://github.com/servo/servo
cd servo
ANDROID_TOOLCHAIN=/path/to/toolchain ANDROID_NDK=/path/to/ndk PATH=$PATH:/path/to/toolchain/bin ./mach build --android
cd ports/android
ANDROID_SDK=/path/to/sdk make install

== Steps of Implementation ==

We created a new file mod.rs in the following directory: servo/components/script/parse/mod.rs

→ We have created a Parser Trait with the parse_chunk method in this mod.rs

→ Implementation of this Parser trait for the ServoHTML Parser struct is in the servo / components/script/dom/servohtmlparser.rs

→ We have modified servo/components/script/parse/html.rs to invoke the parse_chunk method appropriately.

== References ==
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:06:01Z

Jhkhamba: /* Prerequisites */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:03:13Z

Jhkhamba: /* Prerequisites */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:01:54Z

Jhkhamba: /* Prerequisites */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T18:00:37Z

Jhkhamba:

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T17:56:45Z

Jhkhamba: /* Integrating an XML Parser */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T17:55:43Z

Jhkhamba: /* Integrating an XML Parser */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T17:48:52Z

Jhkhamba: /* Servo */

= Integrating an XML Parser =
This wiki is about the project M 1452: Integrate an XML Parser, which is a part of the ongoing development on the Servo browser. Below you can find a brief description about the servo project, rust programming language, requirements of this particular project, setting up of the development environment and other relevant details.

__TOC__
= Background Information =

== Rust ==
[http://www.rust-lang.org/ Rust] is a systems language for writing high performance applications that are usually written in C or C++ but it was developed to prevent some of the problems related to invalid memory accesses that generate segmentation faults. It covers imperative, functional and object-oriented programming.
It's designed to support concurrency and parallelism in building platforms that take full advantage of modern hardware. Its static type system is safe and expressive and it provides strong guarantees about isolation, concurrency execution and memory safety. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

Rust combines powerful and flexible modern programming constructs with a clear performance model to make program efficiency predictable and manageable. One important way it achieves this is by allowing fine-grained control over memory allocation through contiguous records and stack allocation. This control is balanced with the absolute requirement of safety: Rust’s type system and runtime guarantee the absence of data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. <ref name=Rust>[https://www.mozilla.org/en-US/research/projects/ Overview of Mozilla Research Projects]</ref>

== Servo ==
Servo is an experimental project to build a Web browser engine for a new generation of hardware: mobile devices, multi-core processors and high-performance GPUs. With Servo, we are rethinking the browser at every level of the technology stack — from input parsing to page layout to graphics rendering — to optimize for power efficiency and maximum parallelism.

Servo builds on top of Rust to provide a secure and reliable foundation. Memory safety at the core of the platform ensures a high degree of assurance in the browser’s trusted computing base. Rust’s lightweight task mechanism also promises to allow fine-grained isolation between browser components, such as tabs and extensions, without the need for expensive runtime protection schemes, like operating system process isolation.<ref name=Rust></ref>

== References ==
<references></references>

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T17:46:23Z

Jhkhamba: /* Rust */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T17:44:48Z

Jhkhamba: /* Rust */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T17:44:19Z

Jhkhamba: /* Rust */

CSC/ECE 517 Fall 2014/oss M1452 jns

2014-10-27T17:42:30Z

Jhkhamba:

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T20:18:09Z

Jhkhamba: /* Introduction */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found. Running Brakeman as a part of continuous integration provides feedback during all stages of development and can alert developers immediately when a potential vulnerability is introduced. Bringing security testing as close to the developer as possible (even scanning as files are saved) means security problems are caught faster - and the sooner problems are found the cheaper they are to fix. <ref name=confreaks>[http://www.confreaks.com/videos/890-railsconf2012-keeping-rails-applications-on-track-with-brakeman Keeping Rails Applications on track with Brakeman]</ref>

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

Here is a comparison of Brakeman with other security scanners<ref name=comp>[https://www.ruby-toolbox.com/categories/security_tools Rails Security Scanners]</ref>

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || 769667|| 623965|| 24151
|-
| '''Last Release''' || about a month ago|| about a month ago|| about a year ago
|-
| '''Activity''' || Active|| Less Active|| Inactive
|-
| '''Security Score''' || 2.644|| 1.071 || 0.449
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

==Further Reading==

[http://www.confreaks.com/videos/890-railsconf2012-keeping-rails-applications-on-track-with-brakeman Keeping Rails Applications on Track with Brakeman]

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T20:17:25Z

Jhkhamba: /* Introduction */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found. Running Brakeman as a part of continuous integration provides feedback during all stages of development and can alert developers immediately when a potential vulnerability is introduced. Bringing security testing as close to the developer as possible (even scanning as files are saved) means security problems are caught faster - and the sooner problems are found the cheaper they are to fix. <ref name=confreaks>[http://www.confreaks.com/videos/890-railsconf2012-keeping-rails-applications-on-track-with-brakeman Keeping Rails Applications on track with Brakeman</ref>

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

Here is a comparison of Brakeman with other security scanners<ref name=comp>[https://www.ruby-toolbox.com/categories/security_tools Rails Security Scanners]</ref>

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || 769667|| 623965|| 24151
|-
| '''Last Release''' || about a month ago|| about a month ago|| about a year ago
|-
| '''Activity''' || Active|| Less Active|| Inactive
|-
| '''Security Score''' || 2.644|| 1.071 || 0.449
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

==Further Reading==

[http://www.confreaks.com/videos/890-railsconf2012-keeping-rails-applications-on-track-with-brakeman Keeping Rails Applications on Track with Brakeman]

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T20:16:56Z

Jhkhamba:

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found. Running Brakeman as a part of continuous integration provides feedback during all stages of development and can alert developers immediately when a potential vulnerability is introduced. Bringing security testing as close to the developer as possible (even scanning as files are saved) means security problems are caught faster - and the sooner problems are found the cheaper they are to fix. <ref name=brakeman>[http://www.confreaks.com/videos/890-railsconf2012-keeping-rails-applications-on-track-with-brakeman Keeping Rails Applications on track with Brakeman</ref>

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

Here is a comparison of Brakeman with other security scanners<ref name=comp>[https://www.ruby-toolbox.com/categories/security_tools Rails Security Scanners]</ref>

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || 769667|| 623965|| 24151
|-
| '''Last Release''' || about a month ago|| about a month ago|| about a year ago
|-
| '''Activity''' || Active|| Less Active|| Inactive
|-
| '''Security Score''' || 2.644|| 1.071 || 0.449
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

==Further Reading==

[http://www.confreaks.com/videos/890-railsconf2012-keeping-rails-applications-on-track-with-brakeman Keeping Rails Applications on Track with Brakeman]

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:38:59Z

Jhkhamba: /* Comparison with other Security Scanners */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

Here is a comparison of Brakeman with other security scanners<ref name=comp>[https://www.ruby-toolbox.com/categories/security_tools Rails Security Scanners]</ref>

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || 769667|| 623965|| 24151
|-
| '''Last Release''' || about a month ago|| about a month ago|| about a year ago
|-
| '''Activity''' || Active|| Less Active|| Inactive
|-
| '''Security Score''' || 2.644|| 1.071 || 0.449
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:38:19Z

Jhkhamba:

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

Here is a comparison of Brakeman with other security scanners<ref name=comp>[https://www.ruby-toolbox.com/categories/security_tools ]</ref>

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || 769667|| 623965|| 24151
|-
| '''Last Release''' || about a month ago|| about a month ago|| about a year ago
|-
| '''Activity''' || Active|| Less Active|| Inactive
|-
| '''Security Score''' || 2.644|| 1.071 || 0.449
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:37:27Z

Jhkhamba: /* Comparison with other Security Scanners */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

Here is a comparison of Brakeman with other security scanners

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || 769667|| 623965|| 24151
|-
| '''Last Release''' || about a month ago|| about a month ago|| about a year ago
|-
| '''Activity''' || Active|| Less Active|| Inactive
|-
| '''Security Score''' || 2.644|| 1.071 || 0.449
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:35:43Z

Jhkhamba: /* Comparison with other Security Scanners */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || 769667|| 623965|| 24151
|-
| '''Last Release''' || about a month ago|| about a month ago|| about a year ago
|-
| '''Activity''' || Active|| Less Active|| Inactive
|-
| '''Security Score''' || 2.644|| 1.071 || 0.449
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:33:45Z

Jhkhamba: /* Comparison with other Security Scanners */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

{| class="wikitable"
|-
! !! Brakeman!! Loofah!! Tarantula
|-
| '''No. of Downloads''' || ExampleR1C1 || ExampleR1C2 || ExampleR1C3
|-
| '''Activity''' || ExampleR2C1 || ExampleR2C2 || ExampleR2C3
|-
| '''Last Release''' || ExampleR3C1 || ExampleR3C2 || ExampleR3C3
|-
| '''Security Score''' || ExampleR1C1 || ExampleR1C2 || ExampleR1C3
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:31:19Z

Jhkhamba:

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Comparison with other Security Scanners==

{| class="wikitable"
|-
! Brakeman!! Loofah!! Tarantula
|-
| ExampleR1C1 || ExampleR1C2 || ExampleR1C3
|-
| ExampleR2C1 || ExampleR2C2 || ExampleR2C3
|-
| ExampleR3C1 || ExampleR3C2 || ExampleR3C3
|}

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:13:48Z

Jhkhamba: /* Background */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=VulnerabilityScanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Vulnerability Scanning]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:13:18Z

Jhkhamba: /* Background */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside.<ref name=Vulnerability Scanning>[http://www.redant.com.au/automated-testing/vulnerability-scanning-ruby-on-rails/ Brakeman Scanner Introduction]</ref> This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-13T18:11:52Z

Jhkhamba: /* Background */

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

Brakeman is a vulnerability scanner that scans your code from the inside. This allows Brakeman to view the database structure and the logic and structure of the application. This is smart scanning as it does not need to scan 100's of webpages that all use the same application code. It only scans that piece of code once.

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-06T23:11:32Z

Jhkhamba:

'''Software security in Ruby on Rails web applications using Brakeman scanner''' 
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-06T23:10:07Z

Jhkhamba: /* Introduction */

Software security in Ruby on Rails web applications using Brakeman scanner
[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

__TOC__

==Background==

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-06T23:06:51Z

Jhkhamba: /* Introduction */

Software security in Ruby on Rails web applications using Brakeman scanner
==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

__TOC__

==Background==

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>

CSC/ECE 517 Fall 2014

2014-10-06T21:33:14Z

Jhkhamba:

*[[CSC/ECE_517_Fall_2014/sample_page]]
*[[CSC/ECE_517_Fall_2014/ch1a 22 as]]
*[[CSC/ECE 517 Fall 2014/ch1a 19 mx]]
*[[CSC/ECE 517 Fall 2014/ch1a 3 zq]]
*[[CSC/ECE 517 Fall 2014/ch1a 4 lf]]
*[[CSC/ECE 517 Fall 2014/ch1a 4 wl]]
*[[CSC/ECE 517 Fall 2014/ch1a a7 ch]]
*[[CSC/ECE 517 Fall 2014/ch1a 25 jf]]
*[[CSC/ECE 517 Fall 2014/ch1a 8 os]]
*[[CSC/ECE 517 Fall 2014/ch1a 8 sn]]
*[[CSC/ECE 517 Fall 2014/ch1a 15 gs]]
*[[CSC/ECE 517 Fall 2014/ch1a 10 hu]]
*[[CSC/ECE 517 Fall 2014/ch1a 20 kv]]
*[[CSC/ECE 517 Fall 2014/ch1a 21 as]]
*[[CSC/ECE 517 Fall 2014/ch1a 24 sa]]
*[[CSC/ECE 517 Fall 2014/ch1a 26 sn]]
*[[CSC/ECE 517 Fall 2014/ch1a 6 rl]]
*[[CSC/ECE 517 Fall 2014/ch1a 2 ss]]
*[[CSC/ECE 517 Fall 2014/ch1a 16 av]]
*[[CSC/ECE 517 Fall 2014/ch1a 1 rm]]
*[[CSC/ECE 517 Fall 2014/ch1a 1 sj]]
*[[CSC/ECE 517 Fall 2014/ch1a 23 ss]]
*[[CSC/ECE 517 Fall 2014/ch1a 20 rn]]
*[[CSC/ECE 517 Fall 2014/ch1a 22 sp]]
*[[CSC/ECE 517 Fall 2014/ch1a 26 gn]]

*[[CSC/ECE 517 Fall 2014/ch1a 13 va]]
*[[CSC/ECE 517 Fall 2014/ch1a 9 aa]]
*[[CSC/ECE 517 Fall 2014/ch1a 9 kn]]
*[[CSC/ECE 517 Fall 2014/ch1a 11 ap]]
*[[CSC/ECE 517 Fall 2014/ch1a 25 ks]]
*[[CSC/ECE 517 Fall 2014/ch1a 7 kz]]
*[[CSC/ECE_517_Fall_2014/ch1a_6_bn]]
*[[CSC/ECE_517_Fall_2014/ch1a 10 zz]]
*[[CSC/ECE_517_Fall_2014/ch1a 16 va]]
*[[CSC/ECE_517_Fall_2014/ch1a F1415 rv]]
*[[CSC/ECE_517_Fall_2014/ch1a_3_cp]]
*[[CSC/ECE 517 Fall 2014/ch1b 26 sa]]
*[[CSC/ECE_517_Fall_2014/ch1b_28_cg]]
*[[CSC/ECE_517_Fall_2014/ch1b 29 ry]]
*[[CSC/ECE_517_Fall_2014/ch1b 30 cs]]
*[[CSC/ECE_517_Fall_2014/ch1b_33_jy]]

CSC/ECE 517 Fall 2014/ch1b 33 jy

2014-10-06T20:09:49Z

Jhkhamba: /* Introduction */

Software security in Ruby on Rails web applications using Brakeman scanner
==Introduction==
[http://brakemanscanner.org/ Brakeman] is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref>
Lift borrows fro Brakeman scans your application by looking at your source code, which means it is not necessary to set up your application stack to use it. Once the scan is complete, Brakeman displays a list of all security issues that were found.

[https://docs.google.com/document/d/1--CEtBpSUACsjSSXtDB5bNIOBzHoMJPr8W0DSqasO_4/edit?usp=sharing Writeup Page]

__TOC__

==Background==

* 2011 - v1.0 released - Brakeman can now be used as a library
* v1.2 - Added rake options to create rake task to run Brakeman
* v1.3 - Added skip files option
* v1.5 - Added JSON Report Format
* v1.7 - Improved processing of Rails 3 routes
* v1.9 - Updated to RubyParser 3
* v2.0 - Combine deserialization checks into single check
* v2.1 - Support for ignoring warnings
* v2.2 - Reduce command injection false positives
* v2.4 - Detect SQL Injection in ‘delete_all’/’destroy_all’
* v2.6 - Parse most files upfront instead of on demand

==Installation<ref>http://brakemanscanner.org/docs/install/</ref>==
One can install Brakeman in 3 ways.
===Using RubyGems===
Brakeman can be installed by executing below gem install command at ruby prompt.
<pre>gem install brakeman</pre>
If you are among those people who are skeptical about installing unsigned gems, we have good news for you, Brakeman gems are now signed.
To verify the Brakeman gem, one must add the [https://github.com/presidentbeef/brakeman/blob/master/brakeman-public_cert.pem public Brakeman certificate] to their trusted list by using below command.
<pre>gem cert --add <(curl -Ls https://raw.github.com/presidentbeef/brakeman/master/brakeman-public_cert.pem)</pre>
certificate can also be added to trusted list by manually downloading and adding it.
Once certificate is added gems can be installed with trust policy.
*HighSecurity trust policy implies that all dependent gems must be signed and verified.
*MediumSecurity trust policy implies that all signed dependent gems must be verified.
Since all the dependent dependencies are not yet signed by their authors at this time, only MediumSecurity can be enforced.
<pre>gem install brakeman -P MediumSecurity</pre>

===Bundle install===
Brakeman can be added to a Gemfile using below line
<pre>gem "brakeman", :require => false</pre>
Adding Brakeman gem to Gemfile enables it to be installed as part of bundle install.

===Source code===
If you would like to have latest version of Brakeman you can always clone the Brakeman git project, build the gem yourself and install it.
Following are the commands used to install Brakeman from source code.
<pre>git clone git://github.com/presidentbeef/brakeman.git
cd brakeman
gem build brakeman.gemspec
gem install brakeman-*.gem</pre>

==Running Brakeman==
You can run Brakeman in 2 ways.
===Running brakeman from your rails app directory===
<pre>cd your_rails_app/
brakeman</pre>
This will scan the application in the current directory and output a report to the command line.
===Supplying path as an option to Brakeman===
<pre>brakeman your_rails_app</pre>
where your_rails_app is the path to your rails application.

==Options<ref>http://brakemanscanner.org/docs/options/</ref>==
===Output Options===
====Output File====
To specify an output file for the results:
<pre>brakeman -o output_file</pre>
====Output Format====
The output format is determined by the file extension used with the -o option or by using the -f option. Current options are: text, html, tabs, and csv.
For example, to output an HTML report:
<pre>brakeman -o report.html</pre>
===Message Length===
By default, brakeman truncates warning messages to 100 characters. The --message-limit option can be used to adjust this. Setting the limit to -1 will disable truncation completely.
===Quiet Operation===
To suppress informational warnings and just output the report:
<pre>brakeman -q</pre>
===Debugging Information===
To see all kinds of debugging information:
<pre>brakeman -d</pre>
===Scanning Options===
====Specify Path to Application====
Usually the path to the Rails app is the last argument. Optionally, the --path option can be used to specify a path.
<pre>brakeman --path your_rails_app -o report.html</pre>
====Manually Turn on XSS Protection====
If you are using the rails_xss gem or some other plugin, but Brakeman is not detecting it, the --escape-html option will use Erubis for rendering ERB files and turn on HTML escaping for ERB and HAML.
====Manually Turn on Rails 3 Support====
Brakeman should detect Rails 3 applications, but if not the -3 will switch Brakeman to Rails 3 mode.
====Specifying Which Checks to Run====
Specific checks can be skipped, if desired. The name needs to be the correct case. For example, to skip looking for default routes (DefaultRoutes):
<pre>brakeman -x DefaultRoutes</pre>
Multiple checks should be separated by a comma:
<pre>brakeman -x DefaultRoutes,Redirect</pre>
To do the opposite and only run a certain set of tests:
<pre>brakeman -t SQL,ValidationRegex</pre>
====Report Routes====
To see what actions brakeman has detected as being routes, use the --routes option.
===Warning Options===
====Ignore Safe Methods====
To indicate certain methods are “safe”:
<pre>brakeman -s benign_method,totally_safe</pre>
====Assume Unknown Methods are Safe====
By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would raise a warning (in Rails 2.x):
<pre><%= some_method(:option => params[:input]) %></pre>
To only raise warnings only when untrusted data is being directly used:
<pre>brakeman -r</pre>
====Ignore Model Output====
By default, brakeman will report unescaped model attributes as dangerous. To disregard these warnings, use --ignore-model-output.
====Set Minimum Confidence Level====
To only report warnings at or above a certain confidence level, use the -w option.
#Weak confidence
#Medium confidence
#High confidence
For example, to only show high confidence warnings:
<pre>brakeman -w3</pre>

==Confidence Levels<ref>http://brakemanscanner.org/docs/confidence/</ref>==
Brakeman assigns each warning a confidence level. This rating is intended to indicate how certain Brakeman is that the given warning is a real problem.
The following guidelines are used:
*High - Either this is a simple warning or user input is very likely being used in unsafe ways.
*Medium - This generally indicates an unsafe use of a variable, but the variable may or may not be user input.
*Weak - Typically means user input was indirectly used in a potentially unsafe manner.
However, Brakeman can easily guess wrong, so it is best to read through all warnings and assess their importance manually.

==Warning Types<ref>http://brakemanscanner.org/docs/warning_types/</ref>==
Below are list of warnings Brakeman can detect and report in an application. You can know more about a warning by clicking on that warning.
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting Cross Site Scripting]
*[http://brakemanscanner.org/docs/warning_types/cross_site_scripting_to_json Cross Site Scripting (JSON)]
*[http://brakemanscanner.org/docs/warning_types/content_tag Cross Site Scripting (Content Tag)]
*[http://brakemanscanner.org/docs/warning_types/sql_injection SQL Injection]
*[http://brakemanscanner.org/docs/warning_types/command_injection Command Injection]
*[http://brakemanscanner.org/docs/warning_types/mass_assignment Mass Assignment]
*[http://brakemanscanner.org/docs/warning_types/attribute_restriction Attribute Restriction]
*[http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery Cross-Site Request Forgery]
*[http://brakemanscanner.org/docs/warning_types/redirect Unsafe Redirects]
*[http://brakemanscanner.org/docs/warning_types/default_routes Default Routes]
*[http://brakemanscanner.org/docs/warning_types/format_validation Format Validation]
*[http://brakemanscanner.org/docs/warning_types/denial_of_service Denial of Service]
*[http://brakemanscanner.org/docs/warning_types/dynamic_render_paths Dynamic Render Paths]
*[http://brakemanscanner.org/docs/warning_types/dangerous_evaluation Dangerous Evaluation]
*[http://brakemanscanner.org/docs/warning_types/unsafe_deserialization Unsafe Deserialization]
*[http://brakemanscanner.org/docs/warning_types/file_access File Access]
*[http://brakemanscanner.org/docs/warning_types/basic_authentication Basic Authentication]
*[http://brakemanscanner.org/docs/warning_types/session_setting Session Settings]
*[http://brakemanscanner.org/docs/warning_types/information_disclosure Information Disclosure]
*[http://brakemanscanner.org/docs/warning_types/dangerous_send Dangerous Send]
*[http://brakemanscanner.org/docs/warning_types/CVE-2011-0446 Mail Link]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution Remote Code Execution]
*[http://brakemanscanner.org/docs/warning_types/remote_code_execution_yaml_load Remote Execution in YAML.load]
*[http://brakemanscanner.org/docs/warning_types/ssl_verification_bypass SSL Verification Bypass]

==Reducing False Positives<ref>http://brakemanscanner.org/docs/reducing_false_positives/</ref>==
Brakeman tries to report maximum number of warning. As of now there is no method for Brakeman to know certain items are actually safe or not. Hence false positives can become overwhelming. For this reason Brakeman provides options for customizing reports and reduce false positives.
===Specify Checks to Run===
One can specify Brakeman to run a specific set of checks/tests using --test.
For example, to only check for SQL injection and cross-site scripting:
<pre>brakeman --test CheckSQL,CheckCrossSiteScripting</pre>
One can also specify Brakeman to exclude certain checks/test using --except.
To exclude checks for dynamic render paths:
<pre>brakeman --except CheckRender</pre>
(‘Check’ can actually be omitted from the names.)
Both --test and --except options take a comma-separated list of check names, which are case-sensitive.
To get list of checks supported by Brakeman one can use below command.
<pre>brakeman --checks</pre>
===Set Confidence Threshold===
Brakeman allows to set the confidence levels of warnings one would like to see in the report by using -w
For example if you want Brakeman to report high and medium confidence warnings only use below command.
<pre>brakeman –w2</pre>
===Mark Methods as Safe===
If you want Brakeman to ignore some methods, this can be achieved by using --safe-methods option. This option can take methods as a comma-separated list.
For example:
<pre>brakeman --safe-methods this_one,that_one,totally_safe,my_sanitizer</pre>
===Only Reporting Direct Vulnerabilities===
With the default settings, Brakeman will report cross-site scripting vulnerabilities if the return value of a method where user input is a parameter is output.
For example, this will raise a warning unless some_method is marked as safe like above:
<pre><%= some_method(params[:blah]) %></pre>
To ignore this kind of output, use the --report-direct option. This also applies to some other situations, such as checking calls to redirect_to.
===Ignoring Model Attributes===
Brakeman assumes database values are suspect (and so should you). But for some applications this does not make sense. Use the --ignore-model-output option to suppress reporting model attributes as cross-site scripting vulnerabilities.

==Using Brakeman as a Library==

Brakeman was initially designed to be used as a command-line application. Version 1.0 introduced changes that allowed Brakeman to be used as a library and future releases will make it even easier to use.
<pre>
require 'brakeman'
tracker = Brakeman.run "my/app"
puts tracker.report
</pre>

This code runs Brakeman against the Rails application in ‘my/app’ and prints out the report.<ref name=brakeman>[http://brakemanscanner.org/docs/introduction/ Brakeman Scanner Introduction]</ref> This is the same as running Brakeman with no options. Brakeman.run returns a Tracker object which contains all the information from the scan. Tracker#checks holds the results from running the checks.
Brakeman can be run with a host of command-line options:

<pre>
Brakeman.run :app_path => "my/app"
</pre>

*app_path - path to root of Rails app (required)
*assume_all_routes - assume all methods are routes (default: false)
*check_arguments - check arguments of methods (default: true)
*collapse_mass_assignment - report unprotected models in single warning (default: true)
*combine_locations - combine warning locations (default: true)
*config_file - configuration file
*escape_html - escape HTML by default (automatic)
*exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
*html_style - path to CSS file
*ignore_model_output - consider models safe (default: false)
*message_limit - limit length of messages
*min_confidence - minimum confidence (0-2, 0 is highest)
*output_file - file for output
*output_format - format for output (:to_s, :to_tabs, :to_csv, :to_html)
*parallel_checks - run checks in parallel (default: true)
*print_report - if no output file specified, print to stdout (default: false)
*quiet - suppress most messages (default: true)
*rails3 - force Rails 3 mode (automatic)
*report_routes - show found routes on controllers (default: false)
*run_checks - array of checks to run (run all if not specified)
*safe_methods - array of methods to consider safe
*skip_libs - do not process lib/ directory (default: false)
*skip_checks - checks not to run (run all if not specified)

==Advantages==
1. No Configuration Necessary -
:Once Brakeman has been installed, no configuration is required. It can directly be run.
2. Run It Anytime -
:Brakeman can run at any stage of development because all it needs is source code. A new application can be generated instantly and can be run against Brakeman.
3. Better Coverage -
:Brakeman provides security before they can become exploitable because it can scan pages that are not ‘live’ yet.
4. Best Practices -
:Brakeman is built specifically for Rails applications, so it can check configuration settings for best practices.
5. Flexible Testing -
:Each Brakeman check is independent of the other and hence testing can be limited to a small subset of checks.
6. Speed -
:Much faster than “black box” website scanner. Large applications can be scanned in a matter of minutes.

==Disadvantages==
1. False Positives - 
:Brakeman is extremely suspicious by default. Some values that are safe may be marked suspicious by Brakeman. 
2. Unusual Configurations - 
:Brakeman assumes all applications follow the typical Rails setup. If not, it may miss scanning certain files. 
3. Only Knows Code - 
:Brakeman cannot scan the entire application stack,, but only the software code. 
4. Isn’t Omniscient - 
:Brakeman may miss certain things or misunderstand them. 

== References ==
<references></references>