rake brakeman
Passed Started
by
@bak1an
Anton Baklanov
1Running with gitlab-ci-multi-runner 1.6.0 (01b3ea1)2Using Docker executor with image ruby:2.3.1 ...3Pulling docker image ruby:2.3.1 ...4Running on runner-8a2f473d-project-472466-concurrent-0 via runner-8a2f473d-machine-1475455357-2c6bdcc4-digital-ocean-4gb...5Cloning repository for master with git depth set to 20...6Cloning into '/builds/bak1an/gitlab-ce'...7Checking out 9235f1d4 as master...8Checking cache for ruby-231...9Downloading cache.zip from https://runners-cache-1.gitlab.com:443/runner/runner/8a2f473d/project/472466/ruby-231 10Downloading artifacts for knapsack (4678251)...11Downloading artifacts from coordinator... ok id=4678251 responseStatus=200 OK token=LnYev2YS12$ source ./scripts/prepare_build.sh13/builds/bak1an/gitlab-ce/vendor/apt /builds/bak1an/gitlab-ce14/builds/bak1an/gitlab-ce15debconf: delaying package configuration, since apt-utils is not installed16Selecting previously unselected package cmake-data.17(Reading database ... 21157 files and directories currently installed.)18Preparing to unpack .../cmake-data_3.0.2-1+deb8u1_all.deb ...19Unpacking cmake-data (3.0.2-1+deb8u1) ...20Selecting previously unselected package libarchive13:amd64.21Preparing to unpack .../libarchive13_3.1.2-11+deb8u3_amd64.deb ...22Unpacking libarchive13:amd64 (3.1.2-11+deb8u3) ...23Selecting previously unselected package cmake.24Preparing to unpack .../cmake_3.0.2-1+deb8u1_amd64.deb ...25Unpacking cmake (3.0.2-1+deb8u1) ...26Selecting previously unselected package libc-ares2:amd64.27Preparing to unpack .../libc-ares2_1.10.0-2+deb8u1_amd64.deb ...28Unpacking libc-ares2:amd64 (1.10.0-2+deb8u1) ...29Selecting previously unselected package icu-devtools.30Preparing to unpack .../icu-devtools_52.1-8+deb8u3_amd64.deb ...31Unpacking icu-devtools (52.1-8+deb8u3) ...32Selecting previously unselected package libdbi-perl.33Preparing to unpack .../libdbi-perl_1.631-3+b1_amd64.deb ...34Unpacking libdbi-perl (1.631-3+b1) ...35Selecting previously unselected package libdbd-mysql-perl.36Preparing to unpack .../libdbd-mysql-perl_4.028-2+deb8u1_amd64.deb ...37Unpacking libdbd-mysql-perl (4.028-2+deb8u1) ...38Selecting previously unselected package libicu-dev:amd64.39Preparing to unpack .../libicu-dev_52.1-8+deb8u3_amd64.deb ...40Unpacking libicu-dev:amd64 (52.1-8+deb8u3) ...41Selecting previously unselected package libterm-readkey-perl.42Preparing to unpack .../libterm-readkey-perl_2.32-1+b1_amd64.deb ...43Unpacking libterm-readkey-perl (2.32-1+b1) ...44Selecting previously unselected package libv8-3.14.5.45Preparing to unpack .../libv8-3.14.5_3.14.5.8-8.1_amd64.deb ...46Unpacking libv8-3.14.5 (3.14.5.8-8.1) ...47Selecting previously unselected package lsb-release.48Preparing to unpack .../lsb-release_4.1+Debian13+nmu1_all.deb ...49Unpacking lsb-release (4.1+Debian13+nmu1) ...50Selecting previously unselected package mysql-client-5.5.51Preparing to unpack .../mysql-client-5.5_5.5.52-0+deb8u1_amd64.deb ...52Unpacking mysql-client-5.5 (5.5.52-0+deb8u1) ...53Selecting previously unselected package mysql-client.54Preparing to unpack .../mysql-client_5.5.52-0+deb8u1_all.deb ...55Unpacking mysql-client (5.5.52-0+deb8u1) ...56Selecting previously unselected package postgresql-client-common.57Preparing to unpack .../postgresql-client-common_165+deb8u1_all.deb ...58Unpacking postgresql-client-common (165+deb8u1) ...59Selecting previously unselected package postgresql-client-9.4.60Preparing to unpack .../postgresql-client-9.4_9.4.9-0+deb8u1_amd64.deb ...61Unpacking postgresql-client-9.4 (9.4.9-0+deb8u1) ...62Selecting previously unselected package postgresql-client.63Preparing to unpack .../postgresql-client_9.4+165+deb8u1_all.deb ...64Unpacking postgresql-client (9.4+165+deb8u1) ...65Selecting previously unselected package unzip.66Preparing to unpack .../unzip_6.0-16+deb8u2_amd64.deb ...67Unpacking unzip (6.0-16+deb8u2) ...68Selecting previously unselected package nodejs.69Preparing to unpack .../nodejs_0.10.29~dfsg-2_amd64.deb ...70Unpacking nodejs (0.10.29~dfsg-2) ...71Processing triggers for mime-support (3.58) ...72Setting up cmake-data (3.0.2-1+deb8u1) ...73Setting up libarchive13:amd64 (3.1.2-11+deb8u3) ...74Setting up cmake (3.0.2-1+deb8u1) ...75Setting up libc-ares2:amd64 (1.10.0-2+deb8u1) ...76Setting up icu-devtools (52.1-8+deb8u3) ...77Setting up libdbi-perl (1.631-3+b1) ...78Setting up libdbd-mysql-perl (4.028-2+deb8u1) ...79Setting up libicu-dev:amd64 (52.1-8+deb8u3) ...80Setting up libterm-readkey-perl (2.32-1+b1) ...81Setting up libv8-3.14.5 (3.14.5.8-8.1) ...82Setting up lsb-release (4.1+Debian13+nmu1) ...83Setting up mysql-client-5.5 (5.5.52-0+deb8u1) ...84Setting up mysql-client (5.5.52-0+deb8u1) ...85Setting up postgresql-client-common (165+deb8u1) ...86Setting up postgresql-client-9.4 (9.4.9-0+deb8u1) ...87update-alternatives: using /usr/share/postgresql/9.4/man/man1/psql.1.gz to provide /usr/share/man/man1/psql.1.gz (psql.1.gz) in auto mode88Setting up postgresql-client (9.4+165+deb8u1) ...89Setting up unzip (6.0-16+deb8u2) ...90Setting up nodejs (0.10.29~dfsg-2) ...91update-alternatives: using /usr/bin/nodejs to provide /usr/bin/js (js) in auto mode92Processing triggers for libc-bin (2.19-18+deb8u6) ...93$ cp config/gitlab.yml.example config/gitlab.yml94$ bundle --version95Bundler version 1.13.296$ [ "$USE_BUNDLE_INSTALL" != "true" ] || retry bundle install --without postgres production --jobs $(nproc) "${FLAGS[@]}"97$ retry gem install knapsack98Successfully installed timecop-0.8.199Successfully installed knapsack-1.12.11002 gems installed101$ [ "$SETUP_DB" != "true" ] || bundle exec rake db:drop db:create db:schema:load db:migrate102$ bundle exec $CI_BUILD_NAME103Loading scanner...104Processing application in /builds/bak1an/gitlab-ce105Processing gems...106[Notice] Detected Rails 4 application107Processing configuration...108[Notice] Escaping HTML by default109Parsing files...110Processing initializers...111Processing libs...112Processing routes... 113Processing templates... 114Processing data flow in templates...115Processing models... 116Processing controllers... 117Processing data flow in controllers...118Indexing call sites... 119Running checks in parallel...120 - CheckBasicAuth121 - CheckBasicAuthTimingAttack122 - CheckCrossSiteScripting123 - CheckContentTag124 - CheckCreateWith125 - CheckDefaultRoutes126 - CheckDeserialize127 - CheckDetailedExceptions128 - CheckDigestDoS129 - CheckDynamicFinders130 - CheckEscapeFunction131 - CheckEvaluation132 - CheckExecute133 - CheckFileAccess134 - CheckFileDisclosure135 - CheckFilterSkipping136 - CheckForgerySetting137 - CheckHeaderDoS138 - CheckI18nXSS139 - CheckJRubyXML140 - CheckJSONEncoding141 - CheckJSONParsing142 - CheckLinkTo143 - CheckLinkToHref144 - CheckMailTo145 - CheckMassAssignment146 - CheckMimeTypeDoS147 - CheckModelAttrAccessible148 - CheckModelAttributes149 - CheckModelSerialize150 - CheckNestedAttributes151 - CheckNestedAttributesBypass152 - CheckNumberToCurrency153 - CheckQuoteTableName154 - CheckRedirect155 - CheckRegexDoS156 - CheckRender157 - CheckRenderDoS158 - CheckRenderInline159 - CheckResponseSplitting160 - CheckRouteDoS161 - CheckSafeBufferManipulation162 - CheckSanitizeMethods163 - CheckSelectTag164 - CheckSelectVulnerability165 - CheckSend166 - CheckSendFile167 - CheckSessionManipulation168 - CheckSessionSettings169 - CheckSimpleFormat170 - CheckSingleQuotes171 - CheckSkipBeforeFilter172 - CheckSQL173 - CheckSQLCVEs174 - CheckSSLVerify175 - CheckStripTags176 - CheckSymbolDoSCVE177 - CheckTranslateBug178 - CheckUnsafeReflection179 - CheckValidationRegex180 - CheckWithoutProtection181 - CheckXMLDoS182 - CheckYAMLParsing183Checks finished, collecting results...184Generating report...185+BRAKEMAN REPORT+186Application path: /builds/bak1an/gitlab-ce187Rails version: 4.2.7.1188Brakeman version: 3.3.2189Started at 2016-10-03 00:50:11 +0000190Duration: 63.78327363 seconds191Checks run: BasicAuth, BasicAuthTimingAttack, ContentTag, CreateWith, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, DynamicFinders, EscapeFunction, Evaluation, Execute, FileAccess, FileDisclosure, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONEncoding, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, MimeTypeDoS, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NestedAttributesBypass, NumberToCurrency, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, RenderInline, ResponseSplitting, RouteDoS, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionManipulation, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoSCVE, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, XMLDoS, YAMLParsing192+SUMMARY+193+-------------------+-------+194| Scanned/Reported | Total |195+-------------------+-------+196| Controllers | 152 |197| Models | 115 |198| Templates | 665 |199| Errors | 14 |200| Security Warnings | 0 (0) |201+-------------------+-------+202+Errors+203+-----------------------------------+----------------------------------------->>204| Error | Location >>205+-----------------------------------+----------------------------------------->>206| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>207| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>208| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>209| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>210| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>211| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>212| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>213| Invalid US-ASCII character "\xE2" | While compiling HAML in /builds/bak1an/g>>214| Invalid US-ASCII character "\xC2" | While compiling HAML in /builds/bak1an/g>>215| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>216| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>217| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>218| Invalid US-ASCII character "\xC2" | While compiling HAML in /builds/bak1an/g>>219| Invalid US-ASCII character "\xC3" | While compiling HAML in /builds/bak1an/g>>220+-----------------------------------+----------------------------------------->>221Security check succeed222Creating cache ruby-231...223vendor/apt: found 54 matching files 224vendor/ruby: found 37729 matching files 225Archive is up to date! 226Build succeeded