Ciao,
ho provato la gem su un app rails e mi salta fuori questo errore, non
essendo formattato per essere letto presumo sia qualche bug(
http://imgur.com/Y5fG5kA):
17:51:53 [$] dawn: Solution: Please refere to the Ruby on Rails
cheatsheet
available from owasp.org to mitigate this vulnerability
17:51:53 [!] dawn: Evidence:
17:51:53 [!] dawn: [{:filename=>“./config/deploy.rb”,
:matches=>[{:match=>“# ask :branch, proc { git rev-parse --abbrev-ref HEAD.chomp }\n”, :line=>3}]},
{:filename=>“./config/environments/production.rb”, :matches=>[{:match=>"
Add rack-cache to your Gemfile before enabling this.\n", :line=>17}]},
{:filename=>“./config/initializers/devise.rb”, :matches=>[{:match=>" #
given strategies, for example, config.params_authenticatable = [:database] will\n", :line=>52}, {:match=>" # given strategies, for
example, config.http_authenticatable = [:token] will\n", :line=>58},
{:match=>" # passing :skip => :sessions to devise_for in your
config/routes.rb\n", :line=>81}, {:match=>" # Require the
devise-encryptable gem when using anything other than bcrypt\n",
:line=>195}, {:match=>" # When using Devise inside an engine, let’s
call
it MyEngine, and this engine\n", :line=>245}, {:match=>" # The router
that invoked devise_for, in the example above, would be:\n",
:line=>251}]}, {:filename=>“./config/initializers/secret_token.rb”,
:matches=>[{:match=>“# You can use rake secret to generate a secure
secret key.\n”, :line=>7}]},
{:filename=>“./config/initializers/simple_form.rb”,
:matches=>[{:match=>"
given input by passing: f.input EXTENSION_NAME => false.\n",
:line=>11}, {:match=>" # renaming b.use to b.optional.\n",
:line=>13}, {:match=>" # They are disabled unless you pass f.input EXTENSION_NAME => :lookup\n", :line=>24}, {:match=>" # extensions by
default, you can change b.optional to b.use.\n", :line=>27}]}]
17:51:53 [!] dawn: []
2014/1/21 Paolo P. [email protected]
