我不明白为什么这是XSS警告Rails4。link_to href中的不安全模型属性

Question

I have a show view with this code:

 %ul.pager
   %li.pull-left{ class: ('disabled' if collection_of_all_topics.index(@topic).zero?) }
     = link_to t('.previous_topic_html'), previous_topic(collection_of_all_topics, @topic)
   %li.pull-right{ class: ('disabled' if collection_of_all_topics.index(@topic).zero?) }
     = link_to t('.next_topic_html'), next_topic(collection_of_all_topics, @topic)

When I try to execute a brakeman -q command I receive these two warnings:

     Medium     | topics/show (TopicsController#show) | Cross Site Scripting | Unsafe model attribute in link_to href near line 29: link_to(t(".previous_topic_html"), previous_topi>>
| Medium     | topics/show (TopicsController#show) | Cross Site Scripting | Unsafe model attribute in link_to href near line 31: link_to(t(".next_topic_html"), next_topic(+Topic>>

For the path parameter of the link_to method I have a set of logic that calculates the next and previous topic located in my topic_helper.rb file:

 module TopicsHelper
  def next_topic?(collection_of_all_topics, topic)
    !(topic == collection_of_all_topics.last)
  end

  def next_topic(collection_of_all_topics, topic)
    return '' unless next_topic?(collection_of_all_topics, topic)
    topic_path(collection_of_all_topics[(collection_of_all_topics.index(topic) + 1)])
  end

  def previous_topic(collection_of_all_topics, topic)
    topic_path(collection_of_all_topics[(collection_of_all_topics.index(topic) - 1)])
  end
end

I've done some reading on the Rails guides with XSS under the security section but I still don't understand what the problem is here, or more importantly how to fix it. I've tried these methods to fix the error:

 = h(link_to t('.previous_topic_html'), previous_topic(collection_of_all_topics, @topic))

 = sanitize(link_to t('.previous_topic_html'), previous_topic(collection_of_all_topics, @topic))

 = link_to t('.previous_topic_html'), sanitize(previous_topic(collection_of_all_topics, @topic))

 = link_to t('.previous_topic_html'), h(previous_topic(collection_of_all_topics, @topic))

These implementations still result in the warning. Why is this a warning and how do I fix this?

Answer 1

Brakeman is complaining because you are accessing attributes of @topic in the view. The TopicsHelper might be triggering it? Check out their explanation here . IMO, Brakeman is a bit too sensitive on this issue. If you're really concerned, sanitize should do the trick. The danger here is that an end user could manipulate the @topic id in the link and access other Topics. Is that an issue for you?

See this issue on Brakeman's github issues .

See also this issue .

TLDR; this is PROBABLY a false positive and should be ignored.