This repository was archived by the owner on Feb 4, 2026. It is now read-only.
File tree Expand file tree Collapse file tree 3 files changed +4
-4
lines changed
Expand file tree Collapse file tree 3 files changed +4
-4
lines changed Original file line number Diff line number Diff line change 33 SPDX-License-Identifier: Apache-2.0
44=end
55
6- # {fact rule=untrusted -format-strings @v1.0 defects=0}
6+ # {fact rule=tainted -format@v1.0 defects=0}
77class TaintedFormat < ActionController ::Base
88 def sanitized_input
99 # Compliant: User-input is not used to format output.
Original file line number Diff line number Diff line change 33 SPDX-License-Identifier: Apache-2.0
44=end
55
6- # {fact rule=untrusted -format-strings @v1.0 defects=1}
6+ # {fact rule=tainted -format@v1.0 defects=1}
77class TaintedFormat < ActionController ::Base
88 def unsanitized_input
99 # Noncompliant: untrusted user input is being used directly in format sting.
Original file line number Diff line number Diff line change 33SPDX-License-Identifier: Apache-2.0
44=end
55
6- # {fact rule=autoescape-disabled @v1.0 defects=0}
6+ # {fact rule=untrusted-file-open @v1.0 defects=0}
77filename = "testfile"
88# Compliant: File being opened is static.
99open ( filename ) do |f |
1010 print f . gets
1111end
1212# {/fact}
1313
14- # {fact rule=autoescape-disabled @v1.0 defects=1}
14+ # {fact rule=untrusted-file-open @v1.0 defects=1}
1515
1616# Noncompliant: User-input directly controls which file is opened.
1717cmd = open ( "|%s" % params [ :file )
You can’t perform that action at this time.
0 commit comments