A while ago I wrote an article about integrating Rubocop into your workflow. Now that we are checking for code style, it is time to improve the workflow even further with a security scanner.
This is where Brakeman enters the scene. Brakeman is a security scanner for your Ruby on Rails apps. Most security scanners require your app to run; Brakeman is different. By looking at the source code, it can detect possible problems!
Security is important, but at the same time your team usually does not much time or resources to spend on it. Brakeman makes this easy for you, it will check your entire app for known security flaws in your code. This will help you save time, and eventually money.
Please keep in mind that Brakeman is no silver bullet for security. Keep educating yourself on the aspects of security to make sure you are writing secure software.
To install Brakeman, you simply install a gem. Add the following line to your gem file; preferably in a [:development, :test] block. It is recommended not to lock down to a version, that way you're always using the latest version.
After installing you can directly run Brakeman, there is no need for any configuration.
Run Brakeman like this: $ brakeman.
You get an output similar to the following:
After you have ran Brakeman, you will get a list of potential problems; it is important to use your own judgment on those items since not every item on the is an actual problem in your application. This is because Brakeman is extremely paranoid; Use your best judgment!
If Brakeman happens to find any problems in your app that you do not qualify as actual problems, you can easily ignore those.
To create your ignore file, you can run Brakeman with the following command: $ brakeman -I, this will prompt you for an ignore file, using the default is fine here (config/brakeman.ignore.
You then get a question about the run mode, if you run Brakeman for the first time, pick option 1. Inspect all Warnings; if you are trying to add new entries to the ignore list select 2. Hide previously ignored warnings.
Next Brakeman will run like it always does, and with every problem it asks you what you want to do with it:
There are a couple of actions that are worth noting (For the others press ?)
In this case, we will press i, so the warning gets pushed onto the Ignore list.
When you now run Brakeman again, you will see that it will no longer show this warning.
To make sure you and your team stay on top of the Brakeman errors, it is probably a good idea to run Brakeman as part of your test suite.
In your CI, you can add another pipeline/step with the following command; the -z flag is important here because this makes Brakeman fail with a non-zero code if there is a problem, and thus make your CI fail:
We use Codeship for our continues Integration, and setting it up is as easy as adding another bash command to our Test Commands.
Whenever we now push a new commit, Brakeman will be running, and inform us if we introduced a new possible security problem.
If you have any comments or questions, please let me know! You can find me on Twitter or by Email
