Q
Detector Library
Ruby detectors (21/21)
SQL InjectionDivide by ZeroSensitive HTTP ActionInsufficient Protected CredentialsSensitive Information LeakUntrusted DeserializationLog InjectionXML External EntityPath InjectionHttp to File AccessCode InjectionOS Command InjectionResource leakCross Site Scripting (XSS)Untrusted OpenImproper Input ValidationStack Trace ExposureImproper Certificate Validationsend_file InjectionUnsafe File PermissionsTainted Format
XML External Entity High
Objects that parse or handle XML data can lead to XML External Entity (XXE) attacks when not configured properly. Improper restriction of XML external entity processing can lead to server-side request forgery and information disclosure.
Detector ID
ruby/xml-external-entity@v1.0
Category
Common Weakness Enumeration (CWE) 
Noncompliant example
1def xml_external_entity_noncompliant()
2 # Noncompliant: Disabling encryption of sensitive data
3 config.force_ssl = false
4endCompliant example
1def xml_external_entity_compliant()
2 # Compliant: Sensitive data is encrypted
3 config.force_ssl = true
4end