Description

Detects usage of Ruby's OpenURI library with insecure HTTP or FTP URL schemes. This creates a risk of man-in-the-middle attacks since data is transmitted unencrypted over the network, potentially exposing sensitive information to attackers.

Detection Strategy

• Check if the OpenURI library is imported in the Ruby code

• Look for calls to URI.open() or URI.parse() methods

• Examine if the URL parameter uses insecure schemes like 'http://' or 'ftp://'

• Report vulnerability when unencrypted URI schemes are used with these methods

Vulnerable code example

require 'openuri'

def fetch_url
  url = "http://example.com/data"
  URI.open(url) do |f|  # Vulnerable: Using URI.open allows arbitrary URL requests (SSRF risk)
    f.read
  end
end

✅ Secure code example

require 'uri'
require 'open-uri'

def fetch_url
  url = "http://example.com/data"
  
  # Validate URL against allowlist of trusted domains
  uri = URI.parse(url)...