Description

This detector identifies Ruby cookies that are configured to persist across browser sessions without proper security attributes like HttpOnly or Secure flags. Persistent cookies that contain sensitive information pose security risks as they can be accessed by client-side scripts or transmitted over insecure connections, making them vulnerable to XSS attacks and man-in-the-middle interceptions.

Detection Strategy

• Scans Ruby source code for cookie assignment statements or method calls that set cookies

• Identifies cookies that are configured to persist beyond the current session (typically through explicit expiration dates or persistent flags)

• Checks if these persistent cookies lack critical security attributes such as HttpOnly flag (prevents JavaScript access) or Secure flag (ensures HTTPS-only transmission)

• Reports violations when persistent cookies containing potentially sensitive data are created without adequate security protections

Vulnerable code example

class SessionsController < ApplicationController
  def create
    cookies.permanent[:auth_token] = params[:token] # Permanent cookie with sensitive data from user input
  end

  def login
    cookies.signed.permanent[:password] = request.params[:pwd] # Signed doesn't encrypt, permanent exposes sensitive data
  end...

✅ Secure code example

class SessionsController < ApplicationController
  def create
    cookies.encrypted.permanent[:auth_token] = params[:token] # encrypted makes sensitive data opaque to client
  end

  def login
    cookies.encrypted.permanent[:password] = request.params[:pwd] # encrypted protects sensitive password data
  end...