Description

Detects the use of insufficiently long cryptographic session keys in Ruby applications. Short session keys can be vulnerable to brute force attacks, making session hijacking possible and compromising user authentication security.

Detection Strategy

• Checks if the SecureRandom library is imported in the Ruby code

• Identifies when SecureRandom generated values are used to set session cookie values

• Verifies if the generated session key length meets minimum security requirements

• Reports a vulnerability when a session key with insufficient length is detected

Vulnerable code example

require 'securerandom'

# VULNERABLE: Generates session keys with insufficient entropy (< 16 bytes)
def generate_session_key
  session_id = SecureRandom.random_bytes(8)  # Only 8 bytes - easily brute-forced
  cookies[:session_id] = session_id
  
  key_length = 4  # Extremely low entropy...

✅ Secure code example

require 'securerandom'

def generate_session_key
  # Use 16 bytes (128 bits) minimum for session ID
  session_id = SecureRandom.random_bytes(16)
  cookies[:session_id] = session_id
  
  # Use 32 bytes for session key to provide high entropy...