False positive with loofah CVE

[mroach]

There appears to be a false positive with identifying a loofah version vulnerable to a CVE.

This message started appearing after upgrading from 2.9.1 to 2.10.0. The nature of the error and the correlation with the version bump leads me to think there's a string vs numeric version comparison issue.

Confidence: Medium
Category: Cross-Site Scripting
Check: SanitizeMethods
Message: loofah gem 2.10.0 is vulnerable (CVE-2018-8048). Upgrade to 2.2.1
File: Gemfile.lock

Brakeman version 5.0.0

[mroach]

I posted this on the wrong repository. Hurrah! Sorry about that!

[flavorjones]

No worries! I expect it's the same problem reported at #209? If so, thanks for your patience.

[mroach]

Yeah it was (thanks for linking!), and I was searching around between brakeman and loofah to establish a chronology and after all that I realised I hadn’t updated brakeman which already fixed this. :)

…

On Mon, 28 Jun 2021 at 16:33, Mike Dalessio ***@***.***> wrote: No worries! I expect it's the same problem reported at #209 <#209>? If so, thanks for your patience. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#210 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAATJHV3DZOJSWNJKV5XBP3TVDMDBANCNFSM47OUQ7NA> .