Sobelow

https://hexdocs.pm/sobelow
Admin
Sobelow is a security-focused static analysis tool for Elixir and the Phoenix framework, used by...
Tokens:1,610
Snippets:26
Trust Score:9.7
Update:1 year ago
Show doc for...
Tokens:
Raw
### Install Sobelow from Master Branch using Mix Escript

Source: https://hexdocs.pm/sobelow/readme

This command installs Sobelow directly from its master branch on GitHub using Mix Escript. This is useful for testing the latest features or contributing to the project.

```bash
$ mix escript.install github nccgroup/sobelow
```

--------------------------------

### Install Sobelow Globally using Mix Escript

Source: https://hexdocs.pm/sobelow/readme

This command installs Sobelow globally on your system using Mix Escript, making it available as a command-line tool. This is a convenient way to use Sobelow without adding it as a project dependency.

```bash
$ mix escript.install hex sobelow
```

--------------------------------

### Configuring Sobelow for Umbrella Apps

Source: https://hexdocs.pm/sobelow/readme

Example of setting up a Sobelow alias in a root `mix.exs` file for umbrella applications.

```elixir
defp aliases do
  [
    sobelow: ["cmd mix sobelow"]
  ]
end
```

--------------------------------

### Run Sobelow Scan on Phoenix Project

Source: https://hexdocs.pm/sobelow/readme

This command initiates a Sobelow security scan on your Phoenix project. Run this from the project's root directory to get a quick overview of potential security issues.

```bash
$ mix sobelow
```

--------------------------------

### Get Sobelow Module and Vulnerability Details

Source: https://hexdocs.pm/sobelow/index

Users can retrieve a list of available finding modules and their associated details directly from the command line. This helps in understanding the different categories of findings and how to manage them.

```shell
$ mix help sobelow

```

--------------------------------

### Install Sobelow as a Development Dependency

Source: https://hexdocs.pm/sobelow/readme

This code snippet shows how to add Sobelow to your Elixir application's dependencies, typically for development and testing environments. It specifies the package name and version, and ensures it's not included in the production runtime.

```elixir
def deps do
  [
    {:sobelow, "~> 0.13", only: [:dev, :test], runtime: false}
  ]
end
```

--------------------------------

### Elixir Path.dirname Example

Source: https://hexdocs.pm/sobelow/Sobelow.Misc

Demonstrates an insecure use of Path.dirname with user input that contains a null byte. This highlights how Elixir's `Path` functions not being null-terminated can lead to unexpected file access when interacting with null-terminated `File` functions.

```elixir
user_input = "/var/www/secret.txt\0/name"

path = Path.dirname(user_input)
public_file = path <> "/public.txt"

File.read(public_file)
```

--------------------------------

### Saving and Using Sobelow Configuration

Source: https://hexdocs.pm/sobelow/readme

Demonstrates how to save current Sobelow options to a configuration file and how to apply a saved configuration.

```bash
$ mix sobelow -i XSS.Raw,Traversal --verbose --exit Low --save-config
$ mix sobelow --save-config
$ mix sobelow --config
```

--------------------------------

### Viewing Sobelow Module Details

Source: https://hexdocs.pm/sobelow/readme

Command to display help information, including details about finding modules.

```bash
$ mix help sobelow
```

--------------------------------

### Run Sobelow Static Analysis Tool

Source: https://hexdocs.pm/sobelow/Mix.Tasks

This command executes the Sobelow static analysis tool to scan a Phoenix application for vulnerabilities. It should be run from the project's root directory. No external dependencies are required beyond Sobelow itself.

```bash
mix sobelow
```

--------------------------------

### Run Sobelow with Saved Configuration

Source: https://hexdocs.pm/sobelow/index

After creating a `.sobelow-conf` file, this command allows Sobelow to be run using the saved configurations. This simplifies repeated scans with consistent settings.

```shell
$ mix sobelow --config

```

--------------------------------

### Configure Sobelow for Umbrella Apps

Source: https://hexdocs.pm/sobelow/index

This configuration snippet shows how to set up an alias in the root `mix.exs` file to run Sobelow against all child applications within an umbrella project. It also mentions using individual `.sobelow-conf` files for each child app.

```elixir
defp aliases do
  [
    sobelow: ["cmd mix sobelow"]
  ]
end

```

--------------------------------

### Save Sobelow Configuration to File

Source: https://hexdocs.pm/sobelow/index

This command allows users to save their frequently used Sobelow options into a configuration file named `.sobelow-conf`. This file can be edited directly for future scans. If no options are provided, the file is populated with default values.

```shell
$ mix sobelow -i XSS.Raw,Traversal --verbose --exit Low --save-config

```

```shell
$ mix sobelow --save-config

```

--------------------------------

### Ignore Sobelow Secure HTTP Headers Check

Source: https://hexdocs.pm/sobelow/Sobelow.Config

This command allows users to ignore the 'Missing Secure HTTP Headers' security check performed by Sobelow. It is useful when the default secure headers are not required or have been implemented through alternative means.

```bash
mix sobelow -i Config.Headers
```

--------------------------------

### Ignoring False Positives in Sobelow

Source: https://hexdocs.pm/sobelow/readme

Shows how to mark specific functions or all findings as false positives using comments or flags.

```elixir
# sobelow_skip ["Traversal"]
def vuln_func(...) do
  ...
end
```

```bash
$ mix sobelow --mark-skip-all
$ mix sobelow --skip
```

--------------------------------

### Configure Sobelow to Ignore Modules

Source: https://hexdocs.pm/sobelow/Mix.Tasks

This command runs Sobelow while ignoring specified modules. The `-i` flag followed by a comma-separated list of module names prevents Sobelow from analyzing these modules. This is useful for excluding irrelevant parts of the application.

```bash
mix sobelow -i XSS.Raw,Traversal
```

--------------------------------

### Ignoring Sobelow Misc.FilePath Check

Source: https://hexdocs.pm/sobelow/Sobelow.Misc

Shows the command-line usage for ignoring the Misc.FilePath check in Sobelow. This is useful if the check is deprecated or not applicable to your project's Elixir version.

```bash
$ mix sobelow -i Misc.FilePath
```

--------------------------------

### Ignore SQLi Stream Checks with Sobelow CLI

Source: https://hexdocs.pm/sobelow/Sobelow.SQL

This command demonstrates how to instruct Sobelow to ignore SQL injection checks specifically related to the SQL.Stream module. This is useful for situations where parameterized queries are guaranteed or false positives are frequent.

```bash
$
mix sobelow -i SQL.Stream
```

--------------------------------

### Mark False Positives in Sobelow

Source: https://hexdocs.pm/sobelow/index

Sobelow can be configured to skip specific findings marked as false positives. This can be done using inline comments before function definitions for function-level findings, or globally using flags for all finding types.

```shell
# sobelow_skip ["Traversal"]
def vuln_func(...) do
  ...
end

```

```shell
$ mix sobelow --mark-skip-all

```

```shell
$ mix sobelow --skip

```

--------------------------------

### Disable Sobelow Update Checks

Source: https://hexdocs.pm/sobelow/index

Sobelow periodically checks for updates and alerts the user. The `--private` flag can be used during a scan to disable this update-checking functionality, preventing the creation of the `.sobelow` tracking file.

```shell
$ mix sobelow --private

```

--------------------------------

### Ignore Sobelow XSS SendResp Check

Source: https://hexdocs.pm/sobelow/Sobelow.XSS

This command allows users to bypass the XSS SendResp checks performed by Sobelow. It is useful for excluding specific checks from the analysis.

```bash
mix sobelow -i XSS.SendResp
```

--------------------------------

### Disabling Sobelow Update Checks

Source: https://hexdocs.pm/sobelow/readme

Usage of the `--private` flag to disable automatic update checks during scans.

```bash
$ mix sobelow --private
```
Tokens:
Raw