Authorization removed (ARCH6203)

Key ruby.security.authorization-removed · Severity error · Category security · CWE CWE-862

Merge requests only. Compares each changed endpoint with its version on the target branch and flags one that became less protected: on Rails controllers an authentication or authorization before_action removed, a skip_before_action added, an action added to the filter’s except: or dropped from its only:, or a base class that carried the filter left; on Grape APIs a before block that authenticates removed from the API class, the namespace around the route or an ancestor. What authenticates is recognised from the repository’s own code (a method that answers 401 / 403, raises Pundit::NotAuthorizedError or redirects to sign-in) and the libraries’ own names (Devise authenticate_<scope>!, doorkeeper_authorize!, CanCanCan), not from this project’s names. An open endpoint on its own is not a finding; the change that opened it is, and an action the change itself added is new, not opened.

Incorrect

class Admin::ReportsController < ApplicationController
  before_action :authenticate_user!
  before_action :authenticate_user!, except: [:export]

  def export
    send_data Report.to_csv
  end
end

Correct

class Admin::ReportsController < ApplicationController
  before_action :authenticate_user!

  def export
    send_data Report.to_csv
  end
end