Sobelow v0.7.1 Mix.Tasks.Sobelow

Sobelow is a static analysis tool for discovering vulnerabilities in Phoenix applications.

This tool should be run in the root of the project directory with the following command:

mix sobelow

Command line options

  • --root -r - Specify application root directory
  • --verbose -v - Print vulnerable code snippets
  • --ignore -i - Ignore modules
  • --ignore-files - Ignore files
  • --details -d - Get module details
  • --all-details - Get all module details
  • --private - Skip update checks
  • --skip - Skip functions flagged with @sobelow_skip
  • --router - Specify router location
  • --exit - Return non-zero exit status
  • --format - Specify findings output format
  • --quiet - Return no output if there are no findings
  • --compact - Minimal, single-line findings

Ignoring modules

If specific modules, or classes of modules are not relevant to the scan, it is possible to ignore them with a comma-separated list.

mix sobelow -i XSS.Raw,Traversal

Supported modules

  • XSS
  • XSS.Raw
  • XSS.SendResp
  • XSS.ContentType
  • XSS.HTML
  • SQL
  • SQL.Query
  • SQL.Stream
  • Config
  • Config.CSRF
  • Config.Headers
  • Config.CSP
  • Config.HTTPS
  • Config.HSTS
  • Config.Secrets
  • Vuln
  • Vuln.CookieRCE
  • Vuln.HeaderInject
  • Vuln.PlugNull
  • Vuln.Redirect
  • Vuln.Coherence
  • Vuln.Ecto
  • Traversal
  • Traversal.SendFile
  • Traversal.FileModule
  • Traversal.SendDownload
  • Misc
  • Misc.BinToTerm
  • Misc.FilePath
  • RCE.EEx
  • RCE.CodeModule
  • CI
  • CI.System
  • CI.OS
  • DOS
  • DOS.StringToAtom
  • DOS.ListToAtom
  • DOS.BinToAtom

Summary

Functions

A task needs to implement run which receives a list of command line args

Functions

run(argv)

A task needs to implement run which receives a list of command line args.

Callback implementation for Mix.Task.run/1.

run_diff(argv)
set_env(key, value)