rules:
- id: timing-attack
  message: >-
    Checks for unsafe use of method http_basic_authenticate_with, which is vulnerable
    to timing attacks as it
    does not use constant-time checking when comparing passwords. Affected Rails versions
    include:
    5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1. Avoid this function if possible.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_basic_auth_timing_attack.rb
    - https://groups.google.com/g/rubyonrails-security/c/ANv0HDHEC3k/m/mt7wNGxbFQAJ
    category: security
    technology:
    - ruby
  languages:
  - ruby
  severity: ERROR
  pattern: http_basic_authenticate_with ...