From 24184fd99d5f5e5d1c66a3dce62ca5b2731a0023 Mon Sep 17 00:00:00 2001
From: Justin Collins <justin@presidentbeef.com>
Date: Mon, 7 Jun 2021 10:07:03 -0700
Subject: [PATCH] Fix Loofah version check

Fixes #1603
---
 lib/brakeman/checks/check_sanitize_methods.rb |  3 ++-
 test/tests/cves.rb                            | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/lib/brakeman/checks/check_sanitize_methods.rb b/lib/brakeman/checks/check_sanitize_methods.rb
index fcd84ab5a3..b917f225cd 100644
--- a/lib/brakeman/checks/check_sanitize_methods.rb
+++ b/lib/brakeman/checks/check_sanitize_methods.rb
@@ -90,7 +90,8 @@ def check_cve_2018_8048
   def loofah_vulnerable_cve_2018_8048?
     loofah_version = tracker.config.gem_version(:loofah)
 
-    loofah_version and loofah_version < "2.2.1"
+    # 2.2.1 is fix version
+    loofah_version and version_between?("0.0.0", "2.2.0", loofah_version)
   end
 
   def warn_sanitizer_cve cve, link, upgrade_version
diff --git a/test/tests/cves.rb b/test/tests/cves.rb
index 930ea80522..6b61e3b2eb 100644
--- a/test/tests/cves.rb
+++ b/test/tests/cves.rb
@@ -261,6 +261,24 @@ def test_CVE_2018_3760_sprockets
     assert_new 1 # CVE-2018-3760
   end
 
+  def test_CVE_2018_8048_exact_fix_version
+    before_rescan_of "Gemfile.lock", "rails5.2" do
+      replace "Gemfile.lock", "loofah (2.1.1)", "loofah (2.2.1)"
+    end
+
+    assert_version "2.2.1", :loofah
+    assert_fixed 1
+  end
+
+  def test_CVE_2018_8048_newer_version
+    before_rescan_of "Gemfile.lock", "rails5.2" do
+      replace "Gemfile.lock", "loofah (2.1.1)", "loofah (2.10.1)"
+    end
+
+    assert_version "2.10.1", :loofah
+    assert_fixed 1
+  end
+
   def test_CVE_2013_0276
     before_rescan_of "app/models/protected.rb", "rails2", :collapse_mass_assignment => true do
       replace "app/models/protected.rb", "attr_accessible nil", "attr_protected :admin"