brakeman-lib 3.3.1

data/lib/brakeman/processors/base_processor.rb

@@ -0,0 +1,277 @@
+require 'brakeman/processors/lib/processor_helper'
+require 'brakeman/processors/lib/safe_call_helper'
+require 'brakeman/util'
+
+#Base processor for most processors.
+class Brakeman::BaseProcessor < Brakeman::SexpProcessor
+  include Brakeman::ProcessorHelper
+  include Brakeman::SafeCallHelper
+  include Brakeman::Util
+
+  IGNORE = Sexp.new :ignore
+
+  #Return a new Processor.
+  def initialize tracker
+    super()
+    @last = nil
+    @tracker = tracker
+    @current_template = @current_module = @current_class = @current_method = @file_name = nil
+  end
+
+  def process_file exp, file_name
+    @file_name = file_name
+    process exp
+  end
+
+  def ignore
+    IGNORE
+  end
+
+  #Process a new scope. Removes expressions that are set to nil.
+  def process_scope exp
+    #NOPE?
+  end
+
+  #Default processing.
+  def process_default exp
+    exp = exp.dup
+
+    exp.each_with_index do |e, i|
+      if sexp? e and not e.empty?
+        exp[i] = process e
+      else
+        e
+      end
+    end
+
+    exp
+  end
+
+  #Process an if statement.
+  def process_if exp
+    exp = exp.dup
+    condition = exp[1] = process exp.condition
+
+    if true? condition
+      exp[2] = process exp.then_clause if exp.then_clause
+      exp[3] = nil
+    elsif false? condition
+      exp[2] = nil
+      exp[3] = process exp.else_clause if exp.else_clause
+    else
+      exp[2] = process exp.then_clause if exp.then_clause
+      exp[3] = process exp.else_clause if exp.else_clause
+    end
+
+    exp
+  end
+
+  #Processes calls with blocks.
+  #
+  #s(:iter, CALL, {:lasgn|:masgn}, BLOCK)
+  def process_iter exp
+    exp = exp.dup
+    call = process exp.block_call
+    #deal with assignments somehow
+    if exp.block
+      block = process exp.block
+      block = nil if block.empty?
+    else
+      block = nil
+    end
+
+    call = Sexp.new(:iter, call, exp.block_args, block).compact
+    call.line(exp.line)
+    call
+  end
+
+  #String with interpolation.
+  def process_dstr exp
+    exp = exp.dup
+    exp.shift
+    exp.map! do |e|
+      if e.is_a? String
+        e
+      else
+        res = process e
+        if res.empty?
+          nil
+        else
+          res
+        end
+      end
+    end.compact!
+
+    exp.unshift :dstr
+  end
+
+  #Processes a block. Changes Sexp node type to :rlist
+  def process_block exp
+    exp = exp.dup
+    exp.shift
+
+    exp.map! do |e|
+      process e
+    end
+
+    exp.unshift :rlist
+  end
+
+  #Processes the inside of an interpolated String.
+  def process_evstr exp
+    exp = exp.dup
+    if exp[1]
+      exp[1] = process exp[1]
+    end
+
+    exp
+  end
+
+  #Processes a hash
+  def process_hash exp
+    exp = exp.dup
+    exp.shift
+    exp.map! do |e|
+      if sexp? e
+        process e
+      else
+        e
+      end
+    end
+
+    exp.unshift :hash
+  end
+
+  #Processes the values in an argument list
+  def process_arglist exp
+    exp = exp.dup
+    exp.shift
+    exp.map! do |e|
+      process e
+    end
+
+    exp.unshift :arglist
+  end
+
+  #Processes a local assignment
+  def process_lasgn exp
+    exp = exp.dup
+    exp.rhs = process exp.rhs
+    exp
+  end
+
+  alias :process_iasgn :process_lasgn
+
+  #Processes an instance variable assignment
+  def process_iasgn exp
+    exp = exp.dup
+    exp.rhs = process exp.rhs
+    exp
+  end
+
+  #Processes an attribute assignment, which can be either x.y = 1 or x[:y] = 1
+  def process_attrasgn exp
+    exp = exp.dup
+    exp.target = process exp.target
+    exp.arglist = process exp.arglist
+    exp
+  end
+
+  #Ignore ignore Sexps
+  def process_ignore exp
+    exp
+  end
+
+  def process_cdecl exp
+    file = case
+           when @file_name
+             @file_name
+           when @current_class.is_a?(Brakeman::Collection)
+             @current_class.file
+           when @current_module.is_a?(Brakeman::Collection)
+             @current_module.file
+           else
+             nil
+           end
+
+    @tracker.add_constant exp.lhs, exp.rhs, :file => file if @tracker
+    exp
+  end
+
+  #Convenience method for `make_render exp, true`
+  def make_render_in_view exp
+    make_render exp, true
+  end
+
+  #Generates :render node from call to render.
+  def make_render exp, in_view = false 
+    render_type, value, rest = find_render_type exp, in_view
+    rest = process rest
+    result = Sexp.new(:render, render_type, value, rest)
+    result.line(exp.line)
+    result
+  end
+
+  #Determines the type of a call to render.
+  #
+  #Possible types are:
+  #:action, :default, :file, :inline, :js, :json, :nothing, :partial,
+  #:template, :text, :update, :xml
+  #
+  #And also :layout for inside templates
+  def find_render_type call, in_view = false
+    rest = Sexp.new(:hash)
+    type = nil
+    value = nil
+    first_arg = call.first_arg
+
+    if call.second_arg.nil? and first_arg == Sexp.new(:lit, :update)
+      return :update, nil, Sexp.new(:arglist, *call.args[0..-2]) #TODO HUH?
+    end
+
+    #Look for render :action, ... or render "action", ...
+    if string? first_arg or symbol? first_arg
+      if @current_template and @tracker.options[:rails3]
+        type = :partial
+        value = first_arg
+      else
+        type = :action
+        value = first_arg
+      end
+    elsif first_arg.is_a? Symbol or first_arg.is_a? String
+      type = :action
+      value = Sexp.new(:lit, first_arg.to_sym)
+		elsif first_arg.nil?
+			type = :default
+    elsif not hash? first_arg
+      type = :action
+      value = first_arg
+    end
+
+    types_in_hash = Set[:action, :file, :inline, :js, :json, :nothing, :partial, :template, :text, :update, :xml]
+
+    #render :layout => "blah" means something else when in a template
+    if in_view
+      types_in_hash << :layout
+    end
+
+    last_arg = call.last_arg
+
+    #Look for "type" of render in options hash
+    #For example, render :file => "blah"
+    if hash? last_arg
+      hash_iterate(last_arg) do |key, val|
+        if symbol? key and types_in_hash.include? key.value
+          type = key.value
+          value = val
+        else  
+          rest << key << val
+        end
+      end
+    end
+
+    type ||= :default
+    value ||= :default
+    return type, value, rest
+  end
+end

data/lib/brakeman/processors/config_processor.rb

@@ -0,0 +1,14 @@
+require 'brakeman/processors/base_processor'
+require 'brakeman/processors/alias_processor'
+require 'brakeman/processors/lib/rails3_config_processor.rb'
+require 'brakeman/processors/lib/rails2_config_processor.rb'
+
+class Brakeman::ConfigProcessor
+  def self.new tracker
+    if tracker.options[:rails3]
+      Brakeman::Rails3ConfigProcessor.new tracker
+    else
+      Brakeman::Rails2ConfigProcessor.new tracker
+    end
+  end
+end

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -0,0 +1,273 @@
+require 'brakeman/processors/alias_processor'
+require 'brakeman/processors/lib/render_helper'
+require 'brakeman/processors/lib/render_path'
+require 'brakeman/processors/lib/find_return_value'
+
+#Processes aliasing in controllers, but includes following
+#renders in routes and putting variables into templates
+class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
+  include Brakeman::RenderHelper
+
+  #If only_method is specified, only that method will be processed,
+  #other methods will be skipped.
+  #This is for rescanning just a single action.
+  def initialize app_tree, tracker, only_method = nil
+    super tracker
+    @app_tree = app_tree
+    @only_method = only_method
+    @rendered = false
+    @current_class = @current_module = @current_method = nil
+    @method_cache = {} #Cache method lookups
+  end
+
+  def process_controller name, src, file_name
+    if not node_type? src, :class
+      Brakeman.debug "#{name} is not a class, it's a #{src.node_type}"
+      return
+    else
+      @current_class = name
+      @file_name = file_name
+
+      process_default src
+
+      process_mixins
+    end
+  end
+
+  #Process modules mixed into the controller, in case they contain actions.
+  def process_mixins
+    controller = @tracker.controllers[@current_class]
+
+    controller.includes.each do |i|
+      mixin = @tracker.libs[i]
+
+      next unless mixin
+
+      #Process methods in alphabetical order for consistency
+      methods = mixin.methods_public.keys.map { |n| n.to_s }.sort.map { |n| n.to_sym }
+
+      methods.each do |name|
+        #Need to process the method like it was in a controller in order
+        #to get the renders set
+        processor = Brakeman::ControllerProcessor.new(@app_tree, @tracker)
+        method = mixin.get_method(name)[:src].deep_clone
+
+        if node_type? method, :defn
+          method = processor.process_defn method
+        else
+          #Should be a defn, but this will catch other cases
+          method = processor.process method
+        end
+
+        @file_name = mixin.file
+        #Then process it like any other method in the controller
+        process method
+      end
+    end
+  end
+
+  #Skip it, must be an inner class
+  def process_class exp
+    exp
+  end
+
+  #Processes a method definition, which may include
+  #processing any rendered templates.
+  def process_defn exp
+    meth_name = exp.method_name
+
+    Brakeman.debug "Processing #{@current_class}##{meth_name}"
+
+    #Skip if instructed to only process a specific method
+    #(but don't skip if this method was called from elsewhere)
+    return exp if @current_method.nil? and @only_method and @only_method != meth_name
+
+    is_route = route? meth_name
+    other_method = @current_method
+    @current_method = meth_name
+    @rendered = false if is_route
+
+    meth_env do
+      if is_route
+        before_filter_list(@current_method, @current_class).each do |f|
+          process_before_filter f
+        end
+      end
+
+      process_all exp.body
+
+      if is_route and not @rendered
+        process_default_render exp
+      end
+    end
+
+    @current_method = other_method
+    exp
+  end
+
+  #Look for calls to head()
+  def process_call exp
+    exp = super
+    return exp unless call? exp
+
+    method = exp.method
+
+    if method == :head
+      @rendered = true
+    elsif @tracker.options[:interprocedural] and
+      @current_method and (exp.target.nil? or exp.target.node_type == :self)
+
+      exp = get_call_value(exp)
+    end
+
+    exp
+  end
+
+  #Check for +respond_to+
+  def process_iter exp
+    super
+
+    if call? exp.block_call and exp.block_call.method == :respond_to
+      @rendered = true
+    end
+
+    exp
+  end
+
+  #Processes a call to a before filter.
+  #Basically, adds any instance variable assignments to the environment.
+  #TODO: method arguments?
+  def process_before_filter name
+    filter = find_method name, @current_class
+
+    if filter.nil?
+      Brakeman.debug "[Notice] Could not find filter #{name}"
+      return
+    end
+
+    method = filter[:method]
+
+    if ivars = @tracker.filter_cache[[filter[:controller], name]]
+      ivars.each do |variable, value|
+        env[variable] = value
+      end
+    else
+      processor = Brakeman::AliasProcessor.new @tracker
+      processor.process_safely(method.body_list, only_ivars(:include_request_vars))
+
+      ivars = processor.only_ivars(:include_request_vars).all
+
+      @tracker.filter_cache[[filter[:controller], name]] = ivars
+
+      ivars.each do |variable, value|
+        env[variable] = value
+      end
+    end
+  end
+
+  #Processes the default template for the current action
+  def process_default_render exp
+    process_layout
+    process_template template_name, nil, nil, nil
+  end
+
+  #Process template and add the current class and method name as called_from info
+  def process_template name, args, _, line
+    # If line is null, assume implicit render and set the end of the action
+    # method as the line number
+    if line.nil? and controller = @tracker.controllers[@current_class]
+      if meth = controller.get_method(@current_method)
+        line = meth[:src] && meth[:src].last && meth[:src].last.line
+        line += 1
+      end
+    end
+
+    render_path = Brakeman::RenderPath.new.add_controller_render(@current_class, @current_method, line, relative_path(@file_name))
+    super name, args, render_path, line
+  end
+
+  #Turns a method name into a template name
+  def template_name name = nil
+    name ||= @current_method
+    name = name.to_s
+    if name.include? "/"
+      name
+    else
+      controller = @current_class.to_s.gsub("Controller", "")
+      controller.gsub!("::", "/")
+      underscore(controller + "/" + name.to_s)
+    end
+  end
+
+  #Determines default layout name
+  def layout_name
+    controller = @tracker.controllers[@current_class]
+
+    return controller.layout if controller.layout
+    return false if controller.layout == false
+
+    app_controller = @tracker.controllers[:ApplicationController]
+
+    return app_controller.layout if app_controller and app_controller.layout
+
+    nil
+  end
+
+  #Returns true if the given method name is also a route
+  def route? method
+    if @tracker.routes[:allow_all_actions] or @tracker.options[:assume_all_routes]
+      true
+    else
+      routes = @tracker.routes[@current_class]
+      routes and (routes.include? :allow_all_actions or routes.include? method)
+    end
+  end
+
+  #Get list of filters, including those that are inherited
+  def before_filter_list method, klass
+    controller = @tracker.controllers[klass]
+
+    if controller
+      controller.before_filter_list self, method
+    else
+      []
+    end
+  end
+
+  #Finds a method in the given class or a parent class
+  #
+  #Returns nil if the method could not be found.
+  #
+  #If found, returns hash table with controller name and method sexp.
+  def find_method method_name, klass
+    return nil if sexp? method_name
+    method_name = method_name.to_sym
+
+    if method = @method_cache[method_name]
+      return method
+    end
+
+    controller = @tracker.controllers[klass]
+    controller ||= @tracker.libs[klass]
+
+    if klass and controller
+      method = controller.get_method method_name
+
+      if method.nil?
+        controller.includes.each do |included|
+          method = find_method method_name, included
+          if method
+            @method_cache[method_name] = method
+            return method
+          end
+       end
+
+        @method_cache[method_name] = find_method method_name, controller.parent
+      else
+        @method_cache[method_name] = { :controller => controller.name, :method => method[:src] }
+      end
+    else
+      nil
+    end
+  end
+end