brakeman-lib 3.3.1

data/lib/brakeman/processors/model_processor.rb

@@ -0,0 +1,191 @@
+require 'brakeman/processors/base_processor'
+require 'brakeman/tracker/model'
+
+#Processes models. Puts results in tracker.models
+class Brakeman::ModelProcessor < Brakeman::BaseProcessor
+
+  def initialize tracker
+    super
+    @current_class = nil
+    @current_method = nil
+    @current_module = nil
+    @visibility = :public
+    @file_name = nil
+  end
+
+  #Process model source
+  def process_model src, file_name = nil
+    @file_name = file_name
+    process src
+  end
+
+  #s(:class, NAME, PARENT, BODY)
+  def process_class exp
+    name = class_name(exp.class_name)
+    parent = class_name(exp.parent_name)
+
+    #If inside an inner class we treat it as a library.
+    if @current_class
+      Brakeman.debug "[Notice] Treating inner class as library: #{name}"
+      Brakeman::LibraryProcessor.new(@tracker).process_library exp, @file_name
+      return exp
+    end
+
+    if @current_class
+      outer_class = @current_class
+      name = (outer_class.name.to_s + "::" + name.to_s).to_sym
+    end
+
+    if @current_module
+      name = (@current_module.name.to_s + "::" + name.to_s).to_sym
+    end
+
+    if @tracker.models[name]
+      @current_class = @tracker.models[name]
+      @current_class.add_file @file_name, exp
+    else
+      @current_class = Brakeman::Model.new name, parent, @file_name, exp, @tracker 
+      @tracker.models[name] = @current_class
+    end
+
+    exp.body = process_all! exp.body
+
+    if outer_class
+      @current_class = outer_class
+    else
+      @current_class = nil
+    end
+
+    exp
+  end
+
+  def process_module exp
+    name = class_name(exp.class_name)
+
+    if @current_module
+      outer_module = @current_module
+      name = (outer_module.name.to_s + "::" + name.to_s).to_sym
+    end
+
+    if @current_class
+      name = (@current_class.name.to_s + "::" + name.to_s).to_sym
+    end
+
+    if @tracker.libs[name]
+      @current_module = @tracker.libs[name]
+      @current_module.add_file @file_name, exp
+    else
+      @current_module = Brakeman::Model.new name, nil, @file_name, exp, @tracker
+      @tracker.libs[name] = @current_module
+    end
+
+    exp.body = process_all! exp.body
+
+    if outer_module
+      @current_module = outer_module
+    else
+      @current_module = nil
+    end
+
+    exp
+  end
+
+  #Handle calls outside of methods,
+  #such as include, attr_accessible, private, etc.
+  def process_call exp
+    return exp unless @current_class
+    return exp if process_call_defn? exp
+
+    target = exp.target
+    if sexp? target
+      target = process target
+    end
+
+    method = exp.method
+    first_arg = exp.first_arg
+
+    #Methods called inside class definition
+    #like attr_* and other settings
+    if @current_method.nil? and target.nil?
+      if first_arg.nil?
+        case method
+        when :private, :protected, :public
+          @visibility = method
+        when :attr_accessible
+          @current_class.set_attr_accessible
+        else
+          #??
+        end
+      else
+        case method
+        when :include
+          @current_class.add_include class_name(first_arg) if @current_class
+        when :attr_accessible
+          @current_class.set_attr_accessible exp
+        when :attr_protected
+          @current_class.set_attr_protected exp
+        else
+          if @current_class
+            @current_class.add_option method, exp
+          end
+        end
+      end
+
+      exp
+    else
+      call = make_call target, method, process_all!(exp.args)
+      call.line(exp.line)
+      call
+    end
+  end
+
+  #Add method definition to tracker
+  def process_defn exp
+    return exp unless @current_class
+    name = exp.method_name
+
+    @current_method = name
+    res = Sexp.new :defn, name, exp.formal_args, *process_all!(exp.body)
+    res.line(exp.line)
+    @current_method = nil
+
+    if @current_class
+      @current_class.add_method @visibility, name, res, @file_name
+    elsif @current_module
+      @current_module.add_method @visibility, name, res, @file_name
+    end
+
+    res
+  end
+
+  #Add method definition to tracker
+  def process_defs exp
+    return exp unless @current_class
+    name = exp.method_name
+
+    if node_type? exp[1], :self
+      if @current_class
+        target = @current_class.name
+      elsif @current_module
+        target = @current_module.name
+      else
+        target = nil
+      end
+    else
+      target = class_name exp[1]
+    end
+
+    @current_method = name
+    res = Sexp.new :defs, target, name, exp.formal_args, *process_all!(exp.body)
+    res.line(exp.line)
+    @current_method = nil
+
+    if @current_class
+      @current_class.add_method @visibility, name, res, @file_name
+    elsif @current_module
+      @current_module.add_method @visibility, name, res, @file_name
+    end
+    res
+  end
+
+end

data/lib/brakeman/processors/output_processor.rb

@@ -0,0 +1,171 @@
+Brakeman.load_brakeman_dependency 'ruby2ruby'
+require 'brakeman/util'
+
+#Produces formatted output strings from Sexps.
+#Recommended usage is
+#
+#  OutputProcessor.new.format(Sexp.new(:str, "hello"))
+class Brakeman::OutputProcessor < Ruby2Ruby
+  include Brakeman::Util
+
+  #Copies +exp+ and then formats it.
+  def format exp
+    process(exp.deep_clone) || "[Format Error]"
+  end
+
+  alias process_safely format
+
+  def process exp
+    begin
+      super exp if sexp? exp and not exp.empty?
+    rescue => e
+      Brakeman.debug "While formatting #{exp}: #{e}\n#{e.backtrace.join("\n")}"
+    end
+  end
+
+  def process_ignore exp
+    exp.clear
+    "[ignored]"
+  end
+
+  def process_params exp
+    exp.clear
+    "params"
+  end
+
+  def process_session exp
+    exp.clear
+    "session"
+  end
+
+  def process_cookies exp
+    exp.clear
+    "cookies"
+  end
+
+  def process_rlist exp
+    out = exp.map do |e|
+      res = process e
+      if res == ""
+        nil
+      else
+        res
+      end
+    end.compact.join("\n")
+    exp.clear
+    out
+  end
+
+  def process_defn exp
+    # Copied from Ruby2Ruby except without the whole
+    # "convert methods to attr_*" stuff
+    name = exp.shift
+    args = process exp.shift
+    args = "" if args == "()"
+
+    exp.shift if exp == s(s(:nil)) # empty it out of a default nil expression
+
+    body = []
+    until exp.empty? do
+      body << indent(process(exp.shift))
+    end
+
+    body << indent("# do nothing") if body.empty?
+
+    body = body.join("\n")
+
+    return "def #{name}#{args}\n#{body}\nend".gsub(/\n\s*\n+/, "\n")
+  end
+
+  def process_iter exp
+    call = process exp[0]
+    block = process_rlist exp[2..-1]
+    out = "#{call} do\n #{block}\n end"
+    exp.clear
+    out
+  end
+
+  def process_output exp
+    out = if exp[0].node_type == :str
+            ""
+          else
+            res = process exp[0]
+
+            if res == ""
+              ""
+            else
+              "[Output] #{res}"
+            end
+          end
+    exp.clear
+    out
+  end
+
+  def process_escaped_output exp
+    out = if exp[0].node_type == :str
+            ""
+          else
+            res = process exp[0]
+
+            if res == ""
+              ""
+            else
+              "[Escaped Output] #{res}"
+            end
+          end
+    exp.clear
+    out
+  end
+
+
+  def process_format exp
+    out = if exp[0].node_type == :str or exp[0].node_type == :ignore
+            ""
+          else
+            res = process exp[0]
+
+            if res == ""
+              ""
+            else
+              "[Format] #{res}"
+            end
+          end
+    exp.clear
+    out
+  end
+
+  def process_format_escaped exp
+    out = if exp[0].node_type == :str or exp[0].node_type == :ignore
+            ""
+          else
+            res = process exp[0]
+
+            if res == ""
+              ""
+            else
+              "[Escaped] #{res}"
+            end
+          end
+    exp.clear
+    out
+  end
+
+  def process_const exp
+    if exp[0] == Brakeman::Tracker::UNKNOWN_MODEL
+      exp.clear
+      "(Unresolved Model)"
+    else
+      out = exp[0].to_s
+      exp.clear
+      out
+    end
+  end
+
+  def process_render exp
+    exp[1] = process exp[1] if sexp? exp[1]
+    exp[2] = process exp[2] if sexp? exp[2]
+    out = "render(#{exp[0]} => #{exp[1]}, #{exp[2]})"
+    exp.clear
+    out
+  end
+end

data/lib/brakeman/processors/route_processor.rb

@@ -0,0 +1,17 @@
+require 'brakeman/processors/base_processor'
+require 'brakeman/processors/alias_processor'
+require 'brakeman/processors/lib/route_helper'
+require 'brakeman/util'
+require 'brakeman/processors/lib/rails3_route_processor.rb'
+require 'brakeman/processors/lib/rails2_route_processor.rb'
+require 'set'
+
+class Brakeman::RoutesProcessor
+  def self.new tracker
+    if tracker.options[:rails3]
+      Brakeman::Rails3RoutesProcessor.new tracker
+    else
+      Brakeman::Rails2RoutesProcessor.new tracker
+    end
+  end
+end

data/lib/brakeman/processors/slim_template_processor.rb

@@ -0,0 +1,107 @@
+require 'brakeman/processors/template_processor'
+require 'brakeman/processors/lib/render_helper'
+
+class Brakeman::SlimTemplateProcessor < Brakeman::TemplateProcessor
+  include Brakeman::RenderHelper
+
+  SAFE_BUFFER = s(:call, s(:colon2, s(:const, :ActiveSupport), :SafeBuffer), :new)
+  OUTPUT_BUFFER = s(:ivar, :@output_buffer)
+  TEMPLE_UTILS = s(:colon2, s(:colon3, :Temple), :Utils)
+
+  def process_call exp
+    target = exp.target
+    method = exp.method
+
+    if method == :safe_concat and (target == SAFE_BUFFER or target == OUTPUT_BUFFER)
+      arg = normalize_output(exp.first_arg)
+
+      if is_escaped? arg
+        make_escaped_output arg
+      elsif string? arg
+        ignore
+      elsif render? arg
+        make_output make_render_in_view arg
+      elsif string_interp? arg
+        process_inside_interp arg
+      elsif node_type? arg, :ignore
+        ignore
+      else
+        make_output arg
+      end
+    elsif is_escaped? exp
+      make_escaped_output exp.first_arg
+    elsif target == nil and method == :render
+      exp.arglist = process exp.arglist
+      make_render_in_view exp
+    else
+      exp.arglist = process exp.arglist
+      exp
+    end
+  end
+
+  def make_output exp
+    s = Sexp.new :output, exp
+    s.line(exp.line)
+    @current_template.add_output s
+    s
+  end
+
+  def make_escaped_output exp
+    s = Sexp.new :escaped_output, exp.first_arg
+    s.line(exp.line)
+    @current_template.add_output s
+    s
+  end
+
+  #Slim likes to interpolate output into strings then pass them to safe_concat.
+  #Better to pull those values out directly.
+  def process_inside_interp exp
+    exp.map! do |e|
+      if node_type? e, :evstr
+        e.value = process_interp_output e.value
+        e
+      else
+        e
+      end
+    end
+
+    exp
+  end
+
+  def process_interp_output exp
+    if sexp? exp
+      if node_type? exp, :if
+        process_interp_output exp.then_clause
+        process_interp_output exp.else_clause
+      elsif exp == SAFE_BUFFER
+        ignore
+      elsif render? exp
+        make_output make_render_in_view exp
+      elsif node_type? :output, :escaped_output
+        exp
+      elsif is_escaped? exp
+        make_escaped_output exp
+      else
+        make_output exp
+      end
+    end
+  end
+
+  def is_escaped? exp
+    call? exp and
+    exp.target == TEMPLE_UTILS and
+    (exp.method == :escape_html or exp.method == :escape_html_safe)
+  end
+
+  def render? exp
+    call? exp and
+    exp.target.nil? and
+    exp.method == :render
+  end
+
+  def process_render exp
+    #Still confused as to why this is not needed in other template processors
+    #but is needed here
+    exp
+  end
+end