brakeman-lib 4.5.0 → 4.7.1

data/lib/brakeman/file_parser.rb

@@ -5,16 +5,16 @@ module Brakeman
   class FileParser
     attr_reader :file_list
 
-    def initialize tracker, app_tree
+    def initialize tracker
       @tracker = tracker
       @timeout = @tracker.options[:parser_timeout]
-      @app_tree = app_tree
+      @app_tree = @tracker.app_tree
       @file_list = {}
     end
 
     def parse_files list, type
       read_files list, type do |path, contents|
-        if ast = parse_ruby(contents, path)
+        if ast = parse_ruby(contents, path.relative)
           ASTFile.new(path, ast)
         end
       end
@@ -24,24 +24,22 @@ module Brakeman
       @file_list[type] ||= []
 
       list.each do |path|
-        result = yield path, read_path(path)
+        file = @app_tree.file_path(path)
+
+        result = yield file, file.read
         if result
           @file_list[type] << result
         end
       end
     end
 
-    def parse_ruby input, path, parser = RubyParser.new
+    def parse_ruby input, path
       begin
         Brakeman.debug "Parsing #{path}"
-        parser.parse input, path, @timeout
+        RubyParser.new.parse input, path, @timeout
       rescue Racc::ParseError => e
-        if parser.class == RubyParser
-          return parse_ruby(input, path, RubyParser.latest)
-        else
-          @tracker.error e, "Could not parse #{path}"
-          nil
-        end
+        @tracker.error e, "Could not parse #{path}"
+        nil
       rescue Timeout::Error => e
         @tracker.error Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout"), caller
         nil
@@ -50,9 +48,5 @@ module Brakeman
         nil
       end
     end
-
-    def read_path path
-      @app_tree.read_path path
-    end
   end
 end

data/lib/brakeman/file_path.rb

@@ -0,0 +1,85 @@
+require 'pathname'
+
+module Brakeman
+  # Class to represent file paths within Brakeman.
+  # FilePath objects track both the relative and absolute paths
+  # to make it easier to manage paths.
+  class FilePath
+    attr_reader :absolute, :relative
+    @cache = {}
+
+    # Create a new FilePath using an AppTree object.
+    #
+    # Note that if the path is already a FilePath, that path will
+    # be returned unaltered.
+    #
+    # Additionally, paths are cached. If the absolute path already has
+    # a FilePath in the cache, that existing FilePath will be returned.
+    def self.from_app_tree app_tree, path
+      return path if path.is_a? Brakeman::FilePath
+
+      absolute = app_tree.expand_path(path).freeze
+
+      if fp = @cache[absolute]
+        return fp
+      end
+
+      relative = app_tree.relative_path(path).freeze
+
+      self.new(absolute, relative).tap { |fp| @cache[absolute] = fp }
+    end
+
+    # Create a new FilePath with the given absolute and relative paths.
+    def initialize absolute_path, relative_path
+      @absolute = absolute_path
+      @relative = relative_path
+    end
+
+    # Just the file name, no path
+    def basename
+      @basename ||= File.basename(self.relative)
+    end
+
+    # Read file from absolute path.
+    def read
+      File.read self.absolute
+    end
+
+    # Check if absolute path exists.
+    def exists?
+      File.exist? self.absolute
+    end
+
+    # Compare FilePaths. Raises an ArgumentError unless both objects are FilePaths.
+    def <=> rhs
+      raise ArgumentError unless rhs.is_a? Brakeman::FilePath
+      self.relative <=> rhs.relative
+    end
+
+    # Compare FilePaths. Raises an ArgumentError unless both objects are FilePaths.
+    def == rhs
+      return false unless rhs.is_a? Brakeman::FilePath
+
+      self.absolute == rhs.absolute
+    end
+
+    # Returns a string with the absolute path.
+    def to_str
+      self.absolute
+    end
+
+    # Returns a string with the absolute path.
+    def to_s
+      self.to_str
+    end
+
+    def hash
+      @hash ||= [@absolute, @relative].hash
+    end
+
+    def eql? rhs
+      @absolute == rhs.absolute and
+        @relative == rhs.relative
+    end
+  end
+end

data/lib/brakeman/options.rb

@@ -82,6 +82,13 @@ module Brakeman::Options
           options[:rails5] = true
         end
 
+        opts.on "-6", "--rails6", "Force Rails 6 mode" do
+          options[:rails3] = true
+          options[:rails4] = true
+          options[:rails5] = true
+          options[:rails6] = true
+        end
+
         opts.separator ""
         opts.separator "Scanning options:"
 

data/lib/brakeman/parsers/haml_embedded.rb

@@ -1,6 +1,6 @@
 module Brakeman
   module FakeHamlFilter
-    # Copied from Haml - force delayed compilation
+    # Copied from Haml 4 - force delayed compilation
     def compile(compiler, text)
       filter = self
       compiler.instance_eval do

data/lib/brakeman/parsers/template_parser.rb

@@ -13,7 +13,7 @@ module Brakeman
     end
 
     def parse_template path, text
-      type = path.match(KNOWN_TEMPLATE_EXTENSIONS)[1].to_sym
+      type = path.relative.match(KNOWN_TEMPLATE_EXTENSIONS)[1].to_sym
       type = :erb if type == :rhtml
       name = template_path_to_name path
       Brakeman.debug "Parsing #{path}"
@@ -63,7 +63,7 @@ module Brakeman
         else
           ERB.new(text, nil, '-').src
         end
-        src.sub!(/^#.*\n/, '') if Brakeman::Scanner::RUBY_1_9
+        src.sub!(/^#.*\n/, '')
         src
       end
     end
@@ -79,7 +79,9 @@ module Brakeman
 
       Haml::Engine.new(text,
                        :filename => path,
-                       :escape_html => tracker.config.escape_html?).precompiled.gsub(/([^\\])\\n/, '\1')
+                       :escape_html => tracker.config.escape_html?,
+                       :escape_filter_interpolations => tracker.config.escape_filter_interpolations?
+                      ).precompiled.gsub(/([^\\])\\n/, '\1')
     rescue Haml::Error => e
       tracker.error e, ["While compiling HAML in #{path}"] << e.backtrace
       nil
@@ -95,7 +97,7 @@ module Brakeman
     end
 
     def self.parse_inline_erb tracker, text
-      fp = Brakeman::FileParser.new(tracker, nil)
+      fp = Brakeman::FileParser.new(tracker)
       tp = self.new(tracker, fp)
       src = tp.parse_erb '_inline_', text
       type = tp.erubis? ? :erubis : :erb

data/lib/brakeman/processor.rb

@@ -13,8 +13,7 @@ module Brakeman
     include Util
 
     def initialize(app_tree, options)
-      @app_tree = app_tree
-      @tracker = Tracker.new(@app_tree, self, options)
+      @tracker = Tracker.new(app_tree, self, options)
     end
 
     def tracked_events
@@ -39,7 +38,7 @@ module Brakeman
     #Process controller source. +file_name+ is used for reporting
     def process_controller src, file_name
       if contains_class? src
-        ControllerProcessor.new(@app_tree, @tracker).process_controller src, file_name
+        ControllerProcessor.new(@tracker).process_controller src, file_name
       else
         LibraryProcessor.new(@tracker).process_library src, file_name
       end
@@ -48,7 +47,7 @@ module Brakeman
     #Process variable aliasing in controller source and save it in the
     #tracker.
     def process_controller_alias name, src, only_method = nil, file = nil
-      ControllerAliasProcessor.new(@app_tree, @tracker, only_method).process_controller name, src, file
+      ControllerAliasProcessor.new(@tracker, only_method).process_controller name, src, file
     end
 
     #Process a model source
@@ -91,7 +90,7 @@ module Brakeman
     def process_initializer file_name, src
       res = BaseProcessor.new(@tracker).process_file src, file_name
       res = AliasProcessor.new(@tracker).process_safely res, nil, file_name
-      @tracker.initializers[Pathname.new(file_name).basename.to_s] = res
+      @tracker.initializers[file_name] = res
     end
 
     #Process source for a library file

data/lib/brakeman/processors/alias_processor.rb

@@ -20,19 +20,18 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   #The recommended usage is:
   #
   # AliasProcessor.new.process_safely src
-  def initialize tracker = nil, file_name = nil
+  def initialize tracker = nil, current_file = nil
     super()
     @env = SexpProcessor::Environment.new
     @inside_if = false
     @ignore_ifs = nil
     @exp_context = []
-    @current_module = nil
     @tracker = tracker #set in subclass as necessary
     @helper_method_cache = {}
     @helper_method_info = Hash.new({})
     @or_depth_limit = (tracker && tracker.options[:branch_limit]) || 5 #arbitrary default
     @meth_env = nil
-    @file_name = file_name
+    @current_file = current_file
     set_env_defaults
   end
 
@@ -44,8 +43,8 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   #
   #This method returns a new Sexp with variables replaced with their values,
   #where possible.
-  def process_safely src, set_env = nil, file_name = nil
-    @file_name = file_name
+  def process_safely src, set_env = nil, current_file = @current_file
+    @current_file = current_file
     @env = set_env || SexpProcessor::Environment.new
     @result = src.deep_clone
     process @result
@@ -250,6 +249,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
         end
         env[target_var] = target
         return first_arg
+      elsif new_string? target
+        env[target_var] = first_arg
+        return first_arg
       elsif array? target
         target << first_arg
         env[target_var] = target
@@ -266,10 +268,19 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       unless target.nil?
         exp = target
       end
+    when :dup
+      unless target.nil?
+        exp = target
+      end
     when :join
       if array? target and target.length > 2 and (string? first_arg or first_arg.nil?)
         exp = process_array_join(target, first_arg)
       end
+    when :!
+      #  Convert `!!a` to boolean
+      if call? target and target.method == :!
+        exp = s(:or, s(:true).line(exp.line), s(:false).line(exp.line)).line(exp.line)
+      end
     end
 
     exp
@@ -368,6 +379,8 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
           elsif e.is_a? Symbol
             local = Sexp.new(:lvar, e)
             env.current[local] = local
+          elsif e.nil? # trailing comma, argument destructuring
+            next # Punt for now
           else
             raise "Unexpected value in block args: #{e.inspect}"
           end
@@ -596,7 +609,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     if node_type? exp, :hash
       if exp.any? { |e| node_type? e, :kwsplat and node_type? e.value, :hash }
         kwsplats, rest = exp.partition { |e| node_type? e, :kwsplat and node_type? e.value, :hash }
-        exp = Sexp.new.concat(rest).line(exp)
+        exp = Sexp.new.concat(rest).line(exp.line)
 
         kwsplats.each do |e|
           exp = process_hash_merge! exp, e.value
@@ -693,7 +706,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     if @tracker
       @tracker.add_constant exp.lhs,
         exp.rhs,
-        :file => current_file_name,
+        :file => @current_file,
         :module => @current_module,
         :class => @current_class,
         :method => @current_method
@@ -1188,6 +1201,13 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     call? exp and exp.method == :raise
   end
 
+  STRING_NEW = s(:call, s(:const, :String), :new)
+
+  # String.new ?
+  def new_string? exp
+    exp == STRING_NEW
+  end
+
   #Set variable to given value.
   #Creates "branched" versions of values when appropriate.
   #Avoids creating multiple branched versions inside same

data/lib/brakeman/processors/base_processor.rb

@@ -15,11 +15,12 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     super()
     @last = nil
     @tracker = tracker
-    @current_template = @current_module = @current_class = @current_method = @file_name = nil
+    @app_tree = tracker.app_tree if tracker
+    @current_template = @current_module = @current_class = @current_method = @current_file = nil
   end
 
-  def process_file exp, file_name
-    @file_name = file_name
+  def process_file exp, current_file
+    @current_file = current_file
     process exp
   end
 
@@ -113,6 +114,8 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     exp.unshift :rlist
   end
 
+  alias process_rlist process_block
+
   #Processes the inside of an interpolated String.
   def process_evstr exp
     exp = exp.dup
@@ -182,7 +185,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     if @tracker
       @tracker.add_constant exp.lhs,
         exp.rhs,
-        :file => current_file_name,
+        :file => current_file,
         :module => @current_module,
         :class => @current_class,
         :method => @current_method
@@ -234,8 +237,8 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     elsif first_arg.is_a? Symbol or first_arg.is_a? String
       type = :action
       value = Sexp.new(:lit, first_arg.to_sym)
-		elsif first_arg.nil?
-			type = :default
+    elsif first_arg.nil?
+      type = :default
     elsif not hash? first_arg
       type = :action
       value = first_arg
@@ -287,7 +290,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     template_name = "#@current_method/inline@#{value.line}:#{class_or_module}".to_sym
     type, ast = Brakeman::TemplateParser.parse_inline_erb(@tracker, value.value)
     ast = ast.deep_clone(value.line)
-    @tracker.processor.process_template(template_name, ast, type, nil, @file_name)
+    @tracker.processor.process_template(template_name, ast, type, nil, @current_file)
     @tracker.processor.process_template_alias(@tracker.templates[template_name])
 
     return s(:lit, template_name), options

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -11,22 +11,22 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
   #If only_method is specified, only that method will be processed,
   #other methods will be skipped.
   #This is for rescanning just a single action.
-  def initialize app_tree, tracker, only_method = nil
+  def initialize tracker, only_method = nil
     super tracker
-    @app_tree = app_tree
+    @app_tree = tracker.app_tree
     @only_method = only_method
     @rendered = false
     @current_class = @current_module = @current_method = nil
     @method_cache = {} #Cache method lookups
   end
 
-  def process_controller name, src, file_name
+  def process_controller name, src, current_file
     if not node_type? src, :class
       Brakeman.debug "#{name} is not a class, it's a #{src.node_type}"
       return
     else
       @current_class = name
-      @file_name = file_name
+      @current_file = @app_tree.file_path(current_file)
 
       process_default src
 
@@ -37,6 +37,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
   #Process modules mixed into the controller, in case they contain actions.
   def process_mixins
     controller = @tracker.controllers[@current_class]
+    original_file = @current_file
 
     controller.includes.each do |i|
       mixin = @tracker.libs[i]
@@ -49,7 +50,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
       methods.each do |name|
         #Need to process the method like it was in a controller in order
         #to get the renders set
-        processor = Brakeman::ControllerProcessor.new(@app_tree, @tracker)
+        processor = Brakeman::ControllerProcessor.new(@tracker, mixin.file)
         method = mixin.get_method(name)[:src].deep_clone
 
         if node_type? method, :defn
@@ -59,11 +60,13 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
           method = processor.process method
         end
 
-        @file_name = mixin.file
+        @current_file = mixin.file
         #Then process it like any other method in the controller
         process method
       end
     end
+  ensure
+    @current_file = original_file
   end
 
   #Skip it, must be an inner class
@@ -187,7 +190,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
       end
     end
 
-    render_path = Brakeman::RenderPath.new.add_controller_render(@current_class, @current_method, line, relative_path(@file_name))
+    render_path = Brakeman::RenderPath.new.add_controller_render(@current_class, @current_method, line, @current_file)
     super name, args, render_path, line
   end