brakeman-lib 4.5.1 → 4.7.2

data/lib/brakeman/tracker/constants.rb

@@ -49,7 +49,7 @@ module Brakeman
     include Brakeman::Util
 
     def initialize
-      @constants = Hash.new { |h, k| h[k] = [] }
+      @constants = {}
     end
 
     def size
@@ -103,6 +103,7 @@ module Brakeman
       end
 
       base_name = Constants.get_constant_base_name(name)
+      @constants[base_name] ||= []
       @constants[base_name] << Constant.new(name, value, context)
     end
 

data/lib/brakeman/util.rb

@@ -8,9 +8,11 @@ module Brakeman::Util
 
   PATH_PARAMETERS = Sexp.new(:call, Sexp.new(:call, nil, :request), :path_parameters)
 
-  REQUEST_PARAMETERS = Sexp.new(:call, Sexp.new(:call, nil, :request), :request_parameters)
+  REQUEST_REQUEST_PARAMETERS = Sexp.new(:call, Sexp.new(:call, nil, :request), :request_parameters)
 
-  REQUEST_PARAMS = Sexp.new(:call, Sexp.new(:call, nil, :request), :parameters)
+  REQUEST_PARAMETERS = Sexp.new(:call, Sexp.new(:call, nil, :request), :parameters)
+
+  REQUEST_PARAMS = Sexp.new(:call, Sexp.new(:call, nil, :request), :params)
 
   REQUEST_ENV = Sexp.new(:call, Sexp.new(:call, nil, :request), :env)
 
@@ -22,7 +24,7 @@ module Brakeman::Util
 
   SESSION = Sexp.new(:call, nil, :session)
 
-  ALL_PARAMETERS = Set[PARAMETERS, QUERY_PARAMETERS, PATH_PARAMETERS, REQUEST_PARAMETERS, REQUEST_PARAMS]
+  ALL_PARAMETERS = Set[PARAMETERS, QUERY_PARAMETERS, PATH_PARAMETERS, REQUEST_REQUEST_PARAMETERS, REQUEST_PARAMETERS, REQUEST_PARAMS]
 
   ALL_COOKIES = Set[COOKIES, REQUEST_COOKIES]
 

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "4.5.1"
+  Version = "4.7.2"
 end

data/lib/brakeman/warning.rb

@@ -271,6 +271,10 @@ class Brakeman::Warning
     end
   end
 
+  def relative_path
+    self.file.relative
+  end
+
   def to_hash absolute_paths: true
     if self.called_from and not absolute_paths
       render_path = self.called_from.with_relative_paths

data/lib/brakeman/warning_codes.rb

@@ -111,6 +111,9 @@ module Brakeman::WarningCodes
     :CVE_2018_3741 => 107,
     :CVE_2018_3760 => 108,
     :force_ssl_disabled => 109,
+    :unsafe_cookie_serialization => 110,
+    :reverse_tabnabbing => 111,
+    :custom_check => 9090,
   }
 
   def self.code name

data/lib/ruby_parser/bm_sexp.rb

@@ -40,7 +40,7 @@ class Sexp
       s.line(line)
     else
       s.original_line = self.original_line
-      s.line(self.line)
+      s.line(self.line) if self.line
     end
 
     s
@@ -371,7 +371,12 @@ class Sexp
   #       s(:block, s(:lvar, :y), s(:call, nil, :z, s(:arglist))))
   def block_call
     expect :iter
-    self[1]
+
+    if self[1].node_type == :lambda
+      s(:call, nil, :lambda).line(self.line)
+    else
+      self[1]
+    end
   end
 
   #Returns block of a call with a block.

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-lib
 version: !ruby/object:Gem::Version
-  version: 4.5.1
+  version: 4.7.2
 platform: ruby
 authors:
 - Justin Collins
 autorequire: 
 bindir: bin
-cert_chain:
-- brakeman-public_cert.pem
-date: 2019-05-11 00:00:00.000000000 Z
+cert_chain: []
+date: 2019-11-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -169,22 +168,16 @@ dependencies:
   name: haml
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '3.0'
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '5.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '3.0'
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '5.1'
 - !ruby/object:Gem::Dependency
   name: slim
   requirement: !ruby/object:Gem::Requirement
@@ -226,6 +219,7 @@ files:
 - lib/brakeman/checks/check_basic_auth.rb
 - lib/brakeman/checks/check_basic_auth_timing_attack.rb
 - lib/brakeman/checks/check_content_tag.rb
+- lib/brakeman/checks/check_cookie_serialization.rb
 - lib/brakeman/checks/check_create_with.rb
 - lib/brakeman/checks/check_cross_site_scripting.rb
 - lib/brakeman/checks/check_default_routes.rb
@@ -266,6 +260,7 @@ files:
 - lib/brakeman/checks/check_render_dos.rb
 - lib/brakeman/checks/check_render_inline.rb
 - lib/brakeman/checks/check_response_splitting.rb
+- lib/brakeman/checks/check_reverse_tabnabbing.rb
 - lib/brakeman/checks/check_route_dos.rb
 - lib/brakeman/checks/check_safe_buffer_manipulation.rb
 - lib/brakeman/checks/check_sanitize_methods.rb
@@ -387,7 +382,14 @@ files:
 homepage: http://brakemanscanner.org
 licenses:
 - Brakeman Public Use License
-metadata: {}
+metadata:
+  bug_tracker_uri: https://github.com/presidentbeef/brakeman/issues
+  changelog_uri: https://github.com/presidentbeef/brakeman/releases
+  documentation_uri: https://brakemanscanner.org/docs/
+  homepage_uri: https://brakemanscanner.org/
+  mailing_list_uri: https://gitter.im/presidentbeef/brakeman
+  source_code_uri: https://github.com/presidentbeef/brakeman
+  wiki_uri: https://github.com/presidentbeef/brakeman/wiki
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -403,8 +405,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.8
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.