brakeman-lib 8.0.4 → 8.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d07db98e56b03b45fd3347a5982628ab3421d8bba0c1a1d55a3b685432ef8375
-  data.tar.gz: 1245d911d4356d014e616bb387810c3879e8a68919fd1f1f173a4a21cf6c8fe9
+  metadata.gz: 93cfb6ec4cc35376d35e8fe361e6b893bfe39858136d53a29196dd5c5869658d
+  data.tar.gz: eb788145060b1e41cf0f18d56395b13681ba0daf72f1948dc8ab0f73e3449b50
 SHA512:
-  metadata.gz: 48540c3c00cf275afe01c3194302d48bd0e8e12602f1abd5a81bc99c1cc13ca5fb48fcf630879dc6a851e88559404d210fb6e0d6324a7203a3ad274b18116504
-  data.tar.gz: 056150df12092b1d16a1b56214d7a268627fe58d7249071c0ef4871aa0c289c184753f2c8468374dd1046beb77515d306c9416033901f0424452ca920ac71993
+  metadata.gz: 9698bfe45b5988178cbe7e134dd0134c00618ec786c0cfcea2a01cce139f1a0e8317dd2b7d1e54ae24b8fe0b4c23687fa02742333ff4c2226cf382a2806597ab
+  data.tar.gz: 9e1ad4ea0ee656909be88cdcb167f0e9eda87c4af2b8a43c58f27e4d8c9c4c1922885958a90a8cb1a71c0049dbfeb2369e3f0751c68bc259d5b78578bdf6725d

data/CHANGES.md

@@ -1,3 +1,20 @@
+# 8.0.6 - 2026-08-13
+
+* Fix EOL date for Rails 8.0 (yeaseul-kim)
+* Add EOL dates for Rails 8.1 and Ruby 4.0
+* Fix command injection false positives (Jacob Evelyn)
+* Fix unused variable warning (viralpraxis)
+
+# 8.0.5 - 2026-06-12
+
+* Add `quote_schema_name` to safe quote method list (Zsolt Kozaroczy)
+* Fix SQL injection false positive for `compact_blank`/`compact` on permitted params (Arpit Jain)
+* Fix inline render false positive for local named `text` (Arpit Jain)
+* Fix HAML crash on `.raw` calls (Federico Franco)
+* Fix Ruby version parsing - especially for non-CRuby versions (Chris Southerland Jr) 
+* Fix `TemplateAliasProcessor#template_name` arity (viralpraxis)
+* Reduce false positives when using shell escaping
+
 # 8.0.4 - 2026-02-26
 
 * Load 'date' library for `--ensure-latest`

data/lib/brakeman/checks/check_eol_rails.rb

@@ -25,6 +25,7 @@ class Brakeman::CheckEOLRails < Brakeman::EOLCheck
     ['7.0.0', '7.0.99'] => Date.new(2025, 4, 1),
     ['7.1.0', '7.1.99'] => Date.new(2025, 10, 1),
     ['7.2.0', '7.2.99'] => Date.new(2026, 8, 9),
-    ['8.0.0', '8.0.99'] => Date.new(2026, 10, 7),
+    ['8.0.0', '8.0.99'] => Date.new(2026, 11, 7),
+    ['8.1.0', '8.1.99'] => Date.new(2027, 10, 10),
   }
 end

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -26,5 +26,6 @@ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
     ['3.2.0', '3.2.99'] => Date.new(2026, 3, 31),
     ['3.3.0', '3.3.99'] => Date.new(2027, 3, 31),
     ['3.4.0', '3.4.99'] => Date.new(2028, 3, 31),
+    ['4.0.0', '4.0.99'] => Date.new(2029, 3, 31),
   }
 end

data/lib/brakeman/checks/check_execute.rb

@@ -55,6 +55,13 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     first_arg = call.first_arg
     failure = nil
 
+    # All spawn-family methods optionally accept an env hash as the first
+    # argument. Strip it so first_arg always points to the command name.
+    if hash?(first_arg)
+      args.delete_at(1)
+      first_arg = args[1]
+    end
+
     case call.method
     when :popen
       # Normally, if we're in a `popen` call, we only are worried about shell
@@ -99,14 +106,17 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
         break if failure
       end
-    when :system, :exec
-      # Normally, if we're in a `system` or `exec` call, we only are worried
-      # about shell injection when there's a single argument, because comma-
-      # separated arguments are always escaped by Ruby. However, an exception is
-      # when the first two arguments are something like "bash -c" because then
-      # the third argument is effectively the command being run and might be
-      # a malicious executable if it comes (partially or fully) from user input.
-      if dash_c_shell_command?(first_arg, call.second_arg)
+    when :system, :exec, :spawn, :capture2, :capture2e, :capture3,
+         :popen2, :popen2e, :popen3
+      # Comma-separated arguments are passed directly to execve without a
+      # shell, so only the first argument (the command name) needs checking.
+      # Exception: `bash -c <script>` — the script is the injection vector.
+      #
+      # All of these methods accept an optional trailing options hash
+      # (e.g. stdin_data:, chdir:); strip it before checking.
+      args.pop if hash?(args.last) && args.length > 2
+
+      if dash_c_shell_command?(first_arg, args[2])
         failure = include_user_input?(args[3]) ||
                   dangerous_interp?(args[3]) ||
                   dangerous_string_building?(args[3])
@@ -115,16 +125,6 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
                   dangerous_interp?(first_arg) ||
                   dangerous_string_building?(first_arg)
       end
-    when :capture2, :capture2e, :capture3
-      # Open3 capture methods can take a :stdin_data argument which is used as the
-      # the input to the called command so it is not succeptable to command injection.
-      # As such if the last argument is a hash (and therefore execution options) it
-      # should be ignored
-
-      args.pop if hash?(args.last) && args.length > 2
-      failure = include_user_input?(args) ||
-                dangerous_interp?(args) ||
-                dangerous_string_building?(args)
     else
       failure = include_user_input?(args) ||
                 dangerous_interp?(args) ||
@@ -176,6 +176,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
   def include_user_input? exp
     if node_type? exp, :arglist, :dstr, :evstr, :dxstr
       exp.each_sexp do |e|
+        next if shell_escape? e
+
         if res = include_user_input?(e)
           return res
         end
@@ -196,7 +198,7 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
       # Check for input at start of string
       exp[1] == "" and
         node_type? exp[2], :evstr and
-        has_immediate_user_input? exp[2]
+        dangerous? exp[2]
     else
       has_immediate_user_input? exp
     end
@@ -266,6 +268,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
   end
 
   def dangerous_interp? exp
+    return if shell_escape? exp
+
     match = include_interp? exp
     return unless match
     interp = match.match

data/lib/brakeman/checks/check_sql.rb

@@ -311,7 +311,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     end
 
     if request_value? arg
-      unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash, :symbolize_keys].include? arg.method
+      unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash, :symbolize_keys, :compact, :compact_blank].include? arg.method
         # Model.where(params[:where])
         arg
       end
@@ -645,7 +645,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
       locale_call? exp
   end
 
-  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
+  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name, :quote_schema_name]
 
   def quote_call? exp
     if call? exp.target

data/lib/brakeman/processors/base_processor.rb

@@ -258,12 +258,19 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     #Look for "type" of render in options hash
     #For example, render :file => "blah"
     if hash? last_arg
-      hash_iterate(last_arg) do |key, val|
-        if symbol? key and types_in_hash.include? key.value
-          type = key.value
-          value = val
-        else  
-          rest << key << val
+      if type
+        #The render type was already determined by a positional argument, so a
+        #key in the options hash that happens to match a render type name (e.g.
+        #`text:`) is a local passed to the partial/action, not a type directive.
+        rest = last_arg
+      else
+        hash_iterate(last_arg) do |key, val|
+          if symbol? key and types_in_hash.include? key.value
+            type = key.value
+            value = val
+          else
+            rest << key << val
+          end
         end
       end
     end

data/lib/brakeman/processors/gem_processor.rb

@@ -6,7 +6,7 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
   def initialize *args
     super
     @gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
-    @ruby_version = /^\s+ruby (\d\.\d.\d+)/
+    @ruby_version = /^\s+ruby (\d+\.\d+\.\d+)/
   end
 
   def process_gems gem_files

data/lib/brakeman/processors/haml_template_processor.rb

@@ -186,6 +186,8 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
 
   def raw? exp
     call? exp and
-      exp.method == :raw
+      exp.target.nil? and
+      exp.method == :raw and
+      exp.first_arg
   end
 end

data/lib/brakeman/processors/lib/render_helper.rb

@@ -19,7 +19,9 @@ module Brakeman::RenderHelper
       end
     when :default
       begin
-        process_template template_name, exp[3], nil, exp.line
+        # exp[2] is either the action name (from controller) or :default when no explicit arg
+        name_arg = (exp[2].nil? || exp[2] == :default) ? nil : exp[2]
+        process_template template_name(name_arg), exp[3], nil, exp.line
       rescue ArgumentError
         Brakeman.debug "Problem processing render: #{exp}"
       end

data/lib/brakeman/scanner.rb

@@ -187,8 +187,14 @@ class Brakeman::Scanner
     end
 
     if @app_tree.exists? ".ruby-version"
-      if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/]
-        tracker.config.set_ruby_version version, @app_tree.file_path(".ruby-version"), 1
+      contents = @app_tree.file_path(".ruby-version").read
+      # Skip alternative Ruby implementations — the EOL dates Brakeman knows
+      # about are MRI's, so a `.ruby-version` of "jruby-10.0.2.0" should not
+      # be parsed as MRI 0.0.2 / 10.0.2.
+      unless contents =~ /\A\s*(jruby|truffleruby|rbx|rubinius|mruby)\b/i
+        if version = contents[/(\d+\.\d+\.\d+)/]
+          tracker.config.set_ruby_version version, @app_tree.file_path(".ruby-version"), 1
+        end
       end
     end
 

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "8.0.4"
+  Version = "8.0.6"
 end

data/lib/brakeman.rb

@@ -427,7 +427,7 @@ module Brakeman
     release_date = latest.date.to_date
     latest_version = latest.version.to_s
 
-    if (Date.today - latest.date.to_date) >= days_old
+    if (Date.today - release_date) >= days_old
       if current != latest_version
         return "Brakeman #{current} is not the latest version #{latest_version}"
       else

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-lib
 version: !ruby/object:Gem::Version
-  version: 8.0.4
+  version: 8.0.6
 platform: ruby
 authors:
 - Justin Collins
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-27 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest