brakeman-lib 8.0.5 → 8.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '081816b1dce310635af2372f9bd944fe3efc4e28a89e5f32be39a83b7abff137'
-  data.tar.gz: a1984f13bf1ffedb4999f5f3b761788f6fd01eb3abbedcfb72fd2be0aa6a5b00
+  metadata.gz: d76a4590b3df146050c07df100680cc1a72821ca5c3e3e6bdf50de904603529a
+  data.tar.gz: 03de5ab61f3f56d0f99e6d6c833b671ddda0c6721214853cc3ddaa909fa01e5d
 SHA512:
-  metadata.gz: a9f099212f13d0897ed9a17a5281da9b8b2f0a983123f0204d72990c7747c1a3ef11db38bbe846cb48a9c99c8e84adb8d20763377fa9279bae17371629d74b9c
-  data.tar.gz: 88d203ec8ce92493f2192658589ba47c9a41543c1e4b7bc78da3aacaf485eaa005fb5beef49ce0f04d02ad3dffbe7c40b65b57aed35bc35baf150928fc3fea25
+  metadata.gz: 39fb331fc88e7a4360eac71cebdca9aebc8a3082ee6293ed52ae1b5d419e5685a7eddb1eccf5f80db7914f8cd2aefc2738f6b020d2f9a55bb6d8c9a5a2938c91
+  data.tar.gz: 4adf39f28d7a5e8ddc64f3e4d539bde4b0dd77f482be347601d4e2cf4846da63cfe37046a7ca66c1ebadcd6156bc2b2726c47b54f7bc0bdacbf5d0d70f044456

data/CHANGES.md

@@ -1,3 +1,22 @@
+# 8.1.0 - 2026-09-30
+
+* Better help and error message for `--ensure-latest`
+* Fix frozen string error (Shai Coleman)
+* Update Sonar report format (fangxing)
+* Fix frozen `src` string error
+* Recognize `Haml::AttributeBuilder.build_class` as an escaped output (Yuriy Tumanov)
+* Include regex code in validation warnings (Eliot Sykes)
+* Check validation regexes in non-activerecord models (Eliot Sykes)
+* Skip top-level vendor directory before recursive globbing (Conor O'Donnell)
+* Support Rails 7.1+ positional enum syntax in SQL injection check (Michael Vogl/Yuriy Tumanov)
+
+# 8.0.6 - 2026-08-13
+
+* Fix EOL date for Rails 8.0 (yeaseul-kim)
+* Add EOL dates for Rails 8.1 and Ruby 4.0
+* Fix command injection false positives (Jacob Evelyn)
+* Fix unused variable warning (viralpraxis)
+
 # 8.0.5 - 2026-06-12
 
 * Add `quote_schema_name` to safe quote method list (Zsolt Kozaroczy)

data/lib/brakeman/app_tree.rb

@@ -64,6 +64,8 @@ module Brakeman
       @only_files = init_options[:only_files]
       @additional_libs_path = init_options[:additional_libs_path] || []
       @engine_paths = init_options[:engine_paths] || []
+      @additional_libs_path_pairs = @additional_libs_path.map { |p| [p, expand_path(p)] }
+      @engine_path_pairs = @engine_paths.map { |p| [p, expand_path(p)] }
       @absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
       @relative_engine_paths = @engine_paths - @absolute_engine_paths
       @skip_vendor = init_options[:skip_vendor]
@@ -251,7 +253,10 @@ module Brakeman
       paths.reject do |path|
         relative_path = path.relative
 
-        if @skip_vendor and relative_path.include? 'vendor/' and !in_engine_paths?(path) and !in_add_libs_paths?(path)
+        if @skip_vendor and
+            (relative_path == 'vendor' || relative_path.include?('vendor/')) and
+            !in_engine_paths?(path) and
+            !in_add_libs_paths?(path)
           true
         else
           match_path EXCLUDED_PATHS, path
@@ -260,11 +265,17 @@ module Brakeman
     end
 
     def in_engine_paths?(path)
-      @engine_paths.any? { |p| path.absolute.include?(p) }
+      @engine_path_pairs.any? do |original, expanded|
+        path.absolute.include?(original) ||
+          expanded.start_with?("#{path.absolute}#{File::SEPARATOR}")
+      end
     end
 
     def in_add_libs_paths?(path)
-      @additional_libs_path.any? { |p| path.absolute.include?(p) }
+      @additional_libs_path_pairs.any? do |original, expanded|
+        path.absolute.include?(original) ||
+          expanded.start_with?("#{path.absolute}#{File::SEPARATOR}")
+      end
     end
 
     def match_path files, path

data/lib/brakeman/checks/check_eol_rails.rb

@@ -25,6 +25,7 @@ class Brakeman::CheckEOLRails < Brakeman::EOLCheck
     ['7.0.0', '7.0.99'] => Date.new(2025, 4, 1),
     ['7.1.0', '7.1.99'] => Date.new(2025, 10, 1),
     ['7.2.0', '7.2.99'] => Date.new(2026, 8, 9),
-    ['8.0.0', '8.0.99'] => Date.new(2026, 10, 7),
+    ['8.0.0', '8.0.99'] => Date.new(2026, 11, 7),
+    ['8.1.0', '8.1.99'] => Date.new(2027, 10, 10),
   }
 end

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -26,5 +26,6 @@ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
     ['3.2.0', '3.2.99'] => Date.new(2026, 3, 31),
     ['3.3.0', '3.3.99'] => Date.new(2027, 3, 31),
     ['3.4.0', '3.4.99'] => Date.new(2028, 3, 31),
+    ['4.0.0', '4.0.99'] => Date.new(2029, 3, 31),
   }
 end

data/lib/brakeman/checks/check_execute.rb

@@ -55,6 +55,13 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     first_arg = call.first_arg
     failure = nil
 
+    # All spawn-family methods optionally accept an env hash as the first
+    # argument. Strip it so first_arg always points to the command name.
+    if hash?(first_arg)
+      args.delete_at(1)
+      first_arg = args[1]
+    end
+
     case call.method
     when :popen
       # Normally, if we're in a `popen` call, we only are worried about shell
@@ -99,14 +106,17 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
         break if failure
       end
-    when :system, :exec
-      # Normally, if we're in a `system` or `exec` call, we only are worried
-      # about shell injection when there's a single argument, because comma-
-      # separated arguments are always escaped by Ruby. However, an exception is
-      # when the first two arguments are something like "bash -c" because then
-      # the third argument is effectively the command being run and might be
-      # a malicious executable if it comes (partially or fully) from user input.
-      if dash_c_shell_command?(first_arg, call.second_arg)
+    when :system, :exec, :spawn, :capture2, :capture2e, :capture3,
+         :popen2, :popen2e, :popen3
+      # Comma-separated arguments are passed directly to execve without a
+      # shell, so only the first argument (the command name) needs checking.
+      # Exception: `bash -c <script>` — the script is the injection vector.
+      #
+      # All of these methods accept an optional trailing options hash
+      # (e.g. stdin_data:, chdir:); strip it before checking.
+      args.pop if hash?(args.last) && args.length > 2
+
+      if dash_c_shell_command?(first_arg, args[2])
         failure = include_user_input?(args[3]) ||
                   dangerous_interp?(args[3]) ||
                   dangerous_string_building?(args[3])
@@ -115,21 +125,6 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
                   dangerous_interp?(first_arg) ||
                   dangerous_string_building?(first_arg)
       end
-    when :capture2, :capture2e, :capture3
-      # Open3 capture methods can take a :stdin_data argument which is used as the
-      # the input to the called command so it is not succeptable to command injection.
-      # As such if the last argument is a hash (and therefore execution options) it
-      # should be ignored
-
-      args.pop if hash?(args.last) && args.length > 2
-
-      args.each_sexp do |arg|
-        failure = include_user_input?(arg) ||
-          dangerous_interp?(arg) ||
-          dangerous_string_building?(arg)
-
-        break if failure
-      end
     else
       failure = include_user_input?(args) ||
                 dangerous_interp?(args) ||

data/lib/brakeman/checks/check_validation_regex.rb

@@ -16,7 +16,7 @@ class Brakeman::CheckValidationRegex < Brakeman::BaseCheck
   FORMAT = Sexp.new(:lit, :format)
 
   def run_check
-    active_record_models.each do |name, model|
+    tracker.models.each do |name, model|
       @current_model = model
       format_validations = model.options[:validates_format_of]
 
@@ -92,7 +92,8 @@ class Brakeman::CheckValidationRegex < Brakeman::BaseCheck
       :message => msg("Insufficient validation for ", msg_code(get_name validator), " using ", msg_code(regex.inspect), ". Use ", msg_code("\\A"), " and ", msg_code("\\z"), " as anchors"),
       :line => value.line,
       :confidence => :high,
-      :cwe_id => [777]
+      :cwe_id => [777],
+      :code => validator
     end
   end
 

data/lib/brakeman/options.rb

@@ -63,9 +63,9 @@ module Brakeman::Options
           options[:exit_on_error] = exit_on_error
         end
 
-        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days." do |days|
+        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days (1-15)." do |days|
           if days and not (1..15).include? days
-            raise OptionParser::InvalidArgument
+            raise OptionParser::InvalidArgument, "Minimum age must be 1-15 days."
           end
 
           options[:ensure_latest] = days || true

data/lib/brakeman/parsers/template_parser.rb

@@ -56,8 +56,15 @@ module Brakeman
         else
           ERB.new(text, nil, '-').src
         end
-        src.sub!(/^#.*\n/, '')
-        src
+
+        # Encoding comment at the beginning throws off line numbers
+        # but the string is frozen in ERB 6.0.2+, so we don't want to
+        # unnecessarily duplicate the string
+        if src.start_with? '#'
+          src.sub(/^#.*\n/, '')
+        else
+          src
+        end
       end
     end
 

data/lib/brakeman/processors/haml_template_processor.rb

@@ -171,7 +171,7 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
 
   def escaped_builder_method? exp
     case exp.method
-    when :build, :build_aria, :build_boolean, :build_data, :build_id, :escape_html
+    when :build, :build_aria, :build_boolean, :build_class, :build_data, :build_id, :escape_html
       true? exp.first_arg
     else
       false

data/lib/brakeman/processors/model_processor.rb

@@ -91,12 +91,25 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
   end
 
   def add_enum_method call
-    arg = call.first_arg
-    return unless hash? arg
-    return unless symbol? arg[1]
+    if call.second_arg.nil?
+      # Rails < 7.1 syntax: enum status: { active: 0, archived: 1 }
+      arg = call.first_arg
+      return unless hash? arg
+      return unless symbol? arg[1]
+
+      enum_name = arg[1].value # first key
+      enums = arg[2] # first value
+    else
+      # Rails >= 7.1 syntax: enum :status, { active: 0, archived: 1 }
+      first_arg = call.first_arg
+      second_arg = call.second_arg
+      return unless symbol? first_arg
+      return unless hash? second_arg or array? second_arg
+
+      enum_name = first_arg.value
+      enums = second_arg
+    end
 
-    enum_name = arg[1].value # first key
-    enums = arg[2] # first value
     enums_name = pluralize(enum_name.to_s).to_sym
 
     call_line = call.line

data/lib/brakeman/report/report_sonar.rb

@@ -1,38 +1,72 @@
 class Brakeman::Report::Sonar < Brakeman::Report::Base
   def generate_report
+    warnings = all_warnings
     report_object = {
-      issues: all_warnings.map { |warning| issue_json(warning) }
+      rules: rules_json(warnings),
+      issues: warnings.map { |warning| issue_json(warning) }
     }
-    return JSON.pretty_generate report_object
+    JSON.pretty_generate report_object
   end
-  
+
   private
-  
+
+  def rules_json(warnings)
+    warnings
+      .each_with_object({}) do |w, unique_warnings|
+        unique_warnings[[w.warning_code, w.confidence]] ||= w
+      end
+      .values
+      .map do |w|
+        {
+          id: rule_id(w),
+          name: w.warning_type.to_s,
+          description: w.link,
+          engineId: "Brakeman",
+          cleanCodeAttribute: "TRUSTWORTHY",
+          type: "VULNERABILITY",
+          severity: rule_severity_for(w.confidence),
+          impacts: [
+            {
+              softwareQuality: "SECURITY",
+              severity: impact_severity_for(w.confidence)
+            }
+          ]
+        }
+      end
+  end
+
   def issue_json(warning)
     {
-      engineId: "Brakeman",
-      ruleId: warning.warning_code,
-      type: "VULNERABILITY",
-      severity: severity_level_for(warning.confidence),
+      ruleId: rule_id(warning),
+      effortMinutes: (4 - warning.confidence) * 15,
       primaryLocation: {
         message: warning.message,
         filePath: warning.file.relative,
         textRange: {
-          "startLine": warning.line || 1,
-          "endLine": warning.line || 1,
+          startLine: warning.line || 1,
+          endLine: warning.line || 1
         }
-      },
-      effortMinutes: (4 - warning.confidence) * 15
+      }
     }
   end
 
-  def severity_level_for(confidence)
-    if confidence == 0
-      "CRITICAL"
-    elsif confidence == 1
-      "MAJOR"
-    else
-      "MINOR"
+  def rule_id(warning)
+    "BRAKEMAN_#{warning.warning_code}_#{rule_severity_for(warning.confidence)}"
+  end
+
+  def rule_severity_for(confidence)
+    case confidence
+    when 0 then "CRITICAL"
+    when 1 then "MAJOR"
+    else "MINOR"
+    end
+  end
+
+  def impact_severity_for(confidence)
+    case confidence
+    when 0 then "HIGH"
+    when 1 then "MEDIUM"
+    else "LOW"
     end
   end
 end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "8.0.5"
+  Version = "8.1.0"
 end

data/lib/brakeman/warning.rb

@@ -175,7 +175,7 @@ class Brakeman::Warning
   def format_with_user_input strip = true, &block
     if self.user_input
       formatted = Brakeman::OutputProcessor.new.format(code, self.user_input, &block)
-      formatted.gsub!(/(\t|\r|\n)+/, " ") if strip
+      formatted = formatted.gsub(/(\t|\r|\n)+/, " ") if strip
       formatted
     else
       format_code
@@ -321,4 +321,3 @@ class Brakeman::Warning
     formatted
   end
 end
-

data/lib/brakeman.rb

@@ -427,7 +427,7 @@ module Brakeman
     release_date = latest.date.to_date
     latest_version = latest.version.to_s
 
-    if (Date.today - latest.date.to_date) >= days_old
+    if (Date.today - release_date) >= days_old
       if current != latest_version
         return "Brakeman #{current} is not the latest version #{latest_version}"
       else

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-lib
 version: !ruby/object:Gem::Version
-  version: 8.0.5
+  version: 8.1.0
 platform: ruby
 authors:
 - Justin Collins
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -481,6 +482,7 @@ metadata:
   mailing_list_uri: https://gitter.im/presidentbeef/brakeman
   source_code_uri: https://github.com/presidentbeef/brakeman
   wiki_uri: https://github.com/presidentbeef/brakeman/wiki
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -495,7 +497,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 3.5.11
+signing_key:
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.
 test_files: []