brakeman-lib 3.3.1 → 3.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7ddc7e6cb65aa8838c73a8052245d17b188059c2
-  data.tar.gz: 9e5e114ead150d6d8ac25cbe4d55f71ee4655f50
+  metadata.gz: 247e1f6cbd985e4c43a49652500d38319984d212
+  data.tar.gz: bb49ccd6dce05cab284eca01935d2368a7c976e3
 SHA512:
-  metadata.gz: d0555c9ee1835ccd8446cc81c4eb0f970cd2ce8966bf7ca3e0d71c81d74ff595aeb116f49b785f40acb4f57095d3a3dfc934d0b5418a8c42c59546ef8cad1dd1
-  data.tar.gz: 4d24f5a2e330ea82dc914175bb54e1a2db32bc7a41131e2fa7ea0facf9e6c6edf37588868a0f7e0257ad7589382b23599348ede3bca8e05a0154683050f2530f
+  metadata.gz: f213baa263336bc6589ae552d87d10fb498abefc4b1921b6a3056abd80716910a61a1c5cedae8c2ec5317f1bcb8fb391cc9832cd6ffbfe014d3dcd4de3bb00c6
+  data.tar.gz: 9b8b4242889b5c03f59c0dec5a21e98bef3dcbdfe3a05cf8f5ac8ae1a9c826f60418cc1b5b9ab3c5c823be3c616da9922fa4511a64a4b48bf149c1917114a418

data/CHANGES

@@ -1,3 +1,7 @@
+# 3.3.2
+
+* Fix serious performance regression with global constant tracking
+
 # 3.3.1 
 
 * Delay loading vendored gems and modifying load path

data/lib/brakeman/checks/check_secrets.rb

@@ -13,7 +13,7 @@ class Brakeman::CheckSecrets < Brakeman::BaseCheck
     @warned = Set.new
 
     @tracker.constants.each do |constant|
-      name = constant.name.last
+      name = constant.name_array.last
       value = constant.value
 
       if string? value and not value.value.empty? and looks_like_secret? name

data/lib/brakeman/options.rb

@@ -76,6 +76,7 @@ module Brakeman::Options
         opts.on "--faster", "Faster, but less accurate scan" do
           options[:ignore_ifs] = true
           options[:skip_libs] = true
+          options[:disable_constant_tracking] = true
         end
 
         opts.on "--ignore-model-output", "Consider model attributes XSS-safe" do

data/lib/brakeman/tracker.rb

@@ -186,11 +186,11 @@ class Brakeman::Tracker
   end
 
   def add_constant name, value, context = nil
-    @constants.add name, value, context
+    @constants.add name, value, context unless @options[:disable_constant_tracking]
   end
 
   def constant_lookup name
-    @constants.get_literal name
+    @constants.get_literal name unless @options[:disable_constant_tracking]
   end
 
   def index_call_sites

data/lib/brakeman/tracker/constants.rb

@@ -2,11 +2,11 @@ require 'brakeman/processors/output_processor'
 
 module Brakeman
   class Constant
-    attr_reader :name, :file
+    attr_reader :name, :name_array, :file, :value
 
     def initialize name, value = nil, context = nil 
       set_name name, context
-      @values = [ value ]
+      @value = value
       @context = context
 
       if @context
@@ -15,28 +15,28 @@ module Brakeman
     end
 
     def line
-      if @values.first.is_a? Sexp
-        @values.first.line
+      if @value.is_a? Sexp
+        @value.line
       end
     end
 
     def set_name name, context
-      @name = Constants.constant_as_array(name)
+      @name = name
+      @name_array = Constants.constant_as_array(name)
     end
 
     def match? name
-      @name.reverse.zip(name.reverse).reduce(true) { |m, a| a[1] ? a[0] == a[1] && m : m }
-    end
-
-    def value
-      @values.reverse.reduce do |m, v|
-        Sexp.new(:or, v, m)
-      end
-    end
-
-    def add_value exp
-      unless @values.include? exp
-        @values << exp
+      if name == @name
+        return true
+      elsif name.is_a? Sexp and name.node_type == :const and name.value == @name
+        return true
+      elsif name.is_a? Symbol and name.value == @name
+        return true
+      elsif name.class == Array
+        name == @name_array or
+          @name_array.reverse.zip(name.reverse).reduce(true) { |m, a| a[1] ? a[0] == a[1] && m : m }
+      else
+        false
       end
     end
   end
@@ -45,7 +45,11 @@ module Brakeman
     include Brakeman::Util
 
     def initialize
-      @constants = []
+      @constants = Hash.new { |h, k| h[k] = [] }
+    end
+
+    def size
+      @constants.length
     end
 
     def [] exp
@@ -60,41 +64,98 @@ module Brakeman
     end
 
     def find_constant exp
-      name = Constants.constant_as_array(exp)
-      @constants.find do |c|
-        c.match? name
+      base_name = Constants.get_constant_base_name(exp)
+
+      if @constants.key? base_name
+        @constants[base_name].find do |c|
+          if c.match? exp
+            return c
+          end
+        end
+
+        name_array = Constants.constant_as_array(exp)
+
+        # Avoid losing info about dynamic constant values
+        return unless name_array.all? { |n| constant? n or n.is_a? Symbol }
+
+        @constants[base_name].find do |c|
+          if c.match? name_array
+            return c
+          end
+        end
       end
+
+      nil
     end
 
     def add name, value, context = nil
-      if existing = self.find_constant(name)
-        existing.add_value value
-      else
-        @constants << Constant.new(name, value, context)
+      if call? value and value.method == :freeze
+        value = value.target
       end
+
+      base_name = Constants.get_constant_base_name(name)
+      @constants[base_name] << Constant.new(name, value, context)
+    end
+
+    LITERALS = [:lit, :false, :str, :true, :array, :hash]
+    def literal? exp
+      exp.is_a? Sexp and LITERALS.include? exp.node_type
     end
 
     def get_literal name
-      if x = self[name] and [:lit, :false, :str, :true, :array, :hash].include? x.node_type
+      if x = self[name] and literal? x
         x
       else
         nil
       end
     end
 
-    def each &block
-      @constants.each &block
+    def each
+      @constants.each do |name, values|
+        values.each do |constant|
+          yield constant
+        end
+      end
     end
 
     def self.constant_as_array exp
-      get_constant_name(exp).split('::')
+      res = []
+      while exp
+        if exp.is_a? Sexp
+          case exp.node_type
+          when :const
+            res << exp.value
+            exp = nil
+          when :colon3
+            res << exp.value << :""
+            exp = nil
+          when :colon2
+            res << exp.last
+            exp = exp[1]
+          else
+            res << exp
+            exp = nil
+          end
+        else
+          res << exp
+          exp = nil
+        end
+      end
+
+      res.reverse!
+      res
     end
 
-    def self.get_constant_name exp
-      if exp.is_a? Sexp
-        Brakeman::OutputProcessor.new.format(exp)
+    def self.get_constant_base_name exp
+      return exp unless exp.is_a? Sexp
+
+      case exp.node_type
+      when :const, :colon3
+        exp.value
+      when :colon2
+        exp.last
       else
-        exp.to_s
+        exp
       end
     end
   end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "3.3.1"
+  Version = "3.3.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-lib
 version: !ruby/object:Gem::Version
-  version: 3.3.1
+  version: 3.3.2
 platform: ruby
 authors:
 - Justin Collins
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain:
 - brakeman-public_cert.pem
-date: 2016-06-02 00:00:00.000000000 Z
+date: 2016-06-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: test-unit