brakeman-lib 8.0.5 → 8.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '081816b1dce310635af2372f9bd944fe3efc4e28a89e5f32be39a83b7abff137'
-  data.tar.gz: a1984f13bf1ffedb4999f5f3b761788f6fd01eb3abbedcfb72fd2be0aa6a5b00
+  metadata.gz: 93cfb6ec4cc35376d35e8fe361e6b893bfe39858136d53a29196dd5c5869658d
+  data.tar.gz: eb788145060b1e41cf0f18d56395b13681ba0daf72f1948dc8ab0f73e3449b50
 SHA512:
-  metadata.gz: a9f099212f13d0897ed9a17a5281da9b8b2f0a983123f0204d72990c7747c1a3ef11db38bbe846cb48a9c99c8e84adb8d20763377fa9279bae17371629d74b9c
-  data.tar.gz: 88d203ec8ce92493f2192658589ba47c9a41543c1e4b7bc78da3aacaf485eaa005fb5beef49ce0f04d02ad3dffbe7c40b65b57aed35bc35baf150928fc3fea25
+  metadata.gz: 9698bfe45b5988178cbe7e134dd0134c00618ec786c0cfcea2a01cce139f1a0e8317dd2b7d1e54ae24b8fe0b4c23687fa02742333ff4c2226cf382a2806597ab
+  data.tar.gz: 9e1ad4ea0ee656909be88cdcb167f0e9eda87c4af2b8a43c58f27e4d8c9c4c1922885958a90a8cb1a71c0049dbfeb2369e3f0751c68bc259d5b78578bdf6725d

data/CHANGES.md

@@ -1,3 +1,10 @@
+# 8.0.6 - 2026-08-13
+
+* Fix EOL date for Rails 8.0 (yeaseul-kim)
+* Add EOL dates for Rails 8.1 and Ruby 4.0
+* Fix command injection false positives (Jacob Evelyn)
+* Fix unused variable warning (viralpraxis)
+
 # 8.0.5 - 2026-06-12
 
 * Add `quote_schema_name` to safe quote method list (Zsolt Kozaroczy)

data/lib/brakeman/checks/check_eol_rails.rb

@@ -25,6 +25,7 @@ class Brakeman::CheckEOLRails < Brakeman::EOLCheck
     ['7.0.0', '7.0.99'] => Date.new(2025, 4, 1),
     ['7.1.0', '7.1.99'] => Date.new(2025, 10, 1),
     ['7.2.0', '7.2.99'] => Date.new(2026, 8, 9),
-    ['8.0.0', '8.0.99'] => Date.new(2026, 10, 7),
+    ['8.0.0', '8.0.99'] => Date.new(2026, 11, 7),
+    ['8.1.0', '8.1.99'] => Date.new(2027, 10, 10),
   }
 end

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -26,5 +26,6 @@ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
     ['3.2.0', '3.2.99'] => Date.new(2026, 3, 31),
     ['3.3.0', '3.3.99'] => Date.new(2027, 3, 31),
     ['3.4.0', '3.4.99'] => Date.new(2028, 3, 31),
+    ['4.0.0', '4.0.99'] => Date.new(2029, 3, 31),
   }
 end

data/lib/brakeman/checks/check_execute.rb

@@ -55,6 +55,13 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     first_arg = call.first_arg
     failure = nil
 
+    # All spawn-family methods optionally accept an env hash as the first
+    # argument. Strip it so first_arg always points to the command name.
+    if hash?(first_arg)
+      args.delete_at(1)
+      first_arg = args[1]
+    end
+
     case call.method
     when :popen
       # Normally, if we're in a `popen` call, we only are worried about shell
@@ -99,14 +106,17 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
         break if failure
       end
-    when :system, :exec
-      # Normally, if we're in a `system` or `exec` call, we only are worried
-      # about shell injection when there's a single argument, because comma-
-      # separated arguments are always escaped by Ruby. However, an exception is
-      # when the first two arguments are something like "bash -c" because then
-      # the third argument is effectively the command being run and might be
-      # a malicious executable if it comes (partially or fully) from user input.
-      if dash_c_shell_command?(first_arg, call.second_arg)
+    when :system, :exec, :spawn, :capture2, :capture2e, :capture3,
+         :popen2, :popen2e, :popen3
+      # Comma-separated arguments are passed directly to execve without a
+      # shell, so only the first argument (the command name) needs checking.
+      # Exception: `bash -c <script>` — the script is the injection vector.
+      #
+      # All of these methods accept an optional trailing options hash
+      # (e.g. stdin_data:, chdir:); strip it before checking.
+      args.pop if hash?(args.last) && args.length > 2
+
+      if dash_c_shell_command?(first_arg, args[2])
         failure = include_user_input?(args[3]) ||
                   dangerous_interp?(args[3]) ||
                   dangerous_string_building?(args[3])
@@ -115,21 +125,6 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
                   dangerous_interp?(first_arg) ||
                   dangerous_string_building?(first_arg)
       end
-    when :capture2, :capture2e, :capture3
-      # Open3 capture methods can take a :stdin_data argument which is used as the
-      # the input to the called command so it is not succeptable to command injection.
-      # As such if the last argument is a hash (and therefore execution options) it
-      # should be ignored
-
-      args.pop if hash?(args.last) && args.length > 2
-
-      args.each_sexp do |arg|
-        failure = include_user_input?(arg) ||
-          dangerous_interp?(arg) ||
-          dangerous_string_building?(arg)
-
-        break if failure
-      end
     else
       failure = include_user_input?(args) ||
                 dangerous_interp?(args) ||

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "8.0.5"
+  Version = "8.0.6"
 end

data/lib/brakeman.rb

@@ -427,7 +427,7 @@ module Brakeman
     release_date = latest.date.to_date
     latest_version = latest.version.to_s
 
-    if (Date.today - latest.date.to_date) >= days_old
+    if (Date.today - release_date) >= days_old
       if current != latest_version
         return "Brakeman #{current} is not the latest version #{latest_version}"
       else

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-lib
 version: !ruby/object:Gem::Version
-  version: 8.0.5
+  version: 8.0.6
 platform: ruby
 authors:
 - Justin Collins
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -481,6 +482,7 @@ metadata:
   mailing_list_uri: https://gitter.im/presidentbeef/brakeman
   source_code_uri: https://github.com/presidentbeef/brakeman
   wiki_uri: https://github.com/presidentbeef/brakeman/wiki
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -495,7 +497,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 3.4.19
+signing_key:
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.
 test_files: []