brakeman-min 0.5.2 → 2.1.0

data/lib/brakeman/processors/lib/route_helper.rb

@@ -0,0 +1,62 @@
+module Brakeman::RouteHelper
+  #Manage Controller prefixes
+  #@prefix is an Array, but this method returns a string
+  #suitable for prefixing onto a controller name.
+  def prefix
+    if @prefix.length > 0
+      @prefix.join("::") << "::"
+    else
+      ''
+    end
+  end
+
+  #Sets the controller name to a proper class name.
+  #For example
+  # self.current_controller = :session
+  # @controller == :SessionController #true
+  #
+  #Also prepends the prefix if there is one set.
+  def current_controller= name
+    @current_controller = (prefix + camelize(name) + "Controller").to_sym
+    @tracker.routes[@current_controller] ||= Set.new
+  end
+
+  #Add route to controller. If a controller is specified,
+  #the current controller will be set to that controller.
+  #If no controller is specified, uses current controller value.
+  def add_route route, controller = nil
+    if node_type? route, :str, :lit
+      route = route.value
+    end
+
+    route = route.to_sym
+
+    if controller
+      self.current_controller = controller
+    end
+
+    routes = @tracker.routes[@current_controller]
+    
+    if routes and routes != :allow_all_actions
+      routes << route
+    end
+  end
+
+  #Add default routes
+  def add_resources_routes
+    existing_routes = @tracker.routes[@current_controller]
+
+    unless existing_routes.is_a? Array and existing_routes.first == :allow_all_actions
+      existing_routes.merge [:index, :new, :create, :show, :edit, :update, :destroy]
+    end
+  end
+
+  #Add default routes minus :index
+  def add_resource_routes
+    existing_routes = @tracker.routes[@current_controller]
+
+    unless existing_routes.is_a? Array and existing_routes.first == :allow_all_actions
+      existing_routes.merge [:new, :create, :show, :edit, :update, :destroy]
+    end
+  end
+end

data/lib/{processors → brakeman/processors}/library_processor.rb

@@ -1,13 +1,13 @@
-require 'processors/base_processor'
-require 'processors/alias_processor'
+require 'brakeman/processors/base_processor'
+require 'brakeman/processors/alias_processor'
 
 #Process generic library and stores it in Tracker.libs
-class LibraryProcessor < BaseProcessor
+class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
   def initialize tracker
     super
     @file_name = nil
-    @alias_processor = AliasProcessor.new
+    @alias_processor = Brakeman::AliasProcessor.new tracker
   end
 
   def process_library src, file_name = nil
@@ -16,7 +16,7 @@ class LibraryProcessor < BaseProcessor
   end
 
   def process_class exp
-    name = class_name(exp[1])
+    name = class_name(exp.class_name)
     
     if @current_class
       outer_class = @current_class
@@ -30,8 +30,15 @@ class LibraryProcessor < BaseProcessor
     if @tracker.libs[name]
       @current_class = @tracker.libs[name]
     else
+      begin
+        parent = class_name exp.parent_name
+      rescue StandardError => e
+        Brakeman.debug e
+        parent = nil
+      end
+
       @current_class = { :name => name,
-                    :parent => class_name(exp[2]),
+                    :parent => parent,
                     :includes => [],
                     :public => {},
                     :private => {},
@@ -42,7 +49,7 @@ class LibraryProcessor < BaseProcessor
       @tracker.libs[name] = @current_class
     end
 
-    exp[3] = process exp[3]
+    exp.body = process_all! exp.body
 
     if outer_class
       @current_class = outer_class
@@ -54,7 +61,7 @@ class LibraryProcessor < BaseProcessor
   end
 
   def process_module exp
-    name = class_name(exp[1])
+    name = class_name(exp.module_name)
 
     if @current_module
       outer_class = @current_module
@@ -79,7 +86,7 @@ class LibraryProcessor < BaseProcessor
       @tracker.libs[name] = @current_module
     end
 
-    exp[2] = process exp[2]
+    exp.body = process_all! exp.body
 
     if outer_class
       @current_module = outer_class
@@ -91,26 +98,26 @@ class LibraryProcessor < BaseProcessor
   end
 
   def process_defn exp
-    exp[0] = :methdef
-    exp[3] = @alias_processor.process_safely process(exp[3]), SexpProcessor::Environment.new
+    exp = @alias_processor.process exp
+    exp.node_type = :methdef
 
     if @current_class
-      @current_class[:public][exp[1]] = exp[3]
+      @current_class[:public][exp.method_name] = exp
     elsif @current_module
-      @current_module[:public][exp[1]] = exp[3]
+      @current_module[:public][exp.method_name] = exp
     end
 
     exp
   end
 
   def process_defs exp
-    exp[0] = :selfdef
-    exp[4] = @alias_processor.process_safely process(exp[4]), SexpProcessor::Environment.new
+    exp = @alias_processor.process exp
+    exp.node_type = :selfdef
 
     if @current_class
-      @current_class[:public][exp[2]] = exp[4]
+      @current_class[:public][exp.method_name] = exp
     elsif @current_module
-      @current_module[:public][exp[3]] = exp[4]
+      @current_module[:public][exp.method_name] = exp
     end
 
     exp

data/lib/{processors → brakeman/processors}/model_processor.rb

@@ -1,7 +1,10 @@
-require 'processors/base_processor'
+require 'brakeman/processors/base_processor'
 
 #Processes models. Puts results in tracker.models
-class ModelProcessor < BaseProcessor
+class Brakeman::ModelProcessor < Brakeman::BaseProcessor
+
+  ASSOCIATIONS = Set[:belongs_to, :has_one, :has_many, :has_and_belongs_to_many]
+
   def initialize tracker
     super 
     @model = nil
@@ -16,24 +19,34 @@ class ModelProcessor < BaseProcessor
     process src
   end
 
-  #s(:class, NAME, PARENT, s(:scope ...))
+  #s(:class, NAME, PARENT, BODY)
   def process_class exp
+    name = class_name exp.class_name
+
     if @model
-      warn "[Notice] Skipping inner class: #{class_name exp[1]}" if OPTIONS[:debug]
+      Brakeman.debug "[Notice] Skipping inner class: #{name}"
       ignore
     else
-      @model = { :name => class_name(exp[1]),
-        :parent => class_name(exp[2]),
+      begin
+        parent = class_name exp.parent_name
+      rescue StandardError => e
+        Brakeman.debug e
+        parent = nil
+      end
+
+      @model = { :name => name,
+        :parent => parent,
         :includes => [],
         :public => {},
         :private => {},
         :protected => {},
         :options => {},
+        :associations => {},
         :file => @file_name }
       @tracker.models[@model[:name]] = @model
-      res = process exp[3]
+      exp.body = process_all! exp.body
       @model = nil
-      res
+      exp
     end
   end
 
@@ -41,45 +54,56 @@ class ModelProcessor < BaseProcessor
   #such as include, attr_accessible, private, etc.
   def process_call exp
     return exp unless @model
-    target = exp[1]
+    target = exp.target
     if sexp? target
       target = process target
     end
 
-    method = exp[2]
-    args = exp[3]
+    method = exp.method
+    first_arg = exp.first_arg
 
     #Methods called inside class definition
     #like attr_* and other settings
     if @current_method.nil? and target.nil?
-      if args.length == 1 #actually, empty
+      if first_arg.nil?
         case method
         when :private, :protected, :public
           @visibility = method
+        when :attr_accessible
+          @model[:attr_accessible] ||= []
         else
           #??
         end
       else
         case method
         when :include
-          @model[:includes] << class_name(args[1]) if @model
+          @model[:includes] << class_name(first_arg) if @model
         when :attr_accessible
           @model[:attr_accessible] ||= []
-          args = args[1..-1].map do |e|
-            e[1]
+          args = []
+
+          exp.each_arg do |e|
+            if node_type? e, :lit
+              args << e.value
+            end
           end
 
           @model[:attr_accessible].concat args
         else
           if @model
-            @model[:options][method] ||= []
-            @model[:options][method] << process(args)
+            if ASSOCIATIONS.include? method
+              @model[:associations][method] ||= []
+              @model[:associations][method].concat exp.args
+            else
+              @model[:options][method] ||= []
+              @model[:options][method] << exp.arglist.line(exp.line)
+            end
           end
         end
       end
       ignore
     else
-      call = Sexp.new :call, target, method, process(args)
+      call = make_call target, method, process_all!(exp.args)
       call.line(exp.line)
       call
     end
@@ -88,10 +112,10 @@ class ModelProcessor < BaseProcessor
   #Add method definition to tracker
   def process_defn exp
     return exp unless @model
-    name = exp[1]
+    name = exp.method_name
 
     @current_method = name
-    res = Sexp.new :methdef, name, process(exp[2]), process(exp[3][1])
+    res = Sexp.new :methdef, name, exp.formal_args, *process_all!(exp.body)
     res.line(exp.line)
     @current_method = nil
     if @model
@@ -104,7 +128,7 @@ class ModelProcessor < BaseProcessor
   #Add method definition to tracker
   def process_defs exp
     return exp unless @model
-    name = exp[2]
+    name = exp.method_name
 
     if exp[1].node_type == :self
       target = @model[:name]
@@ -113,7 +137,7 @@ class ModelProcessor < BaseProcessor
     end
 
     @current_method = name
-    res = Sexp.new :selfdef, target, name, process(exp[3]), process(exp[4][1])
+    res = Sexp.new :selfdef, target, name, exp.formal_args, *process_all!(exp.body)
     res.line(exp.line)
     @current_method = nil
     if @model

data/lib/{processors → brakeman/processors}/output_processor.rb

@@ -1,17 +1,16 @@
-require 'rubygems'
 require 'ruby2ruby'
-require 'util'
+require 'brakeman/util'
 
 #Produces formatted output strings from Sexps.
 #Recommended usage is
 #
 #  OutputProcessor.new.format(Sexp.new(:str, "hello"))
-class OutputProcessor < Ruby2Ruby
-  include Util
+class Brakeman::OutputProcessor < Ruby2Ruby
+  include Brakeman::Util
 
   #Copies +exp+ and then formats it.
   def format exp
-    process exp.deep_clone
+    process(exp.deep_clone) || "[Format Error]"
   end
 
   alias process_safely format
@@ -20,37 +19,7 @@ class OutputProcessor < Ruby2Ruby
     begin
       super exp if sexp? exp and not exp.empty?
     rescue Exception => e
-      warn "While formatting #{exp}: #{e}\n#{e.backtrace.join("\n")}" if OPTIONS[:debug]
-    end
-  end
-
-  def process_call exp
-    if exp[0].is_a? Symbol
-      target = exp[0]
-
-      method = exp[1]
-
-      args = process exp[2]
-
-      out = nil
-
-      if method == :[]
-        if target
-          out = "#{target}[#{args}]"
-        else
-          raise Exception.new("Not sure what to do with access and no target: #{exp}")
-        end
-      else
-        if target
-          out = "#{target}.#{method}(#{args})"
-        else
-          out = "#{method}(#{args})"
-        end
-      end
-      exp.clear
-      out
-    else
-      super exp
+      Brakeman.debug "While formatting #{exp}: #{e}\n#{e.backtrace.join("\n")}"
     end
   end
 
@@ -129,9 +98,32 @@ class OutputProcessor < Ruby2Ruby
     out
   end
 
+  def process_defn exp
+    # Copied from Ruby2Ruby except without the whole
+    # "convert methods to attr_*" stuff
+    name = exp.shift
+    args = process exp.shift
+    args = "" if args == "()"
+
+    exp.shift if exp == s(s(:nil)) # empty it out of a default nil expression
+
+    body = []
+    until exp.empty? do
+      body << indent(process(exp.shift))
+    end
+
+    body << indent("# do nothing") if body.empty?
+
+    body = body.join("\n")
+
+    return "def #{name}#{args}\n#{body}\nend".gsub(/\n\s*\n+/, "\n")
+  end
+
+  alias process_methdef process_defn
+
   def process_call_with_block exp
     call = process exp[0]
-    block = process exp[1] if exp[1]
+    block = process_rlist exp[2..-1]
     out = "#{call} do\n #{block}\n end"
     exp.clear
     out
@@ -153,7 +145,7 @@ class OutputProcessor < Ruby2Ruby
     out
   end
 
-def process_escaped_output exp
+  def process_escaped_output exp
     out = if exp[0].node_type == :str
             ""
           else
@@ -203,11 +195,13 @@ def process_escaped_output exp
   end
 
   def process_const exp
-    if exp[0] == Tracker::UNKNOWN_MODEL
+    if exp[0] == Brakeman::Tracker::UNKNOWN_MODEL
       exp.clear
       "(Unresolved Model)"
     else
-      super exp
+      out = exp[0].to_s
+      exp.clear
+      out
     end
   end
 

data/lib/brakeman/processors/route_processor.rb

@@ -0,0 +1,17 @@
+require 'brakeman/processors/base_processor'
+require 'brakeman/processors/alias_processor'
+require 'brakeman/processors/lib/route_helper'
+require 'brakeman/util'
+require 'brakeman/processors/lib/rails3_route_processor.rb'
+require 'brakeman/processors/lib/rails2_route_processor.rb'
+require 'set'
+
+class Brakeman::RoutesProcessor
+  def self.new tracker
+    if tracker.options[:rails3]
+      Brakeman::Rails3RoutesProcessor.new tracker
+    else
+      Brakeman::Rails2RoutesProcessor.new tracker
+    end
+  end
+end