brakeman-min 0.5.2 → 2.1.0

data/lib/brakeman/brakeman.rake

@@ -0,0 +1,10 @@
+namespace :brakeman do
+
+  desc "Run Brakeman"
+  task :run, :output_files do |t, args|
+    require 'brakeman'
+
+    files = args[:output_files].split(' ') if args[:output_files]
+    Brakeman.run :app_path => ".", :output_files => files, :print_report => true
+  end
+end

data/lib/brakeman/call_index.rb

@@ -0,0 +1,215 @@
+require 'set'
+
+#Stores call sites to look up later.
+class Brakeman::CallIndex
+
+  #Initialize index with calls from FindAllCalls
+  def initialize calls
+    @calls_by_method = Hash.new
+    @calls_by_target = Hash.new
+
+    index_calls calls
+  end
+
+  #Find calls matching specified option hash.
+  #
+  #Options:
+  #
+  #  * :target - symbol, array of symbols, or regular expression to match target(s)
+  #  * :method - symbol, array of symbols, or regular expression to match method(s)
+  #  * :chained - boolean, whether or not to match against a whole method chain (false by default)
+  #  * :nested - boolean, whether or not to match against a method call that is a target itself (false by default)
+  def find_calls options
+    target = options[:target] || options[:targets]
+    method = options[:method] || options[:methods]
+    nested = options[:nested]
+
+    if options[:chained]
+      return find_chain options
+    #Find by narrowest category
+    elsif target and method and target.is_a? Array and method.is_a? Array
+      if target.length > method.length
+        calls = filter_by_target calls_by_methods(method), target
+      else
+        calls = calls_by_targets(target)
+        calls = filter_by_method calls, method
+      end
+
+    #Find by target, then by methods, if provided
+    elsif target
+      calls = calls_by_target target
+
+      if calls and method
+        calls = filter_by_method calls, method
+      end
+
+    #Find calls with no explicit target
+    #with either :target => nil or :target => false
+    elsif options.key? :target and not target and method
+      calls = calls_by_method method
+      calls = filter_by_target calls, nil
+
+    #Find calls by method
+    elsif method
+      calls = calls_by_method method
+    else
+      notify "Invalid arguments to CallCache#find_calls: #{options.inspect}"
+    end
+
+    return [] if calls.nil?
+
+    #Remove calls that are actually targets of other calls
+    #Unless those are explicitly desired
+    calls = filter_nested calls unless nested
+
+    calls
+  end
+
+  def remove_template_indexes template_name = nil
+    @calls_by_method.each do |name, calls|
+      calls.delete_if do |call|
+        from_template call, template_name
+      end
+    end
+
+    @calls_by_target.each do |name, calls|
+      calls.delete_if do |call|
+        from_template call, template_name
+      end
+    end
+  end
+
+  def remove_indexes_by_class classes
+    @calls_by_method.each do |name, calls|
+      calls.delete_if do |call|
+        call[:location][:type] == :class and classes.include? call[:location][:class]
+      end
+    end
+
+    @calls_by_target.each do |name, calls|
+      calls.delete_if do |call|
+        call[:location][:type] == :class and classes.include? call[:location][:class]
+      end
+    end
+  end
+
+  def index_calls calls
+    calls.each do |call|
+      @calls_by_method[call[:method]] ||= []
+      @calls_by_method[call[:method]] << call
+
+      unless call[:target].is_a? Sexp
+        @calls_by_target[call[:target]] ||= []
+        @calls_by_target[call[:target]] << call
+      end
+    end
+  end
+
+  private
+
+  def find_chain options
+    target = options[:target] || options[:targets]
+    method = options[:method] || options[:methods]
+
+    calls = calls_by_method method
+    
+    return [] if calls.nil?
+
+    calls = filter_by_chain calls, target
+  end
+
+  def calls_by_target target
+    if target.is_a? Array
+      calls_by_targets target
+    else
+      @calls_by_target[target]
+    end
+  end
+
+  def calls_by_targets targets
+    calls = []
+
+    targets.each do |target|
+      calls.concat @calls_by_target[target] if @calls_by_target.key? target
+    end
+
+    calls
+  end
+
+  def calls_by_method method
+    if method.is_a? Array
+      calls_by_methods method
+    else
+      @calls_by_method[method.to_sym] || []
+    end
+  end
+
+  def calls_by_methods methods
+    methods = methods.map { |m| m.to_sym }
+    calls = []
+
+    methods.each do |method|
+      calls.concat @calls_by_method[method] if @calls_by_method.key? method
+    end
+
+    calls
+  end
+
+  def calls_with_no_target
+    @calls_by_target[nil] || []
+  end
+
+  def filter calls, key, value
+    if value.is_a? Array
+      values = Set.new value
+
+      calls.select do |call|
+        values.include? call[key]
+      end
+    elsif value.is_a? Regexp
+      calls.select do |call|
+        call[key].to_s.match value
+      end
+    else
+      calls.select do |call|
+        call[key] == value
+      end
+    end
+  end
+
+  def filter_by_method calls, method
+    filter calls, :method, method
+  end
+
+  def filter_by_target calls, target
+    filter calls, :target, target
+  end
+
+  def filter_nested calls
+    filter calls, :nested, false
+  end
+
+  def filter_by_chain calls, target
+    if target.is_a? Array
+      targets = Set.new target
+
+      calls.select do |call|
+        targets.include? call[:chain].first
+      end
+    elsif target.is_a? Regexp
+      calls.select do |call|
+        call[:chain].first.to_s.match target
+      end
+    else
+      calls.select do |call|
+        call[:chain].first == target
+      end
+    end
+  end
+
+  def from_template call, template_name
+    return false unless call[:location][:type] == :template
+    return true if template_name.nil?
+    call[:location][:template] == template_name
+  end
+end

data/lib/brakeman/checks.rb

@@ -0,0 +1,180 @@
+require 'thread'
+require 'brakeman/differ'
+
+#Collects up results from running different checks.
+#
+#Checks can be added with +Check.add(check_class)+
+#
+#All .rb files in checks/ will be loaded.
+class Brakeman::Checks
+  @checks = []
+
+  attr_reader :warnings, :controller_warnings, :model_warnings, :template_warnings, :checks_run
+
+  #Add a check. This will call +_klass_.new+ when running tests
+  def self.add klass
+    @checks << klass
+  end
+
+  def self.checks
+    @checks
+  end
+
+  #No need to use this directly.
+  def initialize options = { }
+    if options[:min_confidence]
+      @min_confidence = options[:min_confidence]
+    else
+      @min_confidence = Brakeman.get_defaults[:min_confidence]
+    end
+
+    @warnings = []
+    @template_warnings = []
+    @model_warnings = []
+    @controller_warnings = []
+    @checks_run = []
+  end
+
+  #Add Warning to list of warnings to report.
+  #Warnings are split into four different arrays
+  #for template, controller, model, and generic warnings.
+  #
+  #Will not add warnings which are below the minimum confidence level.
+  def add_warning warning
+    unless warning.confidence > @min_confidence
+      case warning.warning_set
+      when :template
+        @template_warnings << warning
+      when :warning
+        @warnings << warning
+      when :controller
+        @controller_warnings << warning
+      when :model
+        @model_warnings << warning
+      else
+        raise "Unknown warning: #{warning.warning_set}"
+      end
+    end
+  end
+
+  #Return a hash of arrays of new and fixed warnings
+  #
+  #    diff = checks.diff old_checks
+  #    diff[:fixed]  # [...]
+  #    diff[:new]    # [...]
+  def diff other_checks
+    my_warnings = self.all_warnings
+    other_warnings = other_checks.all_warnings
+    Brakeman::Differ.new(my_warnings, other_warnings).diff
+  end
+
+  #Return an array of all warnings found.
+  def all_warnings
+    @warnings + @template_warnings + @controller_warnings + @model_warnings
+  end
+
+  #Run all the checks on the given Tracker.
+  #Returns a new instance of Checks with the results.
+  def self.run_checks(app_tree, tracker)
+    if tracker.options[:parallel_checks]
+      self.run_checks_parallel(app_tree, tracker)
+    else
+      self.run_checks_sequential(app_tree, tracker)
+    end
+  end
+
+  #Run checks sequentially
+  def self.run_checks_sequential(app_tree, tracker)
+    check_runner = self.new :min_confidence => tracker.options[:min_confidence]
+
+    @checks.each do |c|
+      check_name = get_check_name c
+
+      #Run or don't run check based on options
+      unless tracker.options[:skip_checks].include? check_name or
+        (tracker.options[:run_checks] and not tracker.options[:run_checks].include? check_name)
+
+        Brakeman.notify " - #{check_name}"
+
+        check = c.new(app_tree, tracker)
+
+        begin
+          check.run_check
+        rescue Exception => e
+          tracker.error e
+        end
+
+        check.warnings.each do |w|
+          check_runner.add_warning w
+        end
+
+        #Maintain list of which checks were run
+        #mainly for reporting purposes
+        check_runner.checks_run << check_name[5..-1]
+      end
+    end
+
+    check_runner
+  end
+
+  #Run checks in parallel threads
+  def self.run_checks_parallel(app_tree, tracker)
+    threads = []
+    error_mutex = Mutex.new
+
+    check_runner = self.new :min_confidence => tracker.options[:min_confidence]
+
+    @checks.each do |c|
+      check_name = get_check_name c
+
+      #Run or don't run check based on options
+      unless tracker.options[:skip_checks].include? check_name or
+        (tracker.options[:run_checks] and not tracker.options[:run_checks].include? check_name)
+
+        Brakeman.notify " - #{check_name}"
+
+        threads << Thread.new do
+          check = c.new(app_tree, tracker)
+
+          begin
+            check.run_check
+          rescue Exception => e
+            error_mutex.synchronize do
+              tracker.error e
+            end
+          end
+
+          check.warnings
+        end
+
+        #Maintain list of which checks were run
+        #mainly for reporting purposes
+        check_runner.checks_run << check_name[5..-1]
+      end
+    end
+
+    threads.each { |t| t.join }
+
+    Brakeman.notify "Checks finished, collecting results..."
+
+    #Collect results
+    threads.each do |thread|
+      thread.value.each do |warning|
+        check_runner.add_warning warning
+      end
+    end
+
+    check_runner
+  end
+
+  private
+
+  def self.get_check_name check_class
+    check_class.to_s.split("::").last
+  end
+end
+
+#Load all files in checks/ directory
+Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/checks/*.rb").sort.each do |f|
+  require f.match(/(brakeman\/checks\/.*)\.rb$/)[0]
+end

data/lib/brakeman/checks/base_check.rb

@@ -0,0 +1,538 @@
+require 'brakeman/processors/output_processor'
+require 'brakeman/processors/lib/processor_helper'
+require 'brakeman/warning'
+require 'brakeman/util'
+
+#Basis of vulnerability checks.
+class Brakeman::BaseCheck < Brakeman::SexpProcessor
+  include Brakeman::ProcessorHelper
+  include Brakeman::Util
+  attr_reader :tracker, :warnings
+
+  CONFIDENCE = { :high => 0, :med => 1, :low => 2 }
+
+  Match = Struct.new(:type, :match)
+  
+  class << self
+    attr_accessor :name
+  
+    def inherited(subclass)
+      subclass.name = subclass.to_s.match(/^Brakeman::(.*)$/)[1]
+    end
+  end
+
+  #Initialize Check with Checks.
+  def initialize(app_tree, tracker)
+    super()
+    @app_tree = app_tree
+    @results = [] #only to check for duplicates
+    @warnings = []
+    @tracker = tracker
+    @string_interp = false
+    @current_set = nil
+    @current_template = @current_module = @current_class = @current_method = nil
+    @active_record_models = nil
+    @mass_assign_disabled = nil
+    @has_user_input = nil
+    @safe_input_attributes = Set[:to_i, :to_f, :arel_table, :id]
+  end
+
+  #Add result to result list, which is used to check for duplicates
+  def add_result result, location = nil
+    location ||= (@current_template && @current_template[:name]) || @current_class || @current_module || @current_set || result[:location][:class] || result[:location][:template]
+    location = location[:name] if location.is_a? Hash
+    location = location.to_sym
+
+    if result.is_a? Hash
+      line = result[:call].original_line || result[:call].line
+    elsif sexp? result
+      line = result.original_line || result.line
+    else
+      raise ArgumentError
+    end
+
+    @results << [line, location, result]
+  end
+
+  #Default Sexp processing. Iterates over each value in the Sexp
+  #and processes them if they are also Sexps.
+  def process_default exp
+    exp.each_with_index do |e, i|
+      if sexp? e
+        process e
+      else
+        e
+      end
+    end
+
+    exp
+  end
+
+  #Process calls and check if they include user input
+  def process_call exp
+    process exp.target if sexp? exp.target
+    process_call_args exp
+
+    target = exp.target
+
+    unless @safe_input_attributes.include? exp.method
+      if params? target
+        @has_user_input = Match.new(:params, exp)
+      elsif cookies? target
+        @has_user_input = Match.new(:cookies, exp)
+      elsif request_env? target
+        @has_user_input = Match.new(:request, exp)
+      elsif sexp? target and model_name? target[1] #TODO: Can this be target.target?
+        @has_user_input = Match.new(:model, exp)
+      end
+    end
+
+    exp
+  end
+
+  def process_if exp
+    #This is to ignore user input in condition
+    current_user_input = @has_user_input
+    process exp.condition
+    @has_user_input = current_user_input
+
+    process exp.then_clause if sexp? exp.then_clause
+    process exp.else_clause if sexp? exp.else_clause
+
+    exp
+  end
+
+  #Note that params are included in current expression
+  def process_params exp
+    @has_user_input = Match.new(:params, exp)
+    exp
+  end
+
+  #Note that cookies are included in current expression
+  def process_cookies exp
+    @has_user_input = Match.new(:cookies, exp)
+    exp
+  end
+
+  #Does not actually process string interpolation, but notes that it occurred.
+  def process_string_interp exp
+    @string_interp = Match.new(:interp, exp)
+    process_default exp
+  end
+
+  private
+
+  #Report a warning
+  def warn options
+    extra_opts = { :check => self.class.to_s }
+
+    warning = Brakeman::Warning.new(options.merge(extra_opts))
+    warning.file = file_for warning
+    warning.relative_path = relative_path(warning.file)
+
+    @warnings << warning
+  end
+
+  #Run _exp_ through OutputProcessor to get a nice String.
+  def format_output exp
+    Brakeman::OutputProcessor.new.format(exp).gsub(/\r|\n/, "")
+  end
+
+  #Checks if the model inherits from parent,
+  def ancestor? model, parent
+    if model == nil
+      false
+    elsif model[:parent] == parent
+      true
+    elsif model[:parent]
+      ancestor? tracker.models[model[:parent]], parent
+    else
+      false
+    end
+  end
+
+  def unprotected_model? model
+    model[:attr_accessible].nil? and !parent_classes_protected?(model) and ancestor?(model, :"ActiveRecord::Base")
+  end
+
+  # go up the chain of parent classes to see if any have attr_accessible
+  def parent_classes_protected? model
+    if model[:attr_accessible] or model[:includes].include? :"ActiveModel::ForbiddenAttributesProtection"
+      true
+    elsif parent = tracker.models[model[:parent]]
+      parent_classes_protected? parent
+    else
+      false
+    end
+  end
+
+  #Checks if mass assignment is disabled globally in an initializer.
+  def mass_assign_disabled?
+    return @mass_assign_disabled unless @mass_assign_disabled.nil?
+
+    @mass_assign_disabled = false
+
+    if version_between?("3.1.0", "3.9.9") and
+      tracker.config[:rails][:active_record] and
+      tracker.config[:rails][:active_record][:whitelist_attributes] == Sexp.new(:true)
+
+      @mass_assign_disabled = true
+    elsif version_between?("4.0.0", "4.9.9")
+      #May need to revisit dependng on what Rails 4 actually does/has
+      @mass_assign_disabled = true
+    else
+      matches = tracker.check_initializers(:"ActiveRecord::Base", :send)
+
+      if matches.empty?
+        #Check for
+        #  class ActiveRecord::Base
+        #    attr_accessible nil
+        #  end
+        matches = tracker.check_initializers([], :attr_accessible)
+
+        matches.each do |result|
+          if result.module == "ActiveRecord" and result.result_class == :Base
+            arg = result.call.first_arg
+
+            if arg.nil? or node_type? arg, :nil
+              @mass_assign_disabled = true
+              break
+            end
+          end
+        end
+      else
+        #Check for ActiveRecord::Base.send(:attr_accessible, nil)
+        matches.each do |result|
+          call = result.call
+          if call? call
+            if call.first_arg == Sexp.new(:lit, :attr_accessible) and call.second_arg == Sexp.new(:nil)
+              @mass_assign_disabled = true
+              break
+            end
+          end
+        end
+      end
+    end
+
+    #There is a chance someone is using Rails 3.x and the `strong_parameters`
+    #gem and still using hack above, so this is a separate check for
+    #including ActiveModel::ForbiddenAttributesProtection in
+    #ActiveRecord::Base in an initializer.
+    if not @mass_assign_disabled and version_between?("3.1.0", "3.9.9") and tracker.config[:gems][:strong_parameters]
+      matches = tracker.check_initializers([], :include)
+      forbidden_protection = Sexp.new(:colon2, Sexp.new(:const, :ActiveModel), :ForbiddenAttributesProtection)
+
+      matches.each do |result|
+        if call? result.call and result.call.first_arg == forbidden_protection
+          @mass_assign_disabled = true
+        end
+      end
+
+      unless @mass_assign_disabled
+        matches = tracker.check_initializers(:"ActiveRecord::Base", :send)
+
+        matches.each do |result|
+          if call? result.call and result.call.second_arg == forbidden_protection
+            @mass_assign_disabled = true
+          end
+        end
+      end
+    end
+
+    @mass_assign_disabled
+  end
+
+  #This is to avoid reporting duplicates. Checks if the result has been
+  #reported already from the same line number.
+  def duplicate? result, location = nil
+    if result.is_a? Hash
+      line = result[:call].original_line || result[:call].line
+    elsif sexp? result
+      line = result.original_line || result.line
+    else
+      raise ArgumentError
+    end
+
+    location ||= (@current_template && @current_template[:name]) || @current_class || @current_module || @current_set || result[:location][:class] || result[:location][:template]
+
+    location = location[:name] if location.is_a? Hash
+    location = location.to_sym
+
+    @results.each do |r|
+      if r[0] == line and r[1] == location
+        if tracker.options[:combine_locations]
+          return true
+        elsif r[2] == result
+          return true
+        end
+      end
+    end
+
+    false
+  end
+
+  #Checks if an expression contains string interpolation.
+  #
+  #Returns Match with :interp type if found.
+  def include_interp? exp
+    @string_interp = false
+    process exp
+    @string_interp
+  end
+
+  #Checks if _exp_ includes user input in the form of cookies, parameters,
+  #request environment, or model attributes.
+  #
+  #If found, returns a struct containing a type (:cookies, :params, :request, :model) and
+  #the matching expression (Match#type and Match#match).
+  #
+  #Returns false otherwise.
+  def include_user_input? exp
+    @has_user_input = false
+    process exp
+    @has_user_input
+  end
+
+  #This is used to check for user input being used directly.
+  #
+  ##If found, returns a struct containing a type (:cookies, :params, :request) and
+  #the matching expression (Match#type and Match#match).
+  #
+  #Returns false otherwise.
+  def has_immediate_user_input? exp
+    if exp.nil?
+      false
+    elsif call? exp and not @safe_input_attributes.include? exp.method
+      if params? exp
+        return Match.new(:params, exp)
+      elsif cookies? exp
+        return Match.new(:cookies, exp)
+      elsif request_env? exp
+        return Match.new(:request, exp)
+      else
+        has_immediate_user_input? exp.target
+      end
+    elsif sexp? exp
+      case exp.node_type
+      when :string_interp
+        exp.each do |e|
+          if sexp? e
+            match = has_immediate_user_input?(e)
+            return match if match
+          end
+        end
+        false
+      when :string_eval
+        if sexp? exp.value
+          if exp.value.node_type == :rlist
+            exp.value.each_sexp do |e|
+              match = has_immediate_user_input?(e)
+              return match if match
+            end
+            false
+          else
+            has_immediate_user_input? exp.value
+          end
+        end
+      when :format
+        has_immediate_user_input? exp.value
+      when :if
+        (sexp? exp.then_clause and has_immediate_user_input? exp.then_clause) or
+        (sexp? exp.else_clause and has_immediate_user_input? exp.else_clause)
+      when :or
+        has_immediate_user_input? exp.lhs or
+        has_immediate_user_input? exp.rhs
+      else
+        false
+      end
+    end
+  end
+
+  #Checks for a model attribute at the top level of the
+  #expression.
+  def has_immediate_model? exp, out = nil
+    out = exp if out.nil?
+
+    if sexp? exp and exp.node_type == :output
+      exp = exp.value
+    end
+
+    if call? exp
+      target = exp.target
+      method = exp.method
+
+      if @safe_input_attributes.include? method
+        false
+      elsif call? target and not method.to_s[-1,1] == "?"
+        has_immediate_model? target, out
+      elsif model_name? target
+        exp
+      else
+        false
+      end
+    elsif sexp? exp
+      case exp.node_type
+      when :string_interp
+        exp.each do |e|
+          if sexp? e and match = has_immediate_model?(e, out)
+            return match
+          end
+        end
+        false
+      when :string_eval
+        if sexp? exp.value
+          if exp.value.node_type == :rlist
+            exp.value.each_sexp do |e|
+              if match = has_immediate_model?(e, out)
+                return match
+              end
+            end
+            false
+          else
+            has_immediate_model? exp.value, out
+          end
+        end
+      when :format
+        has_immediate_model? exp.value, out
+      when :if
+        ((sexp? exp.then_clause and has_immediate_model? exp.then_clause, out) or
+         (sexp? exp.else_clause and has_immediate_model? exp.else_clause, out))
+      when :or
+        has_immediate_model? exp.lhs or
+        has_immediate_model? exp.rhs
+      else
+        false
+      end
+    end
+  end
+
+  #Checks if +exp+ is a model name.
+  #
+  #Prior to using this method, either @tracker must be set to
+  #the current tracker, or else @models should contain an array of the model
+  #names, which is available via tracker.models.keys
+  def model_name? exp
+    @models ||= @tracker.models.keys
+
+    if exp.is_a? Symbol
+      @models.include? exp
+    elsif sexp? exp
+      klass = nil
+      begin
+        klass = class_name exp
+      rescue StandardError
+      end
+
+      klass and @models.include? klass
+    else
+      false
+    end
+  end
+
+  #Finds entire method call chain where +target+ is a target in the chain
+  def find_chain exp, target
+    return unless sexp? exp
+
+    case exp.node_type
+    when :output, :format
+      find_chain exp.value, target
+    when :call
+      if exp == target or include_target? exp, target
+        return exp
+      end
+    else
+      exp.each do |e|
+        if sexp? e
+          res = find_chain e, target
+          return res if res
+        end
+      end
+      nil
+    end
+  end
+
+  #Returns true if +target+ is in +exp+
+  def include_target? exp, target
+    return false unless call? exp
+
+    exp.each do |e|
+      return true if e == target or include_target? e, target
+    end
+
+    false
+  end
+
+  #Returns true if low_version <= RAILS_VERSION <= high_version
+  #
+  #If the Rails version is unknown, returns false.
+  def version_between? low_version, high_version
+    return false unless tracker.config[:rails_version]
+
+    version = tracker.config[:rails_version].split(".").map! { |n| n.to_i }
+    low_version = low_version.split(".").map! { |n| n.to_i }
+    high_version = high_version.split(".").map! { |n| n.to_i }
+
+    version.each_with_index do |v, i|
+      if v < low_version.fetch(i, 0)
+        return false
+      elsif v > low_version.fetch(i, 0)
+        break
+      end
+    end
+
+    version.each_with_index do |v, i|
+      if v > high_version.fetch(i, 0)
+        return false
+      elsif v < high_version.fetch(i, 0)
+        break
+      end
+    end
+
+    true
+  end
+
+  def gemfile_or_environment
+    if @app_tree.exists?("Gemfile")
+      "Gemfile"
+    else
+      "config/environment.rb"
+    end
+  end
+
+  def self.description
+    @description
+  end
+
+  def active_record_models
+    return @active_record_models if @active_record_models
+
+    @active_record_models = {}
+
+    tracker.models.each do |name, model|
+      if ancestor? model, :"ActiveRecord::Base"
+        @active_record_models[name] = model
+      end
+    end
+
+    @active_record_models
+  end
+
+  def friendly_type_of input_type
+    if input_type.is_a? Match
+      input_type = input_type.type
+    end
+
+    case input_type
+    when :params
+      "parameter value"
+    when :cookies
+      "cookie value"
+    when :request
+      "request value"
+    when :model
+      "model attribute"
+    else
+      "user input"
+    end
+  end
+end