brakeman-min 5.1.2 → 5.2.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGES.md +9 -0
- data/lib/brakeman/checks/base_check.rb +10 -0
- data/lib/brakeman/checks/check_eol_rails.rb +23 -0
- data/lib/brakeman/checks/check_eol_ruby.rb +26 -0
- data/lib/brakeman/checks/check_sql.rb +3 -2
- data/lib/brakeman/checks/check_symbol_dos.rb +1 -1
- data/lib/brakeman/checks/eol_check.rb +47 -0
- data/lib/brakeman/options.rb +8 -0
- data/lib/brakeman/processors/gem_processor.rb +3 -0
- data/lib/brakeman/processors/lib/rails3_route_processor.rb +2 -0
- data/lib/brakeman/scanner.rb +3 -1
- data/lib/brakeman/tracker/config.rb +8 -1
- data/lib/brakeman/version.rb +1 -1
- data/lib/brakeman/warning_codes.rb +2 -0
- metadata +6 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b708929db28ae69c833a5331dfd011c80c44f05c4d51a318155db512ab801ce7
|
4
|
+
data.tar.gz: c82a48fcb60d2861f77494b87d050d55f22a920239792559caea17901889c3e3
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ad85c83dff7c264926a44fe9c5fef8c434ccc31d1243ca55d709fe3a76fcbf7380022b741bace3c59bb58f8c74c48f50235b4882312d5fbbcd20755e84114895
|
7
|
+
data.tar.gz: 74c726d0431181bcca3cdf75dd0068027f053d62b397a1d85e5b4680ad7c3269419f217670cc6b78139afd0c765351e734118e35a9b9f255f8a6cefe76c0a234
|
data/CHANGES.md
CHANGED
@@ -1,3 +1,12 @@
|
|
1
|
+
# 5.2.0 - 2021-12-15
|
2
|
+
|
3
|
+
* Initial Rails 7 support
|
4
|
+
* Require Ruby 2.5.0+
|
5
|
+
* Fix issue with calls to `foo.root` in routes
|
6
|
+
* Ignore `I18n.locale` in SQL queries
|
7
|
+
* Do not treat `sanitize_sql_like` as safe
|
8
|
+
* Add new checks for unsupported Ruby and Rails versions
|
9
|
+
|
1
10
|
# 5.1.2 - 2021-10-28
|
2
11
|
|
3
12
|
* Handle cases where enums are not symbols
|
@@ -513,4 +513,14 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
|
|
513
513
|
string_building? exp.target or
|
514
514
|
string_building? exp.first_arg
|
515
515
|
end
|
516
|
+
|
517
|
+
I18N_CLASS = s(:const, :I18n)
|
518
|
+
|
519
|
+
def locale_call? exp
|
520
|
+
return unless call? exp
|
521
|
+
|
522
|
+
(exp.target == I18N_CLASS and
|
523
|
+
exp.method == :locale) or
|
524
|
+
locale_call? exp.target
|
525
|
+
end
|
516
526
|
end
|
@@ -0,0 +1,23 @@
|
|
1
|
+
require_relative 'eol_check'
|
2
|
+
|
3
|
+
class Brakeman::CheckEOLRails < Brakeman::EOLCheck
|
4
|
+
Brakeman::Checks.add self
|
5
|
+
|
6
|
+
@description = "Checks for unsupported versions of Rails"
|
7
|
+
|
8
|
+
def run_check
|
9
|
+
return unless tracker.config.rails_version
|
10
|
+
|
11
|
+
check_eol_version :rails, RAILS_EOL_DATES
|
12
|
+
end
|
13
|
+
|
14
|
+
RAILS_EOL_DATES = {
|
15
|
+
['2.0.0', '2.3.99'] => Date.new(2013, 6, 25),
|
16
|
+
['3.0.0', '3.2.99'] => Date.new(2016, 6, 30),
|
17
|
+
['4.0.0', '4.2.99'] => Date.new(2017, 4, 27),
|
18
|
+
['5.0.0', '5.0.99'] => Date.new(2018, 5, 9),
|
19
|
+
['5.1.0', '5.1.99'] => Date.new(2019, 8, 25),
|
20
|
+
['5.2.0', '5.2.99'] => Date.new(2022, 6, 1),
|
21
|
+
['6.0.0', '6.0.99'] => Date.new(2023, 6, 1),
|
22
|
+
}
|
23
|
+
end
|
@@ -0,0 +1,26 @@
|
|
1
|
+
require_relative 'eol_check'
|
2
|
+
|
3
|
+
class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
|
4
|
+
Brakeman::Checks.add self
|
5
|
+
|
6
|
+
@description = "Checks for unsupported versions of Ruby"
|
7
|
+
|
8
|
+
def run_check
|
9
|
+
return unless tracker.config.ruby_version
|
10
|
+
|
11
|
+
check_eol_version :ruby, RUBY_EOL_DATES
|
12
|
+
end
|
13
|
+
|
14
|
+
RUBY_EOL_DATES = {
|
15
|
+
['0.0.0', '1.9.3'] => Date.new(2015, 2, 23),
|
16
|
+
['2.0.0', '2.0.99'] => Date.new(2016, 2, 24),
|
17
|
+
['2.1.0', '2.1.99'] => Date.new(2017, 3, 31),
|
18
|
+
['2.2.0', '2.2.99'] => Date.new(2018, 3, 31),
|
19
|
+
['2.3.0', '2.3.99'] => Date.new(2019, 3, 31),
|
20
|
+
['2.4.0', '2.4.99'] => Date.new(2020, 3, 31),
|
21
|
+
['2.5.0', '2.5.99'] => Date.new(2021, 3, 31),
|
22
|
+
['2.6.0', '2.6.99'] => Date.new(2022, 3, 31),
|
23
|
+
['2.7.0', '2.7.99'] => Date.new(2023, 3, 31),
|
24
|
+
['3.0.0', '2.8.99'] => Date.new(2024, 3, 31),
|
25
|
+
}
|
26
|
+
end
|
@@ -584,7 +584,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
|
|
584
584
|
end
|
585
585
|
|
586
586
|
IGNORE_METHODS_IN_SQL = Set[:id, :merge_conditions, :table_name, :quoted_table_name,
|
587
|
-
:quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array,
|
587
|
+
:quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array,
|
588
588
|
:sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
|
589
589
|
:sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
|
590
590
|
:to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
|
@@ -628,7 +628,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
|
|
628
628
|
arel? exp or
|
629
629
|
exp.method.to_s.end_with? "_id" or
|
630
630
|
number_target? exp or
|
631
|
-
date_target? exp
|
631
|
+
date_target? exp or
|
632
|
+
locale_call? exp
|
632
633
|
end
|
633
634
|
|
634
635
|
QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
|
@@ -9,7 +9,7 @@ class Brakeman::CheckSymbolDoS < Brakeman::BaseCheck
|
|
9
9
|
|
10
10
|
def run_check
|
11
11
|
return if rails_version and rails_version >= "5.0.0"
|
12
|
-
return if tracker.config.ruby_version >= "2.2"
|
12
|
+
return if tracker.config.ruby_version and tracker.config.ruby_version >= "2.2"
|
13
13
|
|
14
14
|
tracker.find_call(:methods => UNSAFE_METHODS, :nested => true).each do |result|
|
15
15
|
check_unsafe_symbol_creation(result)
|
@@ -0,0 +1,47 @@
|
|
1
|
+
require 'date'
|
2
|
+
require 'brakeman/checks/base_check'
|
3
|
+
|
4
|
+
# Not used directly - base check for EOLRails and EOLRuby
|
5
|
+
class Brakeman::EOLCheck < Brakeman::BaseCheck
|
6
|
+
def check_eol_version library, eol_dates
|
7
|
+
version = case library
|
8
|
+
when :rails
|
9
|
+
tracker.config.rails_version
|
10
|
+
when :ruby
|
11
|
+
tracker.config.ruby_version
|
12
|
+
else
|
13
|
+
raise 'Implement using tracker.config.gem_version'
|
14
|
+
end
|
15
|
+
|
16
|
+
eol_dates.each do |(start_version, end_version), eol_date|
|
17
|
+
if version_between? start_version, end_version, version
|
18
|
+
case
|
19
|
+
when Date.today >= eol_date
|
20
|
+
warn_about_unsupported_version library, eol_date, version
|
21
|
+
when (Date.today + 30) >= eol_date
|
22
|
+
warn_about_soon_unsupported_version library, eol_date, version, :medium
|
23
|
+
when (Date.today + 60) >= eol_date
|
24
|
+
warn_about_soon_unsupported_version library, eol_date, version, :low
|
25
|
+
end
|
26
|
+
|
27
|
+
break
|
28
|
+
end
|
29
|
+
end
|
30
|
+
end
|
31
|
+
|
32
|
+
def warn_about_soon_unsupported_version library, eol_date, version, confidence
|
33
|
+
warn warning_type: 'Unmaintained Dependency',
|
34
|
+
warning_code: :"pending_eol_#{library}",
|
35
|
+
message: msg("Support for ", msg_version(version, library.capitalize), " ends on #{eol_date}"),
|
36
|
+
confidence: confidence,
|
37
|
+
gem_info: gemfile_or_environment
|
38
|
+
end
|
39
|
+
|
40
|
+
def warn_about_unsupported_version library, eol_date, version
|
41
|
+
warn warning_type: 'Unmaintained Dependency',
|
42
|
+
warning_code: :"eol_#{library}",
|
43
|
+
message: msg("Support for ", msg_version(version, library.capitalize), " ended on #{eol_date}"),
|
44
|
+
confidence: :high,
|
45
|
+
gem_info: gemfile_or_environment
|
46
|
+
end
|
47
|
+
end
|
data/lib/brakeman/options.rb
CHANGED
@@ -93,6 +93,14 @@ module Brakeman::Options
|
|
93
93
|
options[:rails6] = true
|
94
94
|
end
|
95
95
|
|
96
|
+
opts.on "-7", "--rails7", "Force Rails 7 mode" do
|
97
|
+
options[:rails3] = true
|
98
|
+
options[:rails4] = true
|
99
|
+
options[:rails5] = true
|
100
|
+
options[:rails6] = true
|
101
|
+
options[:rails7] = true
|
102
|
+
end
|
103
|
+
|
96
104
|
opts.separator ""
|
97
105
|
opts.separator "Scanning options:"
|
98
106
|
|
@@ -6,6 +6,7 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
|
|
6
6
|
def initialize *args
|
7
7
|
super
|
8
8
|
@gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
|
9
|
+
@ruby_version = /^\s+ruby (\d\.\d.\d+)/
|
9
10
|
end
|
10
11
|
|
11
12
|
def process_gems gem_files
|
@@ -95,6 +96,8 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
|
|
95
96
|
def set_gem_version_and_file line, file, line_num
|
96
97
|
if line =~ @gem_name_version
|
97
98
|
@tracker.config.add_gem $1, $2, file, line_num
|
99
|
+
elsif line =~ @ruby_version
|
100
|
+
@tracker.config.set_ruby_version $1
|
98
101
|
end
|
99
102
|
end
|
100
103
|
end
|
@@ -78,6 +78,8 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BasicProcessor
|
|
78
78
|
|
79
79
|
#TODO: Need test for this
|
80
80
|
def process_root exp
|
81
|
+
return exp unless hash? exp.first_arg
|
82
|
+
|
81
83
|
if value = hash_access(exp.first_arg, :to)
|
82
84
|
if string? value
|
83
85
|
add_route_from_string value
|
data/lib/brakeman/scanner.rb
CHANGED
@@ -137,7 +137,9 @@ class Brakeman::Scanner
|
|
137
137
|
end
|
138
138
|
|
139
139
|
if @app_tree.exists? ".ruby-version"
|
140
|
-
|
140
|
+
if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/]
|
141
|
+
tracker.config.set_ruby_version version
|
142
|
+
end
|
141
143
|
end
|
142
144
|
|
143
145
|
tracker.config.load_rails_defaults
|
@@ -14,7 +14,7 @@ module Brakeman
|
|
14
14
|
@settings = {}
|
15
15
|
@escape_html = nil
|
16
16
|
@erubis = nil
|
17
|
-
@ruby_version =
|
17
|
+
@ruby_version = nil
|
18
18
|
@rails_version = nil
|
19
19
|
end
|
20
20
|
|
@@ -106,6 +106,13 @@ module Brakeman
|
|
106
106
|
tracker.options[:rails5] = true
|
107
107
|
tracker.options[:rails6] = true
|
108
108
|
Brakeman.notify "[Notice] Detected Rails 6 application"
|
109
|
+
elsif @rails_version.start_with? "7"
|
110
|
+
tracker.options[:rails3] = true
|
111
|
+
tracker.options[:rails4] = true
|
112
|
+
tracker.options[:rails5] = true
|
113
|
+
tracker.options[:rails6] = true
|
114
|
+
tracker.options[:rails7] = true
|
115
|
+
Brakeman.notify "[Notice] Detected Rails 7 application"
|
109
116
|
end
|
110
117
|
end
|
111
118
|
end
|
data/lib/brakeman/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: brakeman-min
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 5.
|
4
|
+
version: 5.2.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Justin Collins
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2021-
|
11
|
+
date: 2021-12-16 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: minitest
|
@@ -181,6 +181,8 @@ files:
|
|
181
181
|
- lib/brakeman/checks/check_digest_dos.rb
|
182
182
|
- lib/brakeman/checks/check_divide_by_zero.rb
|
183
183
|
- lib/brakeman/checks/check_dynamic_finders.rb
|
184
|
+
- lib/brakeman/checks/check_eol_rails.rb
|
185
|
+
- lib/brakeman/checks/check_eol_ruby.rb
|
184
186
|
- lib/brakeman/checks/check_escape_function.rb
|
185
187
|
- lib/brakeman/checks/check_evaluation.rb
|
186
188
|
- lib/brakeman/checks/check_execute.rb
|
@@ -247,6 +249,7 @@ files:
|
|
247
249
|
- lib/brakeman/checks/check_without_protection.rb
|
248
250
|
- lib/brakeman/checks/check_xml_dos.rb
|
249
251
|
- lib/brakeman/checks/check_yaml_parsing.rb
|
252
|
+
- lib/brakeman/checks/eol_check.rb
|
250
253
|
- lib/brakeman/codeclimate/engine_configuration.rb
|
251
254
|
- lib/brakeman/commandline.rb
|
252
255
|
- lib/brakeman/differ.rb
|
@@ -362,7 +365,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
362
365
|
requirements:
|
363
366
|
- - ">="
|
364
367
|
- !ruby/object:Gem::Version
|
365
|
-
version: 2.
|
368
|
+
version: 2.5.0
|
366
369
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
367
370
|
requirements:
|
368
371
|
- - ">="
|