brakeman-min 5.4.1 → 6.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a188afc9f3a8b700140582ea3bf9632ef909fde940fb24dd62a71e5d217944c1
-  data.tar.gz: 92d9d4e2a79ad4119866dd24238521052bfb2bd10d2511ac9dbeeec1a3576f4e
+  metadata.gz: 32281be786de7f15331b0a18d3a95ee580824c71ebcaa5793dce46bf9e00eaf5
+  data.tar.gz: 0b86124af3e493a0e30298e59339026f0bee8decd2a3851894b556fcb2e018a3
 SHA512:
-  metadata.gz: 9cf69d5ddc77ffc77096e46a57511847304821e5f655e9c19cc371e7aeeb96f766c2e5956618f942d27dfce68ef31142f3d74b1ef5e0bcb979bcd63929f68030
-  data.tar.gz: c3e1fbf2240fc9bc2a1cb58d724321d36c443bd84dedae296746e1a3e26345ca033d7be199ce7fda0f375e8144cb2b7ecef2a1179e4733f995e714d6c43c029c
+  metadata.gz: 963ea6f98407ab7b887ac6e00a8ab7e6e9388357c7f96bd694e88e80a35e1be337f241fb0bb9708eed5a4f9d418b29c28b37e96fc6a57c9d59b6e032f855ea8a
+  data.tar.gz: 295ba8cd987f5d26fff77fd204f50b54e64126bd5e700ff8d82789b32bbc58c3d4b4b8e8bc0b58841430d67290d0eb452fa302a428c109d9619b6f4b81d4a289

data/CHANGES.md

@@ -1,3 +1,17 @@
+# 6.0.1 - 2023-07-20
+
+* Accept strings for `load_defaults` version
+
+# 6.0.0 - 2023-05-24
+
+* Add obsolete fingerprints to comparison report
+* Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
+* Scan directories that include the word `public`
+* Raise minimum Ruby version to 3.0
+* Drop support for Ruby 1.8/1.9 syntax
+* Fix end-of-life dates for Ruby
+* Fix false positive with `content_tag` in newer Rails
+
 # 5.4.1 - 2023-02-21
 
 * Fix file/line location for EOL software warnings

data/README.md

@@ -66,7 +66,7 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 Brakeman should work with any version of Rails from 2.3.x to 7.x.
 
-Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.5.0 to run.
+Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.
 
 # Basic Options
 
@@ -182,7 +182,7 @@ There is a [plugin available](http://brakemanscanner.org/docs/jenkins/) for Jenk
 
 For even more continuous testing, try the [Guard plugin](https://github.com/guard/guard-brakeman).
 
-There are a couple [Github Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
+There are a couple [GitHub Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
 
 # Building
 

data/lib/brakeman/app_tree.rb

@@ -197,7 +197,6 @@ module Brakeman
       spec/
       test/
       tmp/
-      public/
       log/
     ]
 

data/lib/brakeman/checks/check_content_tag.rb

@@ -73,11 +73,14 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
       check_argument result, content
     end
 
-    #Attribute keys are never escaped, so check them for user input
-    if not @matched and hash? attributes and not request_value? attributes
-      hash_iterate(attributes) do |k, _v|
-        check_argument result, k
-        return if @matched
+    # This changed in Rails 6.1.6
+    if version_between? '0.0.0', '6.1.5' 
+      #Attribute keys are never escaped, so check them for user input
+      if not @matched and hash? attributes and not request_value? attributes
+        hash_iterate(attributes) do |k, _v|
+          check_argument result, k
+          return if @matched
+        end
       end
     end
 

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -21,6 +21,8 @@ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
     ['2.5.0', '2.5.99'] => Date.new(2021, 3, 31),
     ['2.6.0', '2.6.99'] => Date.new(2022, 3, 31),
     ['2.7.0', '2.7.99'] => Date.new(2023, 3, 31),
-    ['3.0.0', '2.8.99'] => Date.new(2024, 3, 31),
+    ['3.0.0', '3.0.99'] => Date.new(2024, 3, 31),
+    ['3.1.0', '3.1.99'] => Date.new(2025, 3, 31),
+    ['3.2.0', '3.2.99'] => Date.new(2026, 3, 31),
   }
 end

data/lib/brakeman/report/report_github.rb

@@ -1,4 +1,4 @@
-# Github Actions Formatter
+# GitHub Actions Formatter
 # Formats warnings as workflow commands to create annotations in GitHub UI
 class Brakeman::Report::Github < Brakeman::Report::Base
   def generate_report

data/lib/brakeman/scanner.rb

@@ -1,6 +1,5 @@
 begin
   Brakeman.load_brakeman_dependency 'ruby_parser'
-  Brakeman.load_brakeman_dependency 'ruby_parser/legacy'
   require 'ruby_parser/bm_sexp.rb'
   require 'ruby_parser/bm_sexp_processor.rb'
   require 'brakeman/processor'

data/lib/brakeman/tracker/config.rb

@@ -20,9 +20,7 @@ module Brakeman
 
     def default_protect_from_forgery?
       if version_between? "5.2.0.beta1", "9.9.9"
-        if @rails.dig(:action_controller, :default_protect_from_forgery) == Sexp.new(:false)
-          return false
-        else
+        if @rails.dig(:action_controller, :default_protect_from_forgery) == Sexp.new(:true)
           return true
         end
       end
@@ -191,13 +189,19 @@ module Brakeman
     # Load defaults based on config.load_defaults value
     # as documented here: https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults
     def load_rails_defaults
-      return unless number? tracker.config.rails[:load_defaults]
+      return unless node_type? tracker.config.rails[:load_defaults], :lit, :str
+
+      version = tracker.config.rails[:load_defaults].value.to_s
+
+      unless version.match? /^\d+\.\d+$/
+        Brakeman.debug "[Notice] Unknown version: #{tracker.config.rails[:load_defaults]}"
+        return
+      end
 
-      version = tracker.config.rails[:load_defaults].value
       true_value = Sexp.new(:true)
       false_value = Sexp.new(:false)
 
-      if version >= 5.0
+      if version >= '5.0'
         set_rails_config(value: true_value, path: [:action_controller, :per_form_csrf_tokens])
         set_rails_config(value: true_value, path: [:action_controller, :forgery_protection_origin_check])
         set_rails_config(value: true_value, path: [:active_record, :belongs_to_required_by_default])
@@ -205,12 +209,12 @@ module Brakeman
         set_rails_config(value: true_value, path: [:ssl_options, :hsts, :subdomains])
       end
 
-      if version >= 5.1
+      if version >= '5.1'
         set_rails_config(value: false_value, path: [:assets, :unknown_asset_fallback])
         set_rails_config(value: true_value, path: [:action_view, :form_with_generates_remote_forms])
       end
 
-      if version >= 5.2
+      if version >= '5.2'
         set_rails_config(value: true_value, path: [:active_record, :cache_versioning])
         set_rails_config(value: true_value, path: [:action_dispatch, :use_authenticated_cookie_encryption])
         set_rails_config(value: true_value, path: [:active_support, :use_authenticated_message_encryption])
@@ -219,7 +223,7 @@ module Brakeman
         set_rails_config(value: true_value, path: [:action_view, :form_with_generates_ids])
       end
 
-      if version >= 6.0
+      if version >= '6.0'
         set_rails_config(value: Sexp.new(:lit, :zeitwerk), path: [:autoloader])
         set_rails_config(value: false_value, path: [:action_view, :default_enforce_utf8])
         set_rails_config(value: true_value, path: [:action_dispatch, :use_cookies_with_metadata])
@@ -232,7 +236,7 @@ module Brakeman
         set_rails_config(value: true_value, path: [:active_record, :collection_cache_versioning])
       end
 
-      if version >= 6.1
+      if version >= '6.1'
         set_rails_config(value: true_value, path: [:action_controller, :urlsafe_csrf_tokens])
         set_rails_config(value: Sexp.new(:lit, :lax), path: [:action_dispatch, :cookies_same_site_protection])
         set_rails_config(value: Sexp.new(:lit, 308), path: [:action_dispatch, :ssl_default_redirect_status])
@@ -244,7 +248,7 @@ module Brakeman
         set_rails_config(value: true_value, path: [:active_storage, :track_variants])
       end
 
-      if version >= 7.0
+      if version >= '7.0'
         video_args =
           Sexp.new(:str, "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2")
         hash_class = s(:colon2, s(:colon2, s(:const, :OpenSSL), :Digest), :SHA256)

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "5.4.1"
+  Version = "6.0.1"
 end

data/lib/brakeman.rb

@@ -493,10 +493,14 @@ module Brakeman
     end
 
     tracker = run(options)
+    new_report = JSON.parse(tracker.report.to_json, symbolize_names: true)
 
-    new_results = JSON.parse(tracker.report.to_json, :symbolize_names => true)[:warnings]
+    new_results = new_report[:warnings]
+    obsolete_ignored = tracker.unused_fingerprints
 
-    Brakeman::Differ.new(new_results, previous_results).diff
+    Brakeman::Differ.new(new_results, previous_results).diff.tap do |diff|
+      diff[:obsolete] = obsolete_ignored
+    end
   end
 
   def self.load_brakeman_dependency name, allow_fail = false

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-min
 version: !ruby/object:Gem::Version
-  version: 5.4.1
+  version: 6.0.1
 platform: ruby
 authors:
 - Justin Collins
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-02-21 00:00:00.000000000 Z
+date: 2023-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -94,20 +94,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.19'
-- !ruby/object:Gem::Dependency
-  name: ruby_parser-legacy
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: sexp_processor
   requirement: !ruby/object:Gem::Requirement