brakeman-min 7.1.1 → 7.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd61d8da658d0f4da21e1f854a04c0e9423a91797bd93ec2a754ee6cc113570f
-  data.tar.gz: 2a725267c5b8296686867da71b9c2286c4ed423c12bb43f204dd10697afbe08f
+  metadata.gz: 7795329b27bb6a83f78b1467d74ff72d9241a4707871f03fa9901ca1118c861c
+  data.tar.gz: bcd9483bcd146a04cbe91164947ba4819f8eb828b73270886d15d4bd29521064
 SHA512:
-  metadata.gz: a85e7dfae5e7dad5a99043c1f785c063a9deee56ab797d70a718ef3f6f8031dbe6b9a3307124d83c016443ae34ef15485a3f594282edf8775797a90d64a5384c
-  data.tar.gz: 70fd83ef6e68861ff57a4809098548c729fcbb67e164f541a5da4a523bb2e7a0d9a3e43f730332317e13917c9432a132af5393a8e5f0368d06abb2ea32ff6b52
+  metadata.gz: 4ab8e958b3bbb9d9678a6fc0927a704914db827ce97f097ca3a9154aacaa4931913b11213d1360ff4f5ad3623c8ad80590aa935f37d5d9720e099d300f95b9d9
+  data.tar.gz: 0d62642d8ff249f550b9d8a7187237325e438310b9009894c71f4b92282a49af020d31f377b4c09bca7f291443843832f48ed326c680c870a42c24b854e1956f

data/CHANGES.md

@@ -1,3 +1,11 @@
+# 7.1.2 - 2025-12-25
+
+* Update `ruby_parser` to remove version restriction (Chedli Bourguiba)
+* Raise minimum required Ruby to 3.2.0
+* Use Minitest 6.0
+* Reduce SQL injection false positives from `count` calls
+* Ignore more Haml attribute builder methods
+
 # 7.1.1 - 2025-11-03
 
 * Fix false positive when calling `with_content` on ViewComponents (Peer Allan)

data/README.md

@@ -65,7 +65,7 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 Brakeman should work with any version of Rails from 2.3.x to 8.x.
 
-Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.
+Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.2.0 to run.
 
 # Basic Options
 
@@ -75,7 +75,7 @@ To specify an output file for the results:
 
     brakeman -o output_file
 
-The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `tabs`, `json`, `junit`, `markdown`, `csv`, `codeclimate`, and `sonar`.
+The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `tabs`, `json`, `junit`, `markdown`, `csv`, `codeclimate`, `github` and `sonar`.
 
 Multiple output files can be specified:
 

data/lib/brakeman/checks/check_sql.rb

@@ -188,18 +188,20 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
                       when :find_by_sql, :count_by_sql
                         check_by_sql_arguments call.first_arg
                       when :calculate
-                        if call.arglist.length > 2
+                        if call.num_args > 2
                           unsafe_sql?(call.second_arg) or check_find_arguments(call.third_arg)
-                        elsif call.arglist.length > 1
+                        elsif call.num_args > 1
                           unsafe_sql?(call.second_arg)
                         end
                       when :last, :first, :all
                         check_find_arguments call.first_arg
                       when :average, :count, :maximum, :minimum, :sum
-                        if call.arglist.length > 1
-                          unsafe_sql?(call.first_arg) or check_find_arguments(call.last_arg)
+                        if call.num_args > 1
+                          if version_between?("0.0.0", "4.9.9") # In Rails 5+ these do not accept multiple arguments
+                            check_find_arguments(call.first_arg) or check_find_arguments(call.second_arg)
+                          end
                         else
-                          check_find_arguments call.last_arg
+                          check_find_arguments call.first_arg
                         end
                       when :where, :rewhere, :having, :find_by, :find_by!, :find_or_create_by, :find_or_create_by!, :find_or_initialize_by,:not, :delete_by, :destroy_by
                         check_query_arguments call.arglist

data/lib/brakeman/processors/haml_template_processor.rb

@@ -166,7 +166,16 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
   def haml_attribute_builder? exp
     call? exp and
       exp.target == ATTRIBUTE_BUILDER and
-      (exp.method == :build or exp.method == :build_id)
+      escaped_builder_method? exp
+  end
+
+  def escaped_builder_method? exp
+    case exp.method
+    when :build, :build_aria, :build_boolean, :build_data, :build_id, :escape_html
+      true? exp.first_arg
+    else
+      false
+    end
   end
 
   def fix_textareas? exp

data/lib/brakeman/processors/lib/rails2_config_processor.rb

@@ -51,7 +51,7 @@ class Brakeman::Rails2ConfigProcessor < Brakeman::BasicProcessor
     if exp.target == RAILS_CONFIG
       #Get rid of '=' at end
       attribute = exp.method.to_s[0..-2].to_sym
-      if exp.args.length > 1
+      if exp.num_args > 1
         #Multiple arguments?...not sure if this will ever happen
         @tracker.config.rails[attribute] = exp.args
       else

data/lib/brakeman/processors/lib/rails3_config_processor.rb

@@ -78,7 +78,7 @@ class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
     if exp.target == RAILS_CONFIG
       #Get rid of '=' at end
       attribute = exp.method.to_s[0..-2].to_sym
-      if exp.args.length > 1
+      if exp.num_args > 1
         #Multiple arguments?...not sure if this will ever happen
         @tracker.config.rails[attribute] = exp.args
       else

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "7.1.1"
+  Version = "7.1.2"
 end

data/lib/ruby_parser/bm_sexp.rb

@@ -172,6 +172,20 @@ class Sexp
     self[2] = name
   end
 
+  # Number of arguments in a method call.
+  def num_args
+    expect :call, :attrasgn, :safe_call, :safe_attrasgn, :super, :zsuper
+
+    case self.node_type
+    when :call, :attrasgn, :safe_call, :safe_attrasgn
+      self.length - 3
+    when :super
+      self.length - 1
+    when :zsuper
+      0
+    end
+  end
+
   #Sets the arglist in a method call.
   def arglist= exp
     expect :call, :attrasgn, :safe_call, :safe_attrasgn

metadata

@@ -1,17 +1,31 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-min
 version: !ruby/object:Gem::Version
-  version: 7.1.1
+  version: 7.1.2
 platform: ruby
 authors:
 - Justin Collins
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-11-04 00:00:00.000000000 Z
+date: 2025-12-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
+- !ruby/object:Gem::Dependency
+  name: minitest-ci
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -25,7 +39,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: minitest-ci
+  name: minitest-mock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -72,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.20.2
+        version: 3.22.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.20.2
+        version: 3.22.0
 - !ruby/object:Gem::Dependency
   name: sexp_processor
   requirement: !ruby/object:Gem::Requirement
@@ -345,14 +359,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.27
+rubygems_version: 3.4.1
 signing_key:
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.