brakeman-min 0.3.0 → 0.3.1

data/lib/processors/lib/find_call.rb

@@ -31,13 +31,14 @@ require 'processors/base_processor'
 # FindCall.new nil, /^g?sub!?$/
 class FindCall < BaseProcessor
 
-  def initialize targets, methods
+  def initialize targets, methods, in_depth = false
     super(nil)
     @calls = []
     @find_targets = targets
     @find_methods = methods
     @current_class = nil
     @current_method = nil
+    @in_depth = in_depth
   end
 
   #Returns a list of results.
@@ -97,6 +98,17 @@ class FindCall < BaseProcessor
       else
         @calls << Sexp.new(:result, @current_class, @current_method, exp).line(exp.line)
       end
+
+    end
+    
+    #Normally FindCall won't match a method invocation that is the target of
+    #another call, such as:
+    #
+    #  User.find(:first, :conditions => "user = '#{params['user']}').name
+    #
+    #A search for User.find will not match this unless @in_depth is true.
+    if @in_depth and sexp? exp[1] and exp[1][0] == :call
+      process exp[1]
     end
 
     exp

data/lib/processors/lib/find_model_call.rb

@@ -6,7 +6,7 @@ class FindModelCall < FindCall
 
   #Passes +targets+ to FindCall
   def initialize targets
-    super(targets, /^(find.*|first|last|all|count|sum|average|minumum|maximum|count_by_sql)$/)
+    super(targets, /^(find.*|first|last|all|count|sum|average|minumum|maximum|count_by_sql)$/, true)
   end 
 
   #Matches entire method chain as a target. This differs from

data/lib/report.rb

@@ -635,7 +635,9 @@ class Report
       [:model_warnings, "Model"], [:template_warnings, "Template"]].map do |meth, category|
 
       checks.send(meth).map do |w|
-        "#{file_for w}\t#{w.line}\t#{w.warning_type}\t#{category}\t#{w.format_message}\t#{TEXT_CONFIDENCE[w.confidence]}"
+        line = w.line || 0
+        w.warning_type.gsub! /[^\w\s]/, ' '
+        "#{file_for w}\t#{line}\t#{w.warning_type}\t#{category}\t#{w.format_message}\t#{TEXT_CONFIDENCE[w.confidence]}"
       end.join "\n"
 
     end.join "\n"

data/lib/version.rb

@@ -1 +1 @@
-Version = "0.3.0"
+Version = "0.3.1"

metadata

@@ -1,12 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: brakeman-min
 version: !ruby/object:Gem::Version 
-  prerelease: false
+  hash: 17
+  prerelease: 
   segments: 
   - 0
   - 3
-  - 0
-  version: 0.3.0
+  - 1
+  version: 0.3.1
 platform: ruby
 authors: 
 - Justin Collins
@@ -14,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-03-21 00:00:00 -07:00
+date: 2011-05-03 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -25,6 +26,7 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        hash: 7
         segments: 
         - 2
         - 2
@@ -39,6 +41,7 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
+        hash: 23
         segments: 
         - 1
         - 2
@@ -59,51 +62,51 @@ files:
 - WARNING_TYPES
 - FEATURES
 - README.md
-- lib/processors/base_processor.rb
-- lib/processors/alias_processor.rb
-- lib/processors/haml_template_processor.rb
-- lib/processors/output_processor.rb
+- lib/warning.rb
 - lib/processors/params_processor.rb
-- lib/processors/erubis_template_processor.rb
 - lib/processors/controller_alias_processor.rb
-- lib/processors/lib/processor_helper.rb
-- lib/processors/lib/render_helper.rb
-- lib/processors/lib/find_model_call.rb
-- lib/processors/lib/find_call.rb
-- lib/processors/route_processor.rb
-- lib/processors/model_processor.rb
+- lib/processors/base_processor.rb
+- lib/processors/controller_processor.rb
+- lib/processors/library_processor.rb
 - lib/processors/erb_template_processor.rb
+- lib/processors/haml_template_processor.rb
 - lib/processors/template_alias_processor.rb
+- lib/processors/route_processor.rb
+- lib/processors/model_processor.rb
+- lib/processors/lib/find_call.rb
+- lib/processors/lib/processor_helper.rb
+- lib/processors/lib/find_model_call.rb
+- lib/processors/lib/render_helper.rb
+- lib/processors/alias_processor.rb
+- lib/processors/output_processor.rb
 - lib/processors/config_processor.rb
+- lib/processors/erubis_template_processor.rb
 - lib/processors/template_processor.rb
-- lib/processors/controller_processor.rb
-- lib/processors/library_processor.rb
-- lib/report.rb
-- lib/util.rb
 - lib/checks/check_send_file.rb
-- lib/checks/check_default_routes.rb
-- lib/checks/check_render.rb
-- lib/checks/check_execute.rb
-- lib/checks/check_mass_assignment.rb
+- lib/checks/check_session_settings.rb
+- lib/checks/check_nested_attributes.rb
 - lib/checks/check_sql.rb
-- lib/checks/check_mail_to.rb
-- lib/checks/check_validation_regex.rb
+- lib/checks/check_mass_assignment.rb
 - lib/checks/check_cross_site_scripting.rb
-- lib/checks/check_redirect.rb
-- lib/checks/check_session_settings.rb
-- lib/checks/check_forgery_setting.rb
-- lib/checks/base_check.rb
 - lib/checks/check_model_attributes.rb
-- lib/checks/check_nested_attributes.rb
+- lib/checks/check_default_routes.rb
 - lib/checks/check_evaluation.rb
+- lib/checks/check_validation_regex.rb
+- lib/checks/check_execute.rb
+- lib/checks/check_mail_to.rb
+- lib/checks/base_check.rb
 - lib/checks/check_file_access.rb
-- lib/processor.rb
-- lib/scanner.rb
+- lib/checks/check_redirect.rb
+- lib/checks/check_forgery_setting.rb
+- lib/checks/check_render.rb
 - lib/tracker.rb
-- lib/checks.rb
+- lib/util.rb
+- lib/report.rb
 - lib/version.rb
-- lib/warning.rb
+- lib/scanner.rb
+- lib/checks.rb
 - lib/scanner_erubis.rb
+- lib/processor.rb
 - lib/format/style.css
 has_rdoc: true
 homepage: http://github.com/presidentbeef/brakeman
@@ -119,6 +122,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
+      hash: 3
       segments: 
       - 0
       version: "0"
@@ -127,13 +131,14 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
+      hash: 3
       segments: 
       - 0
       version: "0"
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.3.7
+rubygems_version: 1.4.1
 signing_key: 
 specification_version: 3
 summary: Security vulnerability scanner for Ruby on Rails.