brakeman-min 3.3.1 → 3.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0908b7c2b06cb913a06b7857e223ae7845c48036
-  data.tar.gz: 8b162cfe56b7acd0f4717d524c6e7ee1e5b8b516
+  metadata.gz: ba232acd49868e90206c54865a88b17a11d58493
+  data.tar.gz: bf41f3bc7896f7f1bf3fa27da5614a52a9735cf6
 SHA512:
-  metadata.gz: 75ee0836a37948d3f4a8c6e0a639cbe20bd950897440de02375121133ae81f0f708bf92202a85540d068f3c04510a92a95a92155fe6e4bffc851b79cfd44c9fc
-  data.tar.gz: 97275a73c3804586be1c676584a8367403dca3ef043c8a1ec8064925a21cc28089aca9c44af1c51ac0eb8aa1b539a67303dda25862994749659939682e3587cf
+  metadata.gz: a9b3d816527a73dc67b09d5c347da60fde3970f090b34bb93762e3d97efdba568baf897562555847d80145ddbd4bc9502876d97f467e50d1e819f7392cc064c9
+  data.tar.gz: 20003ee819f5b659e31575a9ee92229a239fd874839fc542470d3f526527d44bc571b8ce91e49fb293049eb93ddd1139093473e79abac6486a8b2739f46d53a5

data/CHANGES

@@ -1,3 +1,7 @@
+# 3.3.2
+
+* Fix serious performance regression with global constant tracking
+
 # 3.3.1 
 
 * Delay loading vendored gems and modifying load path

data/lib/brakeman/checks/check_secrets.rb

@@ -13,7 +13,7 @@ class Brakeman::CheckSecrets < Brakeman::BaseCheck
     @warned = Set.new
 
     @tracker.constants.each do |constant|
-      name = constant.name.last
+      name = constant.name_array.last
       value = constant.value
 
       if string? value and not value.value.empty? and looks_like_secret? name

data/lib/brakeman/options.rb

@@ -76,6 +76,7 @@ module Brakeman::Options
         opts.on "--faster", "Faster, but less accurate scan" do
           options[:ignore_ifs] = true
           options[:skip_libs] = true
+          options[:disable_constant_tracking] = true
         end
 
         opts.on "--ignore-model-output", "Consider model attributes XSS-safe" do

data/lib/brakeman/tracker.rb

@@ -186,11 +186,11 @@ class Brakeman::Tracker
   end
 
   def add_constant name, value, context = nil
-    @constants.add name, value, context
+    @constants.add name, value, context unless @options[:disable_constant_tracking]
   end
 
   def constant_lookup name
-    @constants.get_literal name
+    @constants.get_literal name unless @options[:disable_constant_tracking]
   end
 
   def index_call_sites

data/lib/brakeman/tracker/constants.rb

@@ -2,11 +2,11 @@ require 'brakeman/processors/output_processor'
 
 module Brakeman
   class Constant
-    attr_reader :name, :file
+    attr_reader :name, :name_array, :file, :value
 
     def initialize name, value = nil, context = nil 
       set_name name, context
-      @values = [ value ]
+      @value = value
       @context = context
 
       if @context
@@ -15,28 +15,28 @@ module Brakeman
     end
 
     def line
-      if @values.first.is_a? Sexp
-        @values.first.line
+      if @value.is_a? Sexp
+        @value.line
       end
     end
 
     def set_name name, context
-      @name = Constants.constant_as_array(name)
+      @name = name
+      @name_array = Constants.constant_as_array(name)
     end
 
     def match? name
-      @name.reverse.zip(name.reverse).reduce(true) { |m, a| a[1] ? a[0] == a[1] && m : m }
-    end
-
-    def value
-      @values.reverse.reduce do |m, v|
-        Sexp.new(:or, v, m)
-      end
-    end
-
-    def add_value exp
-      unless @values.include? exp
-        @values << exp
+      if name == @name
+        return true
+      elsif name.is_a? Sexp and name.node_type == :const and name.value == @name
+        return true
+      elsif name.is_a? Symbol and name.value == @name
+        return true
+      elsif name.class == Array
+        name == @name_array or
+          @name_array.reverse.zip(name.reverse).reduce(true) { |m, a| a[1] ? a[0] == a[1] && m : m }
+      else
+        false
       end
     end
   end
@@ -45,7 +45,11 @@ module Brakeman
     include Brakeman::Util
 
     def initialize
-      @constants = []
+      @constants = Hash.new { |h, k| h[k] = [] }
+    end
+
+    def size
+      @constants.length
     end
 
     def [] exp
@@ -60,41 +64,98 @@ module Brakeman
     end
 
     def find_constant exp
-      name = Constants.constant_as_array(exp)
-      @constants.find do |c|
-        c.match? name
+      base_name = Constants.get_constant_base_name(exp)
+
+      if @constants.key? base_name
+        @constants[base_name].find do |c|
+          if c.match? exp
+            return c
+          end
+        end
+
+        name_array = Constants.constant_as_array(exp)
+
+        # Avoid losing info about dynamic constant values
+        return unless name_array.all? { |n| constant? n or n.is_a? Symbol }
+
+        @constants[base_name].find do |c|
+          if c.match? name_array
+            return c
+          end
+        end
       end
+
+      nil
     end
 
     def add name, value, context = nil
-      if existing = self.find_constant(name)
-        existing.add_value value
-      else
-        @constants << Constant.new(name, value, context)
+      if call? value and value.method == :freeze
+        value = value.target
       end
+
+      base_name = Constants.get_constant_base_name(name)
+      @constants[base_name] << Constant.new(name, value, context)
+    end
+
+    LITERALS = [:lit, :false, :str, :true, :array, :hash]
+    def literal? exp
+      exp.is_a? Sexp and LITERALS.include? exp.node_type
     end
 
     def get_literal name
-      if x = self[name] and [:lit, :false, :str, :true, :array, :hash].include? x.node_type
+      if x = self[name] and literal? x
         x
       else
         nil
       end
     end
 
-    def each &block
-      @constants.each &block
+    def each
+      @constants.each do |name, values|
+        values.each do |constant|
+          yield constant
+        end
+      end
     end
 
     def self.constant_as_array exp
-      get_constant_name(exp).split('::')
+      res = []
+      while exp
+        if exp.is_a? Sexp
+          case exp.node_type
+          when :const
+            res << exp.value
+            exp = nil
+          when :colon3
+            res << exp.value << :""
+            exp = nil
+          when :colon2
+            res << exp.last
+            exp = exp[1]
+          else
+            res << exp
+            exp = nil
+          end
+        else
+          res << exp
+          exp = nil
+        end
+      end
+
+      res.reverse!
+      res
     end
 
-    def self.get_constant_name exp
-      if exp.is_a? Sexp
-        Brakeman::OutputProcessor.new.format(exp)
+    def self.get_constant_base_name exp
+      return exp unless exp.is_a? Sexp
+
+      case exp.node_type
+      when :const, :colon3
+        exp.value
+      when :colon2
+        exp.last
       else
-        exp.to_s
+        exp
       end
     end
   end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "3.3.1"
+  Version = "3.3.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-min
 version: !ruby/object:Gem::Version
-  version: 3.3.1
+  version: 3.3.2
 platform: ruby
 authors:
 - Justin Collins
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain:
 - brakeman-public_cert.pem
-date: 2016-06-03 00:00:00.000000000 Z
+date: 2016-06-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: test-unit