brakeman-min 4.9.0 → 4.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bcf791e0d7b34d749969ab7d9676e424386595f2a38c2c2e5e273e7fba9527b0
-  data.tar.gz: 05bf0234f29252bc3bb3e2070b36bd0e7cd1c56f3ba5ab25ead00c65675cd963
+  metadata.gz: b0fcf3c3ee13f623d43462b52e575c0d89670f9efd97029f024e1dd4428ecdad
+  data.tar.gz: 28ffc613573a1be76a17daa9d47b97fe82c83efb85beeb475543f536f5f16dd9
 SHA512:
-  metadata.gz: c638d4bab3abd103b5c9ed031731c206bd982036911c1fbbd50db454f069cf015967e7099281d16a004de16f9a9fea6af3f51c1cf8747d4ad2672ce62b52c217
-  data.tar.gz: 00de1113a84ec3f64b3ee3a3512805043415551af2db793dfd8dcd330c1e2a94e9c455f97b68003c053c19c6cf9b69b37610cf242f06ce388718b9fd5c283831
+  metadata.gz: 9ae9718ffe7c7d062a0de46bd3bc1505c2c626fbfaede605505cad16ffaf89a8c50bc9e134d27f63d5450ce286c8c4aca67b26c8265dc730a83fa0b423cef6cf
+  data.tar.gz: fe49548d88cc579e7a8c540655bcde6107a51015a812440cb385d024e301932e52155f28ec12efa4078305b34b7e7ff21487c102b54cc17d718b715b37c49b17

data/CHANGES.md

@@ -1,3 +1,10 @@
+# 4.9.1 - 2020-09-04
+
+* Check `chomp`ed strings for SQL injection
+* Use version from `active_record` for non-Rails apps (Ulysse Buonomo)
+* Always set line number for joined arrays
+* Avoid warning about missing `attr_accessible` if `protected_attributes` gem is used
+
 # 4.9.0 - 2020-08-04
 
 * Add check for CVE-2020-8166 (Jamie Finnigan)

data/lib/brakeman/checks/check_model_attributes.rb

@@ -8,7 +8,7 @@ class Brakeman::CheckModelAttributes < Brakeman::BaseCheck
   @description = "Reports models which do not use attr_restricted and warns on models that use attr_protected"
 
   def run_check
-    return if mass_assign_disabled?
+    return if mass_assign_disabled? or tracker.config.has_gem?(:protected_attributes)
 
     #Roll warnings into one warning for all models
     if tracker.options[:collapse_mass_assignment]

data/lib/brakeman/checks/check_sql.rb

@@ -393,7 +393,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     nil
   end
 
-  TO_STRING_METHODS = [:to_s, :squish, :strip, :strip_heredoc]
+  TO_STRING_METHODS = [:chomp, :to_s, :squish, :strip, :strip_heredoc]
 
   #Returns value if interpolated value is not something safe
   def unsafe_string_interp? exp

data/lib/brakeman/processors/lib/call_conversion_helper.rb

@@ -10,7 +10,7 @@ module Brakeman
     def join_arrays lhs, rhs, original_exp = nil
       if array? lhs and array? rhs
         result = Sexp.new(:array)
-        result.line(lhs.line || rhs.line)
+        result.line(lhs.line || rhs.line || 1)
         result.concat lhs[1..-1]
         result.concat rhs[1..-1]
         result

data/lib/brakeman/tracker/config.rb

@@ -79,7 +79,9 @@ module Brakeman
                   # Only used by Rails2ConfigProcessor right now
                   extract_version(version)
                 else
-                  gem_version(:rails) || gem_version(:railties)
+                  gem_version(:rails) ||
+                    gem_version(:railties) ||
+                    gem_version(:activerecord)
                 end
 
       if version

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "4.9.0"
+  Version = "4.9.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-min
 version: !ruby/object:Gem::Version
-  version: 4.9.0
+  version: 4.9.1
 platform: ruby
 authors:
 - Justin Collins
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-08-04 00:00:00.000000000 Z
+date: 2020-09-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest