brakeman-min 8.0.6 → 8.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aadf11175c5a1a59351d414d8983a065482bd293596f8ae1e27e0fd08ba12e38
-  data.tar.gz: 12d1897319ce9f8b9f7062ba52cda478e7bf3d0708070f7f8a20722a9265e5a3
+  metadata.gz: 5617f56b1375fc31177923381488b7a018322e9508712cbb6fcaef3ebb2c8190
+  data.tar.gz: 90f1ec8f568eebe6ae6a5f058395dbb035dcd6a5cfaf55b62c3542d398fb693e
 SHA512:
-  metadata.gz: bd0e1e83d489c975f98ca1314bb9e4178819227311653797da55ff4d62b650489242abb96a04821e3ebce906a7897d3f68b97140089dfdc3c68fa55df0d77dfb
-  data.tar.gz: '05594cee81a90105fe78c2104dc6a80bb3e8b56cfdfff0861f1d1b66a1fdcb3ddb0fd64662e87c7eaa4d17c0d3282c45f77268f5d2ea527d45c18836ba778cc1'
+  metadata.gz: e129e0b2729108abf747ec6c7b0077d1df3dae70be874e9a037fde99ac582103c42153efd63ba75f0440152af8b7b143eff3ff36682142755edbbd8ad2590741
+  data.tar.gz: 58733048687ad8cbac4e17d34e0c92e5d29955d6e72bfc9b80586d46167f082d26d07318946af366a8297e27b7e67eeac5f1620355e243d34d65e605312baf07

data/CHANGES.md

@@ -1,3 +1,15 @@
+# 8.1.0 - 2026-09-30
+
+* Better help and error message for `--ensure-latest`
+* Fix frozen string error (Shai Coleman)
+* Update Sonar report format (fangxing)
+* Fix frozen `src` string error
+* Recognize `Haml::AttributeBuilder.build_class` as an escaped output (Yuriy Tumanov)
+* Include regex code in validation warnings (Eliot Sykes)
+* Check validation regexes in non-activerecord models (Eliot Sykes)
+* Skip top-level vendor directory before recursive globbing (Conor O'Donnell)
+* Support Rails 7.1+ positional enum syntax in SQL injection check (Michael Vogl/Yuriy Tumanov)
+
 # 8.0.6 - 2026-08-13
 
 * Fix EOL date for Rails 8.0 (yeaseul-kim)

data/lib/brakeman/app_tree.rb

@@ -64,6 +64,8 @@ module Brakeman
       @only_files = init_options[:only_files]
       @additional_libs_path = init_options[:additional_libs_path] || []
       @engine_paths = init_options[:engine_paths] || []
+      @additional_libs_path_pairs = @additional_libs_path.map { |p| [p, expand_path(p)] }
+      @engine_path_pairs = @engine_paths.map { |p| [p, expand_path(p)] }
       @absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
       @relative_engine_paths = @engine_paths - @absolute_engine_paths
       @skip_vendor = init_options[:skip_vendor]
@@ -251,7 +253,10 @@ module Brakeman
       paths.reject do |path|
         relative_path = path.relative
 
-        if @skip_vendor and relative_path.include? 'vendor/' and !in_engine_paths?(path) and !in_add_libs_paths?(path)
+        if @skip_vendor and
+            (relative_path == 'vendor' || relative_path.include?('vendor/')) and
+            !in_engine_paths?(path) and
+            !in_add_libs_paths?(path)
           true
         else
           match_path EXCLUDED_PATHS, path
@@ -260,11 +265,17 @@ module Brakeman
     end
 
     def in_engine_paths?(path)
-      @engine_paths.any? { |p| path.absolute.include?(p) }
+      @engine_path_pairs.any? do |original, expanded|
+        path.absolute.include?(original) ||
+          expanded.start_with?("#{path.absolute}#{File::SEPARATOR}")
+      end
     end
 
     def in_add_libs_paths?(path)
-      @additional_libs_path.any? { |p| path.absolute.include?(p) }
+      @additional_libs_path_pairs.any? do |original, expanded|
+        path.absolute.include?(original) ||
+          expanded.start_with?("#{path.absolute}#{File::SEPARATOR}")
+      end
     end
 
     def match_path files, path

data/lib/brakeman/checks/check_validation_regex.rb

@@ -16,7 +16,7 @@ class Brakeman::CheckValidationRegex < Brakeman::BaseCheck
   FORMAT = Sexp.new(:lit, :format)
 
   def run_check
-    active_record_models.each do |name, model|
+    tracker.models.each do |name, model|
       @current_model = model
       format_validations = model.options[:validates_format_of]
 
@@ -92,7 +92,8 @@ class Brakeman::CheckValidationRegex < Brakeman::BaseCheck
       :message => msg("Insufficient validation for ", msg_code(get_name validator), " using ", msg_code(regex.inspect), ". Use ", msg_code("\\A"), " and ", msg_code("\\z"), " as anchors"),
       :line => value.line,
       :confidence => :high,
-      :cwe_id => [777]
+      :cwe_id => [777],
+      :code => validator
     end
   end
 

data/lib/brakeman/options.rb

@@ -63,9 +63,9 @@ module Brakeman::Options
           options[:exit_on_error] = exit_on_error
         end
 
-        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days." do |days|
+        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days (1-15)." do |days|
           if days and not (1..15).include? days
-            raise OptionParser::InvalidArgument
+            raise OptionParser::InvalidArgument, "Minimum age must be 1-15 days."
           end
 
           options[:ensure_latest] = days || true

data/lib/brakeman/parsers/template_parser.rb

@@ -56,8 +56,15 @@ module Brakeman
         else
           ERB.new(text, nil, '-').src
         end
-        src.sub!(/^#.*\n/, '')
-        src
+
+        # Encoding comment at the beginning throws off line numbers
+        # but the string is frozen in ERB 6.0.2+, so we don't want to
+        # unnecessarily duplicate the string
+        if src.start_with? '#'
+          src.sub(/^#.*\n/, '')
+        else
+          src
+        end
       end
     end
 

data/lib/brakeman/processors/haml_template_processor.rb

@@ -171,7 +171,7 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
 
   def escaped_builder_method? exp
     case exp.method
-    when :build, :build_aria, :build_boolean, :build_data, :build_id, :escape_html
+    when :build, :build_aria, :build_boolean, :build_class, :build_data, :build_id, :escape_html
       true? exp.first_arg
     else
       false

data/lib/brakeman/processors/model_processor.rb

@@ -91,12 +91,25 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
   end
 
   def add_enum_method call
-    arg = call.first_arg
-    return unless hash? arg
-    return unless symbol? arg[1]
+    if call.second_arg.nil?
+      # Rails < 7.1 syntax: enum status: { active: 0, archived: 1 }
+      arg = call.first_arg
+      return unless hash? arg
+      return unless symbol? arg[1]
+
+      enum_name = arg[1].value # first key
+      enums = arg[2] # first value
+    else
+      # Rails >= 7.1 syntax: enum :status, { active: 0, archived: 1 }
+      first_arg = call.first_arg
+      second_arg = call.second_arg
+      return unless symbol? first_arg
+      return unless hash? second_arg or array? second_arg
+
+      enum_name = first_arg.value
+      enums = second_arg
+    end
 
-    enum_name = arg[1].value # first key
-    enums = arg[2] # first value
     enums_name = pluralize(enum_name.to_s).to_sym
 
     call_line = call.line

data/lib/brakeman/report/report_sonar.rb

@@ -1,38 +1,72 @@
 class Brakeman::Report::Sonar < Brakeman::Report::Base
   def generate_report
+    warnings = all_warnings
     report_object = {
-      issues: all_warnings.map { |warning| issue_json(warning) }
+      rules: rules_json(warnings),
+      issues: warnings.map { |warning| issue_json(warning) }
     }
-    return JSON.pretty_generate report_object
+    JSON.pretty_generate report_object
   end
-  
+
   private
-  
+
+  def rules_json(warnings)
+    warnings
+      .each_with_object({}) do |w, unique_warnings|
+        unique_warnings[[w.warning_code, w.confidence]] ||= w
+      end
+      .values
+      .map do |w|
+        {
+          id: rule_id(w),
+          name: w.warning_type.to_s,
+          description: w.link,
+          engineId: "Brakeman",
+          cleanCodeAttribute: "TRUSTWORTHY",
+          type: "VULNERABILITY",
+          severity: rule_severity_for(w.confidence),
+          impacts: [
+            {
+              softwareQuality: "SECURITY",
+              severity: impact_severity_for(w.confidence)
+            }
+          ]
+        }
+      end
+  end
+
   def issue_json(warning)
     {
-      engineId: "Brakeman",
-      ruleId: warning.warning_code,
-      type: "VULNERABILITY",
-      severity: severity_level_for(warning.confidence),
+      ruleId: rule_id(warning),
+      effortMinutes: (4 - warning.confidence) * 15,
       primaryLocation: {
         message: warning.message,
         filePath: warning.file.relative,
         textRange: {
-          "startLine": warning.line || 1,
-          "endLine": warning.line || 1,
+          startLine: warning.line || 1,
+          endLine: warning.line || 1
         }
-      },
-      effortMinutes: (4 - warning.confidence) * 15
+      }
     }
   end
 
-  def severity_level_for(confidence)
-    if confidence == 0
-      "CRITICAL"
-    elsif confidence == 1
-      "MAJOR"
-    else
-      "MINOR"
+  def rule_id(warning)
+    "BRAKEMAN_#{warning.warning_code}_#{rule_severity_for(warning.confidence)}"
+  end
+
+  def rule_severity_for(confidence)
+    case confidence
+    when 0 then "CRITICAL"
+    when 1 then "MAJOR"
+    else "MINOR"
+    end
+  end
+
+  def impact_severity_for(confidence)
+    case confidence
+    when 0 then "HIGH"
+    when 1 then "MEDIUM"
+    else "LOW"
     end
   end
 end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "8.0.6"
+  Version = "8.1.0"
 end

data/lib/brakeman/warning.rb

@@ -175,7 +175,7 @@ class Brakeman::Warning
   def format_with_user_input strip = true, &block
     if self.user_input
       formatted = Brakeman::OutputProcessor.new.format(code, self.user_input, &block)
-      formatted.gsub!(/(\t|\r|\n)+/, " ") if strip
+      formatted = formatted.gsub(/(\t|\r|\n)+/, " ") if strip
       formatted
     else
       format_code
@@ -321,4 +321,3 @@ class Brakeman::Warning
     formatted
   end
 end
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman-min
 version: !ruby/object:Gem::Version
-  version: 8.0.6
+  version: 8.1.0
 platform: ruby
 authors:
 - Justin Collins
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -365,7 +365,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.19
+rubygems_version: 3.5.11
 signing_key:
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.