brakeman 1.9.5 → 2.0.0.pre2

data/lib/tasks/brakeman.rake

@@ -0,0 +1,10 @@
+namespace :brakeman do
+
+  desc "Run Brakeman"
+  task :run, :output_files do |t, args|
+    require 'brakeman'
+
+    files = args[:output_files].split(' ') if args[:output_files]
+    Brakeman.run :app_path => ".", :output_files => files, :print_report => true
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: brakeman
 version: !ruby/object:Gem::Version 
-  version: 1.9.5
+  version: 2.0.0.pre2
 platform: ruby
 authors: 
 - Justin Collins
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2013-04-05 00:00:00 Z
+date: 2013-05-16 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: ruby_parser
@@ -26,9 +26,9 @@ dependencies:
   prerelease: false
   requirement: &id002 !ruby/object:Gem::Requirement 
     requirements: 
-    - - "="
+    - - ~>
       - !ruby/object:Gem::Version 
-        version: 2.0.3
+        version: 2.0.5
   type: :runtime
   version_requirements: *id002
 - !ruby/object:Gem::Dependency 
@@ -58,7 +58,7 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        version: "1.6"
+        version: 1.6.19
   type: :runtime
   version_requirements: *id005
 - !ruby/object:Gem::Dependency 
@@ -177,6 +177,7 @@ files:
 - lib/brakeman/checks/check_symbol_dos.rb
 - lib/brakeman/checks/check_sanitize_methods.rb
 - lib/brakeman/checks/check_file_access.rb
+- lib/brakeman/checks/check_deserialize.rb
 - lib/brakeman/checks/base_check.rb
 - lib/brakeman/checks/check_validation_regex.rb
 - lib/brakeman/checks/check_evaluation.rb
@@ -188,7 +189,6 @@ files:
 - lib/brakeman/checks/check_translate_bug.rb
 - lib/brakeman/checks/check_jruby_xml.rb
 - lib/brakeman/checks/check_default_routes.rb
-- lib/brakeman/checks/check_yaml_load.rb
 - lib/brakeman/checks/check_link_to.rb
 - lib/brakeman/checks/check_quote_table_name.rb
 - lib/brakeman/checks/check_send.rb
@@ -232,6 +232,7 @@ files:
 - lib/ruby_parser/bm_sexp.rb
 - lib/ruby_parser/bm_sexp_processor.rb
 - lib/brakeman.rb
+- lib/tasks/brakeman.rake
 homepage: http://brakemanscanner.org
 licenses: 
 - MIT
@@ -244,13 +245,14 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement 
   requirements: 
-  - &id011 
-    - ">="
+  - - ">="
     - !ruby/object:Gem::Version 
       version: "0"
 required_rubygems_version: !ruby/object:Gem::Requirement 
   requirements: 
-  - *id011
+  - - ">"
+    - !ruby/object:Gem::Version 
+      version: 1.3.1
 requirements: []
 
 rubyforge_project: 

data/lib/brakeman/checks/check_yaml_load.rb

@@ -1,55 +0,0 @@
-require 'brakeman/checks/base_check'
-
-#YAML.load can be used for remote code execution
-class Brakeman::CheckYAMLLoad < Brakeman::BaseCheck
-  Brakeman::Checks.add self
-
-  @description = "Checks for uses of YAML.load"
-
-  def run_check
-    yaml_methods = [:load, :load_documents, :load_stream, :parse_documents, :parse_stream]
-
-    tracker.find_call(:target => :YAML, :methods => yaml_methods ).each do |result|
-      check_yaml_load result
-    end
-  end
-
-  def check_yaml_load result
-    return if duplicate? result
-    add_result result
-
-    arg = result[:call].first_arg
-    method = result[:call].method
-
-    if input = has_immediate_user_input?(arg)
-      confidence = CONFIDENCE[:high]
-    elsif input = include_user_input?(arg)
-      confidence = CONFIDENCE[:med]
-    end
-
-    if confidence
-      input_type = case input.type
-                   when :params
-                     "parameter value"
-                   when :cookies
-                     "cookies value"
-                   when :request
-                     "request value"
-                   when :model
-                     "model attribute"
-                   else
-                     "user input"
-                   end
-
-      message = "YAML.#{method} called with #{input_type}"
-
-      warn :result => result,
-        :warning_type => "Remote Code Execution",
-        :warning_code => :unsafe_deserialize,
-        :message => message,
-        :user_input => input.match,
-        :confidence => confidence,
-        :link_path => "remote_code_execution_yaml_load"
-    end
-  end
-end