brakeman 2.5.0 → 2.6.0

data/lib/brakeman/processors/lib/rails3_route_processor.rb

@@ -89,18 +89,17 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BaseProcessor
     second_arg = exp.second_arg
     last_arg = exp.last_arg
 
-    #Check if there is an unrestricted action parameter
-    action_variable = false
-
     if string? first_arg
-      matcher = first_arg.value
 
+      matcher = first_arg.value
       if matcher == ':controller(/:action(/:id(.:format)))' or
-        matcher.include? ':controller' and matcher.include? ':action' #Default routes
+        matcher.include? ':controller' and action_route?(matcher)  #Default routes
         @tracker.routes[:allow_all_actions] = first_arg
         return exp
-      elsif matcher.include? ':action'
-        action_variable = true
+      elsif action_route?(first_arg)
+          if hash? second_arg and controller_name = hash_access(second_arg, :controller)
+            loose_action(controller_name, "matched") #TODO: Parse verbs
+          end
       elsif second_arg.nil? and in_controller_block? and not matcher.include? ":"
         add_route matcher
       end
@@ -123,7 +122,6 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BaseProcessor
             add_route v
           end
 
-          action_variable = false
          when :to
            if string? v
              add_route_from_string v[1]
@@ -135,10 +133,6 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BaseProcessor
       end
     end
 
-    if action_variable
-      @tracker.routes[@current_controller] = :allow_all_actions
-    end
-
     @current_controller = nil unless in_controller_block?
     exp
   end
@@ -169,9 +163,17 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BaseProcessor
           elsif in_controller_block? and symbol? v
             add_route v
           end
+        elsif action_route?(first_arg)
+          if hash? second_arg and controller_name = hash_access(second_arg, :controller)
+            loose_action(controller_name, exp.method)
+          end
         end
       end
     elsif string? first_arg
+      if first_arg.value.include? ':controller' and action_route?(first_arg) #Default routes
+        @tracker.routes[:allow_all_actions] = first_arg
+      end
+
       route = first_arg.value.split "/"
       if route.length != 2
         add_route route[0]
@@ -287,4 +289,17 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BaseProcessor
     yield
     @controller_block = prev_block
   end
+
+  def action_route? arg
+    if string? arg
+      arg = arg.value
+    end
+
+    arg.is_a? String and (arg.include? ":action" or arg.include? "*action")
+  end
+
+  def loose_action controller_name, verb = "any"
+    self.current_controller = controller_name.value
+    @tracker.routes[@current_controller] = [:allow_all_actions, {:allow_verb => verb}]
+  end
 end

data/lib/brakeman/processors/lib/route_helper.rb

@@ -39,7 +39,7 @@ module Brakeman::RouteHelper
 
     routes = @tracker.routes[@current_controller]
     
-    if routes and routes != :allow_all_actions
+    if routes and not routes.include? :allow_all_actions
       routes << route
     end
   end

data/lib/brakeman/processors/library_processor.rb

@@ -8,6 +8,8 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
     super
     @file_name = nil
     @alias_processor = Brakeman::AliasProcessor.new tracker
+    @current_module = nil
+    @current_class = nil
   end
 
   def process_library src, file_name = nil
@@ -17,7 +19,8 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
   def process_class exp
     name = class_name(exp.class_name)
-    
+    parent = class_name exp.parent_name
+
     if @current_class
       outer_class = @current_class
       name = (outer_class[:name].to_s + "::" + name.to_s).to_sym
@@ -29,18 +32,20 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
     if @tracker.libs[name]
       @current_class = @tracker.libs[name]
+      @current_class[:files] << @file_name unless @current_class[:files].include? @file_name
+      @current_class[:src][@file_name] = exp
     else
-      parent = class_name exp.parent_name
-
-      @current_class = { :name => name,
-                    :parent => parent,
-                    :includes => [],
-                    :public => {},
-                    :private => {},
-                    :protected => {},
-                    :src => exp,
-                    :file => @file_name }
-    
+      @current_class = {
+        :name => name,
+        :parent => parent,
+        :includes => [],
+        :public => {},
+        :private => {},
+        :protected => {},
+        :src => { @file_name => exp },
+        :files => [ @file_name ]
+      }
+
       @tracker.libs[name] = @current_class
     end
 
@@ -59,8 +64,8 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
     name = class_name(exp.module_name)
 
     if @current_module
-      outer_class = @current_module
-      name = (outer_class[:name].to_s + "::" + name.to_s).to_sym
+      outer_module = @current_module
+      name = (outer_module[:name].to_s + "::" + name.to_s).to_sym
     end
 
     if @current_class
@@ -69,22 +74,26 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
     if @tracker.libs[name]
       @current_module = @tracker.libs[name]
+      @current_module[:files] << @file_name unless @current_module[:files].include? @file_name
+      @current_module[:src][@file_name] = exp
     else
-      @current_module = { :name => name,
-                    :includes => [],
-                    :public => {},
-                    :private => {},
-                    :protected => {},
-                    :src => exp,
-                    :file => @file_name }
-    
+      @current_module = {
+        :name => name,
+        :includes => [],
+        :public => {},
+        :private => {},
+        :protected => {},
+        :src => { @file_name => exp },
+        :files => [ @file_name ]
+      }
+
       @tracker.libs[name] = @current_module
     end
 
     exp.body = process_all! exp.body
 
-    if outer_class
-      @current_module = outer_class
+    if outer_module
+      @current_module = outer_module
     else
       @current_module = nil
     end
@@ -97,9 +106,9 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
     exp.node_type = :methdef
 
     if @current_class
-      @current_class[:public][exp.method_name] = exp
+      @current_class[:public][exp.method_name] = { :src => exp, :file => @file_name }
     elsif @current_module
-      @current_module[:public][exp.method_name] = exp
+      @current_module[:public][exp.method_name] = { :src => exp, :file => @file_name }
     end
 
     exp
@@ -110,9 +119,9 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
     exp.node_type = :selfdef
 
     if @current_class
-      @current_class[:public][exp.method_name] = exp
+      @current_class[:public][exp.method_name] = { :src => exp, :file => @file_name }
     elsif @current_module
-      @current_module[:public][exp.method_name] = exp
+      @current_module[:public][exp.method_name] = { :src => exp, :file => @file_name }
     end
 
     exp

data/lib/brakeman/processors/model_processor.rb

@@ -6,9 +6,10 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
   ASSOCIATIONS = Set[:belongs_to, :has_one, :has_many, :has_and_belongs_to_many]
 
   def initialize tracker
-    super 
-    @model = nil
+    super
+    @current_class = nil
     @current_method = nil
+    @current_module = nil
     @visibility = :public
     @file_name = nil
   end
@@ -21,34 +22,104 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
 
   #s(:class, NAME, PARENT, BODY)
   def process_class exp
-    name = class_name exp.class_name
+    name = class_name(exp.class_name)
+    parent = class_name(exp.parent_name)
+
+    #If inside an inner class we treat it as a library.
+    if @current_class
+      Brakeman.debug "[Notice] Treating inner class as library: #{name}"
+      Brakeman::LibraryProcessor.new(@tracker).process_library exp, @file_name
+      return exp
+    end
 
-    if @model
-      Brakeman.debug "[Notice] Skipping inner class: #{name}"
-      ignore
-    else
-      parent = class_name exp.parent_name
+    if @current_class
+      outer_class = @current_class
+      name = (outer_class[:name].to_s + "::" + name.to_s).to_sym
+    end
+
+    if @current_module
+      name = (@current_module[:name].to_s + "::" + name.to_s).to_sym
+    end
 
-      @model = { :name => name,
+    if @tracker.models[name]
+      @current_class = @tracker.models[name]
+      @current_class[:files] << @file_name unless @current_class[:files].include? @file_name
+      @current_class[:src][@file_name] = exp
+    else
+      @current_class = {
+        :name => name,
         :parent => parent,
         :includes => [],
         :public => {},
         :private => {},
         :protected => {},
         :options => {},
+        :src => { @file_name => exp },
         :associations => {},
-        :file => @file_name }
-      @tracker.models[@model[:name]] = @model
-      exp.body = process_all! exp.body
-      @model = nil
-      exp
+        :files => [ @file_name ]
+      }
+
+      @tracker.models[name] = @current_class
+    end
+
+    exp.body = process_all! exp.body
+
+    if outer_class
+      @current_class = outer_class
+    else
+      @current_class = nil
     end
+
+    exp
+  end
+
+  def process_module exp
+    name = class_name(exp.class_name)
+
+    if @current_module
+      outer_module = @current_module
+      name = (outer_module[:name].to_s + "::" + name.to_s).to_sym
+    end
+
+    if @current_class
+      name = (@current_class[:name].to_s + "::" + name.to_s).to_sym
+    end
+
+    if @tracker.libs[name]
+      @current_module = @tracker.libs[name]
+      @current_module[:files] << @file_name unless @current_module[:files].include? @file_name
+      @current_module[:src][@file_name] = exp
+    else
+      @current_module = {
+        :name => name,
+        :includes => [],
+        :public => {},
+        :private => {},
+        :protected => {},
+        :options => {},
+        :src => { @file_name => exp },
+        :associations => {},
+        :files => [ @file_name ]
+      }
+
+      @tracker.libs[name] = @current_module
+    end
+
+    exp.body = process_all! exp.body
+
+    if outer_module
+      @current_module = outer_module
+    else
+      @current_module = nil
+    end
+
+    exp
   end
 
   #Handle calls outside of methods,
   #such as include, attr_accessible, private, etc.
   def process_call exp
-    return exp unless @model
+    return exp unless @current_class
     target = exp.target
     if sexp? target
       target = process target
@@ -65,36 +136,36 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
         when :private, :protected, :public
           @visibility = method
         when :attr_accessible
-          @model[:attr_accessible] ||= []
+          @current_class[:attr_accessible] ||= []
         else
           #??
         end
       else
         case method
         when :include
-          @model[:includes] << class_name(first_arg) if @model
+          @current_class[:includes] << class_name(first_arg) if @current_class
         when :attr_accessible
-          @model[:attr_accessible] ||= []
+          @current_class[:attr_accessible] ||= []
           args = []
 
           exp.each_arg do |e|
             if node_type? e, :lit
               args << e.value
             elsif hash? e
-              @model[:options][:role_accessible] ||= []
-              @model[:options][:role_accessible].concat args
+              @current_class[:options][:role_accessible] ||= []
+              @current_class[:options][:role_accessible].concat args
             end
           end
 
-          @model[:attr_accessible].concat args
+          @current_class[:attr_accessible].concat args
         else
-          if @model
+          if @current_class
             if ASSOCIATIONS.include? method
-              @model[:associations][method] ||= []
-              @model[:associations][method].concat exp.args
+              @current_class[:associations][method] ||= []
+              @current_class[:associations][method].concat exp.args
             else
-              @model[:options][method] ||= []
-              @model[:options][method] << exp.arglist.line(exp.line)
+              @current_class[:options][method] ||= []
+              @current_class[:options][method] << exp.arglist.line(exp.line)
             end
           end
         end
@@ -109,27 +180,36 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
 
   #Add method definition to tracker
   def process_defn exp
-    return exp unless @model
+    return exp unless @current_class
     name = exp.method_name
 
     @current_method = name
     res = Sexp.new :methdef, name, exp.formal_args, *process_all!(exp.body)
     res.line(exp.line)
     @current_method = nil
-    if @model
-      list = @model[@visibility]
-      list[name] = res
+
+    if @current_class
+      @current_class[@visibility][name] = { :src => res, :file => @file_name }
+    elsif @current_module
+      @current_module[@visibility][name] = { :src => res, :file => @file_name }
     end
+
     res
   end
 
   #Add method definition to tracker
   def process_defs exp
-    return exp unless @model
+    return exp unless @current_class
     name = exp.method_name
 
     if exp[1].node_type == :self
-      target = @model[:name]
+      if @current_class
+        target = @current_class[:name]
+      elsif @current_module
+        target = @current_module
+      else
+        target = nil
+      end
     else
       target = class_name exp[1]
     end
@@ -138,8 +218,11 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
     res = Sexp.new :selfdef, target, name, exp.formal_args, *process_all!(exp.body)
     res.line(exp.line)
     @current_method = nil
-    if @model
-      @model[@visibility][name] = res unless @model.nil?
+
+    if @current_class
+      @current_class[@visibility][name] = { :src => res, :file => @file_name }
+    elsif @current_module
+      @current_module[@visibility][name] = { :src => res, :file => @file_name }
     end
     res
   end

data/lib/brakeman/report/report_base.rb

@@ -39,7 +39,7 @@ class Brakeman::Report::Base
       name = name.to_sym
       c = tracker.controllers[name]
 
-      if tracker.routes[:allow_all_actions] or tracker.routes[name] == :allow_all_actions
+      if tracker.routes.include? :allow_all_actions or (tracker.routes[name] and tracker.routes[name].include? :allow_all_actions)
         routes = c[:public].keys.map{|e| e.to_s}.sort.join(", ")
       elsif tracker.routes[name].nil?
         #No routes defined for this controller.