brakeman 2.6.3 → 3.0.0

data/lib/brakeman/processors/controller_processor.rb

@@ -67,7 +67,7 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
         :public => {},
         :private => {},
         :protected => {},
-        :options => {:before_filters => []},
+        :options => {:before_filters => [], :skip_filters => []},
         :src => { @file_name => exp },
         :files => [ @file_name ]
       }
@@ -158,9 +158,11 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
         when :include
           @current_class[:includes] << class_name(first_arg) if @current_class
         when :before_filter, :append_before_filter, :before_action, :append_before_action
-          @current_class[:options][:before_filters] << exp.args
+          @current_class[:options][:before_filters] << exp
         when :prepend_before_filter, :prepend_before_action
-          @current_class[:options][:before_filters].unshift exp.args
+          @current_class[:options][:before_filters].unshift exp
+        when :skip_before_filter, :skip_filter, :skip_before_action, :skip_action_callback
+          @current_class[:options][:skip_filters] << exp
         when :layout
           if string? last_arg
             #layout "some_layout"

data/lib/brakeman/processors/gem_processor.rb

@@ -1,7 +1,7 @@
-require 'brakeman/processors/base_processor'
+require 'brakeman/processors/lib/basic_processor'
 
 #Processes Gemfile and Gemfile.lock
-class Brakeman::GemProcessor < Brakeman::BaseProcessor
+class Brakeman::GemProcessor < Brakeman::BasicProcessor
 
   def initialize *args
     super
@@ -14,9 +14,11 @@ class Brakeman::GemProcessor < Brakeman::BaseProcessor
 
     if gem_lock
       process_gem_lock gem_lock
-      @tracker.config[:rails_version] = @tracker.config[:gems][:rails]
-    elsif @tracker.config[:gems][:rails] =~ /(\d+.\d+.\d+)/
+      @tracker.config[:rails_version] = @tracker.config[:gems][:rails][:version] if @tracker.config[:gems][:rails]
+    elsif @tracker.config[:gems] && @tracker.config[:gems][:rails] && @tracker.config[:gems][:rails][:version] =~ /(\d+.\d+.\d+)/
       @tracker.config[:rails_version] = $1
+    else
+      @tracker.config[:rails_version] = nil
     end
 
     if @tracker.options[:rails3].nil? and @tracker.options[:rails4].nil? and @tracker.config[:rails_version]
@@ -45,9 +47,9 @@ class Brakeman::GemProcessor < Brakeman::BaseProcessor
       gem_version = exp.second_arg
 
       if string? gem_version
-        @tracker.config[:gems][gem_name.value.to_sym] = gem_version.value
+        @tracker.config[:gems][gem_name.value.to_sym] = { :version => gem_version.value.to_s, :file => 'Gemfile', :line => exp.line }
       else
-        @tracker.config[:gems][gem_name.value.to_sym] = ">=0.0.0"
+        @tracker.config[:gems][gem_name.value.to_sym] = { :version => nil, :file => 'Gemfile' , :line => exp.line }
       end
     end
 
@@ -55,15 +57,17 @@ class Brakeman::GemProcessor < Brakeman::BaseProcessor
   end
 
   def process_gem_lock gem_lock
+    line_num = 1
     gem_lock.each_line do |line|
-      set_gem_version line
+      set_gem_version_and_file line, 'Gemfile.lock', line_num
+      line_num += 1
     end
   end
 
   # Supports .rc2 but not ~>, >=, or <=
-  def set_gem_version line
+  def set_gem_version_and_file line, file, line_num
     if line =~ @gem_name_version
-      @tracker.config[:gems][$1.to_sym] = $2
+      @tracker.config[:gems][$1.to_sym] = { :version => $2, :file => file, :line => line_num }
     end
   end
 end

data/lib/brakeman/processors/lib/basic_processor.rb

@@ -0,0 +1,17 @@
+require 'brakeman/processors/lib/processor_helper'
+require 'brakeman/util'
+
+class Brakeman::BasicProcessor < Brakeman::SexpProcessor
+  include Brakeman::ProcessorHelper
+  include Brakeman::Util
+
+  def initialize tracker
+    super()
+    @tracker = tracker
+    @current_template = @current_module = @current_class = @current_method = nil
+  end
+
+  def process_default exp
+    process_all exp
+  end
+end

data/lib/brakeman/processors/lib/find_all_calls.rb

@@ -1,6 +1,6 @@
-require 'brakeman/processors/base_processor'
+require 'brakeman/processors/lib/basic_processor'
 
-class Brakeman::FindAllCalls < Brakeman::BaseProcessor
+class Brakeman::FindAllCalls < Brakeman::BasicProcessor
   attr_reader :calls
 
   def initialize tracker

data/lib/brakeman/processors/lib/find_call.rb

@@ -1,4 +1,4 @@
-require 'brakeman/processors/base_processor'
+require 'brakeman/processors/lib/basic_processor'
 
 #Finds method calls matching the given target(s).
 #   #-- This should be deprecated --#
@@ -31,7 +31,7 @@ require 'brakeman/processors/base_processor'
 #
 # #Find all calls to sub, sub!, gsub, or gsub!
 # FindCall.new nil, /^g?sub!?$/
-class Brakeman::FindCall < Brakeman::BaseProcessor
+class Brakeman::FindCall < Brakeman::BasicProcessor
 
   def initialize targets, methods, tracker, in_depth = false
     super tracker

data/lib/brakeman/processors/lib/processor_helper.rb

@@ -29,6 +29,15 @@ module Brakeman::ProcessorHelper
 
     exp
   end
+
+  def process_class exp
+    current_class = @current_class
+    @current_class = class_name exp[1]
+    process_all exp.body
+    @current_class = current_class
+    exp
+  end
+
   #Sets the current module.
   def process_module exp
     module_name = class_name(exp.class_name).to_s

data/lib/brakeman/processors/lib/rails2_config_processor.rb

@@ -1,3 +1,5 @@
+require 'brakeman/processors/lib/basic_processor'
+
 #Processes configuration. Results are put in tracker.config.
 #
 #Configuration of Rails via Rails::Initializer are stored in tracker.config[:rails].
@@ -12,7 +14,7 @@
 #  tracker.config[:rails][:action_controller][:session_store]
 #
 #Values for tracker.config[:rails] will still be Sexps.
-class Brakeman::Rails2ConfigProcessor < Brakeman::BaseProcessor
+class Brakeman::Rails2ConfigProcessor < Brakeman::BasicProcessor
   #Replace block variable in
   #
   #  Rails::Initializer.run |config|

data/lib/brakeman/processors/lib/rails2_route_processor.rb

@@ -1,10 +1,10 @@
-require 'brakeman/processors/base_processor'
+require 'brakeman/processors/lib/basic_processor'
 
 #Processes the Sexp from routes.rb. Stores results in tracker.routes.
 #
 #Note that it is only interested in determining what methods on which
 #controllers are used as routes, not the generated URLs for routes.
-class Brakeman::Rails2RoutesProcessor < Brakeman::BaseProcessor
+class Brakeman::Rails2RoutesProcessor < Brakeman::BasicProcessor
   include Brakeman::RouteHelper
 
   attr_reader :map, :nested, :current_controller
@@ -76,7 +76,7 @@ class Brakeman::Rails2RoutesProcessor < Brakeman::BaseProcessor
       end
       exp
     else
-      super
+      process_default exp
     end
   end
 

data/lib/brakeman/processors/lib/rails3_config_processor.rb

@@ -1,3 +1,6 @@
+
+require 'brakeman/processors/lib/basic_processor'
+
 #Processes configuration. Results are put in tracker.config.
 #
 #Configuration of Rails via Rails::Initializer are stored in tracker.config[:rails].
@@ -12,7 +15,7 @@
 #  tracker.config[:rails][:active_record][:whitelist_attributes]
 #
 #Values for tracker.config[:rails] will still be Sexps.
-class Brakeman::Rails3ConfigProcessor < Brakeman::BaseProcessor
+class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
   RAILS_CONFIG = Sexp.new(:call, nil, :config)
 
   def initialize *args

data/lib/brakeman/processors/lib/rails3_route_processor.rb

@@ -1,8 +1,10 @@
+require 'brakeman/processors/lib/basic_processor'
+
 #Processes the Sexp from routes.rb. Stores results in tracker.routes.
 #
 #Note that it is only interested in determining what methods on which
 #controllers are used as routes, not the generated URLs for routes.
-class Brakeman::Rails3RoutesProcessor < Brakeman::BaseProcessor
+class Brakeman::Rails3RoutesProcessor < Brakeman::BasicProcessor
   include Brakeman::RouteHelper
 
   attr_reader :map, :nested, :current_controller
@@ -53,7 +55,7 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BaseProcessor
     when :controller
       process_controller_block exp
     else
-      super
+      process_default exp
     end
   end
 

data/lib/brakeman/processors/output_processor.rb

@@ -23,12 +23,6 @@ class Brakeman::OutputProcessor < Ruby2Ruby
     end
   end
 
-  def process_lvar exp
-    out = "(local #{exp[0]})"
-    exp.clear
-    out
-  end
-
   def process_ignore exp
     exp.clear
     "[ignored]"
@@ -78,7 +72,7 @@ class Brakeman::OutputProcessor < Ruby2Ruby
       elsif string? e
         e[1]
       else
-        process e
+        "\#{#{process e}}"
       end
     end.join
     exp.clear

data/lib/brakeman/report/report_json.rb

@@ -40,6 +40,6 @@ class Brakeman::Report::JSON < Brakeman::Report::Base
       hash = w.to_hash
       hash[:file] = warning_file w
       hash
-    end.sort_by { |w| w[:file] }
+    end.sort_by { |w| "#{w[:fingerprint]}#{w[:line]}" }
   end
 end

data/lib/brakeman/tracker.rb

@@ -83,7 +83,13 @@ class Brakeman::Tracker
 
   #Iterate over all methods in controllers and models.
   def each_method
-    [self.controllers, self.models].each do |set|
+    classes = [self.controllers, self.models]
+
+    if @options[:index_libs]
+      classes << self.libs
+    end
+
+    classes.each do |set|
       set.each do |set_name, info|
         [:private, :public, :protected].each do |visibility|
           info[visibility].each do |method_name, definition|

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "2.6.3"
+  Version = "3.0.0"
 end

data/lib/brakeman/warning.rb

@@ -16,7 +16,7 @@ class Brakeman::Warning
   def initialize options = {}
     @view_name = nil
 
-    [:called_from, :check, :class, :code, :confidence, :controller, :file, :line, :link_path,
+    [:called_from, :check, :class, :code, :confidence, :controller, :file, :gem_info, :line, :link_path,
       :message, :method, :model, :relative_path, :template, :user_input, :warning_set, :warning_type].each do |option|
 
       self.instance_variable_set("@#{option}", options[option])
@@ -35,6 +35,10 @@ class Brakeman::Warning
       end
     end
 
+    if @method.to_s =~ /^fake_filter\d+/
+      @method = :before_filter
+    end
+
     if not @line
       if @user_input and @user_input.respond_to? :line
         @line = @user_input.line
@@ -43,6 +47,16 @@ class Brakeman::Warning
       end
     end
 
+    if @gem_info
+      if @gem_info.is_a? Hash
+        @line ||= @gem_info[:line]
+        @file ||= @gem_info[:file]
+      else
+        # Fallback behavior returns just a string for the file name
+        @file ||= @gem_info
+      end
+    end
+
     unless @warning_set
       if self.model
         @warning_set = :model

data/lib/brakeman/warning_codes.rb

@@ -84,6 +84,9 @@ module Brakeman::WarningCodes
     :CVE_2014_3514 => 80,
     :CVE_2014_3514_call => 81,
     :unscoped_find => 82,
+    :CVE_2011_2932 => 83,
+    :cross_site_scripting_inline => 84,
+    :CVE_2014_7829 => 85,
   }
 
   def self.code name

data/lib/ruby_parser/bm_sexp.rb

@@ -4,7 +4,7 @@
 class Sexp
   attr_reader :paren
   attr_accessor :original_line, :or_depth
-  ASSIGNMENT_BOOL = [:gasgn, :iasgn, :lasgn, :cvdecl, :cdecl, :or, :and, :colon2]
+  ASSIGNMENT_BOOL = [:gasgn, :iasgn, :lasgn, :cvdecl, :cvasgn, :cdecl, :or, :and, :colon2]
 
   def method_missing name, *args
     #Brakeman does not use this functionality,
@@ -419,6 +419,7 @@ class Sexp
   #Sets the left hand side of assignment or boolean.
   def lhs= exp
     expect *ASSIGNMENT_BOOL
+    @my_hash_value = nil
     self[1] = exp
   end
 
@@ -427,14 +428,25 @@ class Sexp
   #    s(:lasgn, :x, s(:lit, 1))
   #                  ^--rhs---^
   def rhs
-    expect *ASSIGNMENT_BOOL
-    self[2]
+    expect :attrasgn, *ASSIGNMENT_BOOL
+
+    if self.node_type == :attrasgn
+      self[3]
+    else
+      self[2]
+    end
   end
 
   #Sets the right hand side of assignment or boolean.
   def rhs= exp
-    expect *ASSIGNMENT_BOOL
-    self[2] = exp
+    expect :attrasgn, *ASSIGNMENT_BOOL
+    @my_hash_value = nil
+
+    if self.node_type == :attrasgn
+      self[3] = exp
+    else
+      self[2] = exp
+    end
   end
 
   #Returns name of method being defined in a method definition.

metadata

@@ -1,192 +1,187 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 2.6.3
+  version: 3.0.0
 platform: ruby
 authors:
 - Justin Collins
 autorequire: 
 bindir: bin
 cert_chain:
-- !binary |-
-  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMakNDQWhhZ0F3SUJB
-  Z0lCQURBTkJna3Foa2lHOXcwQkFRVUZBREE5TVF3d0NnWURWUVFEREFOblpX
-  MHgKR0RBV0Jnb0praWFKay9Jc1pBRVpGZ2hpY21GclpXMWhiakVUTUJFR0Nn
-  bVNKb21UOGl4a0FSa1dBMjl5WnpBZQpGdzB4TXpFeU1USXdNRE14TlRkYUZ3
-  MHhOREV5TVRJd01ETXhOVGRhTUQweEREQUtCZ05WQkFNTUEyZGxiVEVZCk1C
-  WUdDZ21TSm9tVDhpeGtBUmtXQ0dKeVlXdGxiV0Z1TVJNd0VRWUtDWkltaVpQ
-  eUxHUUJHUllEYjNKbk1JSUIKSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4
-  QU1JSUJDZ0tDQVFFQXhDSG1YQ2FBY1o0YlZqaWpLb3lRRng0TgpkeU43Qjdi
-  cVk4d09YeTZmL1VaNm1kQzhJUkFqODJLYVdRak5FMkxUL09iRlVXcENSeUxk
-  cndqa0RqZEZEeU9UCm1aQ1praU9lRXkyWnhZR2Z4WE1JL3hnMjRjOHI1WG1o
-  MTZFcnNZdXByUmNnKy9LWjZzNFVqc2VCTlRBUm1CSzQKSUhjcUlkbm9XYllh
-  M0JXSG9mbEpQYUpVSWFVKy95VGNsekZRSHBzd1U3a2E4ZnRJQVdlb0RRbzIy
-  Z2FzUC80TgpIdEp2QUl5ZzFEY1dQTGNuMHFiWm1kZWhnOEhadjhDKzJNdUxL
-  WC8ycVpHOWVzZWVnTXFNbEhIYWJ3d0V5OVZ2CmYvdC8rbHRMakMwQ1JhMlRx
-  WjJFdVE1RUV6Yk9zcUFmdGFaSkZtd3Y5VXQxVWhqbWR2UjVSZk42ZFdNUTVR
-  SUQKQVFBQm96a3dOekFMQmdOVkhROEVCQU1DQkxBd0hRWURWUjBPQkJZRUZQ
-  eUVLZVJ5MDlpOHFTcis5S0ZiZVRxdwprTUNTTUFrR0ExVWRFd1FDTUFBd0RR
-  WUpLb1pJaHZjTkFRRUZCUUFEZ2dFQkFMRWs4L1dubDJWQXFjaHhXbGJnClJO
-  ME1rVlVXTWY4TDB4eFVpVktvNVFlTDROQlZpQUxNQnJVNklTNHk2enluK0Zv
-  VUxBTUVhd1VqWmxaZjRIY2cKUzl1bmV2M3ArUlRXVXlrc0FuQTI3d0hacy9O
-  UklrVzM0czFaSTVOTkUveHl1NFVMT1FqZmgxd09qbFd6eUh1OQowdDQxL0N0
-  cGdOUE0ydUFqRzNSSXFscDdRS1hsYnk1MGNRcVdKUUNnVEgzSk5qTWhtUk9F
-  aFRzSTZDT29BcHZkCkNlN0JyMzl5amVvYXJ2ZWtxMHdDWEJZYWtVQncvRGRa
-  Q0c3bUZaNnhnaDAxZXFuWlVzTmQ4dk0rNlY2djIzVnUKamsydE1qRlQ0TDFk
-  QTNNRXN6MytNUDE0NFBEaFBDaDd0UGU2eXk4MUJPdnlZVFZrS3pyQWtnS3dI
-  RDFDdXZzSApiZHc9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-date: 2014-10-14 00:00:00.000000000 Z
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIDijCCAnKgAwIBAgIBATANBgkqhkiG9w0BAQUFADBFMQ8wDQYDVQQDDAZqdXN0
+  aW4xHTAbBgoJkiaJk/IsZAEZFg1wcmVzaWRlbnRiZWVmMRMwEQYKCZImiZPyLGQB
+  GRYDY29tMB4XDTE1MDEwMzAxMjI0NFoXDTE2MDEwMzAxMjI0NFowRTEPMA0GA1UE
+  AwwGanVzdGluMR0wGwYKCZImiZPyLGQBGRYNcHJlc2lkZW50YmVlZjETMBEGCgmS
+  JomT8ixkARkWA2NvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMjt
+  xjn8ArkEqQNrRjEeyZAOyr0O8+WZ54AcObsKg2osrcAW6iFd7tjnTFclQHmZgje+
+  cwxeF/YG4PbA72ElmCvjn8vQJkdgHspKds1otSozvTF2VDnyAEg0nDTMgkQGQy4R
+  HX3NHXMJ8UCAJv2IV/FsItzcPzPmhhf6vu/QaNrmAm3/nF52EsMSEJNC9eTPWudC
+  kPgt19T9LRKMk5YbXDM6jWGRubusE03bTwY3RThqYM5ra1DwI/HpWKsKdmNrBbse
+  f065WyR7RNAxindc2wMyq1EaInmO7Vds+rsOFZ4ZnO90z046ywmTLTadqlfuc9Qo
+  CEw/AhYB6f6DLH8ICkMCAwEAAaOBhDCBgTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIE
+  sDAdBgNVHQ4EFgQUmIuIvxLr7ziB52LOpVgd694EfaEwIwYDVR0RBBwwGoEYanVz
+  dGluQHByZXNpZGVudGJlZWYuY29tMCMGA1UdEgQcMBqBGGp1c3RpbkBwcmVzaWRl
+  bnRiZWVmLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEAbgSKdn/VSDdl5H2ayE+OM662
+  gTJWP1CWfbcRVJW/UDjDucEF42t6V/dZTDmwyYTR8Qv+5FsQoPHsDsD3Jr1E62dl
+  VYDeUkbmiV5f8fANbvnGUknzrHwp2T0/URxiIY8oFcaCGT+iua9zlNU20+XhB9JN
+  fsOSUNBuuE/MYGA37MR1sP7lFHr5e7I1Qk1x3HvjNB/kSv1+Cj26Lde1ehvMqpmi
+  bxoxp9KNxkO+709YwLO1rYfmcGghg8WV6MYz3PSHdlgWF4KrjRFc/00hXHqVk0Sf
+  mREEv2LPwHH2SgpSSab+iawnX4l6lV8XcIrmp/HSMySsPVFBeOmB0c05LpEN8w==
+  -----END CERTIFICATE-----
+date: 2015-01-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 3.5.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 3.5.0
 - !ruby/object:Gem::Dependency
   name: ruby2ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.1.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.1.1
 - !ruby/object:Gem::Dependency
   name: terminal-table
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.4'
 - !ruby/object:Gem::Dependency
   name: fastercsv
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.5'
 - !ruby/object:Gem::Dependency
   name: highline
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.6.20
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.6.20
 - !ruby/object:Gem::Dependency
   name: erubis
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '2.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '2.6'
 - !ruby/object:Gem::Dependency
   name: haml
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '3.0'
-    - - <
+    - - "<"
       - !ruby/object:Gem::Version
         version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '3.0'
-    - - <
+    - - "<"
       - !ruby/object:Gem::Version
         version: '5.0'
 - !ruby/object:Gem::Dependency
   name: sass
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
 - !ruby/object:Gem::Dependency
   name: slim
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.3.6
-    - - <
+    - - "<"
       - !ruby/object:Gem::Version
         version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.3.6
-    - - <
+    - - "<"
       - !ruby/object:Gem::Version
         version: '3.0'
 - !ruby/object:Gem::Dependency
   name: multi_json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
 description: Brakeman detects security vulnerabilities in Ruby on Rails applications
@@ -220,6 +215,7 @@ files:
 - lib/brakeman/checks/check_evaluation.rb
 - lib/brakeman/checks/check_execute.rb
 - lib/brakeman/checks/check_file_access.rb
+- lib/brakeman/checks/check_file_disclosure.rb
 - lib/brakeman/checks/check_filter_skipping.rb
 - lib/brakeman/checks/check_forgery_setting.rb
 - lib/brakeman/checks/check_header_dos.rb
@@ -240,6 +236,7 @@ files:
 - lib/brakeman/checks/check_regex_dos.rb
 - lib/brakeman/checks/check_render.rb
 - lib/brakeman/checks/check_render_dos.rb
+- lib/brakeman/checks/check_render_inline.rb
 - lib/brakeman/checks/check_response_splitting.rb
 - lib/brakeman/checks/check_safe_buffer_manipulation.rb
 - lib/brakeman/checks/check_sanitize_methods.rb
@@ -256,6 +253,7 @@ files:
 - lib/brakeman/checks/check_ssl_verify.rb
 - lib/brakeman/checks/check_strip_tags.rb
 - lib/brakeman/checks/check_symbol_dos.rb
+- lib/brakeman/checks/check_symbol_dos_cve.rb
 - lib/brakeman/checks/check_translate_bug.rb
 - lib/brakeman/checks/check_unsafe_reflection.rb
 - lib/brakeman/checks/check_unscoped_find.rb
@@ -280,6 +278,7 @@ files:
 - lib/brakeman/processors/erubis_template_processor.rb
 - lib/brakeman/processors/gem_processor.rb
 - lib/brakeman/processors/haml_template_processor.rb
+- lib/brakeman/processors/lib/basic_processor.rb
 - lib/brakeman/processors/lib/find_all_calls.rb
 - lib/brakeman/processors/lib/find_call.rb
 - lib/brakeman/processors/lib/find_return_value.rb
@@ -341,17 +340,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.3.0
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.