brakeman 3.0.5 → 3.1.0

data/lib/brakeman/processors/lib/render_path.rb

@@ -6,19 +6,25 @@ module Brakeman
       @path = []
     end
 
-    def add_controller_render controller_name, method_name
+    def add_controller_render controller_name, method_name, line, file
       method_name ||= ""
 
       @path << { :type => :controller,
                  :class => controller_name.to_sym,
-                 :method => method_name.to_sym }
+                 :method => method_name.to_sym,
+                 :line => line,
+                 :file => file
+                }
 
       self
     end
 
-    def add_template_render template_name
+    def add_template_render template_name, line, file
       @path << { :type => :template,
-                 :name => template_name.to_sym }
+                 :name => template_name.to_sym,
+                 :line => line,
+                 :file => file
+               }
 
       self
     end
@@ -89,7 +95,7 @@ module Brakeman
     end
 
     def to_json *args
-      MultiJson.dump(self.to_a)
+      MultiJson.dump(@path)
     end
 
     def initialize_copy original

data/lib/brakeman/processors/library_processor.rb

@@ -1,5 +1,6 @@
 require 'brakeman/processors/base_processor'
 require 'brakeman/processors/alias_processor'
+require 'brakeman/tracker/library'
 
 #Process generic library and stores it in Tracker.libs
 class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
@@ -23,29 +24,18 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
     if @current_class
       outer_class = @current_class
-      name = (outer_class[:name].to_s + "::" + name.to_s).to_sym
+      name = (outer_class.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @current_module
-      name = (@current_module[:name].to_s + "::" + name.to_s).to_sym
+      name = (@current_module.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @tracker.libs[name]
       @current_class = @tracker.libs[name]
-      @current_class[:files] << @file_name unless @current_class[:files].include? @file_name
-      @current_class[:src][@file_name] = exp
+      @current_class.add_file @file_name, exp
     else
-      @current_class = {
-        :name => name,
-        :parent => parent,
-        :includes => [],
-        :public => {},
-        :private => {},
-        :protected => {},
-        :src => { @file_name => exp },
-        :files => [ @file_name ]
-      }
-
+      @current_class = Brakeman::Library.new name, parent, @file_name, exp, @tracker 
       @tracker.libs[name] = @current_class
     end
 
@@ -65,28 +55,18 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
     if @current_module
       outer_module = @current_module
-      name = (outer_module[:name].to_s + "::" + name.to_s).to_sym
+      name = (outer_module.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @current_class
-      name = (@current_class[:name].to_s + "::" + name.to_s).to_sym
+      name = (@current_class.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @tracker.libs[name]
       @current_module = @tracker.libs[name]
-      @current_module[:files] << @file_name unless @current_module[:files].include? @file_name
-      @current_module[:src][@file_name] = exp
+      @current_module.add_file @file_name, exp
     else
-      @current_module = {
-        :name => name,
-        :includes => [],
-        :public => {},
-        :private => {},
-        :protected => {},
-        :src => { @file_name => exp },
-        :files => [ @file_name ]
-      }
-
+      @current_module = Brakeman::Library.new name, nil, @file_name, exp, @tracker
       @tracker.libs[name] = @current_module
     end
 
@@ -103,14 +83,13 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
   def process_defn exp
     exp = @alias_processor.process exp
-    exp.node_type = :methdef
 
     if @current_class
       exp.body = process_all! exp.body
-      @current_class[:public][exp.method_name] = { :src => exp, :file => @file_name }
+      @current_class.add_method :public, exp.method_name, exp, @file_name
     elsif @current_module
       exp.body = process_all! exp.body
-      @current_module[:public][exp.method_name] = { :src => exp, :file => @file_name }
+      @current_module.add_method :public, exp.method_name, exp, @file_name
     end
 
     exp
@@ -118,14 +97,13 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
   def process_defs exp
     exp = @alias_processor.process exp
-    exp.node_type = :selfdef
 
     if @current_class
       exp.body = process_all! exp.body
-      @current_class[:public][exp.method_name] = { :src => exp, :file => @file_name }
+      @current_class.add_method :public, exp.method_name, exp, @file_name
     elsif @current_module
       exp.body = process_all! exp.body
-      @current_module[:public][exp.method_name] = { :src => exp, :file => @file_name }
+      @current_module.add_method :public, exp.method_name, exp, @file_name
     end
 
     exp

data/lib/brakeman/processors/model_processor.rb

@@ -1,10 +1,9 @@
 require 'brakeman/processors/base_processor'
+require 'brakeman/tracker/model'
 
 #Processes models. Puts results in tracker.models
 class Brakeman::ModelProcessor < Brakeman::BaseProcessor
 
-  ASSOCIATIONS = Set[:belongs_to, :has_one, :has_many, :has_and_belongs_to_many]
-
   def initialize tracker
     super
     @current_class = nil
@@ -34,31 +33,18 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
 
     if @current_class
       outer_class = @current_class
-      name = (outer_class[:name].to_s + "::" + name.to_s).to_sym
+      name = (outer_class.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @current_module
-      name = (@current_module[:name].to_s + "::" + name.to_s).to_sym
+      name = (@current_module.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @tracker.models[name]
       @current_class = @tracker.models[name]
-      @current_class[:files] << @file_name unless @current_class[:files].include? @file_name
-      @current_class[:src][@file_name] = exp
+      @current_class.add_file @file_name, exp
     else
-      @current_class = {
-        :name => name,
-        :parent => parent,
-        :includes => [],
-        :public => {},
-        :private => {},
-        :protected => {},
-        :options => {},
-        :src => { @file_name => exp },
-        :associations => {},
-        :files => [ @file_name ]
-      }
-
+      @current_class = Brakeman::Model.new name, parent, @file_name, exp, @tracker 
       @tracker.models[name] = @current_class
     end
 
@@ -78,30 +64,18 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
 
     if @current_module
       outer_module = @current_module
-      name = (outer_module[:name].to_s + "::" + name.to_s).to_sym
+      name = (outer_module.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @current_class
-      name = (@current_class[:name].to_s + "::" + name.to_s).to_sym
+      name = (@current_class.name.to_s + "::" + name.to_s).to_sym
     end
 
     if @tracker.libs[name]
       @current_module = @tracker.libs[name]
-      @current_module[:files] << @file_name unless @current_module[:files].include? @file_name
-      @current_module[:src][@file_name] = exp
+      @current_module.add_file @file_name, exp
     else
-      @current_module = {
-        :name => name,
-        :includes => [],
-        :public => {},
-        :private => {},
-        :protected => {},
-        :options => {},
-        :src => { @file_name => exp },
-        :associations => {},
-        :files => [ @file_name ]
-      }
-
+      @current_module = Brakeman::Model.new name, nil, @file_name, exp, @tracker
       @tracker.libs[name] = @current_module
     end
 
@@ -136,37 +110,21 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
         when :private, :protected, :public
           @visibility = method
         when :attr_accessible
-          @current_class[:attr_accessible] ||= []
+          @current_class.set_attr_accessible
         else
           #??
         end
       else
         case method
         when :include
-          @current_class[:includes] << class_name(first_arg) if @current_class
+          @current_class.add_include class_name(first_arg) if @current_class
         when :attr_accessible
-          @current_class[:attr_accessible] ||= []
-          args = []
-
-          exp.each_arg do |e|
-            if node_type? e, :lit
-              args << e.value
-            elsif hash? e
-              @current_class[:options][:role_accessible] ||= []
-              @current_class[:options][:role_accessible].concat args
-            end
-          end
-
-          @current_class[:attr_accessible].concat args
+          @current_class.set_attr_accessible exp
+        when :attr_protected
+          @current_class.set_attr_protected exp
         else
           if @current_class
-            if ASSOCIATIONS.include? method
-              @current_class[:associations][method] ||= []
-              @current_class[:associations][method].concat exp.args
-            else
-              @current_class[:options][method] ||= []
-              @current_class[:options][method] << exp.arglist.line(exp.line)
-            end
+            @current_class.add_option method, exp
           end
         end
       end
@@ -185,14 +143,14 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
     name = exp.method_name
 
     @current_method = name
-    res = Sexp.new :methdef, name, exp.formal_args, *process_all!(exp.body)
+    res = Sexp.new :defn, name, exp.formal_args, *process_all!(exp.body)
     res.line(exp.line)
     @current_method = nil
 
     if @current_class
-      @current_class[@visibility][name] = { :src => res, :file => @file_name }
+      @current_class.add_method @visibility, name, res, @file_name
     elsif @current_module
-      @current_module[@visibility][name] = { :src => res, :file => @file_name }
+      @current_module.add_method @visibility, name, res, @file_name
     end
 
     res
@@ -205,7 +163,7 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
 
     if exp[1].node_type == :self
       if @current_class
-        target = @current_class[:name]
+        target = @current_class.name
       elsif @current_module
         target = @current_module
       else
@@ -216,14 +174,14 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
     end
 
     @current_method = name
-    res = Sexp.new :selfdef, target, name, exp.formal_args, *process_all!(exp.body)
+    res = Sexp.new :defs, target, name, exp.formal_args, *process_all!(exp.body)
     res.line(exp.line)
     @current_method = nil
 
     if @current_class
-      @current_class[@visibility][name] = { :src => res, :file => @file_name }
+      @current_class.add_method @visibility, name, res, @file_name
     elsif @current_module
-      @current_module[@visibility][name] = { :src => res, :file => @file_name }
+      @current_module.add_method @visibility, name, res, @file_name
     end
     res
   end

data/lib/brakeman/processors/output_processor.rb

@@ -43,9 +43,6 @@ class Brakeman::OutputProcessor < Ruby2Ruby
     "cookies"
   end
 
-  alias process_string_interp process_dstr
-  alias process_string_eval process_evstr
-
   def process_rlist exp
     out = exp.map do |e|
       res = process e
@@ -80,9 +77,7 @@ class Brakeman::OutputProcessor < Ruby2Ruby
     return "def #{name}#{args}\n#{body}\nend".gsub(/\n\s*\n+/, "\n")
   end
 
-  alias process_methdef process_defn
-
-  def process_call_with_block exp
+  def process_iter exp
     call = process exp[0]
     block = process_rlist exp[2..-1]
     out = "#{call} do\n #{block}\n end"
@@ -173,35 +168,4 @@ class Brakeman::OutputProcessor < Ruby2Ruby
     exp.clear
     out
   end
-
-  #This is copied from Ruby2Ruby, except the :string_eval type has been added
-  def util_dthing(type, exp)
-    s = []
-
-    # first item in sexp is a string literal
-    s << dthing_escape(type, exp.shift)
-
-    until exp.empty?
-      pt = exp.shift
-      case pt
-      when Sexp then
-        case pt.first
-        when :str then
-          s << dthing_escape(type, pt.last)
-        when :evstr, :string_eval then
-          s << '#{' << process(pt) << '}' # do not use interpolation here
-        else
-          raise "unknown type: #{pt.inspect}"
-        end
-      when String then
-        s << pt
-      else
-        # HACK: raise "huh?: #{pt.inspect}" -- hitting # constants in regexps
-        # do nothing for now
-      end
-    end
-
-    s.join
-  end
-
 end

data/lib/brakeman/processors/slim_template_processor.rb

@@ -25,7 +25,7 @@ class Brakeman::SlimTemplateProcessor < Brakeman::TemplateProcessor
         ignore
       elsif render? arg
         make_output make_render_in_view arg
-      elsif node_type? arg, :interp, :dstr
+      elsif string_interp? arg
         process_inside_interp arg
       elsif node_type? arg, :ignore
         ignore
@@ -38,24 +38,22 @@ class Brakeman::SlimTemplateProcessor < Brakeman::TemplateProcessor
       exp.arglist = process exp.arglist
       make_render_in_view exp
     else
-      call = make_call target, method, process_all!(exp.args)
-      call.original_line = exp.original_line
-      call.line(exp.line)
-      call
+      exp.arglist = process exp.arglist
+      exp
     end
   end
 
   def make_output exp
     s = Sexp.new :output, exp
     s.line(exp.line)
-    @current_template[:outputs] << s
+    @current_template.add_output s
     s
   end
 
   def make_escaped_output exp
     s = Sexp.new :escaped_output, exp.first_arg
     s.line(exp.line)
-    @current_template[:outputs] << s
+    @current_template.add_output s
     s
   end
 
@@ -63,7 +61,7 @@ class Brakeman::SlimTemplateProcessor < Brakeman::TemplateProcessor
   #Better to pull those values out directly.
   def process_inside_interp exp
     exp.map! do |e|
-      if node_type? e, :evstr, :string_eval
+      if node_type? e, :evstr
         e.value = process_interp_output e.value
         e
       else

data/lib/brakeman/processors/template_alias_processor.rb

@@ -18,23 +18,25 @@ class Brakeman::TemplateAliasProcessor < Brakeman::AliasProcessor
   end
 
   #Process template
-  def process_template name, args
+  def process_template name, args, _, line = nil
+    file = relative_path(@template.file || @tracker.templates[@template.name])
+
     if @called_from
       if @called_from.include_template? name
-        Brakeman.debug "Skipping circular render from #{@template[:name]} to #{name}"
+        Brakeman.debug "Skipping circular render from #{@template.name} to #{name}"
         return
       end
 
-      super name, args, @called_from.dup.add_template_render(@template[:name])
+      super name, args, @called_from.dup.add_template_render(@template.name, line, file)
     else
-      super name, args, Brakeman::RenderPath.new.add_template_render(@template[:name])
+      super name, args, Brakeman::RenderPath.new.add_template_render(@template.name, line, file)
     end
   end
 
   #Determine template name
   def template_name name
-    if !name.to_s.include?('/') && @template[:name].to_s.include?('/')
-      name = "#{@template[:name].to_s.match(/^(.*\/).*$/)[1]}#{name}"
+    if !name.to_s.include?('/') && @template.name.to_s.include?('/')
+      name = "#{@template.name.to_s.match(/^(.*\/).*$/)[1]}#{name}"
     end
     name
   end
@@ -43,7 +45,7 @@ class Brakeman::TemplateAliasProcessor < Brakeman::AliasProcessor
   FORM_BUILDER_CALL = Sexp.new(:call, Sexp.new(:const, :FormBuilder), :new)
 
   #Looks for form methods and iterating over collections of Models
-  def process_call_with_block exp
+  def process_iter exp
     process_default exp
 
     call = exp.block_call
@@ -77,8 +79,6 @@ class Brakeman::TemplateAliasProcessor < Brakeman::AliasProcessor
     exp
   end
 
-  alias process_iter process_call_with_block
-
   #Checks if +exp+ is a call to Model.all or Model.find*
   def get_model_target exp
     if call? exp