brakeman 3.2.1 → 3.3.0

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform.rb

@@ -0,0 +1,41 @@
+require 'base64'
+
+module SafeYAML
+  class Transform
+    TRANSFORMERS = [
+      Transform::ToSymbol.new,
+      Transform::ToInteger.new,
+      Transform::ToFloat.new,
+      Transform::ToNil.new,
+      Transform::ToBoolean.new,
+      Transform::ToDate.new
+    ]
+
+    def self.to_guessed_type(value, quoted=false, options=nil)
+      return value if quoted
+
+      if value.is_a?(String)
+        TRANSFORMERS.each do |transformer|
+          success, transformed_value = transformer.method(:transform?).arity == 1 ?
+            transformer.transform?(value) :
+            transformer.transform?(value, options)
+
+          return transformed_value if success
+        end
+      end
+
+      value
+    end
+
+    def self.to_proper_type(value, quoted=false, tag=nil, options=nil)
+      case tag
+      when "tag:yaml.org,2002:binary", "x-private:binary", "!binary"
+        decoded = Base64.decode64(value)
+        decoded = decoded.force_encoding(value.encoding) if decoded.respond_to?(:force_encoding)
+        decoded
+      else
+        self.to_guessed_type(value, quoted, options)
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform/to_boolean.rb

@@ -0,0 +1,21 @@
+module SafeYAML
+  class Transform
+    class ToBoolean
+      include TransformationMap
+
+      set_predefined_values({
+        "yes"   => true,
+        "on"    => true,
+        "true"  => true,
+        "no"    => false,
+        "off"   => false,
+        "false" => false
+      })
+
+      def transform?(value)
+        return false if value.length > 5
+        return PREDEFINED_VALUES.include?(value), PREDEFINED_VALUES[value]
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform/to_date.rb

@@ -0,0 +1,13 @@
+module SafeYAML
+  class Transform
+    class ToDate
+      def transform?(value)
+        return true, Date.parse(value) if Parse::Date::DATE_MATCHER.match(value)
+        return true, Parse::Date.value(value) if Parse::Date::TIME_MATCHER.match(value)
+        false
+      rescue ArgumentError
+        return true, value
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform/to_float.rb

@@ -0,0 +1,33 @@
+module SafeYAML
+  class Transform
+    class ToFloat
+      Infinity = 1.0 / 0.0
+      NaN = 0.0 / 0.0
+
+      PREDEFINED_VALUES = {
+        ".inf"  => Infinity,
+        ".Inf"  => Infinity,
+        ".INF"  => Infinity,
+        "-.inf" => -Infinity,
+        "-.Inf" => -Infinity,
+        "-.INF" => -Infinity,
+        ".nan"  => NaN,
+        ".NaN"  => NaN,
+        ".NAN"  => NaN,
+      }.freeze
+
+      MATCHER = /\A[-+]?(?:\d[\d_]*)?\.[\d_]+(?:[eE][-+][\d]+)?\Z/.freeze
+
+      def transform?(value)
+        return true, Float(value) if MATCHER.match(value)
+        try_edge_cases?(value)
+      end
+
+      def try_edge_cases?(value)
+        return true, PREDEFINED_VALUES[value] if PREDEFINED_VALUES.include?(value)
+        return true, Parse::Sexagesimal.value(value) if Parse::Sexagesimal::FLOAT_MATCHER.match(value)
+        return false
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform/to_integer.rb

@@ -0,0 +1,26 @@
+module SafeYAML
+  class Transform
+    class ToInteger
+      MATCHERS = Deep.freeze([
+        /\A[-+]?(0|([1-9][0-9_,]*))\Z/, # decimal
+        /\A0[0-7]+\Z/,                  # octal
+        /\A0x[0-9a-f]+\Z/i,             # hexadecimal
+        /\A0b[01_]+\Z/                  # binary
+      ])
+
+      def transform?(value)
+        MATCHERS.each_with_index do |matcher, idx|
+          value = value.gsub(/[_,]/, "") if idx == 0
+          return true, Integer(value) if matcher.match(value)
+        end
+        try_edge_cases?(value)
+      end
+
+      def try_edge_cases?(value)
+        return true, Parse::Hexadecimal.value(value) if Parse::Hexadecimal::MATCHER.match(value)
+        return true, Parse::Sexagesimal.value(value) if Parse::Sexagesimal::INTEGER_MATCHER.match(value)
+        return false
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform/to_nil.rb

@@ -0,0 +1,18 @@
+module SafeYAML
+  class Transform
+    class ToNil
+      include TransformationMap
+
+      set_predefined_values({
+        ""      => nil,
+        "~"     => nil,
+        "null"  => nil
+      })
+
+      def transform?(value)
+        return false if value.length > 4
+        return PREDEFINED_VALUES.include?(value), PREDEFINED_VALUES[value]
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform/to_symbol.rb

@@ -0,0 +1,17 @@
+module SafeYAML
+  class Transform
+    class ToSymbol
+      def transform?(value, options=SafeYAML::OPTIONS)
+        if options[:deserialize_symbols] && value =~ /\A:./
+          if value =~ /\A:(["'])(.*)\1\Z/
+            return true, $2.sub(/^:/, "").to_sym
+          else
+            return true, value.sub(/^:/, "").to_sym
+          end
+        end
+
+        return false
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/transform/transformation_map.rb

@@ -0,0 +1,47 @@
+module SafeYAML
+  class Transform
+    module TransformationMap
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+
+      class CaseAgnosticMap < Hash
+        def initialize(*args)
+          super
+        end
+
+        def include?(key)
+          super(key.downcase)
+        end
+
+        def [](key)
+          super(key.downcase)
+        end
+
+        # OK, I actually don't think it's all that important that this map be
+        # frozen.
+        def freeze
+          self
+        end
+      end
+
+      module ClassMethods
+        def set_predefined_values(predefined_values)
+          if SafeYAML::YAML_ENGINE == "syck"
+            expanded_map = predefined_values.inject({}) do |hash, (key, value)|
+              hash[key] = value
+              hash[key.capitalize] = value
+              hash[key.upcase] = value
+              hash
+            end
+          else
+            expanded_map = CaseAgnosticMap.new
+            expanded_map.merge!(predefined_values)
+          end
+
+          self.const_set(:PREDEFINED_VALUES, expanded_map.freeze)
+        end
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/lib/safe_yaml/version.rb

@@ -0,0 +1,3 @@
+module SafeYAML
+  VERSION = "1.0.4"
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/run_specs_all_ruby_versions.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+[[ -s "$HOME/.rvm/scripts/rvm" ]] && . "$HOME/.rvm/scripts/rvm"
+
+rvm use 1.8.7
+bundle exec rake spec
+
+rvm use 1.9.2
+YAMLER=syck bundle exec rake spec
+
+YAMLER=psych bundle exec rake spec
+
+rvm use 1.9.3
+YAMLER=syck bundle exec rake spec
+
+YAMLER=psych bundle exec rake spec
+
+rvm use 2.0.0
+bundle exec rake spec
+
+rvm use 2.1.0
+bundle exec rake spec
+
+rvm use 2.1.1
+bundle exec rake spec
+
+rvm use 2.1.2
+bundle exec rake spec
+
+rvm use ruby-head
+bundle exec rake spec
+
+rvm use jruby
+JRUBY_OPTS=--1.8 bundle exec rake spec
+
+JRUBY_OPTS=--1.9 bundle exec rake spec
+
+JRUBY_OPTS=--2.0 bundle exec rake spec

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/safe_yaml.gemspec

@@ -0,0 +1,19 @@
+# -*- encoding: utf-8 -*-
+require File.join(File.dirname(__FILE__), "lib", "safe_yaml", "version")
+
+Gem::Specification.new do |gem|
+  gem.name          = "safe_yaml"
+  gem.version       = SafeYAML::VERSION
+  gem.authors       = "Dan Tao"
+  gem.email         = "daniel.tao@gmail.com"
+  gem.description   = %q{Parse YAML safely}
+  gem.summary       = %q{SameYAML provides an alternative implementation of YAML.load suitable for accepting user input in Ruby applications.}
+  gem.homepage      = "https://github.com/dtao/safe_yaml"
+  gem.license       = "MIT"
+  gem.files         = `git ls-files`.split($\)
+  gem.test_files    = gem.files.grep(%r{^spec/})
+  gem.require_paths = ["lib"]
+  gem.executables   = ["safe_yaml"]
+
+  gem.required_ruby_version = ">= 1.8.7"
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/spec/exploit.1.9.2.yaml

@@ -0,0 +1,2 @@
+--- !ruby/object:ExploitableBackDoor
+foo: bar

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/spec/exploit.1.9.3.yaml

@@ -0,0 +1,2 @@
+--- !ruby/hash:ExploitableBackDoor
+foo: bar

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/spec/issue48.txt

@@ -0,0 +1,20 @@
+---
+title: Blah
+key: value
+---
+
+I'm going to inject a bunch of YAML-looking stuff below and it should all just get ignored.
+
+foo: bar
+
+- foo
+- bar
+
+:foo
+42
+~
+
+---
+text: |
+  Look, I'm another YAML document!
+---

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/spec/libyaml_checker_spec.rb

@@ -0,0 +1,69 @@
+require "spec_helper"
+
+describe SafeYAML::LibyamlChecker do
+  describe "check_libyaml_version" do
+    REAL_YAML_ENGINE = SafeYAML::YAML_ENGINE
+    REAL_LIBYAML_VERSION = SafeYAML::LibyamlChecker::LIBYAML_VERSION
+
+    let(:libyaml_patched) { false }
+
+    before :each do
+      allow(SafeYAML::LibyamlChecker).to receive(:libyaml_patched?).and_return(libyaml_patched)
+    end
+
+    after :each do
+      silence_warnings do
+        SafeYAML::YAML_ENGINE = REAL_YAML_ENGINE
+        SafeYAML::LibyamlChecker::LIBYAML_VERSION = REAL_LIBYAML_VERSION
+      end
+    end
+
+    def test_libyaml_version_ok(expected_result, yaml_engine, libyaml_version=nil)
+      silence_warnings do
+        SafeYAML.const_set("YAML_ENGINE", yaml_engine)
+        SafeYAML::LibyamlChecker.const_set("LIBYAML_VERSION", libyaml_version)
+        expect(SafeYAML::LibyamlChecker.libyaml_version_ok?).to eq(expected_result)
+      end
+    end
+
+    unless defined?(JRUBY_VERSION)
+      it "issues no warnings when 'Syck' is the YAML engine" do
+        test_libyaml_version_ok(true, "syck")
+      end
+
+      it "issues a warning if Psych::LIBYAML_VERSION is not defined" do
+        test_libyaml_version_ok(false, "psych")
+      end
+
+      it "issues a warning if Psych::LIBYAML_VERSION is < 0.1.6" do
+        test_libyaml_version_ok(false, "psych", "0.1.5")
+      end
+
+      it "issues no warning if Psych::LIBYAML_VERSION is == 0.1.6" do
+        test_libyaml_version_ok(true, "psych", "0.1.6")
+      end
+
+      it "issues no warning if Psych::LIBYAML_VERSION is > 0.1.6" do
+        test_libyaml_version_ok(true, "psych", "1.0.0")
+      end
+
+      it "does a proper version comparison (not just a string comparison)" do
+        test_libyaml_version_ok(true, "psych", "0.1.10")
+      end
+
+      context "when the system has a known patched libyaml version" do
+        let(:libyaml_patched) { true }
+
+        it "issues no warning, even when Psych::LIBYAML_VERSION < 0.1.6" do
+          test_libyaml_version_ok(true, "psych", "0.1.4")
+        end
+      end
+    end
+
+    if defined?(JRUBY_VERSION)
+      it "issues no warning, as JRuby doesn't use libyaml" do
+        test_libyaml_version_ok(true, "psych", "0.1.4")
+      end
+    end
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/spec/psych_resolver_spec.rb

@@ -0,0 +1,10 @@
+require "spec_helper"
+
+if SafeYAML::YAML_ENGINE == "psych"
+  require "safe_yaml/psych_resolver"
+
+  describe SafeYAML::PsychResolver do
+    include ResolverSpecs
+    let(:resolver) { SafeYAML::PsychResolver.new }
+  end
+end

data/bundle/ruby/2.3.0/gems/safe_yaml-1.0.4/spec/resolver_specs.rb

@@ -0,0 +1,278 @@
+module ResolverSpecs
+  def self.included(base)
+    base.module_eval do
+      let(:resolver) { nil }
+      let(:result) { @result }
+
+      before :each do
+        # See the comment in the first before :each block in safe_yaml_spec.rb.
+        require "safe_yaml"
+      end
+
+      def parse(yaml)
+        tree = YAML.parse(yaml.unindent)
+        @result = resolver.resolve_node(tree)
+      end
+
+      # Isn't this how I should've been doing it all along?
+      def parse_and_test(yaml)
+        safe_result = parse(yaml)
+
+        exception_thrown = nil
+
+        unsafe_result = begin
+          YAML.unsafe_load(yaml)
+        rescue Exception => e
+          exception_thrown = e
+        end
+
+        if exception_thrown
+          # If the underlying YAML parser (e.g. Psych) threw an exception, I'm
+          # honestly not sure what the right thing to do is. For now I'll just
+          # print a warning. Should SafeYAML fail when Psych fails?
+          Kernel.warn "\n"
+          Kernel.warn "Discrepancy between SafeYAML and #{SafeYAML::YAML_ENGINE} on input:\n"
+          Kernel.warn "#{yaml.unindent}\n"
+          Kernel.warn "SafeYAML result:"
+          Kernel.warn "#{safe_result.inspect}\n"
+          Kernel.warn "#{SafeYAML::YAML_ENGINE} result:"
+          Kernel.warn "#{exception_thrown.inspect}\n"
+
+        else
+          expect(safe_result).to eq(unsafe_result)
+        end
+      end
+
+      context "by default" do
+        it "translates maps to hashes" do
+          parse <<-YAML
+            potayto: potahto
+            tomayto: tomahto
+          YAML
+
+          expect(result).to eq({
+            "potayto" => "potahto",
+            "tomayto" => "tomahto"
+          })
+        end
+
+        it "translates sequences to arrays" do
+          parse <<-YAML
+            - foo
+            - bar
+            - baz
+          YAML
+
+          expect(result).to eq(["foo", "bar", "baz"])
+        end
+
+        it "translates most values to strings" do
+          parse "string: value"
+          expect(result).to eq({ "string" => "value" })
+        end
+
+        it "does not deserialize symbols" do
+          parse ":symbol: value"
+          expect(result).to eq({ ":symbol" => "value" })
+        end
+
+        it "translates valid integral numbers to integers" do
+          parse "integer: 1"
+          expect(result).to eq({ "integer" => 1 })
+        end
+
+        it "translates valid decimal numbers to floats" do
+          parse "float: 3.14"
+          expect(result).to eq({ "float" => 3.14 })
+        end
+
+        it "translates valid dates" do
+          parse "date: 2013-01-24"
+          expect(result).to eq({ "date" => Date.parse("2013-01-24") })
+        end
+
+        it "translates valid true/false values to booleans" do
+          parse <<-YAML
+            - yes
+            - true
+            - no
+            - false
+          YAML
+
+          expect(result).to eq([true, true, false, false])
+        end
+
+        it "translates valid nulls to nil" do
+          parse <<-YAML
+            - 
+            - ~
+            - null
+          YAML
+
+          expect(result).to eq([nil] * 3)
+        end
+
+        it "matches the behavior of the underlying YAML engine w/ respect to capitalization of boolean values" do
+          parse_and_test <<-YAML
+            - true
+            - True
+            - TRUE
+            - tRue
+            - TRue
+            - False
+            - FALSE
+            - fAlse
+            - FALse
+          YAML
+
+          # using Syck: [true, true, true, "tRue", "TRue", false, false, "fAlse", "FALse"]
+          # using Psych: all booleans
+        end
+
+        it "matches the behavior of the underlying YAML engine w/ respect to capitalization of nil values" do
+          parse_and_test <<-YAML
+            - Null
+            - NULL
+            - nUll
+            - NUll
+          YAML
+
+          # using Syck: [nil, nil, "nUll", "NUll"]
+          # using Psych: all nils
+        end
+
+        it "translates quoted empty strings to strings (not nil)" do
+          parse "foo: ''"
+          expect(result).to eq({ "foo" => "" })
+        end
+
+        it "correctly reverse-translates strings encoded via #to_yaml" do
+          parse "5.10".to_yaml
+          expect(result).to eq("5.10")
+        end
+
+        it "does not specially parse any double-quoted strings" do
+          parse <<-YAML
+            - "1"
+            - "3.14"
+            - "true"
+            - "false"
+            - "2013-02-03"
+            - "2013-02-03 16:27:00 -0600"
+          YAML
+
+          expect(result).to eq(["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"])
+        end
+
+        it "does not specially parse any single-quoted strings" do
+          parse <<-YAML
+            - '1'
+            - '3.14'
+            - 'true'
+            - 'false'
+            - '2013-02-03'
+            - '2013-02-03 16:27:00 -0600'
+          YAML
+
+          expect(result).to eq(["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"])
+        end
+
+        it "deals just fine with nested maps" do
+          parse <<-YAML
+            foo:
+              bar:
+                marco: polo
+          YAML
+
+          expect(result).to eq({ "foo" => { "bar" => { "marco" => "polo" } } })
+        end
+
+        it "deals just fine with nested sequences" do
+          parse <<-YAML
+            - foo
+            -
+              - bar1
+              - bar2
+              -
+                - baz1
+                - baz2
+          YAML
+
+          expect(result).to eq(["foo", ["bar1", "bar2", ["baz1", "baz2"]]])
+        end
+
+        it "applies the same transformations to keys as to values" do
+          parse <<-YAML
+            foo: string
+            :bar: symbol
+            1: integer
+            3.14: float
+            2013-01-24: date
+          YAML
+
+          expect(result).to eq({
+            "foo"  => "string",
+            ":bar" => "symbol",
+            1      => "integer",
+            3.14   => "float",
+            Date.parse("2013-01-24") => "date",
+          })
+        end
+
+        it "applies the same transformations to elements in sequences as to all values" do
+          parse <<-YAML
+            - foo
+            - :bar
+            - 1
+            - 3.14
+            - 2013-01-24
+          YAML
+
+          expect(result).to eq(["foo", ":bar", 1, 3.14, Date.parse("2013-01-24")])
+        end
+      end
+
+      context "for Ruby version #{RUBY_VERSION}" do
+        it "translates valid time values" do
+          parse "time: 2013-01-29 05:58:00 -0800"
+          expect(result).to eq({ "time" => Time.utc(2013, 1, 29, 13, 58, 0) })
+        end
+
+        it "applies the same transformation to elements in sequences" do
+          parse "- 2013-01-29 05:58:00 -0800"
+          expect(result).to eq([Time.utc(2013, 1, 29, 13, 58, 0)])
+        end
+
+        it "applies the same transformation to keys" do
+          parse "2013-01-29 05:58:00 -0800: time"
+          expect(result).to eq({ Time.utc(2013, 1, 29, 13, 58, 0) => "time" })
+        end
+      end
+
+      context "with symbol deserialization enabled" do
+        before :each do
+          SafeYAML::OPTIONS[:deserialize_symbols] = true
+        end
+
+        after :each do
+          SafeYAML.restore_defaults!
+        end
+
+        it "translates values starting with ':' to symbols" do
+          parse "symbol: :value"
+          expect(result).to eq({ "symbol" => :value })
+        end
+
+        it "applies the same transformation to keys" do
+          parse ":bar: symbol"
+          expect(result).to eq({ :bar  => "symbol" })
+        end
+
+        it "applies the same transformation to elements in sequences" do
+          parse "- :bar"
+          expect(result).to eq([:bar])
+        end
+      end
+    end
+  end
+end