brakeman 3.6.1 → 3.6.2

data/bundle/ruby/2.3.0/gems/{terminal-table-1.7.3 → terminal-table-1.8.0}/lib/terminal-table/style.rb

@@ -24,6 +24,7 @@ module Terminal
     class Style
       @@defaults = {
         :border_x => "-", :border_y => "|", :border_i => "+",
+        :border_top => true, :border_bottom => true,
         :padding_left => 1, :padding_right => 1,
         :margin_left => '',
         :width => nil, :alignment => nil,
@@ -33,6 +34,8 @@ module Terminal
       attr_accessor :border_x
       attr_accessor :border_y
       attr_accessor :border_i
+      attr_accessor :border_top
+      attr_accessor :border_bottom
 
       attr_accessor :padding_left
       attr_accessor :padding_right

data/bundle/ruby/2.3.0/gems/{terminal-table-1.7.3 → terminal-table-1.8.0}/lib/terminal-table/table.rb

@@ -94,7 +94,7 @@ module Terminal
     # Return length of column _n_.
 
     def column_width n
-      width = column_widths[n] || 0
+      column_widths[n] || 0
     end
     alias length_of_column column_width # for legacy support
 
@@ -122,7 +122,7 @@ module Terminal
 
     def render
       separator = Separator.new(self)
-      buffer = [separator]
+      buffer = style.border_top ? [separator] : []
       unless @title.nil?
         buffer << Row.new(self, [title_cell_options])
         buffer << separator
@@ -137,7 +137,7 @@ module Terminal
         buffer += @rows.product([separator]).flatten
       else
         buffer += @rows
-        buffer << separator
+        buffer << separator if style.border_bottom
       end
       buffer.map { |r| style.margin_left + r.render.rstrip }.join("\n")
     end

data/bundle/ruby/2.3.0/gems/{terminal-table-1.7.3 → terminal-table-1.8.0}/lib/terminal-table/version.rb

@@ -1,5 +1,5 @@
 module Terminal
   class Table
-    VERSION = '1.7.3'
+    VERSION = '1.8.0'
   end
 end

data/bundle/ruby/2.3.0/gems/{terminal-table-1.7.3 → terminal-table-1.8.0}/terminal-table.gemspec

@@ -22,5 +22,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "term-ansicolor"
   spec.add_development_dependency "pry"
 
-  spec.add_runtime_dependency "unicode-display_width", "~> 1.1.1"
+  spec.add_runtime_dependency "unicode-display_width", ["~> 1.1", ">= 1.1.1"]
 end

data/bundle/ruby/2.3.0/gems/unicode-display_width-1.2.1/CHANGELOG.md

@@ -0,0 +1,92 @@
+# CHANGELOG
+
+## 1.2.1
+
+- Fix bug that `emoji: true` would fail for emoji without modifier
+
+## 1.2.0
+
+- Add zero-width codepoint ranges: U+2060..U+206F, U+FFF0..U+FFF8, U+E0000..U+E0FFF
+- Add full-witdh codepoint ranges: U+3400..U+4DBF, U+4E00..U+9FFF, U+F900..U+FAFF, U+20000..U+2FFFD, U+30000..U+3FFFD
+- Experimental emoji support using the [unicode-emoji](https://github.com/janlelis/unicode-emoji) gem
+- Fix minor bug in index compression scheme
+
+## 1.1.3
+
+- Fix that non-UTF-8 encodings do not throw errors, patch by @windwiny
+
+## 1.1.2
+
+- Reduce memory consumption and increase performance, patch by @rrosenblum
+
+## 1.1.1
+
+- Always load index into memory, fixes #9
+
+## 1.1.0
+
+- Support Unicode 9.0
+
+## 1.0.5
+
+- Actually include new index from 1.0.4
+
+## 1.0.4
+
+- New index format (much smaller) and internal API changes
+- Move index generation to a builder plugin for the unicoder gem
+- No public API changes
+
+## 1.0.3
+
+- Avoid circular dependency warning
+
+## 1.0.2
+
+- Fix error that gemspec might be invalid under some circumstances (see gh#6)
+
+## 1.0.1
+
+- Inofficially allow Ruby 1.9
+
+## 1.0.0
+
+- Faster than 0.3.1
+- Advanced determination of character width
+- This includes: Treat width of most chars of general categories (Mn, Me, Cf) as 0
+- This includes: Introduce list of characters with special widths
+- Allow custom overrides for specific codepoints
+- Set required Ruby version to 2.0
+- Add NO_STRING_EXT mode to disable monkey patching
+- Internal API & index format changed drastically
+- Remove require 'unicode/display_size' (use 'unicode/display_width' instead)
+
+## 0.3.1
+
+- Faster than 0.3.0
+- Deprecate usage of aliases: String#display_size and String#display_length
+- Eliminate Ruby warnings (@amatsuda)
+
+## 0.3.0
+
+- Update EastAsianWidth from 7.0 to 8.0
+- Add rake task to update EastAsianWidth.txt
+- Move code to generate index from library to Rakefile
+- Update project's meta files
+- Deprecate requiring 'unicode-display_size'
+
+## 0.2.0
+
+- Update EastAsianWidth from 6.0 to 7.0
+- Don't build index table automatically when not available
+- Don't include EastAsianWidth.txt in gem (only index)
+
+
+## 0.1.0
+
+- Fix github issue #1
+
+
+## 0.1.0
+
+- Initial release

data/bundle/ruby/2.3.0/gems/{unicode-display_width-1.1.3 → unicode-display_width-1.2.1}/README.md

@@ -22,7 +22,9 @@ X      | (user defined)               | Overwrites any other values
 3      | `"\u{2E3B}"`                 | THREE-EM DASH
 0      | General Categories: Mn, Me, Cf (non-arabic) | Excludes ARABIC format characters
 0      | `"\u{1160}".."\u{11FF}"`     | HANGUL JUNGSEONG
+0      | `"\u{2060}".."\u{206F}"`, `"\u{FFF0}".."\u{FFF8}"`, `"\u{E0000}".."\u{E0FFF}"` | Ignorable ranges
 2      | East Asian Width: F, W       | Full-width characters
+2      | `"\u{3400}".."\u{4DBF}"`, `"\u{4E00}".."\u{9FFF}"`, `"\u{F900}".."\u{FAFF}"`, `"\u{20000}".."\u{2FFFD}"`, `"\u{30000}".."\u{3FFFD}"` | Full-width ranges
 1 or 2 | East Asian Width: A          | Ambiguous characters, user defined, default: 1
 1      | All other codepoints         | -
 
@@ -30,7 +32,7 @@ X      | (user defined)               | Overwrites any other values
 
 Install the gem with:
 
-    gem install unicode-display_width
+    $ gem install unicode-display_width
 
 Or add to your Gemfile:
 
@@ -62,6 +64,22 @@ You can overwrite how to handle specific code points by passing a hash (or even
 Unicode::DisplayWidth.of("a\tb", 1, 0x09 => 10)) # => 12
 ```
 
+### Emoji Support
+
+Experimental emoji support is included. It will adjust the string's size for modifier and zero-width joiner sequences. You will need to add the [unicode-emoji](https://github.com/janlelis/unicode-emoji) gem to your Gemfile:
+
+```ruby
+gem 'unicode-display_width'
+gem 'unicode-emoji'
+```
+
+You can then activate the emoji string width adjustments by passing `emoji: true` as fourth parameter:
+
+```ruby
+Unicode::DisplayWidth.of "🤾🏽‍♀️" # => 5
+Unicode::DisplayWidth.of "🤾🏽‍♀️", 1, {}, emoji: true # => 2
+```
+
 ### Usage with String Extension
 
 Activated by default. Will be deactivated in version 2.0:

data/bundle/ruby/2.3.0/gems/{unicode-display_width-1.1.3 → unicode-display_width-1.2.1}/Rakefile

@@ -37,6 +37,7 @@ desc "#{gemspec.name} | Test"
 task :test do
   sh "rspec spec"
 end
+task :spec => :test
 task :default => :test
 
 # # #

data/bundle/ruby/2.3.0/gems/{unicode-display_width-1.1.3 → unicode-display_width-1.2.1}/lib/unicode/display_width.rb

@@ -5,7 +5,7 @@ module Unicode
   module DisplayWidth
     DEPTHS = [0x10000, 0x1000, 0x100, 0x10].freeze
 
-    def self.of(string, ambiguous = 1, overwrite = {})
+    def self.of(string, ambiguous = 1, overwrite = {}, options = {})
       res = string.codepoints.inject(0){ |total_width, codepoint|
         index_or_value = INDEX
         codepoint_depth_offset = codepoint
@@ -19,8 +19,27 @@ module Unicode
         total_width + (overwrite[codepoint] || width || 1)
       }
 
+      res -= emoji_extra_width_of(string) if options[:emoji]
       res < 0 ? 0 : res
     end
+
+    def self.emoji_extra_width_of(string, ambiguous = 1, overwrite = {}, _ = {})
+      require "unicode/emoji"
+
+      extra_width = 0
+      modifier_regex = /[#{ Unicode::Emoji::EMOJI_MODIFIERS.pack("U*") }]/
+      zwj_regex = /(?<=#{ [Unicode::Emoji::ZWJ].pack("U") })./
+
+      string.scan(Unicode::Emoji::REGEX){ |emoji|
+        extra_width += 2 * emoji.scan(modifier_regex).size
+
+        emoji.scan(zwj_regex){ |zwj_succ|
+          extra_width += self.of(zwj_succ, ambiguous, overwrite)
+        }
+      }
+
+      extra_width
+    end
   end
 end
 

data/bundle/ruby/2.3.0/gems/{unicode-display_width-1.1.3 → unicode-display_width-1.2.1}/lib/unicode/display_width/constants.rb

@@ -1,6 +1,6 @@
 module Unicode
   module DisplayWidth
-    VERSION = '1.1.3'
+    VERSION = '1.2.1'
     UNICODE_VERSION = "9.0.0".freeze
     DATA_DIRECTORY = File.expand_path(File.dirname(__FILE__) + '/../../../data/').freeze
     INDEX_FILENAME = (DATA_DIRECTORY + '/display_width.marshal.gz').freeze

data/bundle/ruby/2.3.0/gems/{unicode-display_width-1.1.3 → unicode-display_width-1.2.1}/lib/unicode/display_width/string_ext.rb

@@ -1,8 +1,8 @@
 require_relative '../display_width' unless defined? Unicode::DisplayWidth
 
 class String
-  def display_width(ambiguous = 1, overwrite = {})
-    Unicode::DisplayWidth.of(self, ambiguous, overwrite)
+  def display_width(ambiguous = 1, overwrite = {}, options = {})
+    Unicode::DisplayWidth.of(self, ambiguous, overwrite, options)
   end
 
   def display_size(*args)

data/bundle/ruby/2.3.0/gems/{unicode-display_width-1.1.3 → unicode-display_width-1.2.1}/spec/display_width_spec.rb

@@ -1,6 +1,4 @@
-# coding: utf-8
-
-require 'unicode/display_width'
+require_relative '../lib/unicode/display_width'
 
 describe 'Unicode::DisplayWidth.of' do
   describe '[east asian width]' do
@@ -12,6 +10,10 @@ describe 'Unicode::DisplayWidth.of' do
       expect( '一'.display_width ).to eq 2
     end
 
+    it 'returns 2 for W (which are currently unassigned)' do
+      expect( "\u{3FFFD}".display_width ).to eq 2
+    end
+
     it 'returns 1 for N' do
       expect( 'À'.display_width ).to eq 1
     end
@@ -53,6 +55,18 @@ describe 'Unicode::DisplayWidth.of' do
     it 'returns 0 for HANGUL JUNGSEONG chars' do
       expect( 'ᅠ'.display_width ).to eq 0
     end
+
+    it 'returns 0 for U+2060..U+206F' do
+      expect( "\u{2060}".display_width ).to eq 0
+    end
+
+    it 'returns 0 for U+FFF0..U+FFF8' do
+      expect( "\u{FFF0}".display_width ).to eq 0
+    end
+
+    it 'returns 0 for U+E0000..U+E0FFF' do
+      expect( "\u{E0000}".display_width ).to eq 0
+    end
   end
 
   describe '[special characters]' do
@@ -129,4 +143,14 @@ describe 'Unicode::DisplayWidth.of' do
       expect( 'À'.encode("UTF-16LE").display_width ).to eq 1
     end
   end
+
+  describe '[emoji]' do
+    it 'does not count modifiers and zjw sequences for valid emoji' do
+      expect( "🤾🏽‍♀️".display_width(1, {}, emoji: true) ).to eq 2
+    end
+
+    it 'works with flags' do
+      expect( "🇵🇹".display_width(1, {}, emoji: true) ).to eq 2
+    end
+  end
 end

data/bundle/ruby/2.3.0/gems/{unicode-display_width-1.1.3 → unicode-display_width-1.2.1}/unicode-display_width.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |s|
   s.summary = "Determines the monospace display width of a string in Ruby."
   s.description =  "[Unicode #{Unicode::DisplayWidth::UNICODE_VERSION}] Determines the monospace display width of a string using EastAsianWidth.txt, Unicode general category, and other data."
   s.files = Dir.glob(%w[{lib,spec}/**/*.rb [A-Z]*.{txt,rdoc} data/display_width.marshal.gz]) + %w{Rakefile unicode-display_width.gemspec}
-  s.extra_rdoc_files = ["README.md", "MIT-LICENSE.txt", "CHANGELOG.txt"]
+  s.extra_rdoc_files = ["README.md", "MIT-LICENSE.txt", "CHANGELOG.md"]
   s.license = 'MIT'
   s.required_ruby_version = '>= 1.9.3'
   s.add_development_dependency 'rspec', '~> 3.4'

data/lib/brakeman.rb

@@ -114,6 +114,14 @@ module Brakeman
         # After parsing the yaml config file for options, convert any string keys into symbols.
         options.keys.select {|k| k.is_a? String}.map {|k| k.to_sym }.each {|k| options[k] = options[k.to_s]; options.delete(k.to_s) }
 
+        unless line_options[:allow_check_paths_in_config]
+          if options.include? :additional_checks_path
+            options.delete :additional_checks_path
+
+            notify "[Notice] Ignoring additional check paths in config file. Use --allow-check-paths-in-config to allow" unless (options[:quiet] || quiet)
+          end
+        end
+
         # notify if options[:quiet] and quiet is nil||false
         notify "[Notice] Using configuration in #{config}" unless (options[:quiet] || quiet)
         options
@@ -269,43 +277,6 @@ module Brakeman
     end
   end
 
-  #Installs Rake task for running Brakeman,
-  #which basically means copying `lib/brakeman/brakeman.rake` to
-  #`lib/tasks/brakeman.rake` in the current Rails application.
-  def self.install_rake_task install_path = nil
-    if install_path
-      rake_path = File.join(install_path, "Rakefile")
-      task_path = File.join(install_path, "lib", "tasks", "brakeman.rake")
-    else
-      rake_path = "Rakefile"
-      task_path = File.join("lib", "tasks", "brakeman.rake")
-    end
-
-    if not File.exist? rake_path
-      raise RakeInstallError, "No Rakefile detected"
-    elsif File.exist? task_path
-      raise RakeInstallError, "Task already exists"
-    end
-
-    require 'fileutils'
-
-    if not File.exist? "lib/tasks"
-      notify "Creating lib/tasks"
-      FileUtils.mkdir_p "lib/tasks"
-    end
-
-    path = File.expand_path(File.dirname(__FILE__))
-
-    FileUtils.cp "#{path}/brakeman/brakeman.rake", task_path
-
-    if File.exist? task_path
-      notify "Task created in #{task_path}"
-      notify "Usage: rake brakeman:run[output_file]"
-    else
-      raise RakeInstallError, "Could not create task"
-    end
-  end
-
   #Output configuration to YAML
   def self.dump_config options
     require 'yaml'
@@ -534,7 +505,6 @@ module Brakeman
   end
 
   class DependencyError < RuntimeError; end
-  class RakeInstallError < RuntimeError; end
   class NoBrakemanError < RuntimeError; end
   class NoApplication < RuntimeError; end
   class MissingChecksError < RuntimeError; end

data/lib/brakeman/checks/base_check.rb

@@ -6,6 +6,7 @@ require 'brakeman/util'
 #Basis of vulnerability checks.
 class Brakeman::BaseCheck < Brakeman::SexpProcessor
   include Brakeman::ProcessorHelper
+  include Brakeman::SafeCallHelper
   include Brakeman::Util
   attr_reader :tracker, :warnings
 

data/lib/brakeman/checks/check_session_settings.rb

@@ -115,7 +115,13 @@ class Brakeman::CheckSessionSettings < Brakeman::BaseCheck
       yaml = @app_tree.read secrets_file
       require 'date' # https://github.com/dtao/safe_yaml/issues/80
       require 'safe_yaml/load'
-      secrets = SafeYAML.load yaml
+      begin
+        secrets = SafeYAML.load yaml
+      rescue Psych::SyntaxError, RuntimeError => e
+        Brakeman.notify "[Notice] #{self.class}: Unable to parse `#{secrets_file}`"
+        Brakeman.debug "Failed to parse #{secrets_file}: #{e.inspect}"
+        return
+      end
 
       if secrets["production"] and secret = secrets["production"]["secret_key_base"]
         unless secret.include? "<%="

data/lib/brakeman/checks/check_sql.rb

@@ -164,7 +164,9 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     dangerous_value = case method
                       when :find
                         check_find_arguments call.second_arg
-                      when :exists?, :delete_all, :destroy_all
+                      when :exists?
+                        check_exists call.first_arg
+                      when :delete_all, :destroy_all
                         check_find_arguments call.first_arg
                       when :named_scope, :scope
                         check_scope_arguments call
@@ -633,6 +635,14 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     end
   end
 
+  def check_exists arg
+    if call? arg and arg.method == :to_s
+      false
+    else
+      check_find_arguments arg
+    end
+  end
+
   #Prior to Rails 2.1.1, the :offset and :limit parameters were not
   #escaping input properly.
   #