brakeman 3.7.2 → 5.4.1

data/lib/brakeman/warning.rb

@@ -1,36 +1,50 @@
 require 'json'
 require 'digest/sha2'
 require 'brakeman/warning_codes'
+require 'brakeman/messages'
 
 #The Warning class stores information about warnings
 class Brakeman::Warning
-  attr_reader :called_from, :check, :class, :confidence, :controller,
+  attr_reader :called_from, :check, :class, :confidence, :controller, :cwe_id,
     :line, :method, :model, :template, :user_input, :user_input_type,
     :warning_code, :warning_set, :warning_type
 
-  attr_accessor :code, :context, :file, :message, :relative_path
-
-  TEXT_CONFIDENCE = [ "High", "Medium", "Weak" ]
-
-  OPTIONS = {:called_from => :@called_from,
-              :check => :@check,
-              :class => :@class,
-              :code => :@code,
-              :confidence => :@confidence,
-              :controller => :@controller,
-              :file => :@file,
-              :gem_info => :@gem_info,
-              :line => :@line,
-              :link_path => :@link_path,
-              :message => :@message,
-              :method => :@method,
-              :model => :@model,
-              :relative_path => :@relative_path,
-              :template => :@template,
-              :user_input => :@user_input,
-              :warning_set => :@warning_set,
-              :warning_type => :@warning_type
-            }
+  attr_accessor :code, :context, :file, :message
+
+  TEXT_CONFIDENCE = {
+    0 => "High",
+    1 => "Medium",
+    2 => "Weak",
+  }
+
+  CONFIDENCE = {
+    :high => 0,
+    :med => 1,
+    :medium => 1,
+    :low => 2,
+    :weak => 2,
+  }
+
+  OPTIONS = {
+    :called_from => :@called_from,
+    :check => :@check,
+    :class => :@class,
+    :code => :@code,
+    :controller => :@controller,
+    :cwe_id => :@cwe_id,
+    :file => :@file,
+    :gem_info => :@gem_info,
+    :line => :@line,
+    :link => :@link,
+    :link_path => :@link_path,
+    :message => :@message,
+    :method => :@method,
+    :model => :@model,
+    :template => :@template,
+    :user_input => :@user_input,
+    :warning_set => :@warning_set,
+    :warning_type => :@warning_type,
+  }
 
   #+options[:result]+ can be a result from Tracker#find_call. Otherwise, it can be +nil+.
   def initialize options = {}
@@ -40,6 +54,8 @@ class Brakeman::Warning
       self.instance_variable_set(var, options[key])
     end
 
+    self.confidence = options[:confidence]
+
     result = options[:result]
     if result
       @code ||= result[:call]
@@ -85,9 +101,11 @@ class Brakeman::Warning
     unless @warning_set
       if self.model
         @warning_set = :model
+        @file ||= self.model.file
       elsif self.template
         @warning_set = :template
         @called_from = self.template.render_path
+        @file ||= self.template.file
       elsif self.controller
         @warning_set = :controller
       else
@@ -97,10 +115,16 @@ class Brakeman::Warning
 
     if options[:warning_code]
       @warning_code = Brakeman::WarningCodes.code options[:warning_code]
+    else
+      @warning_code = nil
     end
 
     Brakeman.debug("Warning created without warning code: #{options[:warning_code]}") unless @warning_code
 
+    if options[:message].is_a? String
+      @message = Brakeman::Messages::Message.new(options[:message])
+    end
+
     @format_message = nil
     @row = nil
   end
@@ -113,6 +137,20 @@ class Brakeman::Warning
     self.hash == other_warning.hash
   end
 
+  def confidence= conf
+    @confidence = case conf
+                  when Integer
+                    conf
+                  when Symbol
+                    CONFIDENCE[conf]
+                  else
+                    raise "Could not set confidence to `#{conf}`"
+                  end
+
+    raise "Could not set confidence to `#{conf}`" unless @confidence
+    raise "Invalid confidence: `#{@confidence}`" unless TEXT_CONFIDENCE[@confidence]
+  end
+
   #Returns name of a view, including where it was rendered from
   def view_name(include_renderer = true)
     if called_from and include_renderer
@@ -148,7 +186,7 @@ class Brakeman::Warning
   def format_message
     return @format_message if @format_message
 
-    @format_message = self.message.dup
+    @format_message = self.message.to_s.dup
 
     if self.line
       @format_message << " near line #{self.line}"
@@ -168,11 +206,11 @@ class Brakeman::Warning
       if @link_path.start_with? "http"
         @link = @link_path
       else
-        @link = "http://brakemanscanner.org/docs/warning_types/#{@link_path}"
+        @link = "https://brakemanscanner.org/docs/warning_types/#{@link_path}"
       end
     else
       warning_path = self.warning_type.to_s.downcase.gsub(/\s+/, '_') + "/"
-      @link = "http://brakemanscanner.org/docs/warning_types/#{warning_path}"
+      @link = "https://brakemanscanner.org/docs/warning_types/#{warning_path}"
     end
 
     @link
@@ -180,15 +218,16 @@ class Brakeman::Warning
 
   #Generates a hash suitable for inserting into a table
   def to_row type = :warning
-    @row = { "Confidence" => self.confidence,
+    @row = { "Confidence" => TEXT_CONFIDENCE[self.confidence],
       "Warning Type" => self.warning_type.to_s,
-      "Message" => self.format_message }
+      "CWE ID" => self.cwe_id,
+      "Message" => self.message }
 
     case type
     when :template
       @row["Template"] = self.view_name.to_s
     when :model
-      @row["Model"] = self.model.to_s
+      @row["Model"] = self.model.name.to_s
     when :controller
       @row["Controller"] = self.controller.to_s
     when :warning
@@ -202,7 +241,7 @@ class Brakeman::Warning
   def to_s
    output =  "(#{TEXT_CONFIDENCE[self.confidence]}) #{self.warning_type} - #{self.message}"
    output << " near line #{self.line}" if self.line
-   output << " in #{self.file}" if self.file
+   output << " in #{self.file.relative}" if self.file
    output << ": #{self.format_code}" if self.code
 
    output
@@ -214,40 +253,59 @@ class Brakeman::Warning
     warning_code_string = sprintf("%03d", @warning_code)
     code_string = @code.inspect
 
-    Digest::SHA2.new(256).update("#{warning_code_string}#{code_string}#{location_string}#{@relative_path}#{self.confidence}").to_s
+    Digest::SHA2.new(256).update("#{warning_code_string}#{code_string}#{location_string}#{self.file.relative}#{self.confidence}").to_s
   end
 
   def location include_renderer = true
     case @warning_set
     when :template
-      location = { :type => :template, :template => self.view_name(include_renderer) }
+      { :type => :template, :template => self.view_name(include_renderer) }
     when :model
-      location = { :type => :model, :model => self.model }
+      { :type => :model, :model => self.model.name }
     when :controller
-      location = { :type => :controller, :controller => self.controller }
+      { :type => :controller, :controller => self.controller }
     when :warning
       if self.class
-        location = { :type => :method, :class => self.class, :method => self.method }
+        { :type => :method, :class => self.class, :method => self.method }
       else
-        location = nil
+        nil
       end
     end
   end
 
-  def to_hash
+  def relative_path
+    self.file.relative
+  end
+
+  def check_name
+    @check_name ||= self.check.sub(/^Brakeman::Check/, '')
+  end
+
+  def confidence_name
+    TEXT_CONFIDENCE[self.confidence]
+  end
+
+  def to_hash absolute_paths: true
+    if self.called_from and not absolute_paths
+      render_path = self.called_from.with_relative_paths
+    else
+      render_path = self.called_from
+    end
+
     { :warning_type => self.warning_type,
       :warning_code => @warning_code,
       :fingerprint => self.fingerprint,
-      :check_name => self.check.gsub(/^Brakeman::Check/, ''),
-      :message => self.message,
-      :file => self.file,
+      :check_name => self.check_name,
+      :message => self.message.to_s,
+      :file => (absolute_paths ? self.file.absolute : self.file.relative),
       :line => self.line,
       :link => self.link,
       :code => (@code && self.format_code(false)),
-      :render_path => self.called_from,
+      :render_path => render_path,
       :location => self.location(false),
       :user_input => (@user_input && self.format_user_input(false)),
-      :confidence => TEXT_CONFIDENCE[self.confidence]
+      :confidence => self.confidence_name,
+      :cwe_id => cwe_id
     }
   end
 

data/lib/brakeman/warning_codes.rb

@@ -105,6 +105,33 @@ module Brakeman::WarningCodes
     :secret_in_source => 101,
     :CVE_2016_6316 => 102,
     :CVE_2016_6317 => 103,
+    :divide_by_zero => 104,
+    :dangerous_permit_key => 105,
+    :CVE_2018_8048 => 106,
+    :CVE_2018_3741 => 107,
+    :CVE_2018_3760 => 108,
+    :force_ssl_disabled => 109,
+    :unsafe_cookie_serialization => 110,
+    :reverse_tabnabbing => 111,
+    :mass_assign_permit_all => 112,
+    :json_html_escape_config => 113,
+    :json_html_escape_module => 114,
+    :CVE_2020_8159 => 115,
+    :CVE_2020_8166 => 116,
+    :erb_template_injection => 117,
+    :http_verb_confusion => 118,
+    :unsafe_method_reflection => 119,
+    :eol_rails => 120,
+    :eol_ruby => 121,
+    :pending_eol_rails => 122,
+    :pending_eol_ruby => 123,
+    :CVE_2022_32209 => 124,
+    :pathname_traversal => 125,
+    :insecure_rsa_padding_mode => 126,
+    :missing_rsa_padding_mode => 127,
+    :small_rsa_key_size => 128,
+
+    :custom_check => 9090,
   }
 
   def self.code name

data/lib/brakeman.rb

@@ -20,6 +20,10 @@ module Brakeman
   #option is set
   Errors_Found_Exit_Code = 7
 
+  #Exit code returned when an ignored warning has no note and
+  #--ensure-ignore-notes is set
+  Empty_Ignore_Note_Exit_Code = 8
+
   @debug = false
   @quiet = false
   @loaded_dependencies = []
@@ -38,7 +42,8 @@ module Brakeman
   #  * :combine_locations - combine warning locations (default: true)
   #  * :config_file - configuration file
   #  * :escape_html - escape HTML by default (automatic)
-  #  * :exit_on_warn - return false if warnings found, true otherwise. Not recommended for library use (default: false)
+  #  * :exit_on_error - only affects Commandline module (default: true)
+  #  * :exit_on_warn - only affects Commandline module (default: true)
   #  * :github_repo - github repo to use for file links (user/repo[/path][@ref])
   #  * :highlight_user_input - highlight user input in reported warnings (default: true)
   #  * :html_style - path to CSS file
@@ -50,13 +55,19 @@ module Brakeman
   #  * :output_files - files for output
   #  * :output_formats - formats for output (:to_s, :to_tabs, :to_csv, :to_html)
   #  * :parallel_checks - run checks in parallel (default: true)
+  #  * :parser_timeout - set timeout for parsing an individual file (default: 10 seconds)
   #  * :print_report - if no output file specified, print to stdout (default: false)
   #  * :quiet - suppress most messages (default: true)
   #  * :rails3 - force Rails 3 mode (automatic)
+  #  * :rails4 - force Rails 4 mode (automatic)
+  #  * :rails5 - force Rails 5 mode (automatic)
+  #  * :rails6 - force Rails 6 mode (automatic)
   #  * :report_routes - show found routes on controllers (default: false)
   #  * :run_checks - array of checks to run (run all if not specified)
   #  * :safe_methods - array of methods to consider safe
+  #  * :sql_safe_methods - array of sql sanitization methods to consider safe
   #  * :skip_libs - do not process lib/ directory (default: false)
+  #  * :skip_vendor - do not process vendor/ directory (default: true)
   #  * :skip_checks - checks not to run (run all if not specified)
   #  * :absolute_paths - show absolute path of each file (default: false)
   #  * :summary_only - only output summary section of report for plain/table (:summary_only, :no_summary, true)
@@ -71,6 +82,7 @@ module Brakeman
     if @quiet
       options[:report_progress] = false
     end
+
     scan options
   end
 
@@ -96,6 +108,10 @@ module Brakeman
     elsif options[:rails5]
       options[:rails3] = true
       options[:rails4] = true
+    elsif options[:rails6]
+      options[:rails3] = true
+      options[:rails4] = true
+      options[:rails5] = true
     end
 
     options[:output_formats] = get_output_formats options
@@ -142,10 +158,17 @@ module Brakeman
     end
   end
 
-  CONFIG_FILES = [
-    File.expand_path("~/.brakeman/config.yml"),
-    File.expand_path("/etc/brakeman/config.yml")
-  ]
+  CONFIG_FILES = begin
+                   [
+                     File.expand_path("~/.brakeman/config.yml"),
+                     File.expand_path("/etc/brakeman/config.yml")
+                   ]
+                 rescue ArgumentError
+                   # In case $HOME or $USER aren't defined for use of `~`
+                   [
+                     File.expand_path("/etc/brakeman/config.yml")
+                   ]
+                 end
 
   def self.config_file custom_location, app_path
     app_config = File.expand_path(File.join(app_path, "config", "brakeman.yml"))
@@ -156,23 +179,29 @@ module Brakeman
   #Default set of options
   def self.default_options
     { :assume_all_routes => true,
-      :skip_checks => Set.new,
       :check_arguments => true,
-      :safe_methods => Set.new,
-      :min_confidence => 2,
-      :combine_locations => true,
       :collapse_mass_assignment => false,
+      :combine_locations => true,
+      :engine_paths => ["engines/*"],
+      :exit_on_error => true,
+      :exit_on_warn => true,
       :highlight_user_input => true,
-      :ignore_redirect_to_model => true,
+      :html_style => "#{File.expand_path(File.dirname(__FILE__))}/brakeman/format/style.css",
       :ignore_model_output => false,
+      :ignore_redirect_to_model => true,
       :index_libs => true,
       :message_limit => 100,
+      :min_confidence => 2,
+      :output_color => true,
+      :pager => true,
       :parallel_checks => true,
+      :parser_timeout => 10,
       :relative_path => false,
       :report_progress => true,
-      :html_style => "#{File.expand_path(File.dirname(__FILE__))}/brakeman/format/style.css",
-      :output_color => true,
-      :engine_paths => ["engines/*"]
+      :safe_methods => Set.new,
+      :sql_safe_methods => Set.new,
+      :skip_checks => Set.new,
+      :skip_vendor => true,
     }
   end
 
@@ -213,10 +242,20 @@ module Brakeman
       [:to_markdown]
     when :cc, :to_cc, :codeclimate, :to_codeclimate
       [:to_codeclimate]
-    when :plain ,:to_plain
-      [:to_plain]
+    when :plain ,:to_plain, :text, :to_text, :to_s
+      [:to_text]
+    when :table, :to_table
+      [:to_table]
+    when :junit, :to_junit
+      [:to_junit]
+    when :sarif, :to_sarif
+      [:to_sarif]
+    when :sonar, :to_sonar
+      [:to_sonar]
+    when :github, :to_github
+      [:to_github]
     else
-      [:to_s]
+      [:to_text]
     end
   end
   private_class_method :get_formats_from_output_format
@@ -239,9 +278,19 @@ module Brakeman
       when /(\.cc|\.codeclimate)$/i
         :to_codeclimate
       when /\.plain$/i
-        :to_plain
+        :to_text
+      when /\.table$/i
+        :to_table
+      when /\.junit$/i
+        :to_junit
+      when /\.sarif$/i
+        :to_sarif
+      when /\.sonar$/i
+        :to_sonar
+      when /\.github$/i
+        :to_github
       else
-        :to_s
+        :to_text
       end
     end
   end
@@ -337,7 +386,7 @@ module Brakeman
     scanner = Scanner.new options
     tracker = scanner.tracker
 
-    check_for_missing_checks options[:run_checks], options[:skip_checks]
+    check_for_missing_checks options[:run_checks], options[:skip_checks], options[:enable_checks]
 
     notify "Processing application in #{tracker.app_path}"
     scanner.process
@@ -345,7 +394,7 @@ module Brakeman
     if options[:parallel_checks]
       notify "Running checks in parallel..."
     else
-      notify "Runnning checks..."
+      notify "Running checks..."
     end
 
     tracker.run_checks
@@ -367,7 +416,7 @@ module Brakeman
 
   def self.write_report_to_files tracker, output_files
     require 'fileutils'
-    tracker.options[:output_color] = false
+    tracker.options[:output_color] = false unless tracker.options[:output_color] == :force
 
     output_files.each_with_index do |output_file, idx|
       dir = File.dirname(output_file)
@@ -384,12 +433,18 @@ module Brakeman
   private_class_method :write_report_to_files
 
   def self.write_report_to_formats tracker, output_formats
-    unless $stdout.tty?
+    unless $stdout.tty? or tracker.options[:output_color] == :force
       tracker.options[:output_color] = false
     end
 
-    output_formats.each do |output_format|
-      puts tracker.report.format(output_format)
+    if not $stdout.tty? or not tracker.options[:pager] or output_formats.length > 1 # does this ever happen??
+      output_formats.each do |output_format|
+        puts tracker.report.format(output_format)
+      end
+    else
+      require "brakeman/report/pager"
+
+      Brakeman::Pager.new(tracker).page_report(tracker.report, output_formats.first)
     end
   end
   private_class_method :write_report_to_formats
@@ -424,7 +479,7 @@ module Brakeman
     $stderr.puts message if @debug
   end
 
-  # Compare JSON ouptut from a previous scan and return the diff of the two scans
+  # Compare JSON output from a previous scan and return the diff of the two scans
   def self.compare options
     require 'json'
     require 'brakeman/differ'
@@ -470,6 +525,18 @@ module Brakeman
     end
   end
 
+  # Returns an array of alert fingerprints for any ignored warnings without
+  # notes found in the specified ignore file (if it exists).
+  def self.ignore_file_entries_with_empty_notes file
+    return [] unless file
+
+    require 'brakeman/report/ignore/config'
+
+    config = IgnoreConfig.new(file, nil)
+    config.read_from_file
+    config.already_ignored_entries_with_empty_notes.map { |i| i[:fingerprint] }
+  end
+
   def self.filter_warnings tracker, options
     require 'brakeman/report/ignore/config'
 
@@ -504,11 +571,13 @@ module Brakeman
     end if options[:additional_checks_path]
   end
 
-  def self.check_for_missing_checks included_checks, excluded_checks
-    missing = Brakeman::Checks.missing_checks(included_checks || Set.new, excluded_checks || Set.new)
+  def self.check_for_missing_checks included_checks, excluded_checks, enabled_checks
+    checks = included_checks.to_a + excluded_checks.to_a + enabled_checks.to_a
+
+    missing = Brakeman::Checks.missing_checks(checks)
 
     unless missing.empty?
-      raise MissingChecksError, "Could not find specified check#{missing.length > 1 ? 's' : ''}: #{missing.to_a.join(', ')}"
+      raise MissingChecksError, "Could not find specified check#{missing.length > 1 ? 's' : ''}: #{missing.map {|c| "`#{c}`"}.join(', ')}"
     end
   end
 

data/lib/ruby_parser/bm_sexp.rb

@@ -4,6 +4,7 @@
 class Sexp
   attr_accessor :original_line, :or_depth
   ASSIGNMENT_BOOL = [:gasgn, :iasgn, :lasgn, :cvdecl, :cvasgn, :cdecl, :or, :and, :colon2, :op_asgn_or]
+  CALLS = [:call, :attrasgn, :safe_call, :safe_attrasgn]
 
   def method_missing name, *args
     #Brakeman does not use this functionality,
@@ -39,7 +40,7 @@ class Sexp
       s.line(line)
     else
       s.original_line = self.original_line
-      s.line(self.line)
+      s.line(self.line) if self.line
     end
 
     s
@@ -174,7 +175,7 @@ class Sexp
     start_index = 3
 
     if exp.is_a? Sexp and exp.node_type == :arglist
-      exp = exp[1..-1]
+      exp = exp.sexp_body
     end
 
     exp.each_with_index do |e, i|
@@ -197,10 +198,10 @@ class Sexp
 
     case self.node_type
     when :call, :attrasgn, :safe_call, :safe_attrasgn
-      self[3..-1].unshift :arglist
+      self.sexp_body(3).unshift :arglist
     when :super, :zsuper
       if self[1]
-        self[1..-1].unshift :arglist
+        self.sexp_body.unshift :arglist
       else
         Sexp.new(:arglist)
       end
@@ -217,13 +218,13 @@ class Sexp
     case self.node_type
     when :call, :attrasgn, :safe_call, :safe_attrasgn
       if self[3]
-        self[3..-1]
+        self.sexp_body(3)
       else
         Sexp.new
       end
     when :super, :zsuper
       if self[1]
-        self[1..-1]
+        self.sexp_body
       else
         Sexp.new
       end
@@ -307,6 +308,21 @@ class Sexp
     end
   end
 
+  def call_chain
+    expect :call, :attrasgn, :safe_call, :safe_attrasgn
+
+    chain = []
+    call = self
+
+    while call.class == Sexp and CALLS.include? call.first 
+      chain << call.method
+      call = call.target
+    end
+
+    chain.reverse!
+    chain
+  end
+
   #Returns condition of an if expression:
   #
   #    s(:if,
@@ -355,7 +371,12 @@ class Sexp
   #       s(:block, s(:lvar, :y), s(:call, nil, :z, s(:arglist))))
   def block_call
     expect :iter
-    self[1]
+
+    if self[1].node_type == :lambda
+      s(:call, nil, :lambda).line(self.line)
+    else
+      self[1]
+    end
   end
 
   #Returns block of a call with a block.
@@ -490,6 +511,10 @@ class Sexp
 
     self.slice!(index..-1) #Remove old body
 
+    if exp.first == :rlist
+      exp = exp.sexp_body
+    end
+
     #Insert new body
     exp.each do |e|
       self[index] = e
@@ -504,11 +529,11 @@ class Sexp
 
     case self.node_type
     when :defn, :class
-      self[3..-1]
+      self.sexp_body(3)
     when :defs
-      self[4..-1]
+      self.sexp_body(4)
     when :module
-      self[2..-1]
+      self.sexp_body(2)
     end
   end
 
@@ -518,6 +543,20 @@ class Sexp
     self.body.unshift :rlist
   end
 
+  # Number of "statements" in a method.
+  # This is more efficient than `Sexp#body.length`
+  # because `Sexp#body` creates a new Sexp.
+  def method_length
+    expect :defn, :defs
+
+    case self.node_type
+    when :defn
+      self.length - 3
+    when :defs
+      self.length - 4
+    end
+  end
+
   def render_type
     expect :render
     self[1]
@@ -603,4 +642,14 @@ end
   RUBY
 end
 
+class String
+  ##
+  # This is a hack used by the lexer to sneak in line numbers at the
+  # identifier level. This should be MUCH smaller than making
+  # process_token return [value, lineno] and modifying EVERYTHING that
+  # reduces tIDENTIFIER.
+
+  attr_accessor :lineno
+end
+
 class WrongSexpError < RuntimeError; end