brakeman 4.10.0 → 5.0.0.pre1

data/lib/brakeman/processors/lib/file_type_detector.rb

@@ -0,0 +1,64 @@
+module Brakeman
+  class FileTypeDetector < BaseProcessor
+    def initialize
+      super(nil)
+      reset
+    end
+
+    def detect_type(file)
+      reset
+      process(file.ast)
+
+      if @file_type.nil?
+        @file_type = guess_from_path(file.path.relative)
+      end
+
+      @file_type || :libs
+    end
+
+    MODEL_CLASSES = [
+      :'ActiveRecord::Base',
+      :ApplicationRecord
+    ]
+
+    def process_class exp
+      name = class_name(exp.class_name)
+      parent = class_name(exp.parent_name)
+
+      if name.match(/Controller$/)
+        @file_type = :controllers
+        return exp
+      elsif MODEL_CLASSES.include? parent
+        @file_type = :models
+        return exp
+      end
+
+      super
+    end
+
+    def guess_from_path path
+      case
+      when path.include?('app/models')
+        :models
+      when path.include?('app/controllers')
+        :controllers
+      when path.include?('config/initializers')
+        :initializers
+      when path.include?('lib/')
+        :libs
+      when path.match?(%r{config/environments/(?!production\.rb)$})
+        :skip
+      when path.match?(%r{environments/production\.rb$})
+        :skip
+      when path.match?(%r{application\.rb$})
+        :skip
+      end
+    end
+
+    private
+
+    def reset
+      @file_type = nil
+    end
+  end
+end

data/lib/brakeman/report.rb

@@ -45,6 +45,9 @@ class Brakeman::Report
       Brakeman::Report::JUnit
     when :to_sarif
       return self.to_sarif
+    when :to_sonar
+      require_report 'sonar'
+      Brakeman::Report::Sonar
     else
       raise "Invalid format: #{format}. Should be one of #{VALID_FORMATS.inspect}"
     end
@@ -69,6 +72,11 @@ class Brakeman::Report
     generate Brakeman::Report::JSON
   end
 
+  def to_sonar
+    require_report 'sonar'
+    generate Brakeman::Report::Sonar
+  end
+
   def to_table
     require_report 'table'
     generate Brakeman::Report::Table

data/lib/brakeman/report/report_sonar.rb

@@ -0,0 +1,38 @@
+class Brakeman::Report::Sonar < Brakeman::Report::Base
+  def generate_report
+    report_object = {
+      issues: all_warnings.map { |warning| issue_json(warning) }
+    }
+    return JSON.pretty_generate report_object
+  end
+  
+  private
+  
+  def issue_json(warning)
+    {
+      engineId: "Brakeman",
+      ruleId: warning.warning_code,
+      type: "VULNERABILITY",
+      severity: severity_level_for(warning.confidence),
+      primaryLocation: {
+        message: warning.message,
+        filePath: warning.file.relative,
+        textRange: {
+          "startLine": warning.line || 1,
+          "endLine": warning.line || 1,
+        }
+      },
+      effortMinutes: (4 - warning.confidence) * 15
+    }
+  end
+
+  def severity_level_for(confidence)
+    if confidence == 0
+      "CRITICAL"
+    elsif confidence == 1
+      "MAJOR"
+    else
+      "MINOR"
+    end
+  end
+end

data/lib/brakeman/rescanner.rb

@@ -132,10 +132,11 @@ class Brakeman::Rescanner < Brakeman::Scanner
     template_name = template_path_to_name(path)
 
     tracker.reset_template template_name
-    fp = Brakeman::FileParser.new(tracker)
+    fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
     template_parser = Brakeman::TemplateParser.new(tracker, fp)
     template_parser.parse_template path, path.read
-    process_template fp.file_list[:templates].first
+    tracker.add_errors(fp.errors)
+    process_template fp.file_list.first
 
     @processor.process_template_alias tracker.templates[template_name]
 
@@ -390,9 +391,10 @@ class Brakeman::Rescanner < Brakeman::Scanner
 
   def parse_ruby_files list
     paths = list.select(&:exists?)
-    file_parser = Brakeman::FileParser.new(tracker)
-    file_parser.parse_files paths, :rescan
-    file_parser.file_list[:rescan]
+    file_parser = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
+    file_parser.parse_files paths
+    tracker.add_errors(file_parser.errors)
+    file_parser.file_list
   end
 end
 

data/lib/brakeman/scanner.rb

@@ -7,6 +7,7 @@ begin
   require 'brakeman/app_tree'
   require 'brakeman/file_parser'
   require 'brakeman/parsers/template_parser'
+  require 'brakeman/processors/lib/file_type_detector'
 rescue LoadError => e
   $stderr.puts e.message
   $stderr.puts "Please install the appropriate dependency."
@@ -23,7 +24,10 @@ class Brakeman::Scanner
     @app_tree = Brakeman::AppTree.from_options(options)
 
     if (!@app_tree.root || !@app_tree.exists?("app")) && !options[:force_scan]
-      raise Brakeman::NoApplication, "Please supply the path to a Rails application (looking in #{@app_tree.root})."
+      message = "Please supply the path to a Rails application (looking in #{@app_tree.root}).\n" <<
+                "  Use `--force` to run a scan anyway - for example if there are many applications in one directory."
+
+      raise Brakeman::NoApplication, message
     end
 
     @processor = processor || Brakeman::Processor.new(@app_tree, options)
@@ -43,6 +47,8 @@ class Brakeman::Scanner
     process_config
     Brakeman.notify "Parsing files..."
     parse_files
+    Brakeman.notify "Detecting file types..."
+    detect_file_types
     Brakeman.notify "Processing initializers..."
     process_initializers
     Brakeman.notify "Processing libs..."
@@ -65,29 +71,47 @@ class Brakeman::Scanner
   end
 
   def parse_files
-    fp = Brakeman::FileParser.new tracker
-
-    files = {
-      :initializers => @app_tree.initializer_paths,
-      :controllers => @app_tree.controller_paths,
-      :models => @app_tree.model_paths
-    }
-
-    unless options[:skip_libs]
-      files[:libs] = @app_tree.lib_paths
-    end
+    fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
 
-    files.each do |name, paths|
-      fp.parse_files paths, name
-    end
+    fp.parse_files tracker.app_tree.ruby_file_paths
 
     template_parser = Brakeman::TemplateParser.new(tracker, fp)
 
-    fp.read_files(@app_tree.template_paths, :templates) do |path, contents|
+    fp.read_files(@app_tree.template_paths) do |path, contents|
       template_parser.parse_template path, contents
     end
 
-    @file_list = fp.file_list
+    # Collect errors raised during parsing
+    tracker.add_errors(fp.errors)
+
+    @parsed_files = fp.file_list
+  end
+
+  def detect_file_types
+    @file_list = {
+      controllers: [],
+      initializers: [],
+      libs: [],
+      models: [],
+      templates: [],
+    }
+
+    detector = Brakeman::FileTypeDetector.new
+
+    @parsed_files.each do |file|
+      if file.is_a? Brakeman::TemplateParser::TemplateFile
+        @file_list[:templates] << file
+      else
+        type = detector.detect_type(file)
+        unless type == :skip
+          if @file_list[type].nil?
+            raise type.to_s
+          else
+            @file_list[type] << file
+          end
+        end
+      end
+    end
   end
 
   #Process config/environment.rb and config/gems.rb
@@ -325,7 +349,7 @@ class Brakeman::Scanner
   end
 
   def parse_ruby_file file
-    fp = Brakeman::FileParser.new(self.tracker)
+    fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
     fp.parse_ruby(file.read, file)
   end
 end

data/lib/brakeman/tracker.rb

@@ -68,6 +68,12 @@ class Brakeman::Tracker
     }
   end
 
+  def add_errors exceptions
+    exceptions.each do |e|
+      error(e)
+    end
+  end
+
   #Run a set of checks on the current information. Results will be stored
   #in Tracker#checks.
   def run_checks

data/lib/brakeman/util.rb

@@ -368,8 +368,13 @@ module Brakeman::Util
   #
   # views/test/something.html.erb -> test/something
   def template_path_to_name path
-    names = path.relative.split("/")
+    names = path.relative.split('/')
     names.last.gsub!(/(\.(html|js)\..*|\.(rhtml|haml|erb|slim))$/, '')
-    names[(names.index("views") + 1)..-1].join("/").to_sym
+
+    if names.include? 'views'
+      names[(names.index('views') + 1)..-1]
+    else
+      names
+    end.join('/').to_sym
   end
 end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "4.10.0"
+  Version = "5.0.0.pre1"
 end

data/lib/brakeman/warning_codes.rb

@@ -119,6 +119,8 @@ module Brakeman::WarningCodes
     :CVE_2020_8159 => 115,
     :CVE_2020_8166 => 116,
     :erb_template_injection => 117,
+    :http_verb_confusion => 118,
+    :unsafe_method_reflection => 119,
 
     :custom_check => 9090,
   }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 4.10.0
+  version: 5.0.0.pre1
 platform: ruby
 authors:
 - Justin Collins
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-28 00:00:00.000000000 Z
+date: 2020-11-18 00:00:00.000000000 Z
 dependencies: []
 description: Brakeman detects security vulnerabilities in Ruby on Rails applications
   via static analysis.
@@ -56,46 +56,46 @@ files:
 - bundle/ruby/2.7.0/gems/erubis-2.7.0/lib/erubis/tiny.rb
 - bundle/ruby/2.7.0/gems/erubis-2.7.0/lib/erubis/util.rb
 - bundle/ruby/2.7.0/gems/erubis-2.7.0/setup.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/CHANGELOG.md
-- bundle/ruby/2.7.0/gems/haml-5.1.2/FAQ.md
-- bundle/ruby/2.7.0/gems/haml-5.1.2/Gemfile
-- bundle/ruby/2.7.0/gems/haml-5.1.2/MIT-LICENSE
-- bundle/ruby/2.7.0/gems/haml-5.1.2/README.md
-- bundle/ruby/2.7.0/gems/haml-5.1.2/REFERENCE.md
-- bundle/ruby/2.7.0/gems/haml-5.1.2/TODO
-- bundle/ruby/2.7.0/gems/haml-5.1.2/haml.gemspec
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/attribute_builder.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/attribute_compiler.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/attribute_parser.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/buffer.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/compiler.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/engine.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/error.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/exec.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/filters.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/generator.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/helpers.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/helpers/action_view_extensions.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/helpers/action_view_mods.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/helpers/action_view_xss_mods.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/helpers/safe_erubi_template.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/helpers/safe_erubis_template.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/helpers/xss_mods.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/options.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/parser.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/plugin.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/railtie.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/sass_rails_filter.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/template.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/template/options.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/temple_engine.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/temple_line_counter.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/util.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/version.rb
-- bundle/ruby/2.7.0/gems/haml-5.1.2/yard/default/fulldoc/html/css/common.sass
-- bundle/ruby/2.7.0/gems/haml-5.1.2/yard/default/layout/html/footer.erb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/CHANGELOG.md
+- bundle/ruby/2.7.0/gems/haml-5.2.0/FAQ.md
+- bundle/ruby/2.7.0/gems/haml-5.2.0/Gemfile
+- bundle/ruby/2.7.0/gems/haml-5.2.0/MIT-LICENSE
+- bundle/ruby/2.7.0/gems/haml-5.2.0/README.md
+- bundle/ruby/2.7.0/gems/haml-5.2.0/REFERENCE.md
+- bundle/ruby/2.7.0/gems/haml-5.2.0/TODO
+- bundle/ruby/2.7.0/gems/haml-5.2.0/haml.gemspec
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/attribute_builder.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/attribute_compiler.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/attribute_parser.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/buffer.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/compiler.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/engine.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/error.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/escapable.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/exec.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/filters.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/generator.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/helpers.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/helpers/action_view_extensions.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/helpers/action_view_mods.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/helpers/action_view_xss_mods.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/helpers/safe_erubi_template.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/helpers/safe_erubis_template.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/helpers/xss_mods.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/options.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/parser.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/plugin.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/railtie.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/sass_rails_filter.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/template.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/template/options.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/temple_engine.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/temple_line_counter.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/util.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/lib/haml/version.rb
+- bundle/ruby/2.7.0/gems/haml-5.2.0/yard/default/fulldoc/html/css/common.sass
+- bundle/ruby/2.7.0/gems/haml-5.2.0/yard/default/layout/html/footer.erb
 - bundle/ruby/2.7.0/gems/highline-2.0.3/AUTHORS
 - bundle/ruby/2.7.0/gems/highline-2.0.3/COPYING
 - bundle/ruby/2.7.0/gems/highline-2.0.3/Changelog.md
@@ -448,8 +448,10 @@ files:
 - lib/brakeman/checks/check_template_injection.rb
 - lib/brakeman/checks/check_translate_bug.rb
 - lib/brakeman/checks/check_unsafe_reflection.rb
+- lib/brakeman/checks/check_unsafe_reflection_methods.rb
 - lib/brakeman/checks/check_unscoped_find.rb
 - lib/brakeman/checks/check_validation_regex.rb
+- lib/brakeman/checks/check_verb_confusion.rb
 - lib/brakeman/checks/check_weak_hash.rb
 - lib/brakeman/checks/check_without_protection.rb
 - lib/brakeman/checks/check_xml_dos.rb
@@ -480,6 +482,7 @@ files:
 - lib/brakeman/processors/haml_template_processor.rb
 - lib/brakeman/processors/lib/basic_processor.rb
 - lib/brakeman/processors/lib/call_conversion_helper.rb
+- lib/brakeman/processors/lib/file_type_detector.rb
 - lib/brakeman/processors/lib/find_all_calls.rb
 - lib/brakeman/processors/lib/find_call.rb
 - lib/brakeman/processors/lib/find_return_value.rb
@@ -516,6 +519,7 @@ files:
 - lib/brakeman/report/report_junit.rb
 - lib/brakeman/report/report_markdown.rb
 - lib/brakeman/report/report_sarif.rb
+- lib/brakeman/report/report_sonar.rb
 - lib/brakeman/report/report_table.rb
 - lib/brakeman/report/report_tabs.rb
 - lib/brakeman/report/report_text.rb
@@ -565,12 +569,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.3.0
+      version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubygems_version: 3.1.2
 signing_key: 

data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb

@@ -1,50 +0,0 @@
-# frozen_string_literal: true
-
-module Haml
-  # Like Temple::Filters::Escapable, but with support for escaping by
-  # Haml::Herlpers.html_escape and Haml::Herlpers.escape_once.
-  class Escapable < Temple::Filter
-    def initialize(*)
-      super
-      @escape_code = "::Haml::Helpers.html_escape((%s))"
-      @escaper = eval("proc {|v| #{@escape_code % 'v'} }")
-      @once_escape_code = "::Haml::Helpers.escape_once((%s))"
-      @once_escaper = eval("proc {|v| #{@once_escape_code % 'v'} }")
-      @escape = false
-    end
-
-    def on_escape(flag, exp)
-      old = @escape
-      @escape = flag
-      compile(exp)
-    ensure
-      @escape = old
-    end
-
-    # The same as Haml::AttributeBuilder.build_attributes
-    def on_static(value)
-      [:static,
-       if @escape == :once
-         @once_escaper[value]
-       elsif @escape
-         @escaper[value]
-       else
-         value
-       end
-      ]
-    end
-
-    # The same as Haml::AttributeBuilder.build_attributes
-    def on_dynamic(value)
-      [:dynamic,
-       if @escape == :once
-         @once_escape_code % value
-       elsif @escape
-         @escape_code % value
-       else
-         "(#{value}).to_s"
-       end
-      ]
-    end
-  end
-end