brakeman 4.10.0 → 5.0.2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (197) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +46 -0
  3. data/README.md +11 -2
  4. data/bundle/load.rb +5 -3
  5. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/CHANGELOG.md +16 -0
  6. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/FAQ.md +0 -0
  7. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/Gemfile +1 -4
  8. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/MIT-LICENSE +0 -0
  9. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/README.md +2 -3
  10. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/REFERENCE.md +29 -7
  11. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/TODO +0 -0
  12. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/haml.gemspec +2 -1
  13. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml.rb +0 -0
  14. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_builder.rb +3 -3
  15. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_compiler.rb +42 -31
  16. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_parser.rb +0 -0
  17. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/buffer.rb +0 -0
  18. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/compiler.rb +0 -0
  19. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/engine.rb +0 -0
  20. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/error.rb +0 -0
  21. data/bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/escapable.rb +77 -0
  22. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/exec.rb +0 -0
  23. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/filters.rb +0 -0
  24. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/generator.rb +0 -0
  25. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers.rb +7 -1
  26. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_extensions.rb +0 -0
  27. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_mods.rb +0 -0
  28. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
  29. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubi_template.rb +0 -0
  30. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubis_template.rb +0 -0
  31. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/xss_mods.rb +6 -3
  32. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/options.rb +0 -0
  33. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/parser.rb +32 -4
  34. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/plugin.rb +0 -0
  35. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/railtie.rb +0 -0
  36. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/sass_rails_filter.rb +0 -0
  37. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template.rb +0 -0
  38. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template/options.rb +0 -0
  39. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_engine.rb +0 -0
  40. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_line_counter.rb +0 -0
  41. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/util.rb +1 -1
  42. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/version.rb +1 -1
  43. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/fulldoc/html/css/common.sass +0 -0
  44. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/layout/html/footer.erb +0 -0
  45. data/bundle/ruby/2.7.0/gems/parallel-1.20.1/MIT-LICENSE.txt +20 -0
  46. data/bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel.rb +523 -0
  47. data/bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/processor_count.rb +42 -0
  48. data/bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/version.rb +3 -0
  49. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt +22 -0
  50. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md +178 -0
  51. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md +48 -0
  52. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml.rb +3 -0
  53. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attlistdecl.rb +63 -0
  54. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attribute.rb +205 -0
  55. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/cdata.rb +68 -0
  56. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/child.rb +97 -0
  57. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/comment.rb +80 -0
  58. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/doctype.rb +311 -0
  59. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/document.rb +451 -0
  60. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/attlistdecl.rb +11 -0
  61. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/dtd.rb +47 -0
  62. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/elementdecl.rb +18 -0
  63. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/entitydecl.rb +57 -0
  64. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/notationdecl.rb +40 -0
  65. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/element.rb +2599 -0
  66. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/encoding.rb +51 -0
  67. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/entity.rb +171 -0
  68. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/default.rb +116 -0
  69. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/pretty.rb +142 -0
  70. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/transitive.rb +58 -0
  71. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/functions.rb +447 -0
  72. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/instruction.rb +79 -0
  73. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/light/node.rb +188 -0
  74. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/namespace.rb +59 -0
  75. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/node.rb +76 -0
  76. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/output.rb +30 -0
  77. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parent.rb +166 -0
  78. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parseexception.rb +52 -0
  79. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb +694 -0
  80. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/lightparser.rb +59 -0
  81. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb +197 -0
  82. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb +273 -0
  83. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/streamparser.rb +61 -0
  84. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb +101 -0
  85. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/ultralightparser.rb +57 -0
  86. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/xpathparser.rb +689 -0
  87. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/quickpath.rb +266 -0
  88. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/rexml.rb +37 -0
  89. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/sax2listener.rb +98 -0
  90. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/security.rb +28 -0
  91. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/source.rb +298 -0
  92. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/streamlistener.rb +93 -0
  93. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/text.rb +424 -0
  94. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/undefinednamespaceexception.rb +9 -0
  95. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/relaxng.rb +539 -0
  96. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validation.rb +144 -0
  97. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validationexception.rb +10 -0
  98. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmldecl.rb +130 -0
  99. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmltokens.rb +85 -0
  100. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath.rb +81 -0
  101. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath_parser.rb +974 -0
  102. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/History.rdoc +25 -0
  103. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/Manifest.txt +2 -0
  104. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/README.rdoc +0 -0
  105. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/compare/normalize.rb +2 -2
  106. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/debugging.md +190 -0
  107. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/rp_extensions.rb +0 -0
  108. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/rp_stringscanner.rb +0 -0
  109. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby20_parser.rb +2392 -2384
  110. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby20_parser.y +6 -1
  111. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby21_parser.rb +2553 -2550
  112. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby21_parser.y +6 -1
  113. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby22_parser.rb +2491 -2471
  114. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby22_parser.y +6 -1
  115. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby23_parser.rb +2422 -2403
  116. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby23_parser.y +6 -1
  117. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby24_parser.rb +2460 -2450
  118. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby24_parser.y +6 -1
  119. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby25_parser.rb +2450 -2441
  120. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby25_parser.y +6 -1
  121. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby26_parser.rb +2444 -2433
  122. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby26_parser.y +7 -1
  123. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby27_parser.rb +7310 -0
  124. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby27_parser.y +21 -1
  125. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.rb +7310 -0
  126. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.y +2677 -0
  127. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby_lexer.rb +19 -0
  128. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby_lexer.rex +1 -1
  129. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby_lexer.rex.rb +1 -1
  130. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby_parser.rb +2 -0
  131. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby_parser.yy +27 -1
  132. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/lib/ruby_parser_extras.rb +2 -2
  133. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/tools/munge.rb +2 -2
  134. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.16.0}/tools/ripper.rb +0 -0
  135. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/History.rdoc +12 -0
  136. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/Manifest.txt +0 -0
  137. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/README.rdoc +0 -0
  138. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/lib/composite_sexp_processor.rb +0 -0
  139. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/lib/pt_testcase.rb +2 -2
  140. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/lib/sexp.rb +0 -0
  141. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/lib/sexp_matcher.rb +0 -0
  142. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/lib/sexp_processor.rb +1 -1
  143. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/lib/strict_sexp.rb +0 -0
  144. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.3}/lib/unique.rb +0 -0
  145. data/lib/brakeman.rb +21 -4
  146. data/lib/brakeman/app_tree.rb +36 -3
  147. data/lib/brakeman/checks/base_check.rb +7 -1
  148. data/lib/brakeman/checks/check_detailed_exceptions.rb +1 -1
  149. data/lib/brakeman/checks/check_evaluation.rb +1 -1
  150. data/lib/brakeman/checks/check_execute.rb +2 -1
  151. data/lib/brakeman/checks/check_mass_assignment.rb +4 -6
  152. data/lib/brakeman/checks/check_regex_dos.rb +1 -1
  153. data/lib/brakeman/checks/check_sanitize_methods.rb +2 -1
  154. data/lib/brakeman/checks/check_sql.rb +16 -3
  155. data/lib/brakeman/checks/check_unsafe_reflection_methods.rb +68 -0
  156. data/lib/brakeman/checks/check_verb_confusion.rb +75 -0
  157. data/lib/brakeman/file_parser.rb +50 -22
  158. data/lib/brakeman/options.rb +5 -1
  159. data/lib/brakeman/parsers/template_parser.rb +26 -3
  160. data/lib/brakeman/processors/alias_processor.rb +91 -19
  161. data/lib/brakeman/processors/base_processor.rb +4 -4
  162. data/lib/brakeman/processors/controller_alias_processor.rb +6 -43
  163. data/lib/brakeman/processors/controller_processor.rb +1 -1
  164. data/lib/brakeman/processors/haml_template_processor.rb +8 -1
  165. data/lib/brakeman/processors/lib/call_conversion_helper.rb +10 -0
  166. data/lib/brakeman/processors/lib/file_type_detector.rb +64 -0
  167. data/lib/brakeman/processors/lib/rails3_config_processor.rb +16 -16
  168. data/lib/brakeman/processors/lib/rails4_config_processor.rb +2 -1
  169. data/lib/brakeman/processors/library_processor.rb +9 -0
  170. data/lib/brakeman/processors/output_processor.rb +1 -1
  171. data/lib/brakeman/processors/template_alias_processor.rb +5 -0
  172. data/lib/brakeman/report.rb +12 -1
  173. data/lib/brakeman/report/ignore/interactive.rb +1 -1
  174. data/lib/brakeman/report/report_base.rb +0 -2
  175. data/lib/brakeman/report/report_csv.rb +37 -60
  176. data/lib/brakeman/report/report_github.rb +31 -0
  177. data/lib/brakeman/report/report_junit.rb +2 -2
  178. data/lib/brakeman/report/report_sarif.rb +1 -1
  179. data/lib/brakeman/report/report_sonar.rb +38 -0
  180. data/lib/brakeman/report/report_tabs.rb +1 -1
  181. data/lib/brakeman/report/report_text.rb +1 -1
  182. data/lib/brakeman/rescanner.rb +7 -5
  183. data/lib/brakeman/scanner.rb +47 -18
  184. data/lib/brakeman/tracker.rb +39 -4
  185. data/lib/brakeman/tracker/collection.rb +27 -5
  186. data/lib/brakeman/tracker/config.rb +73 -0
  187. data/lib/brakeman/tracker/controller.rb +1 -1
  188. data/lib/brakeman/tracker/method_info.rb +29 -0
  189. data/lib/brakeman/util.rb +17 -4
  190. data/lib/brakeman/version.rb +1 -1
  191. data/lib/brakeman/warning.rb +10 -2
  192. data/lib/brakeman/warning_codes.rb +2 -0
  193. data/lib/ruby_parser/bm_sexp.rb +9 -9
  194. metadata +149 -84
  195. data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb +0 -50
  196. data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.0/debugging.md +0 -57
  197. data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.0/lib/ruby27_parser.rb +0 -7224
@@ -0,0 +1,451 @@
1
+ # frozen_string_literal: false
2
+ require_relative "security"
3
+ require_relative "element"
4
+ require_relative "xmldecl"
5
+ require_relative "source"
6
+ require_relative "comment"
7
+ require_relative "doctype"
8
+ require_relative "instruction"
9
+ require_relative "rexml"
10
+ require_relative "parseexception"
11
+ require_relative "output"
12
+ require_relative "parsers/baseparser"
13
+ require_relative "parsers/streamparser"
14
+ require_relative "parsers/treeparser"
15
+
16
+ module REXML
17
+ # Represents an XML document.
18
+ #
19
+ # A document may have:
20
+ #
21
+ # - A single child that may be accessed via method #root.
22
+ # - An XML declaration.
23
+ # - A document type.
24
+ # - Processing instructions.
25
+ #
26
+ # == In a Hurry?
27
+ #
28
+ # If you're somewhat familiar with XML
29
+ # and have a particular task in mind,
30
+ # you may want to see the
31
+ # {tasks pages}[../doc/rexml/tasks/tocs/master_toc_rdoc.html],
32
+ # and in particular, the
33
+ # {tasks page for documents}[../doc/rexml/tasks/tocs/document_toc_rdoc.html].
34
+ #
35
+ class Document < Element
36
+ # A convenient default XML declaration. Use:
37
+ #
38
+ # mydoc << XMLDecl.default
39
+ #
40
+ DECLARATION = XMLDecl.default
41
+
42
+ # :call-seq:
43
+ # new(string = nil, context = {}) -> new_document
44
+ # new(io_stream = nil, context = {}) -> new_document
45
+ # new(document = nil, context = {}) -> new_document
46
+ #
47
+ # Returns a new \REXML::Document object.
48
+ #
49
+ # When no arguments are given,
50
+ # returns an empty document:
51
+ #
52
+ # d = REXML::Document.new
53
+ # d.to_s # => ""
54
+ #
55
+ # When argument +string+ is given, it must be a string
56
+ # containing a valid XML document:
57
+ #
58
+ # xml_string = '<root><foo>Foo</foo><bar>Bar</bar></root>'
59
+ # d = REXML::Document.new(xml_string)
60
+ # d.to_s # => "<root><foo>Foo</foo><bar>Bar</bar></root>"
61
+ #
62
+ # When argument +io_stream+ is given, it must be an \IO object
63
+ # that is opened for reading, and when read must return a valid XML document:
64
+ #
65
+ # File.write('t.xml', xml_string)
66
+ # d = File.open('t.xml', 'r') do |io|
67
+ # REXML::Document.new(io)
68
+ # end
69
+ # d.to_s # => "<root><foo>Foo</foo><bar>Bar</bar></root>"
70
+ #
71
+ # When argument +document+ is given, it must be an existing
72
+ # document object, whose context and attributes (but not chidren)
73
+ # are cloned into the new document:
74
+ #
75
+ # d = REXML::Document.new(xml_string)
76
+ # d.children # => [<root> ... </>]
77
+ # d.context = {raw: :all, compress_whitespace: :all}
78
+ # d.add_attributes({'bar' => 0, 'baz' => 1})
79
+ # d1 = REXML::Document.new(d)
80
+ # d1.children # => []
81
+ # d1.context # => {:raw=>:all, :compress_whitespace=>:all}
82
+ # d1.attributes # => {"bar"=>bar='0', "baz"=>baz='1'}
83
+ #
84
+ # When argument +context+ is given, it must be a hash
85
+ # containing context entries for the document;
86
+ # see {Element Context}[../doc/rexml/context_rdoc.html]:
87
+ #
88
+ # context = {raw: :all, compress_whitespace: :all}
89
+ # d = REXML::Document.new(xml_string, context)
90
+ # d.context # => {:raw=>:all, :compress_whitespace=>:all}
91
+ #
92
+ def initialize( source = nil, context = {} )
93
+ @entity_expansion_count = 0
94
+ super()
95
+ @context = context
96
+ return if source.nil?
97
+ if source.kind_of? Document
98
+ @context = source.context
99
+ super source
100
+ else
101
+ build( source )
102
+ end
103
+ end
104
+
105
+ # :call-seq:
106
+ # node_type -> :document
107
+ #
108
+ # Returns the symbol +:document+.
109
+ #
110
+ def node_type
111
+ :document
112
+ end
113
+
114
+ # :call-seq:
115
+ # clone -> new_document
116
+ #
117
+ # Returns the new document resulting from executing
118
+ # <tt>Document.new(self)</tt>. See Document.new.
119
+ #
120
+ def clone
121
+ Document.new self
122
+ end
123
+
124
+ # :call-seq:
125
+ # expanded_name -> empty_string
126
+ #
127
+ # Returns an empty string.
128
+ #
129
+ def expanded_name
130
+ ''
131
+ #d = doc_type
132
+ #d ? d.name : "UNDEFINED"
133
+ end
134
+ alias :name :expanded_name
135
+
136
+ # :call-seq:
137
+ # add(xml_decl) -> self
138
+ # add(doc_type) -> self
139
+ # add(object) -> self
140
+ #
141
+ # Adds an object to the document; returns +self+.
142
+ #
143
+ # When argument +xml_decl+ is given,
144
+ # it must be an REXML::XMLDecl object,
145
+ # which becomes the XML declaration for the document,
146
+ # replacing the previous XML declaration if any:
147
+ #
148
+ # d = REXML::Document.new
149
+ # d.xml_decl.to_s # => ""
150
+ # d.add(REXML::XMLDecl.new('2.0'))
151
+ # d.xml_decl.to_s # => "<?xml version='2.0'?>"
152
+ #
153
+ # When argument +doc_type+ is given,
154
+ # it must be an REXML::DocType object,
155
+ # which becomes the document type for the document,
156
+ # replacing the previous document type, if any:
157
+ #
158
+ # d = REXML::Document.new
159
+ # d.doctype.to_s # => ""
160
+ # d.add(REXML::DocType.new('foo'))
161
+ # d.doctype.to_s # => "<!DOCTYPE foo>"
162
+ #
163
+ # When argument +object+ (not an REXML::XMLDecl or REXML::DocType object)
164
+ # is given it is added as the last child:
165
+ #
166
+ # d = REXML::Document.new
167
+ # d.add(REXML::Element.new('foo'))
168
+ # d.to_s # => "<foo/>"
169
+ #
170
+ def add( child )
171
+ if child.kind_of? XMLDecl
172
+ if @children[0].kind_of? XMLDecl
173
+ @children[0] = child
174
+ else
175
+ @children.unshift child
176
+ end
177
+ child.parent = self
178
+ elsif child.kind_of? DocType
179
+ # Find first Element or DocType node and insert the decl right
180
+ # before it. If there is no such node, just insert the child at the
181
+ # end. If there is a child and it is an DocType, then replace it.
182
+ insert_before_index = @children.find_index { |x|
183
+ x.kind_of?(Element) || x.kind_of?(DocType)
184
+ }
185
+ if insert_before_index # Not null = not end of list
186
+ if @children[ insert_before_index ].kind_of? DocType
187
+ @children[ insert_before_index ] = child
188
+ else
189
+ @children[ insert_before_index-1, 0 ] = child
190
+ end
191
+ else # Insert at end of list
192
+ @children << child
193
+ end
194
+ child.parent = self
195
+ else
196
+ rv = super
197
+ raise "attempted adding second root element to document" if @elements.size > 1
198
+ rv
199
+ end
200
+ end
201
+ alias :<< :add
202
+
203
+ # :call-seq:
204
+ # add_element(name_or_element = nil, attributes = nil) -> new_element
205
+ #
206
+ # Adds an element to the document by calling REXML::Element.add_element:
207
+ #
208
+ # REXML::Element.add_element(name_or_element, attributes)
209
+ def add_element(arg=nil, arg2=nil)
210
+ rv = super
211
+ raise "attempted adding second root element to document" if @elements.size > 1
212
+ rv
213
+ end
214
+
215
+ # :call-seq:
216
+ # root -> root_element or nil
217
+ #
218
+ # Returns the root element of the document, if it exists, otherwise +nil+:
219
+ #
220
+ # d = REXML::Document.new('<root></root>')
221
+ # d.root # => <root/>
222
+ # d = REXML::Document.new('')
223
+ # d.root # => nil
224
+ #
225
+ def root
226
+ elements[1]
227
+ #self
228
+ #@children.find { |item| item.kind_of? Element }
229
+ end
230
+
231
+ # :call-seq:
232
+ # doctype -> doc_type or nil
233
+ #
234
+ # Returns the DocType object for the document, if it exists, otherwise +nil+:
235
+ #
236
+ # d = REXML::Document.new('<!DOCTYPE document SYSTEM "subjects.dtd">')
237
+ # d.doctype.class # => REXML::DocType
238
+ # d = REXML::Document.new('')
239
+ # d.doctype.class # => nil
240
+ #
241
+ def doctype
242
+ @children.find { |item| item.kind_of? DocType }
243
+ end
244
+
245
+ # :call-seq:
246
+ # xml_decl -> xml_decl
247
+ #
248
+ # Returns the XMLDecl object for the document, if it exists,
249
+ # otherwise the default XMLDecl object:
250
+ #
251
+ # d = REXML::Document.new('<?xml version="1.0" encoding="UTF-8"?>')
252
+ # d.xml_decl.class # => REXML::XMLDecl
253
+ # d.xml_decl.to_s # => "<?xml version='1.0' encoding='UTF-8'?>"
254
+ # d = REXML::Document.new('')
255
+ # d.xml_decl.class # => REXML::XMLDecl
256
+ # d.xml_decl.to_s # => ""
257
+ #
258
+ def xml_decl
259
+ rv = @children[0]
260
+ return rv if rv.kind_of? XMLDecl
261
+ @children.unshift(XMLDecl.default)[0]
262
+ end
263
+
264
+ # :call-seq:
265
+ # version -> version_string
266
+ #
267
+ # Returns the XMLDecl version of this document as a string,
268
+ # if it has been set, otherwise the default version:
269
+ #
270
+ # d = REXML::Document.new('<?xml version="2.0" encoding="UTF-8"?>')
271
+ # d.version # => "2.0"
272
+ # d = REXML::Document.new('')
273
+ # d.version # => "1.0"
274
+ #
275
+ def version
276
+ xml_decl().version
277
+ end
278
+
279
+ # :call-seq:
280
+ # encoding -> encoding_string
281
+ #
282
+ # Returns the XMLDecl encoding of the document,
283
+ # if it has been set, otherwise the default encoding:
284
+ #
285
+ # d = REXML::Document.new('<?xml version="1.0" encoding="UTF-16"?>')
286
+ # d.encoding # => "UTF-16"
287
+ # d = REXML::Document.new('')
288
+ # d.encoding # => "UTF-8"
289
+ #
290
+ def encoding
291
+ xml_decl().encoding
292
+ end
293
+
294
+ # :call-seq:
295
+ # stand_alone?
296
+ #
297
+ # Returns the XMLDecl standalone value of the document as a string,
298
+ # if it has been set, otherwise the default standalone value:
299
+ #
300
+ # d = REXML::Document.new('<?xml standalone="yes"?>')
301
+ # d.stand_alone? # => "yes"
302
+ # d = REXML::Document.new('')
303
+ # d.stand_alone? # => nil
304
+ #
305
+ def stand_alone?
306
+ xml_decl().stand_alone?
307
+ end
308
+
309
+ # :call-seq:
310
+ # doc.write(output=$stdout, indent=-1, transtive=false, ie_hack=false, encoding=nil)
311
+ # doc.write(options={:output => $stdout, :indent => -1, :transtive => false, :ie_hack => false, :encoding => nil})
312
+ #
313
+ # Write the XML tree out, optionally with indent. This writes out the
314
+ # entire XML document, including XML declarations, doctype declarations,
315
+ # and processing instructions (if any are given).
316
+ #
317
+ # A controversial point is whether Document should always write the XML
318
+ # declaration (<?xml version='1.0'?>) whether or not one is given by the
319
+ # user (or source document). REXML does not write one if one was not
320
+ # specified, because it adds unnecessary bandwidth to applications such
321
+ # as XML-RPC.
322
+ #
323
+ # Accept Nth argument style and options Hash style as argument.
324
+ # The recommended style is options Hash style for one or more
325
+ # arguments case.
326
+ #
327
+ # _Examples_
328
+ # Document.new("<a><b/></a>").write
329
+ #
330
+ # output = ""
331
+ # Document.new("<a><b/></a>").write(output)
332
+ #
333
+ # output = ""
334
+ # Document.new("<a><b/></a>").write(:output => output, :indent => 2)
335
+ #
336
+ # See also the classes in the rexml/formatters package for the proper way
337
+ # to change the default formatting of XML output.
338
+ #
339
+ # _Examples_
340
+ #
341
+ # output = ""
342
+ # tr = Transitive.new
343
+ # tr.write(Document.new("<a><b/></a>"), output)
344
+ #
345
+ # output::
346
+ # output an object which supports '<< string'; this is where the
347
+ # document will be written.
348
+ # indent::
349
+ # An integer. If -1, no indenting will be used; otherwise, the
350
+ # indentation will be twice this number of spaces, and children will be
351
+ # indented an additional amount. For a value of 3, every item will be
352
+ # indented 3 more levels, or 6 more spaces (2 * 3). Defaults to -1
353
+ # transitive::
354
+ # If transitive is true and indent is >= 0, then the output will be
355
+ # pretty-printed in such a way that the added whitespace does not affect
356
+ # the absolute *value* of the document -- that is, it leaves the value
357
+ # and number of Text nodes in the document unchanged.
358
+ # ie_hack::
359
+ # This hack inserts a space before the /> on empty tags to address
360
+ # a limitation of Internet Explorer. Defaults to false
361
+ # encoding::
362
+ # Encoding name as String. Change output encoding to specified encoding
363
+ # instead of encoding in XML declaration.
364
+ # Defaults to nil. It means encoding in XML declaration is used.
365
+ def write(*arguments)
366
+ if arguments.size == 1 and arguments[0].class == Hash
367
+ options = arguments[0]
368
+
369
+ output = options[:output]
370
+ indent = options[:indent]
371
+ transitive = options[:transitive]
372
+ ie_hack = options[:ie_hack]
373
+ encoding = options[:encoding]
374
+ else
375
+ output, indent, transitive, ie_hack, encoding, = *arguments
376
+ end
377
+
378
+ output ||= $stdout
379
+ indent ||= -1
380
+ transitive = false if transitive.nil?
381
+ ie_hack = false if ie_hack.nil?
382
+ encoding ||= xml_decl.encoding
383
+
384
+ if encoding != 'UTF-8' && !output.kind_of?(Output)
385
+ output = Output.new( output, encoding )
386
+ end
387
+ formatter = if indent > -1
388
+ if transitive
389
+ require_relative "formatters/transitive"
390
+ REXML::Formatters::Transitive.new( indent, ie_hack )
391
+ else
392
+ REXML::Formatters::Pretty.new( indent, ie_hack )
393
+ end
394
+ else
395
+ REXML::Formatters::Default.new( ie_hack )
396
+ end
397
+ formatter.write( self, output )
398
+ end
399
+
400
+
401
+ def Document::parse_stream( source, listener )
402
+ Parsers::StreamParser.new( source, listener ).parse
403
+ end
404
+
405
+ # Set the entity expansion limit. By default the limit is set to 10000.
406
+ #
407
+ # Deprecated. Use REXML::Security.entity_expansion_limit= instead.
408
+ def Document::entity_expansion_limit=( val )
409
+ Security.entity_expansion_limit = val
410
+ end
411
+
412
+ # Get the entity expansion limit. By default the limit is set to 10000.
413
+ #
414
+ # Deprecated. Use REXML::Security.entity_expansion_limit= instead.
415
+ def Document::entity_expansion_limit
416
+ return Security.entity_expansion_limit
417
+ end
418
+
419
+ # Set the entity expansion limit. By default the limit is set to 10240.
420
+ #
421
+ # Deprecated. Use REXML::Security.entity_expansion_text_limit= instead.
422
+ def Document::entity_expansion_text_limit=( val )
423
+ Security.entity_expansion_text_limit = val
424
+ end
425
+
426
+ # Get the entity expansion limit. By default the limit is set to 10240.
427
+ #
428
+ # Deprecated. Use REXML::Security.entity_expansion_text_limit instead.
429
+ def Document::entity_expansion_text_limit
430
+ return Security.entity_expansion_text_limit
431
+ end
432
+
433
+ attr_reader :entity_expansion_count
434
+
435
+ def record_entity_expansion
436
+ @entity_expansion_count += 1
437
+ if @entity_expansion_count > Security.entity_expansion_limit
438
+ raise "number of entity expansions exceeded, processing aborted."
439
+ end
440
+ end
441
+
442
+ def document
443
+ self
444
+ end
445
+
446
+ private
447
+ def build( source )
448
+ Parsers::TreeParser.new( source, self ).parse
449
+ end
450
+ end
451
+ end
@@ -0,0 +1,11 @@
1
+ # frozen_string_literal: false
2
+ require_relative "../child"
3
+ module REXML
4
+ module DTD
5
+ class AttlistDecl < Child
6
+ START = "<!ATTLIST"
7
+ START_RE = /^\s*#{START}/um
8
+ PATTERN_RE = /\s*(#{START}.*?>)/um
9
+ end
10
+ end
11
+ end