brakeman 4.2.1 → 4.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53960ae3fa041691f1eef8e4cc0a7797993fc2e0c5e1618391b4fe7a42151d00
-  data.tar.gz: 5486c4a3cfcde489fc6f1a589688d379355896dcc35df0cb0531dd383aa37c6d
+  metadata.gz: b713c88d7aa856518beb948e7d39c0b43dda963378064d5a3126f9684d6d6a2d
+  data.tar.gz: 3ed9ad3b22f8196745f64019867776a6c09984d19fdcbe166046aadbbc4b545c
 SHA512:
-  metadata.gz: 7e1dedfb6173d00394ac06f3cd28c3a8f75e9a88a98e7814f94b90ae244ac033d57978a80bf5bed5ff6efdc2b56837825c39467f804d2142d435235b7c892a90
-  data.tar.gz: a830bb875a913e43a1b8d6713a596e4f2d90376a15d68e90424c1fa9f3de53716af93f8b0fb98110b6fd06196b022c737ab82232755ae5a7e977b7da6c8b4e65
+  metadata.gz: 90414d86f666acb334d05532d07b1edcf7cb90b8174e4682e06c6fd37c7063709043bf95767246f9529d897e0d39637a0088f2ce32fce1c1db78cd9040e38664
+  data.tar.gz: b3cdf474521d19cfc27cfd06d9168b3fc97284ff4ad6f73e2615c15099e93a84d0e90b24c185af5108c49b4fac07dae7acd3717f7f9e4f54f1dbd57f487cca17

data/CHANGES.md

@@ -1,3 +1,19 @@
+# 4.3.0
+
+* Check exec-type calls even if they are targets
+* Convert `Array#join` to string interpolation
+* `BaseCheck#include_interp?` should return first string interpolation
+* Add `--parser-timeout` option
+* Track parent calls in CallIndex
+* Warn about dangerous `link_to` href with `sanitize()`
+* Ignore `params#to_h` and `params#to_hash` in SQL checks
+* Change "".freeze to just ""
+* Ignore `Process.pid` in system calls
+* Index Kernel#\` calls even if they are targets
+* Code Climate: omit leading dot from `only_files` (Todd Mazierski)
+* `--color` can be used to force color output
+* Fix reported line numbers for CVE-2018-3741 and CVE-2018-8048
+
 # 4.2.1
 
 * Add warning for CVE-2018-3741

data/bundle/load.rb

@@ -4,12 +4,12 @@ $:.unshift "#{path}/bundle/ruby/2.5.0/gems/sass-3.4.25/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/sass-3.4.25/vendor/listen/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/tilt-2.0.8/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/temple-0.7.7/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/highline-1.7.10/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/terminal-table-1.8.0/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/ruby_parser-3.11.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/lib"
+$:.unshift "#{path}/bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/ruby2ruby-2.4.1/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/slim-3.0.7/lib"
+$:.unshift "#{path}/bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/erubis-2.7.0/lib"
 $:.unshift "#{path}/bundle/ruby/2.5.0/gems/safe_yaml-1.0.4/lib"

data/bundle/ruby/2.5.0/gems/{sexp_processor-4.10.1 → sexp_processor-4.11.0}/History.rdoc

@@ -1,3 +1,9 @@
+=== 4.11.0 / 2018-04-05
+
+* 1 minor enhancement:
+
+  * Extended deep_each to skip subtrees if block returns :skip.
+
 === 4.10.1 / 2018-02-15
 
 * 1 minor enhancement:

data/bundle/ruby/2.5.0/gems/{sexp_processor-4.10.1 → sexp_processor-4.11.0}/lib/sexp.rb

@@ -86,12 +86,19 @@ class Sexp < Array # ZenTest FULL
 
   ##
   # Recursively enumerates the sexp yielding to +block+ for every element.
+  #
+  # Returning :skip will stop traversing that subtree:
+  #
+  #   sexp.deep_each do |s|
+  #     next :skip if s.sexp_type == :if
+  #     # ...
+  #   end
 
   def deep_each &block
     return enum_for(:deep_each) unless block_given?
 
     self.each_sexp do |sexp|
-      block[sexp]
+      next if block[sexp] == :skip
       sexp.deep_each(&block)
     end
   end

data/bundle/ruby/2.5.0/gems/{sexp_processor-4.10.1 → sexp_processor-4.11.0}/lib/sexp_processor.rb

@@ -34,7 +34,7 @@ require "sexp"
 class SexpProcessor
 
   # duh
-  VERSION = "4.10.1"
+  VERSION = "4.11.0"
 
   ##
   # Automatically shifts off the Sexp type before handing the

data/bundle/ruby/2.5.0/gems/{sexp_processor-4.10.1 → sexp_processor-4.11.0}/test/test_sexp.rb

@@ -641,15 +641,28 @@ class TestSexp < SexpTestCase # ZenTest FULL
     assert_equal 5, s(:a, s(:b, s(:c, s(:d, s(:e))))).depth
   end
 
+  DEEP_EXP = [:lasgn, :str, :if,
+              :and, :true, :lit,
+              :if, :lvar, :str, :true]
+
   def test_deep_each
-    result = []
-    @complex_sexp.deep_each { |s| result << s if s.sexp_type == :if }
-    assert_equal [:if, :if], result.map { |k, _| k }
+    act = []
+
+    @complex_sexp.deep_each { |s| act << s }
+    assert_equal DEEP_EXP, act.map { |k, _| k }
+  end
+
+  def test_deep_each_skip
+    exp = DEEP_EXP.first(3) + DEEP_EXP.last(4)
+    act = []
+
+    @complex_sexp.deep_each { |s| next :skip if s.sexp_type == :and; act << s }
+    assert_equal exp, act.map { |k, _| k }
   end
 
   def test_deep_each_without_block
     assert_kind_of Enumerator, @complex_sexp.deep_each
-    assert_equal [:if, :if], @complex_sexp.deep_each.select { |s, _| s == :if }.map { |k, _| k }
+    assert_equal DEEP_EXP, @complex_sexp.deep_each.map(&:first)
   end
 
   def test_unary_not

data/bundle/ruby/2.5.0/gems/{unicode-display_width-1.3.0 → unicode-display_width-1.3.2}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # CHANGELOG
 
+## 1.3.2
+
+- Explicitly load rubygems/util, fixes regression in 1.3.1 (autoload issue)
+
+## 1.3.1
+
+- Use `Gem::Util` for `gunzip`, removes deprecation warning, patch by @Schwad
+
 ## 1.3.0
 
 - Unicode 10

data/bundle/ruby/2.5.0/gems/{unicode-display_width-1.3.0 → unicode-display_width-1.3.2}/lib/unicode/display_width/constants.rb

@@ -1,6 +1,6 @@
 module Unicode
   module DisplayWidth
-    VERSION = '1.3.0'
+    VERSION = '1.3.2'
     UNICODE_VERSION = "10.0.0".freeze
     DATA_DIRECTORY = File.expand_path(File.dirname(__FILE__) + '/../../../data/').freeze
     INDEX_FILENAME = (DATA_DIRECTORY + '/display_width.marshal.gz').freeze

data/bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/lib/unicode/display_width/index.rb

@@ -0,0 +1,8 @@
+require 'rubygems/util'
+require_relative 'constants'
+
+module Unicode
+  module DisplayWidth
+    INDEX = Marshal.load(Gem::Util.gunzip(File.binread(INDEX_FILENAME)))
+  end
+end

data/lib/brakeman.rb

@@ -51,6 +51,7 @@ module Brakeman
   #  * :output_files - files for output
   #  * :output_formats - formats for output (:to_s, :to_tabs, :to_csv, :to_html)
   #  * :parallel_checks - run checks in parallel (default: true)
+  #  * :parser_timeout - set timeout for parsing an individual file (default: 10 seconds)
   #  * :print_report - if no output file specified, print to stdout (default: false)
   #  * :quiet - suppress most messages (default: true)
   #  * :rails3 - force Rails 3 mode (automatic)
@@ -174,6 +175,7 @@ module Brakeman
       :output_color => true,
       :pager => true,
       :parallel_checks => true,
+      :parser_timeout => 10,
       :relative_path => false,
       :report_progress => true,
       :safe_methods => Set.new,
@@ -376,7 +378,7 @@ module Brakeman
 
   def self.write_report_to_files tracker, output_files
     require 'fileutils'
-    tracker.options[:output_color] = false
+    tracker.options[:output_color] = false unless tracker.options[:output_color] == :force
 
     output_files.each_with_index do |output_file, idx|
       dir = File.dirname(output_file)
@@ -393,7 +395,7 @@ module Brakeman
   private_class_method :write_report_to_files
 
   def self.write_report_to_formats tracker, output_formats
-    unless $stdout.tty?
+    unless $stdout.tty? or tracker.options[:output_color] == :force
       tracker.options[:output_color] = false
     end
 

data/lib/brakeman/checks/base_check.rb

@@ -119,7 +119,10 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
 
   #Does not actually process string interpolation, but notes that it occurred.
   def process_dstr exp
-    @string_interp = Match.new(:interp, exp)
+    unless @string_interp # don't overwrite existing value
+      @string_interp = Match.new(:interp, exp)
+    end
+
     process_default exp
   end
 

data/lib/brakeman/checks/check_execute.rb

@@ -15,7 +15,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
   SAFE_VALUES = [s(:const, :RAILS_ROOT),
                   s(:call, s(:const, :Rails), :root),
-                  s(:call, s(:const, :Rails), :env)]
+                  s(:call, s(:const, :Rails), :env),
+                  s(:call, s(:const, :Process), :pid)]
 
   SHELL_ESCAPES = [:escape, :shellescape, :join]
 
@@ -32,7 +33,7 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     calls = tracker.find_call :targets => [:IO, :Open3, :Kernel, :'POSIX::Spawn', :Process, nil],
       :methods => [:capture2, :capture2e, :capture3, :exec, :pipeline, :pipeline_r,
         :pipeline_rw, :pipeline_start, :pipeline_w, :popen, :popen2, :popen2e,
-        :popen3, :spawn, :syscall, :system]
+        :popen3, :spawn, :syscall, :system], :nested => true
 
     Brakeman.debug "Processing system calls"
     calls.each do |result|

data/lib/brakeman/checks/check_link_to_href.rb

@@ -71,14 +71,15 @@ class Brakeman::CheckLinkToHref < Brakeman::CheckLinkTo
     end
   end
 
+  CHECK_INSIDE_METHODS = [:url_for, :h, :sanitize]
+
   def check_argument? url_arg
     return unless call? url_arg
 
     target = url_arg.target
     method = url_arg.method
 
-    method == :url_for or
-      method == :h or
+    CHECK_INSIDE_METHODS.include? method or
       cgi_escaped? target, method
   end
 

data/lib/brakeman/checks/check_sanitize_methods.rb

@@ -46,12 +46,6 @@ class Brakeman::CheckSanitizeMethods < Brakeman::BaseCheck
 
       message = "Rails #{rails_version} has a vulnerability in #{method}: upgrade to #{@fix_version} or patch"
 
-      if include_user_input? result[:call]
-        confidence = :high
-      else
-        confidence = :medium
-      end
-
       warn :result => result,
         :warning_type => "Cross-Site Scripting",
         :warning_code => code,
@@ -87,7 +81,7 @@ class Brakeman::CheckSanitizeMethods < Brakeman::BaseCheck
       warn :warning_type => "Cross-Site Scripting",
         :warning_code => :CVE_2018_8048,
         :message => message,
-        :gem_info => gemfile_or_environment,
+        :gem_info => gemfile_or_environment(:loofah),
         :confidence => confidence,
         :link_path => "https://github.com/flavorjones/loofah/issues/144"
     end
@@ -111,7 +105,7 @@ class Brakeman::CheckSanitizeMethods < Brakeman::BaseCheck
     warn :warning_type => "Cross-Site Scripting",
       :warning_code => cve.tr('-', '_').to_sym,
       :message => message,
-      :gem_info => gemfile_or_environment,
+      :gem_info => gemfile_or_environment(:'rails-html-sanitizer'),
       :confidence => confidence,
       :link_path => link
   end

data/lib/brakeman/checks/check_sql.rb

@@ -290,7 +290,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     end
 
     if request_value? arg
-      unless call? arg and params? arg.target and [:permit, :slice].include? arg.method
+      unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash].include? arg.method
         # Model.where(params[:where])
         arg
       end

data/lib/brakeman/codeclimate/engine_configuration.rb

@@ -87,9 +87,9 @@ module Brakeman
 
       def stripped_include_path(prefix, subprefixes, path)
         if path.start_with?(prefix)
-          path.sub(%r{^#{prefix}/?}, "./")
+          path.sub(%r{^#{prefix}/?}, "/")
         elsif subprefixes.any? { |subprefix| path =~ %r{^#{subprefix}/?$} }
-          "./"
+          "/"
         end
       end
     end

data/lib/brakeman/file_parser.rb

@@ -7,6 +7,7 @@ module Brakeman
 
     def initialize tracker, app_tree
       @tracker = tracker
+      @timeout = @tracker.options[:parser_timeout]
       @app_tree = app_tree
       @file_list = {}
     end
@@ -33,10 +34,13 @@ module Brakeman
     def parse_ruby input, path
       begin
         Brakeman.debug "Parsing #{path}"
-        RubyParser.new.parse input, path
+        RubyParser.new.parse input, path, @timeout
       rescue Racc::ParseError => e
         @tracker.error e, "Could not parse #{path}"
         nil
+      rescue Timeout::Error => e
+        @tracker.error Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout"), caller
+        nil
       rescue => e
         @tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
         nil

data/lib/brakeman/options.rb

@@ -127,6 +127,10 @@ module Brakeman::Options
           options[:branch_limit] = limit
         end
 
+        opts.on "--parser-timeout SECONDS", Integer, "Set parse timeout (Default: 10)" do |timeout|
+          options[:parser_timeout] = timeout
+        end
+
         opts.on "-r", "--report-direct", "Only report direct use of untrusted data" do |option|
           options[:check_arguments] = !option
         end
@@ -229,7 +233,11 @@ module Brakeman::Options
         end
 
         opts.on "--[no-]color", "Use ANSI colors in report (Default)" do |color|
-          options[:output_color] = color
+          if color
+            options[:output_color] = :force
+          else
+            options[:output_color] = color
+          end
         end
 
         opts.on "-m", "--routes", "Report controller information" do

data/lib/brakeman/parsers/template_parser.rb

@@ -93,7 +93,7 @@ module Brakeman
     end
 
     def self.parse_inline_erb tracker, text
-      fp = Brakeman::FileParser.new(nil, nil)
+      fp = Brakeman::FileParser.new(tracker, nil)
       tp = self.new(tracker, fp)
       src = tp.parse_erb '_inline_', text
       type = tp.erubis? ? :erubis : :erb

data/lib/brakeman/processors/alias_processor.rb

@@ -197,7 +197,6 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       return Sexp.new(:false)
     end
 
-
     #See if it is possible to simplify some basic cases
     #of addition/concatenation.
     case method
@@ -287,11 +286,80 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       if array? target and first_arg.nil? and sexp? target[1]
         exp = target[1]
       end
+    when :freeze
+      if string? target
+        exp = process exp.target
+      end
+    when :join
+      if array? target and target.length > 2 and (string? first_arg or first_arg.nil?)
+        exp = process_array_join(target, first_arg)
+      end
     end
 
     exp
   end
 
+  # Painful conversion of Array#join into string interpolation
+  def process_array_join array, join_str
+    result = s()
+
+    join_value = if string? join_str
+                   join_str.value
+                 else
+                   nil
+                 end
+
+    array[1..-2].each do |e|
+      result << join_item(e, join_value)
+    end
+
+    result << join_item(array.last, nil)
+
+    # Combine the strings at the beginning because that's what RubyParser does
+    combined_first = ""
+    result.each do |e|
+      if string? e
+        combined_first << e.value
+      elsif e.is_a? String
+        combined_first << e
+      else
+        break
+      end
+    end
+
+    # Remove the strings at the beginning
+    result.reject! do |e|
+      if e.is_a? String or string? e
+        true
+      else
+        break
+      end
+    end
+
+    result.unshift combined_first
+
+    # Have to fix up strings that follow interpolation
+    result.reduce(s(:dstr)) do |memo, e|
+      if string? e and node_type? memo.last, :evstr
+        e.value = "#{join_value}#{e.value}"
+      elsif join_value and node_type? memo.last, :evstr and node_type? e, :evstr
+        memo << s(:str, join_value)
+      end
+
+      memo << e
+    end
+  end
+
+  def join_item item, join_value
+    if item.is_a? String
+      "#{item}#{join_value}"
+    elsif string? item or symbol? item or number? item
+      s(:str, "#{item.value}#{join_value}")
+    else
+      s(:evstr, item)
+    end
+  end
+
   def process_iter exp
     @exp_context.push exp
     exp[1] = process exp.block_call

data/lib/brakeman/processors/lib/find_all_calls.rb

@@ -19,6 +19,7 @@ class Brakeman::FindAllCalls < Brakeman::BasicProcessor
     @current_method = opts[:method]
     @current_template = opts[:template]
     @current_file = opts[:file]
+    @current_call = nil
     process exp
   end
 
@@ -111,7 +112,8 @@ class Brakeman::FindAllCalls < Brakeman::BasicProcessor
                 :method => method_name,
                 :call => exp,
                 :nested => false,
-                :location => make_location }
+                :location => make_location,
+                :parent => @current_call }
   end
 
   #Gets the target of a call as a Symbol
@@ -189,7 +191,7 @@ class Brakeman::FindAllCalls < Brakeman::BasicProcessor
   def create_call_hash exp
     target = get_target exp.target
 
-    if call? target
+    if call? target or node_type? target, :dxstr # need to index `` even if target of a call
       already_in_target = @in_target
       @in_target = true
       process target
@@ -199,13 +201,24 @@ class Brakeman::FindAllCalls < Brakeman::BasicProcessor
     end
 
     method = exp.method
-    process_call_args exp
 
-    { :target => target,
+    call_hash = {
+      :target => target,
       :method => method,
       :call => exp,
       :nested => @in_target,
       :chain => get_chain(exp),
-      :location => make_location }
+      :location => make_location,
+      :parent => @current_call
+    }
+
+    old_parent = @current_call
+    @current_call = call_hash
+
+    process_call_args exp
+
+    @current_call = old_parent
+
+    call_hash
   end
 end

data/lib/brakeman/report/pager.rb

@@ -102,7 +102,9 @@ module Brakeman
     end
 
     def set_color
-      unless @tracker and less_options.include? "-R "
+      return unless @tracker
+
+      unless less_options.include? "-R " or @tracker.options[:output_color] == :force
         @tracker.options[:output_color] = false
       end
     end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "4.2.1"
+  Version = "4.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 4.2.1
+  version: 4.3.0
 platform: ruby
 authors:
 - Justin Collins
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain:
 - brakeman-public_cert.pem
-date: 2018-03-24 00:00:00.000000000 Z
+date: 2018-05-11 00:00:00.000000000 Z
 dependencies: []
 description: Brakeman detects security vulnerabilities in Ruby on Rails applications
   via static analysis.
@@ -890,20 +890,20 @@ files:
 - bundle/ruby/2.5.0/gems/sass-3.4.25/vendor/listen/spec/support/fixtures_helper.rb
 - bundle/ruby/2.5.0/gems/sass-3.4.25/vendor/listen/spec/support/listeners_helper.rb
 - bundle/ruby/2.5.0/gems/sass-3.4.25/vendor/listen/spec/support/platform_helper.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/History.rdoc
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/Manifest.txt
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/README.rdoc
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/Rakefile
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/lib/composite_sexp_processor.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/lib/pt_testcase.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/lib/sexp.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/lib/sexp_processor.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/lib/strict_sexp.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/lib/unique.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/test/test_composite_sexp_processor.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/test/test_environment.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/test/test_sexp.rb
-- bundle/ruby/2.5.0/gems/sexp_processor-4.10.1/test/test_sexp_processor.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/History.rdoc
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/Manifest.txt
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/README.rdoc
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/Rakefile
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/lib/composite_sexp_processor.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/lib/pt_testcase.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/lib/sexp.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/lib/sexp_processor.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/lib/strict_sexp.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/lib/unique.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/test/test_composite_sexp_processor.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/test/test_environment.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/test/test_sexp.rb
+- bundle/ruby/2.5.0/gems/sexp_processor-4.11.0/test/test_sexp_processor.rb
 - bundle/ruby/2.5.0/gems/slim-3.0.7/CHANGES
 - bundle/ruby/2.5.0/gems/slim-3.0.7/Gemfile
 - bundle/ruby/2.5.0/gems/slim-3.0.7/LICENSE
@@ -1220,18 +1220,18 @@ files:
 - bundle/ruby/2.5.0/gems/tilt-2.0.8/test/tilt_wikiclothtemplate_test.rb
 - bundle/ruby/2.5.0/gems/tilt-2.0.8/test/tilt_yajltemplate_test.rb
 - bundle/ruby/2.5.0/gems/tilt-2.0.8/tilt.gemspec
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/CHANGELOG.md
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/MIT-LICENSE.txt
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/README.md
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/Rakefile
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/data/display_width.marshal.gz
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/lib/unicode/display_width.rb
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/lib/unicode/display_width/constants.rb
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/lib/unicode/display_width/index.rb
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/lib/unicode/display_width/no_string_ext.rb
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/lib/unicode/display_width/string_ext.rb
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/spec/display_width_spec.rb
-- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/unicode-display_width.gemspec
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/CHANGELOG.md
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/MIT-LICENSE.txt
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/README.md
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/Rakefile
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/data/display_width.marshal.gz
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/lib/unicode/display_width.rb
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/lib/unicode/display_width/constants.rb
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/lib/unicode/display_width/index.rb
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/lib/unicode/display_width/no_string_ext.rb
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/lib/unicode/display_width/string_ext.rb
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/spec/display_width_spec.rb
+- bundle/ruby/2.5.0/gems/unicode-display_width-1.3.2/unicode-display_width.gemspec
 - lib/brakeman.rb
 - lib/brakeman/app_tree.rb
 - lib/brakeman/call_index.rb
@@ -1410,7 +1410,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.3
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.

data/bundle/ruby/2.5.0/gems/unicode-display_width-1.3.0/lib/unicode/display_width/index.rb

@@ -1,7 +0,0 @@
-require_relative 'constants'
-
-module Unicode
-  module DisplayWidth
-    INDEX = Marshal.load(Gem.gunzip(File.binread(INDEX_FILENAME)))
-  end
-end