brakeman 4.3.1 → 4.4.0

data/bundle/ruby/2.5.0/gems/{tilt-2.0.8 → tilt-2.0.9}/lib/tilt/erb.rb

@@ -7,6 +7,8 @@ module Tilt
   class ERBTemplate < Template
     @@default_output_variable = '_erbout'
 
+    SUPPORTS_KVARGS = ::ERB.instance_method(:initialize).parameters.assoc(:key) rescue false
+
     def self.default_output_variable
       @@default_output_variable
     end
@@ -19,7 +21,11 @@ module Tilt
     def prepare
       @outvar = options[:outvar] || self.class.default_output_variable
       options[:trim] = '<>' if !(options[:trim] == false) && (options[:trim].nil? || options[:trim] == true)
-      @engine = ::ERB.new(data, options[:safe], options[:trim], @outvar)
+      @engine = if SUPPORTS_KVARGS
+        ::ERB.new(data, trim_mode: options[:trim], eoutvar: @outvar)
+      else
+        ::ERB.new(data, options[:safe], options[:trim], @outvar)
+      end
     end
 
     def precompiled_template(locals)

data/bundle/ruby/2.5.0/gems/{tilt-2.0.8 → tilt-2.0.9}/lib/tilt/haml.rb

@@ -62,7 +62,7 @@ module Tilt
           <<-RUBY
             begin
               extend Haml::Helpers
-              _hamlout = @haml_buffer = Haml::Buffer.new(@haml_buffer, #{options_for_buffer.inspect})
+              _hamlout = @haml_buffer = Haml::Buffer.new(haml_buffer, #{options_for_buffer.inspect})
               _erbout = _hamlout.buffer
               __in_erb_template = true
               _haml_locals = locals
@@ -76,7 +76,7 @@ module Tilt
           <<-RUBY
               #{precompiled_method_return_value}
             ensure
-              @haml_buffer = @haml_buffer.upper if @haml_buffer
+              @haml_buffer = @haml_buffer.upper if haml_buffer
             end
           RUBY
         end

data/bundle/ruby/2.5.0/gems/{tilt-2.0.8 → tilt-2.0.9}/lib/tilt/sass.rb

@@ -1,5 +1,4 @@
 require 'tilt/template'
-require 'sass'
 
 module Tilt
   # Sass template implementation. See:
@@ -9,8 +8,20 @@ module Tilt
   class SassTemplate < Template
     self.default_mime_type = 'text/css'
 
+    begin
+      require 'sassc'
+      Sass = ::SassC
+    rescue LoadError => err
+      begin
+        require 'sass'
+        Sass = ::Sass
+      rescue LoadError
+        raise err
+      end
+    end
+
     def prepare
-      @engine = ::Sass::Engine.new(data, sass_options)
+      @engine = Sass::Engine.new(data, sass_options)
     end
 
     def evaluate(scope, locals, &block)

data/bundle/ruby/2.5.0/gems/{tilt-2.0.8 → tilt-2.0.9}/tilt.gemspec

@@ -3,8 +3,8 @@ Gem::Specification.new do |s|
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
 
   s.name = 'tilt'
-  s.version = '2.0.8'
-  s.date = '2017-07-24'
+  s.version = '2.0.9'
+  s.date = '2018-11-28'
 
   s.description = "Generic interface to multiple Ruby template engines"
   s.summary     = s.description

data/bundle/ruby/2.5.0/gems/{unicode-display_width-1.4.0 → unicode-display_width-1.4.1}/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 1.4.1
+
+- Only bundle required lib/* and data/* files in actual rubygem, patch by @tas50
+
 ## 1.4.0
 
 - Unicode 11

data/bundle/ruby/2.5.0/gems/{unicode-display_width-1.4.0 → unicode-display_width-1.4.1}/lib/unicode/display_width/constants.rb

@@ -1,6 +1,6 @@
 module Unicode
   module DisplayWidth
-    VERSION = '1.4.0'
+    VERSION = '1.4.1'
     UNICODE_VERSION = "11.0.0".freeze
     DATA_DIRECTORY = File.expand_path(File.dirname(__FILE__) + '/../../../data/').freeze
     INDEX_FILENAME = (DATA_DIRECTORY + '/display_width.marshal.gz').freeze

data/lib/brakeman.rb

@@ -348,7 +348,7 @@ module Brakeman
     scanner = Scanner.new options
     tracker = scanner.tracker
 
-    check_for_missing_checks options[:run_checks], options[:skip_checks]
+    check_for_missing_checks options[:run_checks], options[:skip_checks], options[:enable_checks]
 
     notify "Processing application in #{tracker.app_path}"
     scanner.process
@@ -521,8 +521,10 @@ module Brakeman
     end if options[:additional_checks_path]
   end
 
-  def self.check_for_missing_checks included_checks, excluded_checks
-    missing = Brakeman::Checks.missing_checks(included_checks || Set.new, excluded_checks || Set.new)
+  def self.check_for_missing_checks included_checks, excluded_checks, enabled_checks
+    checks = included_checks.to_a + excluded_checks.to_a + enabled_checks.to_a
+
+    missing = Brakeman::Checks.missing_checks(checks)
 
     unless missing.empty?
       raise MissingChecksError, "Could not find specified check#{missing.length > 1 ? 's' : ''}: #{missing.map {|c| "`#{c}`"}.join(', ')}"

data/lib/brakeman/app_tree.rb

@@ -61,6 +61,7 @@ module Brakeman
       @engine_paths = init_options[:engine_paths] || []
       @absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
       @relative_engine_paths = @engine_paths - @absolute_engine_paths
+      @gemspec = nil
     end
 
     def expand_path(path)
@@ -116,6 +117,18 @@ module Brakeman
                      find_job_paths
     end
 
+    def gemspec
+      return @gemspec unless @gemspec.nil?
+
+      gemspecs =  Dir.glob(File.join(@root, "*.gemspec"))
+
+      if gemspecs.length > 1 or gemspecs.empty?
+        @gemspec = false
+      else
+        @gemspec = File.basename(gemspecs.first)
+      end
+    end
+
   private
 
     def find_helper_paths
@@ -176,12 +189,13 @@ module Brakeman
 
     def root_search_pattern
       return @root_search_pattern if @root_search_pattern
+
       abs = @absolute_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
       rel = @relative_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
 
       roots = ([@root] + abs).join(",")
       rel_engines = (rel + [""]).join("/,")
-      @root_search_patrern = "{#{roots}}/{#{rel_engines}}"
+      @root_search_pattern = "{#{roots}}/{#{rel_engines}}"
     end
 
     def prioritize_concerns paths

data/lib/brakeman/call_index.rb

@@ -5,8 +5,8 @@ class Brakeman::CallIndex
 
   #Initialize index with calls from FindAllCalls
   def initialize calls
-    @calls_by_method = Hash.new { |h, k| h[k] = [] }
-    @calls_by_target = Hash.new { |h, k| h[k] = [] }
+    @calls_by_method = {}
+    @calls_by_target = {}
 
     index_calls calls
   end
@@ -87,13 +87,16 @@ class Brakeman::CallIndex
 
   def index_calls calls
     calls.each do |call|
+      @calls_by_method[call[:method]] ||= []
       @calls_by_method[call[:method]] << call
 
       target = call[:target]
 
       if not target.is_a? Sexp
+        @calls_by_target[target] ||= []
         @calls_by_target[target] << call
       elsif target.node_type == :params or target.node_type == :session
+        @calls_by_target[target.node_type] ||= []
         @calls_by_target[target.node_type] << call
       end
     end
@@ -116,7 +119,7 @@ class Brakeman::CallIndex
     if target.is_a? Array
       calls_by_targets target
     else
-      @calls_by_target[target]
+      @calls_by_target[target] || []
     end
   end
 
@@ -136,7 +139,7 @@ class Brakeman::CallIndex
     elsif method.is_a? Regexp
       calls_by_methods_regex method
     else
-      @calls_by_method[method.to_sym]
+      @calls_by_method[method.to_sym] || []
     end
   end
 

data/lib/brakeman/checks.rb

@@ -37,15 +37,14 @@ class Brakeman::Checks
     end
   end
 
-  def self.missing_checks included_checks, excluded_checks
-    included_checks = included_checks.map(&:to_s).to_set
-    excluded_checks = excluded_checks.map(&:to_s).to_set
+  def self.missing_checks check_args
+    check_args = check_args.to_a.map(&:to_s).to_set
 
-    if included_checks == Set['CheckNone']
+    if check_args == Set['CheckNone']
       return []
     else
       loaded = self.checks.map { |name| name.to_s.gsub('Brakeman::', '') }.to_set
-      missing = (included_checks - loaded) + (excluded_checks - loaded)
+      missing = check_args - loaded
 
       unless missing.empty?
         return missing
@@ -170,8 +169,16 @@ class Brakeman::Checks
     to_run = if tracker.options[:run_all_checks] or tracker.options[:run_checks]
                @checks + @optional_checks
              else
-               @checks
-             end
+               @checks.dup
+             end.to_set
+
+    if enabled_checks = tracker.options[:enable_checks]
+      @optional_checks.each do |c|
+        if enabled_checks.include? self.get_check_name(c)
+          to_run << c
+        end
+      end
+    end
 
     self.filter_checks to_run, tracker
   end
@@ -179,12 +186,13 @@ class Brakeman::Checks
   def self.filter_checks checks, tracker
     skipped = tracker.options[:skip_checks]
     explicit = tracker.options[:run_checks]
+    enabled = tracker.options[:enable_checks] || []
 
     checks.reject do |c|
       check_name = self.get_check_name(c)
 
       skipped.include? check_name or
-        (explicit and not explicit.include? check_name)
+        (explicit and not explicit.include? check_name and not enabled.include? check_name)
     end
   end
 

data/lib/brakeman/checks/base_check.rb

@@ -2,12 +2,14 @@ require 'brakeman/processors/output_processor'
 require 'brakeman/processors/lib/processor_helper'
 require 'brakeman/warning'
 require 'brakeman/util'
+require 'brakeman/messages'
 
 #Basis of vulnerability checks.
 class Brakeman::BaseCheck < Brakeman::SexpProcessor
   include Brakeman::ProcessorHelper
   include Brakeman::SafeCallHelper
   include Brakeman::Util
+  include Brakeman::Messages
   attr_reader :tracker, :warnings
 
   # This is for legacy support.
@@ -483,23 +485,4 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
 
     @active_record_models
   end
-
-  def friendly_type_of input_type
-    if input_type.is_a? Match
-      input_type = input_type.type
-    end
-
-    case input_type
-    when :params
-      "parameter value"
-    when :cookies
-      "cookie value"
-    when :request
-      "request value"
-    when :model
-      "model attribute"
-    else
-      "user input"
-    end
-  end
 end

data/lib/brakeman/checks/check_basic_auth_timing_attack.rb

@@ -25,7 +25,7 @@ class Brakeman::CheckBasicAuthTimingAttack < Brakeman::BaseCheck
       warn :result => result,
         :warning_type => "Timing Attack",
         :warning_code => :CVE_2015_7576,
-        :message => "Basic authentication in Rails #{rails_version} is vulnerable to timing attacks. Upgrade to #@upgrade",
+        :message => msg("Basic authentication in ", msg_version(rails_version), " is vulnerable to timing attacks. Upgrade to ", msg_version(@upgrade)),
         :confidence => :high,
         :link => "https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ"
     end

data/lib/brakeman/checks/check_content_tag.rb

@@ -96,7 +96,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
     end
 
     if input = has_immediate_user_input?(arg)
-      message = "Unescaped #{friendly_type_of input} in content_tag"
+      message = msg("Unescaped ", msg_input(input), " in ", msg_code("content_tag"))
 
       add_result result
 
@@ -121,7 +121,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
         warn :result => result,
           :warning_type => "Cross-Site Scripting",
           :warning_code => :xss_content_tag,
-          :message => "Unescaped model attribute in content_tag",
+          :message => msg("Unescaped model attribute in ", msg_code("content_tag")),
           :user_input => match,
           :confidence => confidence,
           :link_path => "content_tag"
@@ -130,7 +130,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
     elsif @matched
       return if @matched.type == :model and tracker.options[:ignore_model_output]
 
-      message = "Unescaped #{friendly_type_of @matched} in content_tag"
+      message = msg("Unescaped ", msg_input(@matched), " in ", msg_code("content_tag"))
 
       add_result result
 
@@ -181,7 +181,7 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
 
       warn :warning_type => "Cross-Site Scripting",
         :warning_code => :CVE_2016_6316,
-        :message => "Rails #{rails_version} content_tag does not escape double quotes in attribute values (CVE-2016-6316). Upgrade to #{fix_version}",
+        :message => msg(msg_version(rails_version), " ", msg_code("content_tag"), " does not escape double quotes in attribute values ", msg_cve("CVE-2016-6316"), ". Upgrade to ", msg_version(fix_version)),
         :confidence => confidence,
         :gem_info => gemfile_or_environment,
         :link_path => "https://groups.google.com/d/msg/ruby-security-ann/8B2iV2tPRSE/JkjCJkSoCgAJ"

data/lib/brakeman/checks/check_create_with.rb

@@ -16,7 +16,7 @@ class Brakeman::CheckCreateWith < Brakeman::BaseCheck
       return
     end
 
-    @message = "create_with is vulnerable to strong params bypass. Upgrade to Rails #{suggested_version} or patch"
+    @message = msg(msg_code("create_with"), " is vulnerable to strong params bypass. Upgrade to ", msg_version(suggested_version), " or patch")
 
     tracker.find_call(:method => :create_with, :nested => true).each do |result|
       process_result result

data/lib/brakeman/checks/check_cross_site_scripting.rb

@@ -70,7 +70,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
     if input = has_immediate_user_input?(out)
       add_result exp
 
-      message = "Unescaped #{friendly_type_of input}"
+      message = msg("Unescaped ", msg_input(input))
 
       warn :template => @current_template,
         :warning_type => "Cross-Site Scripting",
@@ -168,7 +168,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
       if @matched
         unless @matched.type and tracker.options[:ignore_model_output]
-          message = "Unescaped #{friendly_type_of @matched}"
+          message = msg("Unescaped ", msg_input(@matched))
         end
 
         if message and not duplicate? exp
@@ -180,7 +180,7 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
           if @known_dangerous.include? exp.method
             confidence = :high
             if exp.method == :to_json
-              message += " in JSON hash"
+              message << msg_plain(" in JSON hash")
               link_path += "_to_json"
               warning_code = :xss_to_json
             end