brakeman 4.3.1 → 5.0.0

data/lib/brakeman/report/report_html.rb

@@ -1,9 +1,10 @@
 require 'cgi'
+require 'brakeman/report/report_table.rb'
 
-class Brakeman::Report::HTML < Brakeman::Report::Base
+class Brakeman::Report::HTML < Brakeman::Report::Table
   HTML_CONFIDENCE = [ "<span class='high-confidence'>High</span>",
-    "<span class='med-confidence'>Medium</span>",
-    "<span class='weak-confidence'>Weak</span>" ]
+                      "<span class='med-confidence'>Medium</span>",
+                      "<span class='weak-confidence'>Weak</span>" ]
 
   def initialize *args
     super
@@ -66,20 +67,18 @@ class Brakeman::Report::HTML < Brakeman::Report::Base
   end
 
   def convert_warning warning, original
-    warning["Confidence"] = HTML_CONFIDENCE[warning["Confidence"]]
+    warning["Confidence"] = HTML_CONFIDENCE[original.confidence]
     warning["Message"] = with_context original, warning["Message"]
     warning["Warning Type"] = with_link original, warning["Warning Type"]
     warning
   end
 
   def with_link warning, message
-    "<a rel=\"no-referrer\" href=\"#{warning.link}\">#{message}</a>"
+    "<a rel=\"noreferrer\" href=\"#{warning.link}\">#{message}</a>"
   end
 
   def convert_template_warning warning, original
-    warning["Confidence"] = HTML_CONFIDENCE[warning["Confidence"]]
-    warning["Message"] = with_context original, warning["Message"]
-    warning["Warning Type"] = with_link original, warning["Warning Type"]
+    warning = convert_warning warning, original
     warning["Called From"] = original.called_from
     warning["Template Name"] = original.template.name
     warning
@@ -87,7 +86,7 @@ class Brakeman::Report::HTML < Brakeman::Report::Base
 
   def convert_ignored_warning warning, original
     warning = convert_warning(warning, original)
-    warning['File'] = original.relative_path
+    warning['File'] = original.file.relative
     warning['Note'] = CGI.escapeHTML(@ignore_filter.note_for(original) || "")
     warning
   end
@@ -113,29 +112,16 @@ class Brakeman::Report::HTML < Brakeman::Report::Base
 
   #Generate HTML for warnings, including context show/hidden via Javascript
   def with_context warning, message
-    context = context_for(@app_tree, warning)
-    full_message = nil
-
-    if tracker.options[:message_limit] and tracker.options[:message_limit] > 0 and message.length > tracker.options[:message_limit]
-      full_message = html_message(warning, message)
-      message = message[0..tracker.options[:message_limit]] << "..."
-    end
-
+    @element_id += 1
+    context = context_for(warning)
     message = html_message(warning, message)
-    return message if context.empty? and not full_message
 
-    @element_id += 1
     code_id = "context#@element_id"
     message_id = "message#@element_id"
     full_message_id = "full_message#@element_id"
     alt = false
     output = "<div class='warning_message' onClick=\"toggle('#{code_id}');toggle('#{message_id}');toggle('#{full_message_id}')\" >" <<
-    if full_message
-      "<span id='#{message_id}' style='display:block' >#{message}</span>" <<
-      "<span id='#{full_message_id}' style='display:none'>#{full_message}</span>"
-    else
-      message
-    end <<
+    message <<
     "<table id='#{code_id}' class='context' style='display:none'>" <<
     "<caption>#{CGI.escapeHTML warning_file(warning) || ''}</caption>"
 
@@ -199,18 +185,35 @@ class Brakeman::Report::HTML < Brakeman::Report::Base
 
   #Escape warning message and highlight user input in HTML output
   def html_message warning, message
-    message = CGI.escapeHTML(message)
+    message = message.to_html
 
     if warning.file
-      github_url = github_url warning.file, warning.line
-      message.gsub!(/(near line \d+)/, "<a href=\"#{github_url}\" target='_blank'>\\1</a>") if github_url
+      if github_url = github_url(warning.file, warning.line)
+        message << " <a href=\"#{github_url}\" target='_blank'>near line #{warning.line}</a>"
+      elsif warning.line
+        message << " near line #{warning.line}"
+      end
     end
 
-    if @highlight_user_input and warning.user_input
-      user_input = CGI.escapeHTML(warning.format_user_input)
-      message.gsub!(user_input, "<span class=\"user_input\">#{user_input}</span>")
-    end
+    if warning.code
+      code = warning.format_with_user_input do |_, user_input|
+        "[BMP_UI]#{user_input}[/BMP_UI]"
+      end
+
+      code = "<span class=\"code\">#{CGI.escapeHTML(code).gsub("[BMP_UI]", "<span class=\"user_input\">").gsub("[/BMP_UI]", "</span>")}</span>"
+      full_message = "#{message}: #{code}"
 
-    message
+      if warning.code.mass > 20
+        message_id = "message#@element_id"
+        full_message_id = "full_message#@element_id"
+
+        "<span id='#{message_id}' style='display:block'>#{message}: ...</span>" <<
+        "<span id='#{full_message_id}' style='display:none'>#{full_message}</span>"
+      else
+        full_message
+      end
+    else
+      message
+    end
   end
 end

data/lib/brakeman/report/report_json.rb

@@ -37,9 +37,7 @@ class Brakeman::Report::JSON < Brakeman::Report::Base
 
   def convert_to_hashes warnings
     warnings.map do |w|
-      hash = w.to_hash
-      hash[:file] = warning_file w
-      hash
+      w.to_hash(absolute_paths: false)
     end.sort_by { |w| "#{w[:fingerprint]}#{w[:line]}" }
   end
 end

data/lib/brakeman/report/report_junit.rb

@@ -0,0 +1,104 @@
+require 'time'
+require "stringio"
+require 'rexml/document'
+
+class Brakeman::Report::JUnit < Brakeman::Report::Base
+  def generate_report
+    io = StringIO.new
+    doc = REXML::Document.new
+    doc.add REXML::XMLDecl.new '1.0', 'UTF-8'
+
+    test_suites = REXML::Element.new 'testsuites'
+    test_suites.add_attribute 'xmlns:brakeman', 'https://brakemanscanner.org/'
+    properties = test_suites.add_element 'brakeman:properties', { 'xml:id' => 'scan_info' }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'app_path', 'brakeman:value' => tracker.app_path }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'rails_version', 'brakeman:value' => rails_version }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'security_warnings', 'brakeman:value' => all_warnings.length }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'start_time', 'brakeman:value' => tracker.start_time.iso8601 }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'end_time', 'brakeman:value' => tracker.end_time.iso8601 }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'duration', 'brakeman:value' => tracker.duration }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'checks_performed', 'brakeman:value' => checks.checks_run.join(',') }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'number_of_controllers', 'brakeman:value' => tracker.controllers.length }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'number_of_models', 'brakeman:value' => tracker.models.length - 1 }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'ruby_version', 'brakeman:value' => number_of_templates(@tracker) }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'number_of_templates', 'brakeman:value' => RUBY_VERSION }
+    properties.add_element 'brakeman:property', { 'brakeman:name' => 'brakeman_version', 'brakeman:value' => Brakeman::Version }
+
+    errors = test_suites.add_element 'brakeman:errors'
+    tracker.errors.each { |e|
+      error = errors.add_element 'brakeman:error'
+      error.add_attribute 'brakeman:message', e[:error]
+      e[:backtrace].each { |b|
+        backtrace = error.add_element 'brakeman:backtrace'
+        backtrace.add_text b
+      }
+    }
+
+    obsolete = test_suites.add_element 'brakeman:obsolete'
+    tracker.unused_fingerprints.each { |fingerprint|
+      obsolete.add_element 'brakeman:warning', { 'brakeman:fingerprint' => fingerprint }
+    }
+
+    ignored = test_suites.add_element 'brakeman:ignored'
+    ignored_warnings.each { |w|
+      warning = ignored.add_element 'brakeman:warning'
+      warning.add_attribute 'brakeman:message', w.message
+      warning.add_attribute 'brakeman:category', w.warning_type
+      warning.add_attribute 'brakeman:file', warning_file(w)
+      warning.add_attribute 'brakeman:line', w.line
+      warning.add_attribute 'brakeman:fingerprint', w.fingerprint
+      warning.add_attribute 'brakeman:confidence', w.confidence_name 
+      warning.add_attribute 'brakeman:code', w.format_code
+      warning.add_text w.to_s
+    }
+
+    hostname = `hostname`.strip
+    i = 0
+    all_warnings
+      .map { |warning| [warning.file, [warning]] }
+      .reduce({}) { |entries, entry|
+        key, value = entry
+        entries[key] = entries[key] ? entries[key].concat(value) : value
+        entries
+      }
+      .each { |file, warnings|
+        i += 1
+        test_suite = test_suites.add_element 'testsuite'
+        test_suite.add_attribute 'id', i
+        test_suite.add_attribute 'package', 'brakeman'
+        test_suite.add_attribute 'name', file.relative
+        test_suite.add_attribute 'timestamp', tracker.start_time.strftime('%FT%T')
+        test_suite.add_attribute 'hostname', hostname == '' ? 'localhost' : hostname
+        test_suite.add_attribute 'tests', checks.checks_run.length
+        test_suite.add_attribute 'failures', warnings.length
+        test_suite.add_attribute 'errors', '0'
+        test_suite.add_attribute 'time', '0'
+
+        test_suite.add_element 'properties'
+
+        warnings.each { |warning|
+          test_case = test_suite.add_element 'testcase'
+          test_case.add_attribute 'name', 'run_check'
+          test_case.add_attribute 'classname', warning.check
+          test_case.add_attribute 'time', '0'
+
+          failure = test_case.add_element 'failure'
+          failure.add_attribute 'message', warning.message
+          failure.add_attribute 'type', warning.warning_type
+          failure.add_attribute 'brakeman:fingerprint', warning.fingerprint
+          failure.add_attribute 'brakeman:file', warning_file(warning)
+          failure.add_attribute 'brakeman:line', warning.line
+          failure.add_attribute 'brakeman:confidence', warning.confidence_name 
+          failure.add_attribute 'brakeman:code', warning.format_code
+          failure.add_text warning.to_s
+        }
+
+        test_suite.add_element 'system-out'
+        test_suite.add_element 'system-err'
+      }
+
+    doc.add test_suites
+    doc.write io
+    io.string
+  end
+end

data/lib/brakeman/report/report_markdown.rb

@@ -84,7 +84,6 @@ class Brakeman::Report::Markdown < Brakeman::Report::Table
   end
 
   def convert_warning warning, original
-    warning["Confidence"] = TEXT_CONFIDENCE[warning["Confidence"]]
     warning["Message"] = markdown_message original, warning["Message"]
     warning["Warning Type"] = "[#{warning['Warning Type']}](#{original.link})" if original.link
     warning
@@ -92,16 +91,23 @@ class Brakeman::Report::Markdown < Brakeman::Report::Table
 
   # Escape and code format warning message
   def markdown_message warning, message
+    message = message.to_s
+
     if warning.file
       github_url = github_url warning.file, warning.line
-      message.gsub!(/(near line \d+)/, "[\\1](#{github_url})") if github_url
+
+      if github_url
+        message << " near line [#{warning.line}](#{github_url})"
+      elsif warning.line
+        message << " near line #{warning.line}"
+      end
     end
+
     if warning.code
-      code = warning.format_code
-      message.gsub(code, "`#{code.gsub('`','``').gsub(/\A``|``\z/, '` `')}`")
-    else
-      message
+      code = warning.format_code.gsub('`','``').gsub(/\A``|``\z/, '` `')
+      message << ": `#{code}`"
     end
-  end
 
+    message
+  end
 end

data/lib/brakeman/report/report_sarif.rb

@@ -0,0 +1,114 @@
+class Brakeman::Report::SARIF < Brakeman::Report::Base
+  def generate_report
+    sarif_log = {
+      :version => '2.1.0',
+      :$schema => 'https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json',
+      :runs => runs,
+    }
+    JSON.pretty_generate sarif_log
+  end
+
+  def runs
+    [
+      {
+        :tool => {
+          :driver => {
+            :name => 'Brakeman',
+            :informationUri => 'https://brakemanscanner.org',
+            :semanticVersion => Brakeman::Version,
+            :rules => rules,
+          },
+        },
+        :results => results,
+      },
+    ]
+  end
+
+  def rules
+    @rules ||= unique_warnings_by_warning_code.map do |warning|
+      rule_id = render_id warning
+      check_name = warning.check_name
+      check_description = render_message check_descriptions[check_name]
+      {
+        :id => rule_id,
+        :name => "#{check_name}/#{warning.warning_type}",
+        :fullDescription => {
+          :text => check_description,
+        },
+        :helpUri => warning.link,
+        :help => {
+          :text => "More info: #{warning.link}.",
+          :markdown => "[More info](#{warning.link}).",
+        },
+        :properties => {
+          :tags => [check_name],
+        },
+      }
+    end
+  end
+
+  def results
+    @results ||= all_warnings.map do |warning|
+      rule_id = render_id warning
+      result_level = infer_level warning
+      message_text = render_message warning.message.to_s
+      result = {
+        :ruleId => rule_id,
+        :ruleIndex => rules.index { |r| r[:id] == rule_id },
+        :level => result_level,
+        :message => {
+          :text => message_text,
+        },
+        :locations => [
+          :physicalLocation => {
+            :artifactLocation => {
+              :uri => warning.file.relative,
+              :uriBaseId => '%SRCROOT%',
+            },
+            :region => {
+              :startLine => warning.line.is_a?(Integer) ? warning.line : 1,
+            },
+          },
+        ],
+      }
+
+      result
+    end
+  end
+
+  # Returns a hash of all check descriptions, keyed by check namne
+  def check_descriptions
+    @check_descriptions ||= Brakeman::Checks.checks.map do |check|
+      [check.name.gsub(/^Check/, ''), check.description]
+    end.to_h
+  end
+
+  # Returns a de-duplicated set of warnings, used to generate rules
+  def unique_warnings_by_warning_code
+    @unique_warnings_by_warning_code ||= all_warnings.uniq { |w| w.warning_code }
+  end
+
+  def render_id warning
+    # Include alpha prefix to provide 'compiler error' appearance
+    "BRAKE#{'%04d' % warning.warning_code}" # 46 becomes BRAKE0046, for example
+  end
+
+  def render_message message
+    # Ensure message ends with a period
+    if message.end_with? "."
+      message
+    else
+      "#{message}."
+    end
+  end
+
+  def infer_level warning
+    # Infer result level from warning confidence
+    @@levels_from_confidence ||= Hash.new('warning').update({
+      0 => 'error',    # 0 represents 'high confidence', which we infer as 'error'
+      1 => 'warning',  # 1 represents 'medium confidence' which we infer as 'warning'
+      2 => 'note',     # 2 represents 'weak, or low, confidence', which we infer as 'note'
+    })
+    @@levels_from_confidence[warning.confidence]
+  end
+end

data/lib/brakeman/report/report_sonar.rb

@@ -0,0 +1,38 @@
+class Brakeman::Report::Sonar < Brakeman::Report::Base
+  def generate_report
+    report_object = {
+      issues: all_warnings.map { |warning| issue_json(warning) }
+    }
+    return JSON.pretty_generate report_object
+  end
+  
+  private
+  
+  def issue_json(warning)
+    {
+      engineId: "Brakeman",
+      ruleId: warning.warning_code,
+      type: "VULNERABILITY",
+      severity: severity_level_for(warning.confidence),
+      primaryLocation: {
+        message: warning.message,
+        filePath: warning.file.relative,
+        textRange: {
+          "startLine": warning.line || 1,
+          "endLine": warning.line || 1,
+        }
+      },
+      effortMinutes: (4 - warning.confidence) * 15
+    }
+  end
+
+  def severity_level_for(confidence)
+    if confidence == 0
+      "CRITICAL"
+    elsif confidence == 1
+      "MAJOR"
+    else
+      "MINOR"
+    end
+  end
+end

data/lib/brakeman/report/report_table.rb

@@ -62,6 +62,96 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     end
   end
 
+  #Generate table of how many warnings of each warning type were reported
+  def generate_warning_overview
+    types = warnings_summary.keys
+    types.delete :high_confidence
+    values = types.sort.collect{|warning_type| [warning_type, warnings_summary[warning_type]] }
+    locals = {:types => types, :warnings_summary => warnings_summary}
+
+    render_array('warning_overview', ['Warning Type', 'Total'], values, locals)
+  end
+
+  #Generate table of controllers and routes found for those controllers
+  def generate_controllers
+    controller_rows = controller_information
+
+    cols = ['Name', 'Parent', 'Includes', 'Routes']
+
+    locals = {:controller_rows => controller_rows}
+    values = controller_rows.collect{|row| row.values_at(*cols) }
+    render_array('controller_overview', cols, values, locals)
+  end
+
+  #Generate table of errors or return nil if no errors
+  def generate_errors
+    values = tracker.errors.collect{|error| [error[:error], error[:backtrace][0]]}
+    render_array('error_overview', ['Error', 'Location'], values, {:tracker => tracker})
+  end
+
+  def generate_obsolete
+    values = tracker.unused_fingerprints.collect{|fingerprint| [fingerprint] }
+    render_array('obsolete_ignore_entries', ['fingerprint'], values, {:tracker => tracker})
+  end
+
+  def generate_warnings
+    render_warnings generic_warnings,
+                    :warning,
+                    'security_warnings',
+                    ["Confidence", "Class", "Method", "Warning Type", "Message"],
+                    'Class'
+  end
+
+  #Generate table of template warnings or return nil if no warnings
+  def generate_template_warnings
+    render_warnings template_warnings,
+                    :template,
+                    'view_warnings',
+                    ['Confidence', 'Template', 'Warning Type', 'Message'],
+                    'Template'
+
+  end
+
+  #Generate table of model warnings or return nil if no warnings
+  def generate_model_warnings
+    render_warnings model_warnings,
+                    :model,
+                    'model_warnings',
+                    ['Confidence', 'Model', 'Warning Type', 'Message'],
+                    'Model'
+  end
+
+  #Generate table of controller warnings or nil if no warnings
+  def generate_controller_warnings
+    render_warnings controller_warnings,
+                    :controller,
+                    'controller_warnings',
+                    ['Confidence', 'Controller', 'Warning Type', 'Message'],
+                    'Controller'
+  end
+
+  def generate_ignored_warnings
+    render_warnings ignored_warnings,
+                    :ignored,
+                    'ignored_warnings',
+                    ['Confidence', 'Warning Type', 'File', 'Message'],
+                    'Warning Type'
+  end
+
+  def render_warnings warnings, type, template, cols, sort_col
+    unless warnings.empty?
+      rows = sort(convert_to_rows(warnings, type), sort_col)
+
+      values = rows.collect { |row| row.values_at(*cols) }
+
+      locals = { :warnings => rows }
+
+      render_array(template, cols, values, locals)
+    else
+      nil
+    end
+  end
+
   #Generate listings of templates and their output
   def generate_templates
     out_processor = Brakeman::OutputProcessor.new
@@ -92,6 +182,40 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     output
   end
 
+  def convert_to_rows warnings, type = :warning
+    warnings.map do |warning|
+      w = warning.to_row type
+
+      case type
+      when :warning
+        convert_warning w, warning
+      when :ignored
+        convert_ignored_warning w, warning
+      when :template
+        convert_template_warning w, warning
+      else
+        convert_warning w, warning
+      end
+    end
+  end
+
+  def convert_ignored_warning warning, original
+    convert_warning warning, original
+  end
+
+  def convert_template_warning warning, original
+    convert_warning warning, original
+  end
+
+  def sort rows, sort_col
+    stabilizer = 0
+    rows.sort_by do |row|
+      stabilizer += 1
+
+      row.values_at("Confidence", "Warning Type", sort_col) << stabilizer
+    end
+  end
+
   def render_array template, headings, value_array, locals
     return if value_array.empty?
 
@@ -100,6 +224,35 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     end
   end
 
+  def convert_warning warning, original
+    warning["Message"] = text_message original, warning["Message"]
+
+    warning
+  end
+
+  #Escape warning message and highlight user input in text output
+  def text_message warning, message
+    message = message.to_s
+
+    if warning.line
+      message << " near line #{warning.line}"
+    end
+
+    if warning.code
+      if @highlight_user_input and warning.user_input
+        code = warning.format_with_user_input do |user_input, user_input_string|
+          "+#{user_input_string}+"
+        end
+      else
+        code = warning.format_code
+      end
+
+      message << ": #{code}"
+    end
+
+    message
+  end
+
   #Generate header for text output
   def text_header
     <<-HEADER
@@ -114,4 +267,24 @@ Duration: #{tracker.duration} seconds
 Checks run: #{checks.checks_run.sort.join(", ")}
 HEADER
   end
+
+  def truncate_table str
+    @terminal_width ||= if @tracker.options[:table_width]
+                          @tracker.options[:table_width]
+                        elsif $stdin && $stdin.tty?
+                          Brakeman.load_brakeman_dependency 'highline'
+                          ::HighLine.default_instance.terminal.terminal_size[0]
+                        else
+                          80
+                        end
+    lines = str.lines
+
+    lines.map do |line|
+      if line.chomp.length > @terminal_width
+        line[0..(@terminal_width - 3)] + ">>\n"
+      else
+        line
+      end
+    end.join
+  end
 end