brakeman 4.3.1 → 5.4.0

data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/CHANGELOG.md

@@ -0,0 +1,137 @@
+# CHANGELOG
+
+## 1.8.0
+ 
+- Unicode 14.0 (last release of 1.x)
+ 
+## 1.7.0
+
+- Unicode 13
+
+## 1.6.1
+
+- Fix that ambiguous and overwrite options where ignored for emoji-measuring
+
+## 1.6.0
+
+- Unicode 12.1
+
+## 1.5.0
+
+- Unicode 12
+
+## 1.4.1
+
+- Only bundle required lib/* and data/* files in actual rubygem, patch by @tas50
+
+## 1.4.0
+
+- Unicode 11
+
+## 1.3.3
+
+- Replace Gem::Util.gunzip with direct zlib implementation
+  This removes the dependency on rubygems, fixes #17
+
+## 1.3.2
+
+- Explicitly load rubygems/util, fixes regression in 1.3.1 (autoload issue)
+
+## 1.3.1
+
+- Use `Gem::Util` for `gunzip`, removes deprecation warning, patch by @Schwad
+
+## 1.3.0
+
+- Unicode 10
+
+## 1.2.1
+
+- Fix bug that `emoji: true` would fail for emoji without modifier
+
+## 1.2.0
+
+- Add zero-width codepoint ranges: U+2060..U+206F, U+FFF0..U+FFF8, U+E0000..U+E0FFF
+- Add full-witdh codepoint ranges: U+3400..U+4DBF, U+4E00..U+9FFF, U+F900..U+FAFF, U+20000..U+2FFFD, U+30000..U+3FFFD
+- Experimental emoji support using the [unicode-emoji](https://github.com/janlelis/unicode-emoji) gem
+- Fix minor bug in index compression scheme
+
+## 1.1.3
+
+- Fix that non-UTF-8 encodings do not throw errors, patch by @windwiny
+
+## 1.1.2
+
+- Reduce memory consumption and increase performance, patch by @rrosenblum
+
+## 1.1.1
+
+- Always load index into memory, fixes #9
+
+## 1.1.0
+
+- Support Unicode 9.0
+
+## 1.0.5
+
+- Actually include new index from 1.0.4
+
+## 1.0.4
+
+- New index format (much smaller) and internal API changes
+- Move index generation to a builder plugin for the unicoder gem
+- No public API changes
+
+## 1.0.3
+
+- Avoid circular dependency warning
+
+## 1.0.2
+
+- Fix error that gemspec might be invalid under some circumstances (see gh#6)
+
+## 1.0.1
+
+- Inofficially allow Ruby 1.9
+
+## 1.0.0
+
+- Faster than 0.3.1
+- Advanced determination of character width
+- This includes: Treat width of most chars of general categories (Mn, Me, Cf) as 0
+- This includes: Introduce list of characters with special widths
+- Allow custom overrides for specific codepoints
+- Set required Ruby version to 2.0
+- Add NO_STRING_EXT mode to disable monkey patching
+- Internal API & index format changed drastically
+- Remove require 'unicode/display_size' (use 'unicode/display_width' instead)
+
+## 0.3.1
+
+- Faster than 0.3.0
+- Deprecate usage of aliases: String#display_size and String#display_length
+- Eliminate Ruby warnings (@amatsuda)
+
+## 0.3.0
+
+- Update EastAsianWidth from 7.0 to 8.0
+- Add rake task to update EastAsianWidth.txt
+- Move code to generate index from library to Rakefile
+- Update project's meta files
+- Deprecate requiring 'unicode-display_size'
+
+## 0.2.0
+
+- Update EastAsianWidth from 6.0 to 7.0
+- Don't build index table automatically when not available
+- Don't include EastAsianWidth.txt in gem (only index)
+
+
+## 0.1.0
+
+- Fix github issue #1
+
+
+## 0.1.0
+
+- Initial release

data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/MIT-LICENSE.txt

@@ -0,0 +1,22 @@
+The MIT LICENSE
+
+Copyright (c) 2011, 2015-2020 Jan Lelis
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/README.md

@@ -0,0 +1,124 @@
+## Unicode::DisplayWidth [![[version]](https://badge.fury.io/rb/unicode-display_width.svg)](https://badge.fury.io/rb/unicode-display_width) [<img src="https://travis-ci.org/janlelis/unicode-display_width.png" />](https://travis-ci.org/janlelis/unicode-display_width)
+
+Determines the monospace display width of a string in Ruby. Implementation based on [EastAsianWidth.txt](https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt) and other data, 100% in Ruby. Other than [wcwidth()](https://github.com/janlelis/wcswidth-ruby), which fulfills a similar purpose, it does not rely on the OS vendor to provide an up-to-date method for measuring string width.
+
+Unicode version: **14.0.0** (September 2021)
+
+Supported Rubies: **2.7**, **2.6**, **2.5**, **2.4**
+
+Old Rubies that might still work: **2.3**, **2.2**, **2.1**, **2.0**, **1.9**
+
+## Introduction to Character Widths
+
+Guessing the correct space a character will consume on terminals is not easy. There is no single standard. Most implementations combine data from [East Asian Width](https://www.unicode.org/reports/tr11/), some [General Categories](https://en.wikipedia.org/wiki/Unicode_character_property#General_Category), and hand-picked adjustments.
+
+### How this Library Handles Widths
+
+Further at the top means higher precedence. Please expect changes to this algorithm with every MINOR version update (the X in 1.X.0)!
+
+Width  | Characters                   | Comment
+-------|------------------------------|--------------------------------------------------
+X      | (user defined)               | Overwrites any other values
+-1     | `"\b"`                       | Backspace (total width never below 0)
+0      | `"\0"`, `"\x05"`, `"\a"`, `"\n"`, `"\v"`, `"\f"`, `"\r"`, `"\x0E"`, `"\x0F"` | [C0 control codes](https://en.wikipedia.org/wiki/C0_and_C1_control_codes#C0_.28ASCII_and_derivatives.29) that do not change horizontal width
+1      | `"\u{00AD}"`                 | SOFT HYPHEN
+2      | `"\u{2E3A}"`                 | TWO-EM DASH
+3      | `"\u{2E3B}"`                 | THREE-EM DASH
+0      | General Categories: Mn, Me, Cf (non-arabic) | Excludes ARABIC format characters
+0      | `"\u{1160}".."\u{11FF}"`     | HANGUL JUNGSEONG
+0      | `"\u{2060}".."\u{206F}"`, `"\u{FFF0}".."\u{FFF8}"`, `"\u{E0000}".."\u{E0FFF}"` | Ignorable ranges
+2      | East Asian Width: F, W       | Full-width characters
+2      | `"\u{3400}".."\u{4DBF}"`, `"\u{4E00}".."\u{9FFF}"`, `"\u{F900}".."\u{FAFF}"`, `"\u{20000}".."\u{2FFFD}"`, `"\u{30000}".."\u{3FFFD}"` | Full-width ranges
+1 or 2 | East Asian Width: A          | Ambiguous characters, user defined, default: 1
+1      | All other codepoints         | -
+
+## Install
+
+Install the gem with:
+
+    $ gem install unicode-display_width
+
+Or add to your Gemfile:
+
+    gem 'unicode-display_width'
+
+## Usage
+
+```ruby
+require 'unicode/display_width'
+
+Unicode::DisplayWidth.of("⚀") # => 1
+Unicode::DisplayWidth.of("一") # => 2
+```
+
+### Ambiguous Characters
+
+The second parameter defines the value returned by characters defined as ambiguous:
+
+```ruby
+Unicode::DisplayWidth.of("·", 1) # => 1
+Unicode::DisplayWidth.of("·", 2) # => 2
+```
+
+### Custom Overwrites
+
+You can overwrite how to handle specific code points by passing a hash (or even a proc) as third parameter:
+
+```ruby
+Unicode::DisplayWidth.of("a\tb", 1, 0x09 => 10)) # => 12
+```
+
+### Emoji Support
+
+Experimental emoji support is included. It will adjust the string's size for modifier and zero-width joiner sequences. You will need to add the [unicode-emoji](https://github.com/janlelis/unicode-emoji) gem to your Gemfile:
+
+```ruby
+gem 'unicode-display_width'
+gem 'unicode-emoji'
+```
+
+You can then activate the emoji string width adjustments by passing `emoji: true` as fourth parameter:
+
+```ruby
+Unicode::DisplayWidth.of "🤾🏽‍♀️" # => 5
+Unicode::DisplayWidth.of "🤾🏽‍♀️", 1, {}, emoji: true # => 2
+```
+
+### Usage with String Extension
+
+Activated by default. Will be deactivated in version 2.0:
+
+```ruby
+require 'unicode/display_width/string_ext'
+
+"⚀".display_width #=> 1
+'一'.display_width #=> 2
+```
+
+You can actively opt-out from the string extension with: `require 'unicode/display_width/no_string_ext'`
+
+### Usage From the CLI
+
+Use this one-liner to print out display widths for strings from the command-line:
+
+```
+$ gem install unicode-display_width
+$ ruby -r unicode/display_width -e 'puts Unicode::DisplayWidth.of $*[0]' -- "一"
+```
+Replace "一" with the actual string to measure
+
+## Other Implementations & Discussion
+
+- Python: https://github.com/jquast/wcwidth
+- JavaScript: https://github.com/mycoboco/wcwidth.js
+- C: https://www.cl.cam.ac.uk/~mgk25/ucs/wcwidth.c
+- C for Julia: https://github.com/JuliaLang/utf8proc/issues/2
+
+See [unicode-x](https://github.com/janlelis/unicode-x) for more Unicode related micro libraries.
+
+## Copyright & Info
+
+- Copyright (c) 2011, 2015-2020 Jan Lelis, https://janlelis.com, released under the MIT
+license
+- Early versions based on runpaint's unicode-data interface: Copyright (c) 2009 Run Paint Run Run
+- Unicode data: https://www.unicode.org/copyright.html#Exhibit1

data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/lib/unicode/display_width/constants.rb

@@ -0,0 +1,8 @@
+module Unicode
+  module DisplayWidth
+    VERSION = '1.8.0'
+    UNICODE_VERSION = "14.0.0"
+    DATA_DIRECTORY = File.expand_path(File.dirname(__FILE__) + '/../../../data/').freeze
+    INDEX_FILENAME = (DATA_DIRECTORY + '/display_width.marshal.gz').freeze
+  end
+end

data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/lib/unicode/display_width.rb

@@ -0,0 +1,51 @@
+require_relative 'display_width/constants'
+require_relative 'display_width/index'
+
+module Unicode
+  module DisplayWidth
+    DEPTHS = [0x10000, 0x1000, 0x100, 0x10].freeze
+
+    def self.of(string, ambiguous = 1, overwrite = {}, options = {})
+      res = string.codepoints.inject(0){ |total_width, codepoint|
+        index_or_value = INDEX
+        codepoint_depth_offset = codepoint
+        DEPTHS.each{ |depth|
+          index_or_value         = index_or_value[codepoint_depth_offset / depth]
+          codepoint_depth_offset = codepoint_depth_offset % depth
+          break unless index_or_value.is_a? Array
+        }
+        width = index_or_value.is_a?(Array) ? index_or_value[codepoint_depth_offset] : index_or_value
+        width = ambiguous if width == :A
+        total_width + (overwrite[codepoint] || width || 1)
+      }
+
+      res -= emoji_extra_width_of(string, ambiguous, overwrite) if options[:emoji]
+      res < 0 ? 0 : res
+    end
+
+    def self.emoji_extra_width_of(string, ambiguous = 1, overwrite = {}, _ = {})
+      require "unicode/emoji"
+
+      extra_width = 0
+      modifier_regex = /[#{ Unicode::Emoji::EMOJI_MODIFIERS.pack("U*") }]/
+      zwj_regex = /(?<=#{ [Unicode::Emoji::ZWJ].pack("U") })./
+
+      string.scan(Unicode::Emoji::REGEX){ |emoji|
+        extra_width += 2 * emoji.scan(modifier_regex).size
+
+        emoji.scan(zwj_regex){ |zwj_succ|
+          extra_width += self.of(zwj_succ, ambiguous, overwrite)
+        }
+      }
+
+      extra_width
+    end
+  end
+end
+
+# Allows you to opt-out of the default string extension. Will eventually be removed,
+# so you must opt-in for the core extension by requiring 'display_width/string_ext'
+unless defined?(Unicode::DisplayWidth::NO_STRING_EXT) && Unicode::DisplayWidth::NO_STRING_EXT
+  require_relative 'display_width/string_ext'
+end
+

data/lib/brakeman/app_tree.rb

@@ -1,4 +1,5 @@
 require 'pathname'
+require 'brakeman/file_path'
 
 module Brakeman
   class AppTree
@@ -20,13 +21,14 @@ module Brakeman
       end
       init_options[:additional_libs_path] = options[:additional_libs_path]
       init_options[:engine_paths] = options[:engine_paths]
+      init_options[:skip_vendor] = options[:skip_vendor]
       new(root, init_options)
     end
 
     # Accepts an array of filenames and paths with the following format and
     # returns a Regexp to match them:
     #   * "path1/file1.rb" - Matches a specific filename in the project directory.
-    #   * "path1/" - Matches any path that conatains "path1" in the project directory.
+    #   * "path1/" - Matches any path that contains "path1" in the project directory.
     #   * "/path1/ - Matches any path that is rooted at "path1" in the project directory.
     #
     def self.regex_for_paths(paths)
@@ -61,31 +63,43 @@ module Brakeman
       @engine_paths = init_options[:engine_paths] || []
       @absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
       @relative_engine_paths = @engine_paths - @absolute_engine_paths
+      @skip_vendor = init_options[:skip_vendor]
+      @gemspec = nil
+      @root_search_pattern = nil
     end
 
-    def expand_path(path)
-      File.expand_path(path, @root)
+    # Create a new Brakeman::FilePath
+    def file_path(path)
+      Brakeman::FilePath.from_app_tree(self, path)
     end
 
-    def read(path)
-      File.read(File.join(@root, path))
+    # Should only be used by Brakeman::FilePath.
+    # Use AppTree#file_path(path).absolute instead.
+    def expand_path(path)
+      File.expand_path(path, @root)
     end
 
-    # This variation requires full paths instead of paths based
-    # off the project root. I'd prefer to get all the code outside
-    # of AppTree using project-root based paths (e.g. app/models/user.rb)
-    # instead of full paths, but I suspect it's an incompatible change.
-    def read_path(path)
-      File.read(path)
+    # Should only be used by Brakeman::FilePath
+    # Use AppTree#file_path(path).relative instead.
+    def relative_path(path)
+      pname = Pathname.new path
+      if path and not path.empty? and pname.absolute?
+        pname.relative_path_from(Pathname.new(self.root)).to_s
+      else
+        path
+      end
     end
 
     def exists?(path)
-      File.exist?(File.join(@root, path))
+      if path.is_a? Brakeman::FilePath
+        path.exists?
+      else
+        File.exist?(File.join(@root, path))
+      end
     end
 
-    # This is a pair for #read_path. Again, would like to kill these
-    def path_exists?(path)
-      File.exist?(path)
+    def ruby_file_paths
+      find_paths(".").uniq
     end
 
     def initializer_paths
@@ -101,8 +115,8 @@ module Brakeman
     end
 
     def template_paths
-      @template_paths ||= find_paths("app/**/views", "*.{#{VIEW_EXTENSIONS}}") +
-                          find_paths("app/**/views", "*.{erb,haml,slim}").reject { |path| File.basename(path).count(".") > 1 }
+      @template_paths ||= find_paths(".", "*.{#{VIEW_EXTENSIONS}}") +
+        find_paths("**", "*.{erb,haml,slim}").reject { |path| File.basename(path).count(".") > 1 }
     end
 
     def layout_exists?(name)
@@ -110,12 +124,24 @@ module Brakeman
     end
 
     def lib_paths
-      @lib_files ||= find_paths("lib").reject { |path| path.include? "/generators/" or path.include? "lib/tasks/" or path.include? "lib/templates/" } +
+      @lib_files ||= find_paths("lib").reject { |path| path.relative.include? "/generators/" or path.relative.include? "lib/tasks/" or path.relative.include? "lib/templates/" } +
                      find_additional_lib_paths +
                      find_helper_paths +
                      find_job_paths
     end
 
+    def gemspec
+      return @gemspec unless @gemspec.nil?
+
+      gemspecs =  Dir.glob(File.join(@root, "*.gemspec"))
+
+      if gemspecs.length > 1 or gemspecs.empty?
+        @gemspec = false
+      else
+        @gemspec = file_path(File.basename(gemspecs.first))
+      end
+    end
+
   private
 
     def find_helper_paths
@@ -142,7 +168,9 @@ module Brakeman
 
     def select_files(paths)
       paths = select_only_files(paths)
-      reject_skipped_files(paths)
+      paths = reject_skipped_files(paths)
+      paths = convert_to_file_paths(paths)
+      reject_global_excludes(paths)
     end
 
     def select_only_files(paths)
@@ -161,6 +189,40 @@ module Brakeman
       end
     end
 
+    EXCLUDED_PATHS = %w[
+      /generators/
+      lib/tasks/
+      lib/templates/
+      db/
+      spec/
+      test/
+      tmp/
+      public/
+      log/
+    ]
+
+    def reject_global_excludes(paths)
+      paths.reject do |path|
+        relative_path = path.relative
+
+        if @skip_vendor and relative_path.include? 'vendor/' and !in_engine_paths?(path) and !in_add_libs_paths?(path)
+          true
+        else
+          EXCLUDED_PATHS.any? do |excluded|
+            relative_path.include? excluded
+          end
+        end
+      end
+    end
+
+    def in_engine_paths?(path)
+      @engine_paths.any? { |p| path.absolute.include?(p) }
+    end
+
+    def in_add_libs_paths?(path)
+      @additional_libs_path.any? { |p| path.absolute.include?(p) }
+    end
+
     def match_path files, path
       absolute_path = Pathname.new(path)
       # relative root never has a leading separator. But, we use a leading
@@ -176,16 +238,21 @@ module Brakeman
 
     def root_search_pattern
       return @root_search_pattern if @root_search_pattern
-      abs = @absolute_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
-      rel = @relative_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
+
+      abs = @absolute_engine_paths.to_a.map { |path| path.gsub(/#{File::SEPARATOR}+$/, '') }
+      rel = @relative_engine_paths.to_a.map { |path| path.gsub(/#{File::SEPARATOR}+$/, '') }
 
       roots = ([@root] + abs).join(",")
       rel_engines = (rel + [""]).join("/,")
-      @root_search_patrern = "{#{roots}}/{#{rel_engines}}"
+      @root_search_pattern = "{#{roots}}/{#{rel_engines}}"
     end
 
     def prioritize_concerns paths
-      paths.partition { |path| path.include? "concerns" }.flatten
+      paths.partition { |path| path.relative.include? "concerns" }.flatten
+    end
+
+    def convert_to_file_paths paths
+      paths.map { |path| file_path(path) }
     end
   end
 end