brakeman 4.4.0 → 5.0.0

data/bundle/ruby/{2.5.0/gems/tilt-2.0.9 → 2.7.0/gems/tilt-2.0.10}/lib/tilt.rb

@@ -4,7 +4,7 @@ require 'tilt/template'
 # Namespace for Tilt. This module is not intended to be included anywhere.
 module Tilt
   # Current version.
-  VERSION = '2.0.9'
+  VERSION = '2.0.10'
 
   @default_mapping = Mapping.new
 

data/bundle/ruby/{2.5.0/gems/tilt-2.0.9 → 2.7.0/gems/tilt-2.0.10}/lib/tilt/template.rb

@@ -166,7 +166,7 @@ module Tilt
     def evaluate(scope, locals, &block)
       locals_keys = locals.keys
       locals_keys.sort!{|x, y| x.to_s <=> y.to_s}
-      method = compiled_method(locals_keys)
+      method = compiled_method(locals_keys, scope.is_a?(Module) ? scope : scope.class)
       method.bind(scope).call(locals, &block)
     end
 
@@ -231,9 +231,9 @@ module Tilt
     end
 
     # The compiled method for the locals keys provided.
-    def compiled_method(locals_keys)
+    def compiled_method(locals_keys, scope_class=nil)
       LOCK.synchronize do
-        @compiled_method[locals_keys] ||= compile_template_method(locals_keys)
+        @compiled_method[[scope_class, locals_keys]] ||= compile_template_method(locals_keys, scope_class)
       end
     end
 
@@ -247,7 +247,7 @@ module Tilt
       end.join("\n")
     end
 
-    def compile_template_method(local_keys)
+    def compile_template_method(local_keys, scope_class=nil)
       source, offset = precompiled(local_keys)
       local_code = local_extraction(local_keys)
 
@@ -261,17 +261,12 @@ module Tilt
       method_source << <<-RUBY
         TOPOBJECT.class_eval do
           def #{method_name}(locals)
-            Thread.current[:tilt_vars] = [self, locals]
-            class << self
-              this, locals = Thread.current[:tilt_vars]
-              locals = locals
-              this.instance_eval do
-                #{local_code}
+            #{local_code}
       RUBY
       offset += method_source.count("\n")
       method_source << source
-      method_source << "\nend;end;end;end"
-      Object.class_eval(method_source, eval_file, line - offset)
+      method_source << "\nend;end;"
+      (scope_class || Object).class_eval(method_source, eval_file, line - offset)
       unbind_compiled_method(method_name)
     end
 

data/bundle/ruby/{2.5.0/gems/unicode-display_width-1.4.1 → 2.7.0/gems/unicode-display_width-1.7.0}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # CHANGELOG
 
+## 1.7.0
+
+- Unicode 13
+
+## 1.6.1
+
+- Fix that ambiguous and overwrite options where ignored for emoji-measuring
+
+## 1.6.0
+
+- Unicode 12.1
+
+## 1.5.0
+
+- Unicode 12
+
 ## 1.4.1
 
 - Only bundle required lib/* and data/* files in actual rubygem, patch by @tas50

data/bundle/ruby/{2.5.0/gems/unicode-display_width-1.4.1 → 2.7.0/gems/unicode-display_width-1.7.0}/MIT-LICENSE.txt

@@ -1,6 +1,6 @@
 The MIT LICENSE
 
-Copyright (c) 2011, 2015-2018 Jan Lelis
+Copyright (c) 2011, 2015-2020 Jan Lelis
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/bundle/ruby/{2.5.0/gems/unicode-display_width-1.4.1 → 2.7.0/gems/unicode-display_width-1.7.0}/README.md

@@ -1,16 +1,16 @@
-## Unicode::DisplayWidth [![[version]](https://badge.fury.io/rb/unicode-display_width.svg)](http://badge.fury.io/rb/unicode-display_width) [<img src="https://travis-ci.org/janlelis/unicode-display_width.png" />](https://travis-ci.org/janlelis/unicode-display_width)
+## Unicode::DisplayWidth [![[version]](https://badge.fury.io/rb/unicode-display_width.svg)](https://badge.fury.io/rb/unicode-display_width) [<img src="https://travis-ci.org/janlelis/unicode-display_width.png" />](https://travis-ci.org/janlelis/unicode-display_width)
 
-Determines the monospace display width of a string in Ruby. Implementation based on [EastAsianWidth.txt](http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt) and other data, 100% in Ruby. Other than [wcwidth()](https://github.com/janlelis/wcswidth-ruby), which fulfills a similar purpose, it does not rely on the OS vendor to provide an up-to-date method for measuring string width.
+Determines the monospace display width of a string in Ruby. Implementation based on [EastAsianWidth.txt](https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt) and other data, 100% in Ruby. Other than [wcwidth()](https://github.com/janlelis/wcswidth-ruby), which fulfills a similar purpose, it does not rely on the OS vendor to provide an up-to-date method for measuring string width.
 
-Unicode version: **11.0.0**
+Unicode version: **13.0.0** (March 2020)
 
-Supported Rubies: **2.5**, **2.4**, **2.3**
+Supported Rubies: **2.7**, **2.6**, **2.5**, **2.4**
 
-Old Rubies that might still work: **2.2**, **2.1**, **2.0**, **1.9**
+Old Rubies that might still work: **2.3**, **2.2**, **2.1**, **2.0**, **1.9**
 
 ## Introduction to Character Widths
 
-Guesing the correct space a character will consume on terminals is not easy. There is no single standard. Most implementations combine data from [East Asian Width](http://www.unicode.org/reports/tr11/), some [General Categories](https://en.wikipedia.org/wiki/Unicode_character_property#General_Category), and hand-picked adjustments.
+Guessing the correct space a character will consume on terminals is not easy. There is no single standard. Most implementations combine data from [East Asian Width](https://www.unicode.org/reports/tr11/), some [General Categories](https://en.wikipedia.org/wiki/Unicode_character_property#General_Category), and hand-picked adjustments.
 
 ### How this Library Handles Widths
 
@@ -53,7 +53,7 @@ Unicode::DisplayWidth.of("一") # => 2
 
 ### Ambiguous Characters
 
-The second parameter defines the value returned by characterrs defined as ambiguous:
+The second parameter defines the value returned by characters defined as ambiguous:
 
 ```ruby
 Unicode::DisplayWidth.of("·", 1) # => 1
@@ -111,14 +111,14 @@ Replace "一" with the actual string to measure
 
 - Python: https://github.com/jquast/wcwidth
 - JavaScript: https://github.com/mycoboco/wcwidth.js
-- C: http://www.cl.cam.ac.uk/~mgk25/ucs/wcwidth.c
+- C: https://www.cl.cam.ac.uk/~mgk25/ucs/wcwidth.c
 - C for Julia: https://github.com/JuliaLang/utf8proc/issues/2
 
 See [unicode-x](https://github.com/janlelis/unicode-x) for more Unicode related micro libraries.
 
 ## Copyright & Info
 
-- Copyright (c) 2011, 2015-2018 Jan Lelis, http://janlelis.com, released under the MIT
+- Copyright (c) 2011, 2015-2020 Jan Lelis, https://janlelis.com, released under the MIT
 license
 - Early versions based on runpaint's unicode-data interface: Copyright (c) 2009 Run Paint Run Run
-- Unicode data: http://www.unicode.org/copyright.html#Exhibit1
+- Unicode data: https://www.unicode.org/copyright.html#Exhibit1

data/bundle/ruby/{2.5.0/gems/unicode-display_width-1.4.1 → 2.7.0/gems/unicode-display_width-1.7.0}/lib/unicode/display_width.rb

@@ -19,7 +19,7 @@ module Unicode
         total_width + (overwrite[codepoint] || width || 1)
       }
 
-      res -= emoji_extra_width_of(string) if options[:emoji]
+      res -= emoji_extra_width_of(string, ambiguous, overwrite) if options[:emoji]
       res < 0 ? 0 : res
     end
 

data/bundle/ruby/{2.5.0/gems/unicode-display_width-1.4.1 → 2.7.0/gems/unicode-display_width-1.7.0}/lib/unicode/display_width/constants.rb

@@ -1,7 +1,7 @@
 module Unicode
   module DisplayWidth
-    VERSION = '1.4.1'
-    UNICODE_VERSION = "11.0.0".freeze
+    VERSION = '1.7.0'
+    UNICODE_VERSION = "13.0.0".freeze
     DATA_DIRECTORY = File.expand_path(File.dirname(__FILE__) + '/../../../data/').freeze
     INDEX_FILENAME = (DATA_DIRECTORY + '/display_width.marshal.gz').freeze
   end

data/lib/brakeman.rb

@@ -20,6 +20,10 @@ module Brakeman
   #option is set
   Errors_Found_Exit_Code = 7
 
+  #Exit code returned when an ignored warning has no note and
+  #--ensure-ignore-notes is set
+  Empty_Ignore_Note_Exit_Code = 8
+
   @debug = false
   @quiet = false
   @loaded_dependencies = []
@@ -55,10 +59,14 @@ module Brakeman
   #  * :print_report - if no output file specified, print to stdout (default: false)
   #  * :quiet - suppress most messages (default: true)
   #  * :rails3 - force Rails 3 mode (automatic)
+  #  * :rails4 - force Rails 4 mode (automatic)
+  #  * :rails5 - force Rails 5 mode (automatic)
+  #  * :rails6 - force Rails 6 mode (automatic)
   #  * :report_routes - show found routes on controllers (default: false)
   #  * :run_checks - array of checks to run (run all if not specified)
   #  * :safe_methods - array of methods to consider safe
   #  * :skip_libs - do not process lib/ directory (default: false)
+  #  * :skip_vendor - do not process vendor/ directory (default: true)
   #  * :skip_checks - checks not to run (run all if not specified)
   #  * :absolute_paths - show absolute path of each file (default: false)
   #  * :summary_only - only output summary section of report for plain/table (:summary_only, :no_summary, true)
@@ -99,6 +107,10 @@ module Brakeman
     elsif options[:rails5]
       options[:rails3] = true
       options[:rails4] = true
+    elsif options[:rails6]
+      options[:rails3] = true
+      options[:rails4] = true
+      options[:rails5] = true
     end
 
     options[:output_formats] = get_output_formats options
@@ -180,6 +192,7 @@ module Brakeman
       :report_progress => true,
       :safe_methods => Set.new,
       :skip_checks => Set.new,
+      :skip_vendor => true,
     }
   end
 
@@ -224,6 +237,12 @@ module Brakeman
       [:to_text]
     when :table, :to_table
       [:to_table]
+    when :junit, :to_junit
+      [:to_junit]
+    when :sarif, :to_sarif
+      [:to_sarif]
+    when :sonar, :to_sonar
+      [:to_sonar]
     else
       [:to_text]
     end
@@ -251,6 +270,12 @@ module Brakeman
         :to_text
       when /\.table$/i
         :to_table
+      when /\.junit$/i
+        :to_junit
+      when /\.sarif$/i
+        :to_sarif
+      when /\.sonar$/i
+        :to_sonar
       else
         :to_text
       end
@@ -487,6 +512,18 @@ module Brakeman
     end
   end
 
+  # Returns an array of alert fingerprints for any ignored warnings without
+  # notes found in the specified ignore file (if it exists).
+  def self.ignore_file_entries_with_empty_notes file
+    return [] unless file
+
+    require 'brakeman/report/ignore/config'
+
+    config = IgnoreConfig.new(file, nil)
+    config.read_from_file
+    config.already_ignored_entries_with_empty_notes.map { |i| i[:fingerprint] }
+  end
+
   def self.filter_warnings tracker, options
     require 'brakeman/report/ignore/config'
 

data/lib/brakeman/app_tree.rb

@@ -1,4 +1,5 @@
 require 'pathname'
+require 'brakeman/file_path'
 
 module Brakeman
   class AppTree
@@ -20,6 +21,7 @@ module Brakeman
       end
       init_options[:additional_libs_path] = options[:additional_libs_path]
       init_options[:engine_paths] = options[:engine_paths]
+      init_options[:skip_vendor] = options[:skip_vendor]
       new(root, init_options)
     end
 
@@ -61,32 +63,43 @@ module Brakeman
       @engine_paths = init_options[:engine_paths] || []
       @absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
       @relative_engine_paths = @engine_paths - @absolute_engine_paths
+      @skip_vendor = init_options[:skip_vendor]
       @gemspec = nil
+      @root_search_pattern = nil
     end
 
-    def expand_path(path)
-      File.expand_path(path, @root)
+    # Create a new Brakeman::FilePath
+    def file_path(path)
+      Brakeman::FilePath.from_app_tree(self, path)
     end
 
-    def read(path)
-      File.read(File.join(@root, path))
+    # Should only be used by Brakeman::FilePath.
+    # Use AppTree#file_path(path).absolute instead.
+    def expand_path(path)
+      File.expand_path(path, @root)
     end
 
-    # This variation requires full paths instead of paths based
-    # off the project root. I'd prefer to get all the code outside
-    # of AppTree using project-root based paths (e.g. app/models/user.rb)
-    # instead of full paths, but I suspect it's an incompatible change.
-    def read_path(path)
-      File.read(path)
+    # Should only be used by Brakeman::FilePath
+    # Use AppTree#file_path(path).relative instead.
+    def relative_path(path)
+      pname = Pathname.new path
+      if path and not path.empty? and pname.absolute?
+        pname.relative_path_from(Pathname.new(self.root)).to_s
+      else
+        path
+      end
     end
 
     def exists?(path)
-      File.exist?(File.join(@root, path))
+      if path.is_a? Brakeman::FilePath
+        path.exists?
+      else
+        File.exist?(File.join(@root, path))
+      end
     end
 
-    # This is a pair for #read_path. Again, would like to kill these
-    def path_exists?(path)
-      File.exist?(path)
+    def ruby_file_paths
+      find_paths(".").uniq
     end
 
     def initializer_paths
@@ -102,8 +115,8 @@ module Brakeman
     end
 
     def template_paths
-      @template_paths ||= find_paths("app/**/views", "*.{#{VIEW_EXTENSIONS}}") +
-                          find_paths("app/**/views", "*.{erb,haml,slim}").reject { |path| File.basename(path).count(".") > 1 }
+      @template_paths ||= find_paths(".", "*.{#{VIEW_EXTENSIONS}}") +
+        find_paths("**", "*.{erb,haml,slim}").reject { |path| File.basename(path).count(".") > 1 }
     end
 
     def layout_exists?(name)
@@ -111,7 +124,7 @@ module Brakeman
     end
 
     def lib_paths
-      @lib_files ||= find_paths("lib").reject { |path| path.include? "/generators/" or path.include? "lib/tasks/" or path.include? "lib/templates/" } +
+      @lib_files ||= find_paths("lib").reject { |path| path.relative.include? "/generators/" or path.relative.include? "lib/tasks/" or path.relative.include? "lib/templates/" } +
                      find_additional_lib_paths +
                      find_helper_paths +
                      find_job_paths
@@ -125,7 +138,7 @@ module Brakeman
       if gemspecs.length > 1 or gemspecs.empty?
         @gemspec = false
       else
-        @gemspec = File.basename(gemspecs.first)
+        @gemspec = file_path(File.basename(gemspecs.first))
       end
     end
 
@@ -155,7 +168,9 @@ module Brakeman
 
     def select_files(paths)
       paths = select_only_files(paths)
-      reject_skipped_files(paths)
+      paths = reject_skipped_files(paths)
+      paths = convert_to_file_paths(paths)
+      reject_global_excludes(paths)
     end
 
     def select_only_files(paths)
@@ -174,6 +189,32 @@ module Brakeman
       end
     end
 
+    EXCLUDED_PATHS = %w[
+      /generators/
+      lib/tasks/
+      lib/templates/
+      db/
+      spec/
+      test/
+      tmp/
+      public/
+      log/
+    ]
+
+    def reject_global_excludes(paths)
+      paths.reject do |path|
+        relative_path = path.relative
+
+        if @skip_vendor and relative_path.include? 'vendor/'
+          true
+        else
+          EXCLUDED_PATHS.any? do |excluded|
+            relative_path.include? excluded
+          end
+        end
+      end
+    end
+
     def match_path files, path
       absolute_path = Pathname.new(path)
       # relative root never has a leading separator. But, we use a leading
@@ -190,8 +231,8 @@ module Brakeman
     def root_search_pattern
       return @root_search_pattern if @root_search_pattern
 
-      abs = @absolute_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
-      rel = @relative_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
+      abs = @absolute_engine_paths.to_a.map { |path| path.gsub(/#{File::SEPARATOR}+$/, '') }
+      rel = @relative_engine_paths.to_a.map { |path| path.gsub(/#{File::SEPARATOR}+$/, '') }
 
       roots = ([@root] + abs).join(",")
       rel_engines = (rel + [""]).join("/,")
@@ -199,7 +240,11 @@ module Brakeman
     end
 
     def prioritize_concerns paths
-      paths.partition { |path| path.include? "concerns" }.flatten
+      paths.partition { |path| path.relative.include? "concerns" }.flatten
+    end
+
+    def convert_to_file_paths paths
+      paths.map { |path| file_path(path) }
     end
   end
 end