brakeman 4.4.0 → 5.0.0

data/lib/brakeman/checks/check_validation_regex.rb

@@ -17,7 +17,7 @@ class Brakeman::CheckValidationRegex < Brakeman::BaseCheck
 
   def run_check
     active_record_models.each do |name, model|
-      @current_model = name
+      @current_model = model
       format_validations = model.options[:validates_format_of]
 
       if format_validations

data/lib/brakeman/checks/check_verb_confusion.rb

@@ -0,0 +1,75 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckVerbConfusion < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Check for uses of `request.get?` that might have unintentional behavior"
+
+  #Process calls
+  def run_check
+    calls = tracker.find_call(target: :request, methods: [:get?])
+
+    calls.each do |call|
+      process_result call
+    end
+  end
+
+  def process_result result
+    @current_result = result
+    @matched_call = result[:call]
+    klass = tracker.find_class(result[:location][:class])
+
+    # TODO: abstract into tracker.find_location ?
+    if klass.nil?
+      Brakeman.debug "No class found: #{result[:location][:class]}"
+      return
+    end
+
+    method = klass.get_method(result[:location][:method])
+
+    if method.nil?
+      Brakeman.debug "No method found: #{result[:location][:method]}"
+      return
+    end
+
+    process method[:src]
+  end
+
+  def process_if exp
+    if exp.condition == @matched_call
+      # Found `if request.get?`
+
+      # Do not warn if there is an `elsif` clause
+      if node_type? exp.else_clause, :if
+        return exp
+      end
+
+      warn_about_result @current_result, exp
+    end
+
+    exp
+  end
+
+  def warn_about_result result, code
+    return unless original? result
+
+    confidence = :weak
+    message = msg('Potential HTTP verb confusion. ',
+                  msg_code('HEAD'),
+                  ' is routed like ',
+                  msg_code('GET'),
+                  ' but ',
+                  msg_code('request.get?'),
+                  ' will return ',
+                  msg_code('false')
+                 )
+
+    warn :result => result,
+      :warning_type => "HTTP Verb Confusion",
+      :warning_code => :http_verb_confusion,
+      :message => message,
+      :code => code,
+      :user_input => result[:call],
+      :confidence => confidence
+  end
+end

data/lib/brakeman/checks/check_xml_dos.rb

@@ -34,8 +34,8 @@ class Brakeman::CheckXMLDoS < Brakeman::BaseCheck
   end
 
   def has_workaround?
-    tracker.check_initializers(:"ActiveSupport::XmlMini", :backend=).any? do |match|
-      arg = match.call.first_arg
+    tracker.find_call(target: :"ActiveSupport::XmlMini", method: :backend=).any? do |match|
+      arg = match[:call].first_arg
       if string? arg
         value = arg.value
         value == 'Nokogiri' or value == 'LibXML'

data/lib/brakeman/checks/check_yaml_parsing.rb

@@ -48,21 +48,17 @@ class Brakeman::CheckYAMLParsing < Brakeman::BaseCheck
   def disabled_xml_parser?
     if version_between? "0.0.0", "2.3.14"
       #Look for ActionController::Base.param_parsers.delete(Mime::XML)
-      params_parser = s(:call,
-                        s(:colon2, s(:const, :ActionController), :Base),
-                        :param_parsers)
-
-      matches = tracker.check_initializers(params_parser, :delete)
+      matches = tracker.find_call(target: :"ActionController::Base.param_parsers", method: :delete)
     else
       #Look for ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::XML)
-      matches = tracker.check_initializers(:"ActionDispatch::ParamsParser::DEFAULT_PARSERS", :delete)
+      matches = tracker.find_call(target: :"ActionDispatch::ParamsParser::DEFAULT_PARSERS", method: :delete)
     end
 
     unless matches.empty?
       mime_xml = s(:colon2, s(:const, :Mime), :XML)
 
       matches.each do |result|
-        if result.call.first_arg == mime_xml
+        if result[:call].first_arg == mime_xml
           return true
         end
       end
@@ -74,18 +70,14 @@ class Brakeman::CheckYAMLParsing < Brakeman::BaseCheck
   #Look for ActionController::Base.param_parsers[Mime::YAML] = :yaml
   #in Rails 2.x apps
   def enabled_yaml_parser?
-    param_parsers = s(:call,
-                      s(:colon2, s(:const, :ActionController), :Base),
-                      :param_parsers)
-
-    matches = tracker.check_initializers(param_parsers, :[]=)
+    matches = tracker.find_call(target: :'ActionController::Base.param_parsers', method: :[]=)
 
     mime_yaml = s(:colon2, s(:const, :Mime), :YAML)
 
     matches.each do |result|
-      if result.call.first_arg == mime_yaml and
-        symbol? result.call.second_arg and
-        result.call.second_arg.value == :yaml
+      if result[:call].first_arg == mime_yaml and
+        symbol? result[:call].second_arg and
+        result[:call].second_arg.value == :yaml
 
         return true
       end
@@ -96,16 +88,16 @@ class Brakeman::CheckYAMLParsing < Brakeman::BaseCheck
 
   def disabled_xml_dangerous_types?
     if version_between? "0.0.0", "2.3.14"
-      matches = tracker.check_initializers(:"ActiveSupport::CoreExtensions::Hash::Conversions::XML_PARSING", :delete)
+      matches = tracker.find_call(target: :"ActiveSupport::CoreExtensions::Hash::Conversions::XML_PARSING", method: :delete)
     else
-      matches = tracker.check_initializers(:"ActiveSupport::XmlMini::PARSING", :delete)
+      matches = tracker.find_call(target: :"ActiveSupport::XmlMini::PARSING", method: :delete)
     end
 
     symbols_off = false
     yaml_off = false
 
     matches.each do |result|
-      arg = result.call.first_arg
+      arg = result[:call].first_arg
 
       if string? arg
         if arg.value == "yaml"

data/lib/brakeman/commandline.rb

@@ -102,6 +102,13 @@ module Brakeman
           app_path = "."
         end
 
+        if options[:ensure_ignore_notes] and options[:previous_results_json]
+          warn '[Notice] --ensure-ignore-notes may not be used at the same ' \
+               'time as --compare. Deactivating --ensure-ignore-notes. ' \
+               'Please see `brakeman --help` for valid options'
+          options[:ensure_ignore_notes] = false
+        end
+
         return options, app_path
       end
 
@@ -115,7 +122,20 @@ module Brakeman
 
       # Runs a regular report based on the options provided.
       def regular_report options
-        tracker = run_brakeman options 
+        tracker = run_brakeman options
+
+        ensure_ignore_notes_failed = false
+        if tracker.options[:ensure_ignore_notes]
+          fingerprints = Brakeman::ignore_file_entries_with_empty_notes tracker.ignored_filter&.file
+
+          unless fingerprints.empty?
+            ensure_ignore_notes_failed = true
+            warn '[Error] Notes required for all ignored warnings when ' \
+              '--ensure-ignore-notes is set. No notes provided for these ' \
+              'warnings: '
+            fingerprints.each { |f| warn f }
+          end
+        end
 
         if tracker.options[:exit_on_warn] and not tracker.filtered_warnings.empty?
           quit Brakeman::Warnings_Found_Exit_Code
@@ -124,6 +144,10 @@ module Brakeman
         if tracker.options[:exit_on_error] and tracker.errors.any?
           quit Brakeman::Errors_Found_Exit_Code
         end
+
+        if ensure_ignore_notes_failed
+          quit Brakeman::Empty_Ignore_Note_Exit_Code
+        end
       end
 
       # Actually run Brakeman.

data/lib/brakeman/differ.rb

@@ -1,8 +1,6 @@
 # extracting the diff logic to it's own class for consistency. Currently handles
 # an array of Brakeman::Warnings or plain hash representations.  
 class Brakeman::Differ
-  DEFAULT_HASH = {:new => [], :fixed => []}
-  OLD_WARNING_KEYS = [:warning_type, :location, :code, :message, :file, :link, :confidence, :user_input]
   attr_reader :old_warnings, :new_warnings
 
   def initialize new_warnings, old_warnings
@@ -11,9 +9,6 @@ class Brakeman::Differ
   end
 
   def diff
-    # get the type of elements
-    return DEFAULT_HASH if @new_warnings.empty?
-
     warnings = {}
     warnings[:new] = @new_warnings - @old_warnings
     warnings[:fixed] = @old_warnings - @new_warnings
@@ -24,43 +19,31 @@ class Brakeman::Differ
   # second pass to cleanup any vulns which have changed in line number only.
   # Given a list of new warnings, delete pairs of new/fixed vulns that differ
   # only by line number.
-  # Horrible O(n^2) performance.  Keep n small :-/
   def second_pass(warnings)
-    # keep track of the number of elements deleted because the index numbers
-    # won't update as the list is modified
-    elements_deleted_offset = 0
+    new_fingerprints = Set.new(warnings[:new].map(&method(:fingerprint)))
+    fixed_fingerprints = Set.new(warnings[:fixed].map(&method(:fingerprint)))
+
+    # Remove warnings which fingerprints are both in :new and :fixed
+    shared_fingerprints = new_fingerprints.intersection(fixed_fingerprints)
+
+    unless shared_fingerprints.empty?
+      warnings[:new].delete_if do |warning|
+        shared_fingerprints.include?(fingerprint(warning))
+      end
 
-    # dup this list since we will be deleting from it and the iterator gets confused.
-    # use _with_index for fast deletion as opposed to .reject!{|obj| obj == *_warning}
-    warnings[:new].dup.each_with_index do |new_warning, new_warning_id|
-      warnings[:fixed].each_with_index do |fixed_warning, fixed_warning_id|
-        if eql_except_line_number new_warning, fixed_warning
-          warnings[:new].delete_at(new_warning_id - elements_deleted_offset)
-          elements_deleted_offset += 1
-          warnings[:fixed].delete_at(fixed_warning_id)
-          break
-        end
+      warnings[:fixed].delete_if do |warning|
+        shared_fingerprints.include?(fingerprint(warning))
       end
     end
 
     warnings
   end
 
-  def eql_except_line_number new_warning, fixed_warning
-    # can't do this ahead of time, as callers may be expecting a Brakeman::Warning
-    if new_warning.is_a? Brakeman::Warning 
-      new_warning = new_warning.to_hash
-      fixed_warning = fixed_warning.to_hash
-    end
-
-    if new_warning[:fingerprint] and fixed_warning[:fingerprint]
-      new_warning[:fingerprint] == fixed_warning[:fingerprint]
+  def fingerprint(warning)
+    if warning.is_a?(Brakeman::Warning)
+      warning.fingerprint
     else
-     OLD_WARNING_KEYS.each do |attr|
-        return false if new_warning[attr] != fixed_warning[attr]
-      end
-
-      true
+      warning[:fingerprint]
     end
   end
 end

data/lib/brakeman/file_parser.rb

@@ -3,52 +3,56 @@ module Brakeman
 
   # This class handles reading and parsing files.
   class FileParser
-    attr_reader :file_list
+    attr_reader :file_list, :errors
 
-    def initialize tracker, app_tree
-      @tracker = tracker
-      @timeout = @tracker.options[:parser_timeout]
+    def initialize app_tree, timeout
       @app_tree = app_tree
-      @file_list = {}
+      @timeout = timeout
+      @file_list = []
+      @errors = []
     end
 
-    def parse_files list, type
-      read_files list, type do |path, contents|
-        if ast = parse_ruby(contents, path)
+    def parse_files list
+      read_files list do |path, contents|
+        if ast = parse_ruby(contents, path.relative)
           ASTFile.new(path, ast)
         end
       end
     end
 
-    def read_files list, type
-      @file_list[type] ||= []
-
+    def read_files list
       list.each do |path|
-        result = yield path, read_path(path)
+        file = @app_tree.file_path(path)
+
+        result = yield file, file.read
+
         if result
-          @file_list[type] << result
+          @file_list << result
         end
       end
     end
 
+    # _path_ can be a string or a Brakeman::FilePath
     def parse_ruby input, path
+      if path.is_a? Brakeman::FilePath
+        path = path.relative
+      end
+
       begin
         Brakeman.debug "Parsing #{path}"
         RubyParser.new.parse input, path, @timeout
       rescue Racc::ParseError => e
-        @tracker.error e, "Could not parse #{path}"
-        nil
+        error e.exception(e.message + "\nCould not parse #{path}")
       rescue Timeout::Error => e
-        @tracker.error Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout"), caller
-        nil
+        error Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout")
       rescue => e
-        @tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
-        nil
+        error e.exception(e.message + "\nWhile processing #{path}")
       end
     end
 
-    def read_path path
-      @app_tree.read_path path
+    def error exception
+      @errors << exception
+      nil
     end
   end
 end

data/lib/brakeman/file_path.rb

@@ -0,0 +1,85 @@
+require 'pathname'
+
+module Brakeman
+  # Class to represent file paths within Brakeman.
+  # FilePath objects track both the relative and absolute paths
+  # to make it easier to manage paths.
+  class FilePath
+    attr_reader :absolute, :relative
+    @cache = {}
+
+    # Create a new FilePath using an AppTree object.
+    #
+    # Note that if the path is already a FilePath, that path will
+    # be returned unaltered.
+    #
+    # Additionally, paths are cached. If the absolute path already has
+    # a FilePath in the cache, that existing FilePath will be returned.
+    def self.from_app_tree app_tree, path
+      return path if path.is_a? Brakeman::FilePath
+
+      absolute = app_tree.expand_path(path).freeze
+
+      if fp = @cache[absolute]
+        return fp
+      end
+
+      relative = app_tree.relative_path(path).freeze
+
+      self.new(absolute, relative).tap { |fp| @cache[absolute] = fp }
+    end
+
+    # Create a new FilePath with the given absolute and relative paths.
+    def initialize absolute_path, relative_path
+      @absolute = absolute_path
+      @relative = relative_path
+    end
+
+    # Just the file name, no path
+    def basename
+      @basename ||= File.basename(self.relative)
+    end
+
+    # Read file from absolute path.
+    def read
+      File.read self.absolute
+    end
+
+    # Check if absolute path exists.
+    def exists?
+      File.exist? self.absolute
+    end
+
+    # Compare FilePaths. Raises an ArgumentError unless both objects are FilePaths.
+    def <=> rhs
+      raise ArgumentError unless rhs.is_a? Brakeman::FilePath
+      self.relative <=> rhs.relative
+    end
+
+    # Compare FilePaths. Raises an ArgumentError unless both objects are FilePaths.
+    def == rhs
+      return false unless rhs.is_a? Brakeman::FilePath
+
+      self.absolute == rhs.absolute
+    end
+
+    # Returns a string with the absolute path.
+    def to_str
+      self.absolute
+    end
+
+    # Returns a string with the absolute path.
+    def to_s
+      self.to_str
+    end
+
+    def hash
+      @hash ||= [@absolute, @relative].hash
+    end
+
+    def eql? rhs
+      @absolute == rhs.absolute and
+        @relative == rhs.relative
+    end
+  end
+end