brakeman 4.5.0 → 4.5.1

data/bundle/ruby/2.5.0/gems/{ruby_parser-3.13.0 → ruby_parser-3.13.1}/lib/ruby_parser_extras.rb

@@ -7,7 +7,7 @@ require "rp_extensions"
 require "rp_stringscanner"
 
 module RubyParserStuff
-  VERSION = "3.13.0"
+  VERSION = "3.13.1"
 
   attr_accessor :lexer, :in_def, :in_single, :file
   attr_accessor :in_kwarg
@@ -698,6 +698,22 @@ module RubyParserStuff
     result
   end
 
+  def new_const_op_asgn val
+    lhs, asgn_op, rhs = val[0], val[1].to_sym, val[2]
+
+    result = case asgn_op
+             when :"||" then
+               s(:op_asgn_or, lhs, rhs)
+             when :"&&" then
+               s(:op_asgn_and, lhs, rhs)
+             else
+               s(:op_asgn, lhs, asgn_op, rhs)
+             end
+
+    result.line = lhs.line
+    result
+  end
+
   def new_op_asgn2 val
     recv, call_op, meth, op, arg = val
     meth = :"#{meth}="
@@ -804,6 +820,7 @@ module RubyParserStuff
 
   def new_string val
     str = val[0]
+    str.force_encoding("UTF-8")
     str.force_encoding("ASCII-8BIT") unless str.valid_encoding?
     result = s(:str, str)
     self.lexer.fixup_lineno str.count("\n")
@@ -1168,6 +1185,8 @@ module RubyParserStuff
   end
 
   class Keyword
+    include RubyLexer::State::Values
+
     class KWtable
       attr_accessor :name, :state, :id0, :id1
       def initialize(name, id=[], state=nil)
@@ -1196,48 +1215,50 @@ module RubyParserStuff
     # :expr_value   = :expr_beg -- work to remove. Need multi-state support.
 
     wordlist = [
-                ["alias",    [:kALIAS,    :kALIAS      ], :expr_fname ],
-                ["and",      [:kAND,      :kAND        ], :expr_beg   ],
-                ["begin",    [:kBEGIN,    :kBEGIN      ], :expr_beg   ],
-                ["break",    [:kBREAK,    :kBREAK      ], :expr_mid   ],
-                ["case",     [:kCASE,     :kCASE       ], :expr_beg   ],
-                ["class",    [:kCLASS,    :kCLASS      ], :expr_class ],
-                ["def",      [:kDEF,      :kDEF        ], :expr_fname ],
-                ["defined?", [:kDEFINED,  :kDEFINED    ], :expr_arg   ],
-                ["do",       [:kDO,       :kDO         ], :expr_beg   ],
-                ["else",     [:kELSE,     :kELSE       ], :expr_beg   ],
-                ["elsif",    [:kELSIF,    :kELSIF      ], :expr_beg   ],
-                ["end",      [:kEND,      :kEND        ], :expr_end   ],
-                ["ensure",   [:kENSURE,   :kENSURE     ], :expr_beg   ],
-                ["false",    [:kFALSE,    :kFALSE      ], :expr_end   ],
-                ["for",      [:kFOR,      :kFOR        ], :expr_beg   ],
-                ["if",       [:kIF,       :kIF_MOD     ], :expr_beg   ],
-                ["in",       [:kIN,       :kIN         ], :expr_beg   ],
-                ["module",   [:kMODULE,   :kMODULE     ], :expr_beg   ],
-                ["next",     [:kNEXT,     :kNEXT       ], :expr_mid   ],
-                ["nil",      [:kNIL,      :kNIL        ], :expr_end   ],
-                ["not",      [:kNOT,      :kNOT        ], :expr_arg   ],
-                ["or",       [:kOR,       :kOR         ], :expr_beg   ],
-                ["redo",     [:kREDO,     :kREDO       ], :expr_end   ],
-                ["rescue",   [:kRESCUE,   :kRESCUE_MOD ], :expr_mid   ],
-                ["retry",    [:kRETRY,    :kRETRY      ], :expr_end   ],
-                ["return",   [:kRETURN,   :kRETURN     ], :expr_mid   ],
-                ["self",     [:kSELF,     :kSELF       ], :expr_end   ],
-                ["super",    [:kSUPER,    :kSUPER      ], :expr_arg   ],
-                ["then",     [:kTHEN,     :kTHEN       ], :expr_beg   ],
-                ["true",     [:kTRUE,     :kTRUE       ], :expr_end   ],
-                ["undef",    [:kUNDEF,    :kUNDEF      ], :expr_fname ],
-                ["unless",   [:kUNLESS,   :kUNLESS_MOD ], :expr_beg   ],
-                ["until",    [:kUNTIL,    :kUNTIL_MOD  ], :expr_beg   ],
-                ["when",     [:kWHEN,     :kWHEN       ], :expr_beg   ],
-                ["while",    [:kWHILE,    :kWHILE_MOD  ], :expr_beg   ],
-                ["yield",    [:kYIELD,    :kYIELD      ], :expr_arg   ],
-                ["BEGIN",    [:klBEGIN,   :klBEGIN     ], :expr_end   ],
-                ["END",      [:klEND,     :klEND       ], :expr_end   ],
-                ["__FILE__", [:k__FILE__, :k__FILE__   ], :expr_end   ],
-                ["__LINE__", [:k__LINE__, :k__LINE__   ], :expr_end   ],
-                ["__ENCODING__", [:k__ENCODING__, :k__ENCODING__], :expr_end],
-               ].map { |args| KWtable.new(*args) }
+                ["alias",    [:kALIAS,    :kALIAS      ], EXPR_FNAME|EXPR_FITEM],
+                ["and",      [:kAND,      :kAND        ], EXPR_BEG   ],
+                ["begin",    [:kBEGIN,    :kBEGIN      ], EXPR_BEG   ],
+                ["break",    [:kBREAK,    :kBREAK      ], EXPR_MID   ],
+                ["case",     [:kCASE,     :kCASE       ], EXPR_BEG   ],
+                ["class",    [:kCLASS,    :kCLASS      ], EXPR_CLASS ],
+                ["def",      [:kDEF,      :kDEF        ], EXPR_FNAME ],
+                ["defined?", [:kDEFINED,  :kDEFINED    ], EXPR_ARG   ],
+                ["do",       [:kDO,       :kDO         ], EXPR_BEG   ],
+                ["else",     [:kELSE,     :kELSE       ], EXPR_BEG   ],
+                ["elsif",    [:kELSIF,    :kELSIF      ], EXPR_BEG   ],
+                ["end",      [:kEND,      :kEND        ], EXPR_END   ],
+                ["ensure",   [:kENSURE,   :kENSURE     ], EXPR_BEG   ],
+                ["false",    [:kFALSE,    :kFALSE      ], EXPR_END   ],
+                ["for",      [:kFOR,      :kFOR        ], EXPR_BEG   ],
+                ["if",       [:kIF,       :kIF_MOD     ], EXPR_BEG   ],
+                ["in",       [:kIN,       :kIN         ], EXPR_BEG   ],
+                ["module",   [:kMODULE,   :kMODULE     ], EXPR_BEG   ],
+                ["next",     [:kNEXT,     :kNEXT       ], EXPR_MID   ],
+                ["nil",      [:kNIL,      :kNIL        ], EXPR_END   ],
+                ["not",      [:kNOT,      :kNOT        ], EXPR_ARG   ],
+                ["or",       [:kOR,       :kOR         ], EXPR_BEG   ],
+                ["redo",     [:kREDO,     :kREDO       ], EXPR_END   ],
+                ["rescue",   [:kRESCUE,   :kRESCUE_MOD ], EXPR_MID   ],
+                ["retry",    [:kRETRY,    :kRETRY      ], EXPR_END   ],
+                ["return",   [:kRETURN,   :kRETURN     ], EXPR_MID   ],
+                ["self",     [:kSELF,     :kSELF       ], EXPR_END   ],
+                ["super",    [:kSUPER,    :kSUPER      ], EXPR_ARG   ],
+                ["then",     [:kTHEN,     :kTHEN       ], EXPR_BEG   ],
+                ["true",     [:kTRUE,     :kTRUE       ], EXPR_END   ],
+                ["undef",    [:kUNDEF,    :kUNDEF      ], EXPR_FNAME|EXPR_FITEM],
+                ["unless",   [:kUNLESS,   :kUNLESS_MOD ], EXPR_BEG   ],
+                ["until",    [:kUNTIL,    :kUNTIL_MOD  ], EXPR_BEG   ],
+                ["when",     [:kWHEN,     :kWHEN       ], EXPR_BEG   ],
+                ["while",    [:kWHILE,    :kWHILE_MOD  ], EXPR_BEG   ],
+                ["yield",    [:kYIELD,    :kYIELD      ], EXPR_ARG   ],
+                ["BEGIN",    [:klBEGIN,   :klBEGIN     ], EXPR_END   ],
+                ["END",      [:klEND,     :klEND       ], EXPR_END   ],
+                ["__FILE__", [:k__FILE__, :k__FILE__   ], EXPR_END   ],
+                ["__LINE__", [:k__LINE__, :k__LINE__   ], EXPR_END   ],
+                ["__ENCODING__", [:k__ENCODING__, :k__ENCODING__], EXPR_END],
+               ].map { |args|
+      KWtable.new(*args)
+    }
 
     # :startdoc:
 

data/bundle/ruby/2.5.0/gems/{ruby_parser-3.13.0 → ruby_parser-3.13.1}/tools/munge.rb

@@ -107,6 +107,7 @@ def munge s
 
              '"defined?"',     "kDEFINED",
 
+             "<none>",         "none",
 
              '"do (for condition)"', "kDO_COND",
              '"do (for lambda)"',    "kDO_LAMBDA",
@@ -167,7 +168,7 @@ ARGF.each_line do |line|
     item = $1
     stack << munge(item)
   when /^-> \$\$ = (?:token|nterm) (.+) \(.*\)/ then
-    stack << "<none>" if stack.empty?
+    stack << "none" if stack.empty?
     item = munge $1
     x = stack.map { |s| s.strip }.join " "
     if x != item then # prevent kdef -> kdef

data/bundle/ruby/2.5.0/gems/{ruby_parser-3.13.0 → ruby_parser-3.13.1}/tools/ripper.rb

@@ -6,8 +6,13 @@ $p ||= false
 require "ripper/sexp"
 require "pp" if $p
 
+if ARGV.empty? then
+  warn "reading from stdin"
+  ARGV << "-"
+end
+
 ARGV.each do |path|
-  src = File.read path
+  src = path == "-" ? $stdin.read : File.read(path)
   rip = Ripper::SexpBuilderPP.new src
   rip.yydebug = $d
 

data/bundle/ruby/2.5.0/gems/{unicode-display_width-1.5.0 → unicode-display_width-1.6.0}/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 1.6.0
+
+- Unicode 12.1
+
 ## 1.5.0
 
 - Unicode 12

data/bundle/ruby/2.5.0/gems/{unicode-display_width-1.5.0 → unicode-display_width-1.6.0}/README.md

@@ -2,7 +2,7 @@
 
 Determines the monospace display width of a string in Ruby. Implementation based on [EastAsianWidth.txt](https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt) and other data, 100% in Ruby. Other than [wcwidth()](https://github.com/janlelis/wcswidth-ruby), which fulfills a similar purpose, it does not rely on the OS vendor to provide an up-to-date method for measuring string width.
 
-Unicode version: **12.0.0**
+Unicode version: **12.1.0** (May 2019)
 
 Supported Rubies: **2.6**, **2.5**, **2.4**
 

data/bundle/ruby/2.5.0/gems/{unicode-display_width-1.5.0 → unicode-display_width-1.6.0}/lib/unicode/display_width/constants.rb

@@ -1,7 +1,7 @@
 module Unicode
   module DisplayWidth
-    VERSION = '1.5.0'
-    UNICODE_VERSION = "12.0.0".freeze
+    VERSION = '1.6.0'
+    UNICODE_VERSION = "12.1.0".freeze
     DATA_DIRECTORY = File.expand_path(File.dirname(__FILE__) + '/../../../data/').freeze
     INDEX_FILENAME = (DATA_DIRECTORY + '/display_width.marshal.gz').freeze
   end

data/lib/brakeman.rb

@@ -55,6 +55,9 @@ module Brakeman
   #  * :print_report - if no output file specified, print to stdout (default: false)
   #  * :quiet - suppress most messages (default: true)
   #  * :rails3 - force Rails 3 mode (automatic)
+  #  * :rails4 - force Rails 4 mode (automatic)
+  #  * :rails5 - force Rails 5 mode (automatic)
+  #  * :rails6 - force Rails 6 mode (automatic)
   #  * :report_routes - show found routes on controllers (default: false)
   #  * :run_checks - array of checks to run (run all if not specified)
   #  * :safe_methods - array of methods to consider safe
@@ -99,6 +102,10 @@ module Brakeman
     elsif options[:rails5]
       options[:rails3] = true
       options[:rails4] = true
+    elsif options[:rails6]
+      options[:rails3] = true
+      options[:rails4] = true
+      options[:rails5] = true
     end
 
     options[:output_formats] = get_output_formats options

data/lib/brakeman/app_tree.rb

@@ -1,4 +1,5 @@
 require 'pathname'
+require 'brakeman/file_path'
 
 module Brakeman
   class AppTree
@@ -62,31 +63,37 @@ module Brakeman
       @absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
       @relative_engine_paths = @engine_paths - @absolute_engine_paths
       @gemspec = nil
+      @root_search_pattern = nil
     end
 
-    def expand_path(path)
-      File.expand_path(path, @root)
+    # Create a new Brakeman::FilePath
+    def file_path(path)
+      Brakeman::FilePath.from_app_tree(self, path)
     end
 
-    def read(path)
-      File.read(File.join(@root, path))
+    # Should only be used by Brakeman::FilePath.
+    # Use AppTree#file_path(path).absolute instead.
+    def expand_path(path)
+      File.expand_path(path, @root)
     end
 
-    # This variation requires full paths instead of paths based
-    # off the project root. I'd prefer to get all the code outside
-    # of AppTree using project-root based paths (e.g. app/models/user.rb)
-    # instead of full paths, but I suspect it's an incompatible change.
-    def read_path(path)
-      File.read(path)
+    # Should only be used by Brakeman::FilePath
+    # Use AppTree#file_path(path).relative instead.
+    def relative_path(path)
+      pname = Pathname.new path
+      if path and not path.empty? and pname.absolute?
+        pname.relative_path_from(Pathname.new(self.root)).to_s
+      else
+        path
+      end
     end
 
     def exists?(path)
-      File.exist?(File.join(@root, path))
-    end
-
-    # This is a pair for #read_path. Again, would like to kill these
-    def path_exists?(path)
-      File.exist?(path)
+      if path.is_a? Brakeman::FilePath
+        path.exists?
+      else
+        File.exist?(File.join(@root, path))
+      end
     end
 
     def initializer_paths
@@ -111,7 +118,7 @@ module Brakeman
     end
 
     def lib_paths
-      @lib_files ||= find_paths("lib").reject { |path| path.include? "/generators/" or path.include? "lib/tasks/" or path.include? "lib/templates/" } +
+      @lib_files ||= find_paths("lib").reject { |path| path.relative.include? "/generators/" or path.relative.include? "lib/tasks/" or path.relative.include? "lib/templates/" } +
                      find_additional_lib_paths +
                      find_helper_paths +
                      find_job_paths
@@ -125,7 +132,7 @@ module Brakeman
       if gemspecs.length > 1 or gemspecs.empty?
         @gemspec = false
       else
-        @gemspec = File.basename(gemspecs.first)
+        @gemspec = file_path(File.basename(gemspecs.first))
       end
     end
 
@@ -155,7 +162,8 @@ module Brakeman
 
     def select_files(paths)
       paths = select_only_files(paths)
-      reject_skipped_files(paths)
+      paths = reject_skipped_files(paths)
+      convert_to_file_paths(paths)
     end
 
     def select_only_files(paths)
@@ -190,8 +198,8 @@ module Brakeman
     def root_search_pattern
       return @root_search_pattern if @root_search_pattern
 
-      abs = @absolute_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
-      rel = @relative_engine_paths.to_a.map { |path| path.gsub /#{File::SEPARATOR}+$/, '' }
+      abs = @absolute_engine_paths.to_a.map { |path| path.gsub(/#{File::SEPARATOR}+$/, '') }
+      rel = @relative_engine_paths.to_a.map { |path| path.gsub(/#{File::SEPARATOR}+$/, '') }
 
       roots = ([@root] + abs).join(",")
       rel_engines = (rel + [""]).join("/,")
@@ -199,7 +207,11 @@ module Brakeman
     end
 
     def prioritize_concerns paths
-      paths.partition { |path| path.include? "concerns" }.flatten
+      paths.partition { |path| path.relative.include? "concerns" }.flatten
+    end
+
+    def convert_to_file_paths paths
+      paths.map { |path| file_path(path) }
     end
   end
 end

data/lib/brakeman/checks.rb

@@ -109,13 +109,13 @@ class Brakeman::Checks
 
   #Run all the checks on the given Tracker.
   #Returns a new instance of Checks with the results.
-  def self.run_checks(app_tree, tracker)
+  def self.run_checks(tracker)
     checks = self.checks_to_run(tracker)
     check_runner = self.new :min_confidence => tracker.options[:min_confidence]
-    self.actually_run_checks(checks, check_runner, app_tree, tracker)
+    self.actually_run_checks(checks, check_runner, tracker)
   end
 
-  def self.actually_run_checks(checks, check_runner, app_tree, tracker)
+  def self.actually_run_checks(checks, check_runner, tracker)
     threads = [] # Results for parallel
     results = [] # Results for sequential
     parallel = tracker.options[:parallel_checks]
@@ -127,10 +127,10 @@ class Brakeman::Checks
 
       if parallel
         threads << Thread.new do
-          self.run_a_check(c, error_mutex, app_tree, tracker)
+          self.run_a_check(c, error_mutex, tracker)
         end
       else
-        results << self.run_a_check(c, error_mutex, app_tree, tracker)
+        results << self.run_a_check(c, error_mutex, tracker)
       end
 
       #Maintain list of which checks were run
@@ -196,8 +196,8 @@ class Brakeman::Checks
     end
   end
 
-  def self.run_a_check klass, mutex, app_tree, tracker
-    check = klass.new(app_tree, tracker)
+  def self.run_a_check klass, mutex, tracker
+    check = klass.new(tracker)
 
     begin
       check.run_check

data/lib/brakeman/checks/base_check.rb

@@ -27,9 +27,9 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
   end
 
   #Initialize Check with Checks.
-  def initialize(app_tree, tracker)
+  def initialize(tracker)
     super()
-    @app_tree = app_tree
+    @app_tree = tracker.app_tree
     @results = [] #only to check for duplicates
     @warnings = []
     @tracker = tracker
@@ -143,11 +143,11 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
   def warn options
     extra_opts = { :check => self.class.to_s }
 
-    warning = Brakeman::Warning.new(options.merge(extra_opts))
-    warning.file = file_for warning
-    warning.relative_path = relative_path(warning.file)
+    if options[:file]
+      options[:file] = @app_tree.file_path(options[:file])
+    end
 
-    @warnings << warning
+    @warnings << Brakeman::Warning.new(options.merge(extra_opts))
   end
 
   #Run _exp_ through OutputProcessor to get a nice String.
@@ -476,11 +476,11 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
     if gem_name and info = tracker.config.get_gem(gem_name)
       info
     elsif @app_tree.exists?("Gemfile")
-      "Gemfile"
+      @app_tree.file_path "Gemfile"
     elsif @app_tree.exists?("gems.rb")
-      "gems.rb"
+      @app_tree.file_path "gems.rb"
     else
-      "config/environment.rb"
+      @app_tree.file_path "config/environment.rb"
     end
   end
 

data/lib/brakeman/checks/check_cross_site_scripting.rb

@@ -33,6 +33,11 @@ class Brakeman::CheckCrossSiteScripting < Brakeman::BaseCheck
 
   FORM_BUILDER = Sexp.new(:call, Sexp.new(:const, :FormBuilder), :new)
 
+  def initialize *args
+    super
+    @matched = @mark = false
+  end
+
   #Run check
   def run_check
     setup