brakeman 4.5.0 → 4.5.1

data/lib/brakeman/checks/check_validation_regex.rb

@@ -17,7 +17,7 @@ class Brakeman::CheckValidationRegex < Brakeman::BaseCheck
 
   def run_check
     active_record_models.each do |name, model|
-      @current_model = name
+      @current_model = model
       format_validations = model.options[:validates_format_of]
 
       if format_validations

data/lib/brakeman/file_parser.rb

@@ -5,16 +5,16 @@ module Brakeman
   class FileParser
     attr_reader :file_list
 
-    def initialize tracker, app_tree
+    def initialize tracker
       @tracker = tracker
       @timeout = @tracker.options[:parser_timeout]
-      @app_tree = app_tree
+      @app_tree = @tracker.app_tree
       @file_list = {}
     end
 
     def parse_files list, type
       read_files list, type do |path, contents|
-        if ast = parse_ruby(contents, path)
+        if ast = parse_ruby(contents, path.relative)
           ASTFile.new(path, ast)
         end
       end
@@ -24,7 +24,9 @@ module Brakeman
       @file_list[type] ||= []
 
       list.each do |path|
-        result = yield path, read_path(path)
+        file = @app_tree.file_path(path)
+
+        result = yield file, file.read
         if result
           @file_list[type] << result
         end
@@ -50,9 +52,5 @@ module Brakeman
         nil
       end
     end
-
-    def read_path path
-      @app_tree.read_path path
-    end
   end
 end

data/lib/brakeman/file_path.rb

@@ -0,0 +1,71 @@
+require 'pathname'
+
+module Brakeman
+  # Class to represent file paths within Brakeman.
+  # FilePath objects track both the relative and absolute paths
+  # to make it easier to manage paths.
+  class FilePath
+    attr_reader :absolute, :relative
+    @cache = {}
+
+    # Create a new FilePath using an AppTree object.
+    #
+    # Note that if the path is already a FilePath, that path will
+    # be returned unaltered.
+    #
+    # Additionally, paths are cached. If the absolute path already has
+    # a FilePath in the cache, that existing FilePath will be returned.
+    def self.from_app_tree app_tree, path
+      return path if path.is_a? Brakeman::FilePath
+
+      absolute = app_tree.expand_path(path).freeze
+
+      if fp = @cache[absolute]
+        return fp
+      end
+
+      relative = app_tree.relative_path(path).freeze
+
+      self.new(absolute, relative).tap { |fp| @cache[absolute] = fp }
+    end
+
+    # Create a new FilePath with the given absolute and relative paths.
+    def initialize absolute_path, relative_path
+      @absolute = absolute_path
+      @relative = relative_path
+    end
+
+    # Read file from absolute path.
+    def read
+      File.read self.absolute
+    end
+
+    # Check if absolute path exists.
+    def exists?
+      File.exist? self.absolute
+    end
+
+    # Compare FilePaths. Raises an ArgumentError unless both objects are FilePaths.
+    def <=> rhs
+      raise ArgumentError unless rhs.is_a? Brakeman::FilePath
+      self.relative <=> rhs.relative
+    end
+
+    # Compare FilePaths. Raises an ArgumentError unless both objects are FilePaths.
+    def == rhs
+      return false unless rhs.is_a? Brakeman::FilePath
+
+      self.absolute == rhs.absolute
+    end
+
+    # Returns a string with the absolute path.
+    def to_str
+      self.absolute
+    end
+
+    # Returns a string with the absolute path.
+    def to_s
+      self.to_str
+    end
+  end
+end

data/lib/brakeman/options.rb

@@ -82,6 +82,13 @@ module Brakeman::Options
           options[:rails5] = true
         end
 
+        opts.on "-6", "--rails6", "Force Rails 6 mode" do
+          options[:rails3] = true
+          options[:rails4] = true
+          options[:rails5] = true
+          options[:rails6] = true
+        end
+
         opts.separator ""
         opts.separator "Scanning options:"
 

data/lib/brakeman/parsers/template_parser.rb

@@ -13,7 +13,7 @@ module Brakeman
     end
 
     def parse_template path, text
-      type = path.match(KNOWN_TEMPLATE_EXTENSIONS)[1].to_sym
+      type = path.relative.match(KNOWN_TEMPLATE_EXTENSIONS)[1].to_sym
       type = :erb if type == :rhtml
       name = template_path_to_name path
       Brakeman.debug "Parsing #{path}"
@@ -63,7 +63,7 @@ module Brakeman
         else
           ERB.new(text, nil, '-').src
         end
-        src.sub!(/^#.*\n/, '') if Brakeman::Scanner::RUBY_1_9
+        src.sub!(/^#.*\n/, '')
         src
       end
     end
@@ -95,7 +95,7 @@ module Brakeman
     end
 
     def self.parse_inline_erb tracker, text
-      fp = Brakeman::FileParser.new(tracker, nil)
+      fp = Brakeman::FileParser.new(tracker)
       tp = self.new(tracker, fp)
       src = tp.parse_erb '_inline_', text
       type = tp.erubis? ? :erubis : :erb

data/lib/brakeman/processor.rb

@@ -13,8 +13,7 @@ module Brakeman
     include Util
 
     def initialize(app_tree, options)
-      @app_tree = app_tree
-      @tracker = Tracker.new(@app_tree, self, options)
+      @tracker = Tracker.new(app_tree, self, options)
     end
 
     def tracked_events
@@ -39,7 +38,7 @@ module Brakeman
     #Process controller source. +file_name+ is used for reporting
     def process_controller src, file_name
       if contains_class? src
-        ControllerProcessor.new(@app_tree, @tracker).process_controller src, file_name
+        ControllerProcessor.new(@tracker).process_controller src, file_name
       else
         LibraryProcessor.new(@tracker).process_library src, file_name
       end
@@ -48,7 +47,7 @@ module Brakeman
     #Process variable aliasing in controller source and save it in the
     #tracker.
     def process_controller_alias name, src, only_method = nil, file = nil
-      ControllerAliasProcessor.new(@app_tree, @tracker, only_method).process_controller name, src, file
+      ControllerAliasProcessor.new(@tracker, only_method).process_controller name, src, file
     end
 
     #Process a model source

data/lib/brakeman/processors/alias_processor.rb

@@ -20,19 +20,18 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   #The recommended usage is:
   #
   # AliasProcessor.new.process_safely src
-  def initialize tracker = nil, file_name = nil
+  def initialize tracker = nil, current_file = nil
     super()
     @env = SexpProcessor::Environment.new
     @inside_if = false
     @ignore_ifs = nil
     @exp_context = []
-    @current_module = nil
     @tracker = tracker #set in subclass as necessary
     @helper_method_cache = {}
     @helper_method_info = Hash.new({})
     @or_depth_limit = (tracker && tracker.options[:branch_limit]) || 5 #arbitrary default
     @meth_env = nil
-    @file_name = file_name
+    @current_file = current_file
     set_env_defaults
   end
 
@@ -44,8 +43,8 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   #
   #This method returns a new Sexp with variables replaced with their values,
   #where possible.
-  def process_safely src, set_env = nil, file_name = nil
-    @file_name = file_name
+  def process_safely src, set_env = nil, current_file = @current_file
+    @current_file = current_file
     @env = set_env || SexpProcessor::Environment.new
     @result = src.deep_clone
     process @result
@@ -270,6 +269,11 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       if array? target and target.length > 2 and (string? first_arg or first_arg.nil?)
         exp = process_array_join(target, first_arg)
       end
+    when :!
+      #  Convert `!!a` to boolean
+      if call? target and target.method == :!
+        exp = s(:or, s(:true).line(exp.line), s(:false).line(exp.line)).line(exp.line)
+      end
     end
 
     exp
@@ -368,6 +372,8 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
           elsif e.is_a? Symbol
             local = Sexp.new(:lvar, e)
             env.current[local] = local
+          elsif e.nil? # trailing comma, argument destructuring
+            next # Punt for now
           else
             raise "Unexpected value in block args: #{e.inspect}"
           end
@@ -693,7 +699,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     if @tracker
       @tracker.add_constant exp.lhs,
         exp.rhs,
-        :file => current_file_name,
+        :file => @current_file,
         :module => @current_module,
         :class => @current_class,
         :method => @current_method

data/lib/brakeman/processors/base_processor.rb

@@ -15,11 +15,12 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     super()
     @last = nil
     @tracker = tracker
-    @current_template = @current_module = @current_class = @current_method = @file_name = nil
+    @app_tree = tracker.app_tree if tracker
+    @current_template = @current_module = @current_class = @current_method = @current_file = nil
   end
 
-  def process_file exp, file_name
-    @file_name = file_name
+  def process_file exp, current_file
+    @current_file = current_file
     process exp
   end
 
@@ -182,7 +183,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     if @tracker
       @tracker.add_constant exp.lhs,
         exp.rhs,
-        :file => current_file_name,
+        :file => current_file,
         :module => @current_module,
         :class => @current_class,
         :method => @current_method
@@ -234,8 +235,8 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     elsif first_arg.is_a? Symbol or first_arg.is_a? String
       type = :action
       value = Sexp.new(:lit, first_arg.to_sym)
-		elsif first_arg.nil?
-			type = :default
+    elsif first_arg.nil?
+      type = :default
     elsif not hash? first_arg
       type = :action
       value = first_arg
@@ -287,7 +288,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     template_name = "#@current_method/inline@#{value.line}:#{class_or_module}".to_sym
     type, ast = Brakeman::TemplateParser.parse_inline_erb(@tracker, value.value)
     ast = ast.deep_clone(value.line)
-    @tracker.processor.process_template(template_name, ast, type, nil, @file_name)
+    @tracker.processor.process_template(template_name, ast, type, nil, @current_file)
     @tracker.processor.process_template_alias(@tracker.templates[template_name])
 
     return s(:lit, template_name), options

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -11,22 +11,22 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
   #If only_method is specified, only that method will be processed,
   #other methods will be skipped.
   #This is for rescanning just a single action.
-  def initialize app_tree, tracker, only_method = nil
+  def initialize tracker, only_method = nil
     super tracker
-    @app_tree = app_tree
+    @app_tree = tracker.app_tree
     @only_method = only_method
     @rendered = false
     @current_class = @current_module = @current_method = nil
     @method_cache = {} #Cache method lookups
   end
 
-  def process_controller name, src, file_name
+  def process_controller name, src, current_file
     if not node_type? src, :class
       Brakeman.debug "#{name} is not a class, it's a #{src.node_type}"
       return
     else
       @current_class = name
-      @file_name = file_name
+      @current_file = @app_tree.file_path(current_file)
 
       process_default src
 
@@ -37,6 +37,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
   #Process modules mixed into the controller, in case they contain actions.
   def process_mixins
     controller = @tracker.controllers[@current_class]
+    original_file = @current_file
 
     controller.includes.each do |i|
       mixin = @tracker.libs[i]
@@ -49,7 +50,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
       methods.each do |name|
         #Need to process the method like it was in a controller in order
         #to get the renders set
-        processor = Brakeman::ControllerProcessor.new(@app_tree, @tracker)
+        processor = Brakeman::ControllerProcessor.new(@tracker, mixin.file)
         method = mixin.get_method(name)[:src].deep_clone
 
         if node_type? method, :defn
@@ -59,11 +60,13 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
           method = processor.process method
         end
 
-        @file_name = mixin.file
+        @current_file = mixin.file
         #Then process it like any other method in the controller
         process method
       end
     end
+  ensure
+    @current_file = original_file
   end
 
   #Skip it, must be an inner class
@@ -187,7 +190,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
       end
     end
 
-    render_path = Brakeman::RenderPath.new.add_controller_render(@current_class, @current_method, line, relative_path(@file_name))
+    render_path = Brakeman::RenderPath.new.add_controller_render(@current_class, @current_method, line, @current_file)
     super name, args, render_path, line
   end
 

data/lib/brakeman/processors/controller_processor.rb

@@ -8,20 +8,16 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
 
   FORMAT_HTML = Sexp.new(:call, Sexp.new(:lvar, :format), :html)
 
-  def initialize app_tree, tracker
+  def initialize tracker, current_file = nil
     super(tracker)
-    @app_tree = app_tree
-    @current_class = nil
-    @current_method = nil
-    @current_module = nil
     @visibility = :public
-    @file_name = nil
+    @current_file = current_file
     @concerns = Set.new
   end
 
   #Use this method to process a Controller
-  def process_controller src, file_name = nil
-    @file_name = file_name
+  def process_controller src, current_file = @current_file
+    @current_file = current_file
     process src
   end
 
@@ -35,7 +31,7 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
     #a real controller, so we can't take this shortcut.
     if @current_class and @current_class.name.to_s.end_with? "Controller"
       Brakeman.debug "[Notice] Treating inner class as library: #{name}"
-      Brakeman::LibraryProcessor.new(@tracker).process_library exp, @file_name
+      Brakeman::LibraryProcessor.new(@tracker).process_library exp, @current_file
       return exp
     end
 

data/lib/brakeman/processors/haml_template_processor.rb

@@ -7,6 +7,11 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
   JAVASCRIPT_FILTER = s(:colon2, s(:colon2, s(:const, :Haml), :Filters), :Javascript)
   COFFEE_FILTER = s(:colon2, s(:colon2, s(:const, :Haml), :Filters), :Coffee)
 
+  def initialize *args
+    super
+    @javascript = false
+  end
+
   #Processes call, looking for template output
   def process_call exp
     target = exp.target

data/lib/brakeman/processors/lib/module_helper.rb

@@ -13,9 +13,9 @@ module Brakeman::ModuleHelper
 
     if @tracker.libs[name]
       @current_module = @tracker.libs[name]
-      @current_module.add_file @file_name, exp
+      @current_module.add_file @current_file, exp
     else
-      @current_module = tracker_class.new name, parent, @file_name, exp, @tracker
+      @current_module = tracker_class.new name, parent, @current_file, exp, @tracker
       @tracker.libs[name] = @current_module
     end
 
@@ -45,9 +45,9 @@ module Brakeman::ModuleHelper
 
     if collection[name]
       @current_class = collection[name]
-      @current_class.add_file @file_name, exp
+      @current_class.add_file @current_file, exp
     else
-      @current_class = tracker_class.new name, parent, @file_name, exp, @tracker 
+      @current_class = tracker_class.new name, parent, @current_file, exp, @tracker
       collection[name] = @current_class
     end
 
@@ -85,9 +85,9 @@ module Brakeman::ModuleHelper
     @current_method = nil
 
     if @current_class
-      @current_class.add_method @visibility, name, res, @file_name
+      @current_class.add_method @visibility, name, res, @current_file
     elsif @current_module
-      @current_module.add_method @visibility, name, res, @file_name
+      @current_module.add_method @visibility, name, res, @current_file
     end
     res
   end
@@ -101,9 +101,9 @@ module Brakeman::ModuleHelper
     @current_method = nil
 
     if @current_class
-      @current_class.add_method @visibility, name, res, @file_name
+      @current_class.add_method @visibility, name, res, @current_file
     elsif @current_module
-      @current_module.add_method @visibility, name, res, @file_name
+      @current_module.add_method @visibility, name, res, @current_file
     end
 
     res