brakeman 4.5.1 → 4.10.1

data/lib/brakeman/differ.rb

@@ -1,8 +1,6 @@
 # extracting the diff logic to it's own class for consistency. Currently handles
 # an array of Brakeman::Warnings or plain hash representations.  
 class Brakeman::Differ
-  DEFAULT_HASH = {:new => [], :fixed => []}
-  OLD_WARNING_KEYS = [:warning_type, :location, :code, :message, :file, :link, :confidence, :user_input]
   attr_reader :old_warnings, :new_warnings
 
   def initialize new_warnings, old_warnings
@@ -11,9 +9,6 @@ class Brakeman::Differ
   end
 
   def diff
-    # get the type of elements
-    return DEFAULT_HASH if @new_warnings.empty?
-
     warnings = {}
     warnings[:new] = @new_warnings - @old_warnings
     warnings[:fixed] = @old_warnings - @new_warnings
@@ -24,43 +19,31 @@ class Brakeman::Differ
   # second pass to cleanup any vulns which have changed in line number only.
   # Given a list of new warnings, delete pairs of new/fixed vulns that differ
   # only by line number.
-  # Horrible O(n^2) performance.  Keep n small :-/
   def second_pass(warnings)
-    # keep track of the number of elements deleted because the index numbers
-    # won't update as the list is modified
-    elements_deleted_offset = 0
+    new_fingerprints = Set.new(warnings[:new].map(&method(:fingerprint)))
+    fixed_fingerprints = Set.new(warnings[:fixed].map(&method(:fingerprint)))
+
+    # Remove warnings which fingerprints are both in :new and :fixed
+    shared_fingerprints = new_fingerprints.intersection(fixed_fingerprints)
+
+    unless shared_fingerprints.empty?
+      warnings[:new].delete_if do |warning|
+        shared_fingerprints.include?(fingerprint(warning))
+      end
 
-    # dup this list since we will be deleting from it and the iterator gets confused.
-    # use _with_index for fast deletion as opposed to .reject!{|obj| obj == *_warning}
-    warnings[:new].dup.each_with_index do |new_warning, new_warning_id|
-      warnings[:fixed].each_with_index do |fixed_warning, fixed_warning_id|
-        if eql_except_line_number new_warning, fixed_warning
-          warnings[:new].delete_at(new_warning_id - elements_deleted_offset)
-          elements_deleted_offset += 1
-          warnings[:fixed].delete_at(fixed_warning_id)
-          break
-        end
+      warnings[:fixed].delete_if do |warning|
+        shared_fingerprints.include?(fingerprint(warning))
       end
     end
 
     warnings
   end
 
-  def eql_except_line_number new_warning, fixed_warning
-    # can't do this ahead of time, as callers may be expecting a Brakeman::Warning
-    if new_warning.is_a? Brakeman::Warning 
-      new_warning = new_warning.to_hash
-      fixed_warning = fixed_warning.to_hash
-    end
-
-    if new_warning[:fingerprint] and fixed_warning[:fingerprint]
-      new_warning[:fingerprint] == fixed_warning[:fingerprint]
+  def fingerprint(warning)
+    if warning.is_a?(Brakeman::Warning)
+      warning.fingerprint
     else
-     OLD_WARNING_KEYS.each do |attr|
-        return false if new_warning[attr] != fixed_warning[attr]
-      end
-
-      true
+      warning[:fingerprint]
     end
   end
 end

data/lib/brakeman/file_parser.rb

@@ -33,17 +33,18 @@ module Brakeman
       end
     end
 
-    def parse_ruby input, path, parser = RubyParser.new
+    # _path_ can be a string or a Brakeman::FilePath
+    def parse_ruby input, path
+      if path.is_a? Brakeman::FilePath
+        path = path.relative
+      end
+
       begin
         Brakeman.debug "Parsing #{path}"
-        parser.parse input, path, @timeout
+        RubyParser.new.parse input, path, @timeout
       rescue Racc::ParseError => e
-        if parser.class == RubyParser
-          return parse_ruby(input, path, RubyParser.latest)
-        else
-          @tracker.error e, "Could not parse #{path}"
-          nil
-        end
+        @tracker.error e, "Could not parse #{path}"
+        nil
       rescue Timeout::Error => e
         @tracker.error Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout"), caller
         nil

data/lib/brakeman/file_path.rb

@@ -35,6 +35,11 @@ module Brakeman
       @relative = relative_path
     end
 
+    # Just the file name, no path
+    def basename
+      @basename ||= File.basename(self.relative)
+    end
+
     # Read file from absolute path.
     def read
       File.read self.absolute
@@ -67,5 +72,14 @@ module Brakeman
     def to_s
       self.to_str
     end
+
+    def hash
+      @hash ||= [@absolute, @relative].hash
+    end
+
+    def eql? rhs
+      @absolute == rhs.absolute and
+        @relative == rhs.relative
+    end
   end
 end

data/lib/brakeman/options.rb

@@ -67,6 +67,10 @@ module Brakeman::Options
           options[:ensure_latest] = true
         end
 
+        opts.on "--ensure-ignore-notes", "Fail when an ignored warnings does not include a note" do
+          options[:ensure_ignore_notes] = true
+        end
+
         opts.on "-3", "--rails3", "Force Rails 3 mode" do
           options[:rails3] = true
         end
@@ -225,7 +229,7 @@ module Brakeman::Options
 
         opts.on "-f",
           "--format TYPE",
-          [:pdf, :text, :html, :csv, :tabs, :json, :markdown, :codeclimate, :cc, :plain, :table],
+          [:pdf, :text, :html, :csv, :tabs, :json, :markdown, :codeclimate, :cc, :plain, :table, :junit, :sarif],
           "Specify output formats. Default is text" do |type|
 
           type = "s" if type == :text
@@ -301,6 +305,22 @@ module Brakeman::Options
           options[:github_repo] = repo
         end
 
+        opts.on "--text-fields field1,field2,etc.", Array, "Specify fields for text report format" do |format|
+          valid_options = [:category, :category_id, :check, :code, :confidence, :file, :fingerprint, :line, :link, :message, :render_path]
+
+          options[:text_fields] = format.map(&:to_sym)
+
+          if options[:text_fields] == [:all]
+            options[:text_fields] = valid_options
+          else
+            invalid_options = (options[:text_fields] - valid_options)
+
+            unless invalid_options.empty?
+              raise OptionParser::ParseError, "\nInvalid format options: #{invalid_options.inspect}"
+            end
+          end
+        end
+
         opts.on "-w",
           "--confidence-level LEVEL",
           ["1", "2", "3"],

data/lib/brakeman/parsers/haml_embedded.rb

@@ -1,6 +1,6 @@
 module Brakeman
   module FakeHamlFilter
-    # Copied from Haml - force delayed compilation
+    # Copied from Haml 4 - force delayed compilation
     def compile(compiler, text)
       filter = self
       compiler.instance_eval do

data/lib/brakeman/parsers/template_parser.rb

@@ -79,7 +79,9 @@ module Brakeman
 
       Haml::Engine.new(text,
                        :filename => path,
-                       :escape_html => tracker.config.escape_html?).precompiled.gsub(/([^\\])\\n/, '\1')
+                       :escape_html => tracker.config.escape_html?,
+                       :escape_filter_interpolations => tracker.config.escape_filter_interpolations?
+                      ).precompiled.gsub(/([^\\])\\n/, '\1')
     rescue Haml::Error => e
       tracker.error e, ["While compiling HAML in #{path}"] << e.backtrace
       nil

data/lib/brakeman/processor.rb

@@ -53,7 +53,7 @@ module Brakeman
     #Process a model source
     def process_model src, file_name
       result = ModelProcessor.new(@tracker).process_model src, file_name
-      AliasProcessor.new(@tracker).process result if result
+      AliasProcessor.new(@tracker, file_name).process result if result
     end
 
     #Process either an ERB or HAML template
@@ -90,7 +90,7 @@ module Brakeman
     def process_initializer file_name, src
       res = BaseProcessor.new(@tracker).process_file src, file_name
       res = AliasProcessor.new(@tracker).process_safely res, nil, file_name
-      @tracker.initializers[Pathname.new(file_name).basename.to_s] = res
+      @tracker.initializers[file_name] = res
     end
 
     #Process source for a library file

data/lib/brakeman/processors/alias_processor.rb

@@ -82,7 +82,6 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   def replace exp, int = 0
     return exp if int > 3
 
-
     if replacement = env[exp] and not duplicate? replacement
       replace(replacement.deep_clone(exp.line), int + 1)
     elsif tracker and replacement = tracker.constant_lookup(exp) and not duplicate? replacement
@@ -237,7 +236,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
         env[target_var] = target
         return target
       elsif string? target and string_interp? first_arg
-        exp = Sexp.new(:dstr, target.value + first_arg[1]).concat(first_arg[2..-1])
+        exp = Sexp.new(:dstr, target.value + first_arg[1]).concat(first_arg.sexp_body(2))
         env[target_var] = exp
       elsif string? first_arg and string_interp? target
         if string? target.last
@@ -249,6 +248,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
         end
         env[target_var] = target
         return first_arg
+      elsif new_string? target
+        env[target_var] = first_arg
+        return first_arg
       elsif array? target
         target << first_arg
         env[target_var] = target
@@ -265,6 +267,10 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       unless target.nil?
         exp = target
       end
+    when :dup
+      unless target.nil?
+        exp = target
+      end
     when :join
       if array? target and target.length > 2 and (string? first_arg or first_arg.nil?)
         exp = process_array_join(target, first_arg)
@@ -602,7 +608,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     if node_type? exp, :hash
       if exp.any? { |e| node_type? e, :kwsplat and node_type? e.value, :hash }
         kwsplats, rest = exp.partition { |e| node_type? e, :kwsplat and node_type? e.value, :hash }
-        exp = Sexp.new.concat(rest).line(exp)
+        exp = Sexp.new.concat(rest).line(exp.line)
 
         kwsplats.each do |e|
           exp = process_hash_merge! exp, e.value
@@ -724,14 +730,14 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   def array_include_all_literals? exp
     call? exp and
     exp.method == :include? and
-    all_literals? exp.target
+    (all_literals? exp.target or dir_glob? exp.target)
   end
 
   def array_detect_all_literals? exp
     call? exp and
     [:detect, :find].include? exp.method and
     exp.first_arg.nil? and
-    all_literals? exp.target
+    (all_literals? exp.target or dir_glob? exp.target)
   end
 
   #Sets @inside_if = true
@@ -935,7 +941,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     args = exp.args
     exp.pop # remove last arg
     if args.length > 1
-      exp.arglist = args[1..-1]
+      exp.arglist = args.sexp_body
     end
   end
 
@@ -1194,6 +1200,13 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     call? exp and exp.method == :raise
   end
 
+  STRING_NEW = s(:call, s(:const, :String), :new)
+
+  # String.new ?
+  def new_string? exp
+    exp == STRING_NEW
+  end
+
   #Set variable to given value.
   #Creates "branched" versions of values when appropriate.
   #Avoids creating multiple branched versions inside same

data/lib/brakeman/processors/base_processor.rb

@@ -114,6 +114,8 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     exp.unshift :rlist
   end
 
+  alias process_rlist process_block
+
   #Processes the inside of an interpolated String.
   def process_evstr exp
     exp = exp.dup

data/lib/brakeman/processors/controller_processor.rb

@@ -192,8 +192,8 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
 
     filter_name = ("fake_filter" + rand.to_s[/\d+$/]).to_sym
     args = exp.block_call.arglist
-    args.insert(1, Sexp.new(:lit, filter_name))
-    before_filter_call = make_call(nil, :before_filter, args)
+    args.insert(1, Sexp.new(:lit, filter_name).line(exp.line))
+    before_filter_call = make_call(nil, :before_filter, args).line(exp.line)
 
     if exp.block_args.length > 1
       block_variable = exp.block_args[1]
@@ -202,7 +202,7 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
     end
 
     if node_type? exp.block, :block
-      block_inner = exp.block[1..-1]
+      block_inner = exp.block.sexp_body
     else
       block_inner = [exp.block]
     end
@@ -210,9 +210,9 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
     #Build Sexp for filter method
     body = Sexp.new(:lasgn,
                     block_variable,
-                    Sexp.new(:call, Sexp.new(:const, @current_class.name), :new))
+                    Sexp.new(:call, Sexp.new(:const, @current_class.name).line(exp.line), :new).line(exp.line)).line(exp.line)
 
-    filter_method = Sexp.new(:defn, filter_name, Sexp.new(:args), body).concat(block_inner).line(exp.line)
+    filter_method = Sexp.new(:defn, filter_name, Sexp.new(:args).line(exp.line), body).concat(block_inner).line(exp.line)
 
     vis = @visibility
     @visibility = :private

data/lib/brakeman/processors/gem_processor.rb

@@ -29,6 +29,14 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
     @tracker.config.set_rails_version
   end
 
+  # Known issue: Brakeman does not yet support `gem` calls with multiple
+  # "version requirements". Consider the following example from the ruby docs:
+  #
+  #     gem 'rake', '>= 1.1.a', '< 2'
+  #
+  # We are assuming that `second_arg` (eg. '>= 1.1.a') is the only requirement.
+  # Perhaps we should instantiate an array of `::Gem::Requirement`s or even a
+  # `::Gem::Dependency` and pass that to `Tracker::Config#add_gem`?
   def process_call exp
     if exp.target == nil
       if exp.method == :gem
@@ -51,8 +59,8 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
         end
       end
     elsif @inside_gemspec and exp.method == :add_dependency
-      if string? exp.first_arg and string? exp.last_arg
-        @tracker.config.add_gem exp.first_arg.value, exp.last_arg.value, @gemspec, exp.line
+      if string? exp.first_arg and string? exp.second_arg
+        @tracker.config.add_gem exp.first_arg.value, exp.second_arg.value, @gemspec, exp.line
       end
     end
 

data/lib/brakeman/processors/haml_template_processor.rb

@@ -2,8 +2,10 @@ require 'brakeman/processors/template_processor'
 
 #Processes HAML templates.
 class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
-  HAML_FORMAT_METHOD = /format_script_(true|false)_(true|false)_(true|false)_(true|false)_(true|false)_(true|false)_(true|false)/
+  HAMLOUT = s(:call, nil, :_hamlout)
+  HAML_BUFFER = s(:call, HAMLOUT, :buffer)
   HAML_HELPERS = s(:colon2, s(:const, :Haml), :Helpers)
+  HAML_HELPERS2 = s(:colon2, s(:colon3, :Haml), :Helpers)
   JAVASCRIPT_FILTER = s(:colon2, s(:colon2, s(:const, :Haml), :Filters), :Javascript)
   COFFEE_FILTER = s(:colon2, s(:colon2, s(:const, :Haml), :Filters), :Coffee)
 
@@ -14,130 +16,46 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
 
   #Processes call, looking for template output
   def process_call exp
-    target = exp.target
-    if sexp? target
-      target = process target
+    exp = process_default exp
+
+    if buffer_append? exp
+      output = normalize_output(exp.first_arg)
+      res = get_pushed_value(output)
     end
 
-    method = exp.method
-
-    if (call? target and target.method == :_hamlout)
-      res = case method
-            when :adjust_tabs, :rstrip!, :attributes #Check attributes, maybe?
-              ignore
-            when :options, :buffer
-              exp
-            when :open_tag
-              process_call_args exp
-            else
-              arg = exp.first_arg
-
-              if arg
-                @inside_concat = true
-                exp.first_arg = process(arg)
-                out = normalize_output(exp.first_arg)
-                @inside_concat = false
-              else
-                raise "Empty _hamlout.#{method}()?"
-              end
-
-              if string? out
-                ignore
-              else
-                r = case method.to_s
-                    when "push_text"
-                      build_output_from_push_text(out)
-                    when HAML_FORMAT_METHOD
-                      if $4 == "true"
-                        if string_interp? out
-                          build_output_from_push_text(out, :escaped_output)
-                        else
-                          Sexp.new :format_escaped, out
-                        end
-                      else
-                        if string_interp? out
-                          build_output_from_push_text(out)
-                        else
-                          Sexp.new :format, out
-                        end
-                      end
-
-                    else
-                      raise "Unrecognized action on _hamlout: #{method}"
-                    end
-
-                @javascript = false
-                r
-              end
-            end
-
-      res.line(exp.line)
-      res
-
-      #_hamlout.buffer <<
-      #This seems to be used rarely, but directly appends args to output buffer.
-      #Has something to do with values of blocks?
-    elsif sexp? target and method == :<< and is_buffer_target? target
-      @inside_concat = true
-      exp.first_arg = process(exp.first_arg)
-      out = normalize_output(exp.first_arg)
-      @inside_concat = false
-
-      if out.node_type == :str #ignore plain strings
-        ignore
-      else
-        add_output out
-      end
-    elsif target == nil and method == :render
-      #Process call to render()
-      exp.arglist = process exp.arglist
-      make_render_in_view exp
-    elsif target == nil and method == :find_and_preserve and exp.first_arg
-      process exp.first_arg
-    elsif method == :render_with_options
-      if target == JAVASCRIPT_FILTER or target == COFFEE_FILTER
-        @javascript = true
-      end
+    res or exp
+  end
 
-      process exp.first_arg
-    else
-      exp.target = target
-      exp.arglist = process exp.arglist
-      exp
-    end
+  # _haml_out.buffer << ...
+  def buffer_append? exp
+    call? exp and
+      exp.target == HAML_BUFFER and
+      exp.method == :<<
+  end
+
+  PRESERVE_METHODS = [:find_and_preserve, :preserve]
+
+  def find_and_preserve? exp
+    call? exp and
+      PRESERVE_METHODS.include?(exp.method) and
+      exp.first_arg
   end
 
   #If inside an output stream, only return the final expression
   def process_block exp
     exp = exp.dup
     exp.shift
-    if @inside_concat
-      @inside_concat = false
-      exp[0..-2].each do |e|
-        process e
-      end
-      @inside_concat = true
-      process exp[-1]
-    else
-      exp.map! do |e|
-        res = process e
-        if res.empty?
-          nil
-        else
-          res
-        end
+
+    exp.map! do |e|
+      res = process e
+      if res.empty?
+        nil
+      else
+        res
       end
-      Sexp.new(:rlist).concat(exp).compact
     end
-  end
 
-  #Checks if the buffer is the target in a method call Sexp.
-  #TODO: Test this
-  def is_buffer_target? exp
-    exp.node_type == :call and
-    node_type? exp.target, :lvar and
-    exp.target.value == :_hamlout and
-    exp.method == :buffer
+    Sexp.new(:rlist).concat(exp).compact
   end
 
   #HAML likes to put interpolated values into _hamlout.push_text
@@ -158,7 +76,13 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
     end
   end
 
-  #Gets outputs from values interpolated into _hamlout.push_text
+  ESCAPE_METHODS = [
+    :html_escape,
+    :html_escape_without_haml_xss,
+    :escape_once,
+    :escape_once_without_haml_xss
+  ]
+
   def get_pushed_value exp, default = :output
     return exp unless sexp? exp
 
@@ -173,24 +97,71 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
       exp
     when :str, :ignore, :output, :escaped_output
       exp
-    when :block, :rlist, :dstr
-      exp.map! { |e| get_pushed_value e }
+    when :block, :rlist
+      exp.map! { |e| get_pushed_value(e, default) }
+    when :dstr
+      build_output_from_push_text(exp, default)
     when :if
-      clauses = [get_pushed_value(exp.then_clause), get_pushed_value(exp.else_clause)].compact
+      clauses = [get_pushed_value(exp.then_clause, default), get_pushed_value(exp.else_clause, default)].compact
 
       if clauses.length > 1
-        s(:or, *clauses)
+        s(:or, *clauses).line(exp.line)
       else
         clauses.first
       end
-    else
-      if call? exp and exp.target == HAML_HELPERS and exp.method == :html_escape
-        add_escaped_output exp.first_arg
-      elsif @javascript and call? exp and (exp.method == :j or exp.method == :escape_javascript)
-        add_escaped_output exp.first_arg
+    when :call
+      if exp.method == :to_s or exp.method == :strip
+        get_pushed_value(exp.target, default)
+      elsif haml_helpers? exp.target and ESCAPE_METHODS.include? exp.method
+        get_pushed_value(exp.first_arg, :escaped_output)
+      elsif @javascript and (exp.method == :j or exp.method == :escape_javascript) # TODO: Remove - this is not safe
+        get_pushed_value(exp.first_arg, :escaped_output)
+      elsif find_and_preserve? exp or fix_textareas? exp
+        get_pushed_value(exp.first_arg, default)
+      elsif raw? exp
+        get_pushed_value(exp.first_arg, :output)
+      elsif hamlout_attributes? exp
+        ignore # ignore _hamlout.attributes calls
+      elsif exp.target.nil? and exp.method == :render
+        #Process call to render()
+        exp.arglist = process exp.arglist
+        make_render_in_view exp
+      elsif exp.method == :render_with_options
+        if exp.target == JAVASCRIPT_FILTER or exp.target == COFFEE_FILTER
+          @javascript = true
+        end
+
+        get_pushed_value(exp.first_arg, default)
+        @javascript = false
       else
         add_output exp, default
       end
+    else
+      add_output exp, default
     end
   end
+
+  def haml_helpers? exp
+    # Sometimes its Haml::Helpers and
+    # sometimes its ::Haml::Helpers
+    exp == HAML_HELPERS or
+      exp == HAML_HELPERS2
+  end
+
+  def hamlout_attributes? exp
+    call? exp and
+      exp.target == HAMLOUT and
+      exp.method == :attributes
+  end
+
+  def fix_textareas? exp
+    call? exp and
+      exp.target == HAMLOUT and
+      exp.method == :fix_textareas! 
+  end
+
+  def raw? exp
+    call? exp and
+      exp.method == :raw
+  end
 end