brakeman 4.5.1 → 4.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b421b3c9b1e3511d9f76869f86e07c04ce9267569d5d4f2d0965d8ce7303b93
-  data.tar.gz: 1189f4d043614c6624148f72b855db712c3297a51e4c87dcf12afa3a55150554
+  metadata.gz: c08fdc219a1ca48c2559791bd5ddf1053c44090bfad9e436717cb3624f43ea48
+  data.tar.gz: f99e7f2fe9a34b26120860386d5d42bfdd267ba90d70190875f5cc01bb9c5a4e
 SHA512:
-  metadata.gz: d3217750dd567855b96f0ad573f4386c07ba6540781e93da79305cc78e5dbd900a770bb7c06e068f539442b2aa6dfcf407b3be92c219cc0b139f1b11cfa4e1f5
-  data.tar.gz: 158479b5adb292bd783c817606a2bef28f114a6043e7bd906ba4ef8a6f56696028c86dfa0872e494b9a39a9b52bf8fec217ef5d463f987317eeb3bf485323e6e
+  metadata.gz: 1f936807fb350f6424bb663ab14e2024d0e28c38f30dd0d59ed78ddf3476d6e277a01c5f1f793d42ca51465fede65f2dd37e562c6f3a09caca05f9b226d12c97
+  data.tar.gz: 70f5d66778b8cdad63ff67a3abeea065c8ceb55340c0263f2d5a8ac2805916ff9b764a3e6e281060f751fe2ec0f54e6d86df447cf26f46e365249da0ce350bdd

data/CHANGES.md

@@ -1,3 +1,19 @@
+# 4.6.0
+
+* Skip calls to `dup`
+* Add reverse tabnabbing check (Linos Giannopoulos)
+* Better handling of gems with no version declared
+* Warn people that Haml 5 is not fully supported (Jared Beck)
+* Avoid warning about file access with `ActiveStorage::Filename#sanitized` (Tejas Bubane)
+* Update loofah version for fixing CVE-2018-8048 (Markus Nölle)
+* Restore `Warning#relative_path`
+* Add check for cookie serialization with Marshal
+* Index calls in initializers
+* Improve template output handling in conditional branches
+* Avoid assigning `nil` line numbers to `Sexp`s
+* Add special warning code for custom checks
+* Add call matching by regular expression
+
 # 4.5.1 
 
 * Add `Brakeman::FilePath` to represent file paths

data/README.md

@@ -1,7 +1,6 @@
 [![Brakeman Logo](http://brakemanscanner.org/images/logo_medium.png)](http://brakemanscanner.org/)
 
 [![Build Status](https://circleci.com/gh/presidentbeef/brakeman.svg?style=svg)](https://circleci.com/gh/presidentbeef/brakeman)
-[![Maintainability](https://api.codeclimate.com/v1/badges/1b08a5c74695cb0d11ec/maintainability)](https://codeclimate.com/github/presidentbeef/brakeman/maintainability)
 [![Test Coverage](https://api.codeclimate.com/v1/badges/1b08a5c74695cb0d11ec/test_coverage)](https://codeclimate.com/github/presidentbeef/brakeman/test_coverage)
 [![Gitter](https://badges.gitter.im/presidentbeef/brakeman.svg)](https://gitter.im/presidentbeef/brakeman)
 

data/bundle/load.rb

@@ -1,14 +1,14 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/ruby2ruby-2.4.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/haml-4.0.7/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/slim-4.0.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/ruby_parser-3.13.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/temple-0.8.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/highline-2.0.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/sexp_processor-4.12.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/ruby_parser-legacy-1.0.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/unicode-display_width-1.6.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/tilt-2.0.9/lib"
-$:.unshift "#{path}/bundle/ruby/2.5.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/haml-4.0.7/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/slim-4.0.1/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/ruby_parser-3.13.1/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/temple-0.8.1/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/sexp_processor-4.12.1/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/ruby2ruby-2.4.3/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/terminal-table-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/highline-2.0.2/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/ruby_parser-legacy-1.0.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/unicode-display_width-1.6.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/tilt-2.0.9/lib"
+$:.unshift "#{path}/bundle/ruby/2.6.0/gems/safe_yaml-1.0.5/lib"

data/bundle/ruby/{2.5.0/gems/ruby2ruby-2.4.2 → 2.6.0/gems/ruby2ruby-2.4.3}/History.rdoc

@@ -1,10 +1,18 @@
-=== 4.12.0 / 2019-03-12
+=== 2.4.3 / 2019-06-03
 
-* 3 bug fixes:
+* 4 bug fixes:
+
+  * Added shadow block args. (jaynetics)
+  * Fixed generation for block args w/ trailing commas.
+  * Fixed nested masgn block args and arrays. (jaynetics)
+  * Fixes for stabby proc / lambda changes.
+
+=== 2.4.2 / 2019-03-12
+
+* 2 bug fixes:
 
-  * Fixed sexp_body to return empty sexp instead of nil when using STRICT_SEXP.
-  * STRICT_SEXP=4+ fails w/ current use of concat. Removed concat from strictness for now.
-  * Use concat internally instead of splat. Some people have 20000 node sexps! (presidentbeef)
+  * Rewrote process_masgn to fix problems with nesting masgn in block args.
+  * Use RubyParser directly instead of versioned parsers.
 
 === 2.4.1 / 2018-02-15
 

data/bundle/ruby/{2.5.0/gems/ruby2ruby-2.4.2 → 2.6.0/gems/ruby2ruby-2.4.3}/lib/ruby2ruby.rb

@@ -1,7 +1,7 @@
 #!/usr/bin/env ruby -w
 
-require 'rubygems'
-require 'sexp_processor'
+require "rubygems"
+require "sexp_processor"
 
 # :stopdoc:
 # REFACTOR: stolen from ruby_parser
@@ -15,13 +15,13 @@ class Regexp
 
   unless defined? CODES then
     CODES = {
-      EXTENDED   => 'x',
-      IGNORECASE => 'i',
-      MULTILINE  => 'm',
-      ENC_NONE   => 'n',
-      ENC_EUC    => 'e',
-      ENC_SJIS   => 's',
-      ENC_UTF8   => 'u',
+      EXTENDED   => "x",
+      IGNORECASE => "i",
+      MULTILINE  => "m",
+      ENC_NONE   => "n",
+      ENC_EUC    => "e",
+      ENC_SJIS   => "s",
+      ENC_UTF8   => "u",
     }
   end
 end
@@ -31,13 +31,13 @@ end
 # Generate ruby code from a sexp.
 
 class Ruby2Ruby < SexpProcessor
-  VERSION = "2.4.2" # :nodoc:
+  VERSION = "2.4.3" # :nodoc:
 
   # cutoff for one-liners
   LINE_LENGTH = 78
 
   # binary operation messages
-  BINARY = [:<=>, :==, :<, :>, :<=, :>=, :-, :+, :*, :/, :%, :<<, :>>, :**, :'!=', :^, :|, :&]
+  BINARY = [:<=>, :==, :<, :>, :<=, :>=, :-, :+, :*, :/, :%, :<<, :>>, :**, :"!=", :^, :|, :&]
 
   ##
   # Nodes that represent assignment and probably need () around them.
@@ -76,7 +76,7 @@ class Ruby2Ruby < SexpProcessor
     :lvar,
     :nil,
     :str,
-    :true
+    :true,
   ]
 
   def initialize # :nodoc:
@@ -118,6 +118,8 @@ class Ruby2Ruby < SexpProcessor
   def process_args exp # :nodoc:
     _, *args = exp
 
+    shadow = []
+
     args = args.map { |arg|
       case arg
       when Symbol then
@@ -131,15 +133,24 @@ class Ruby2Ruby < SexpProcessor
         when :kwarg then
           _, k, v = arg
           "#{k}: #{process v}"
+        when :shadow then
+          shadow << arg[1]
+          next
         else
           raise "unknown arg type #{arg.first.inspect}"
         end
+      when nil then
+        ""
       else
         raise "unknown arg type #{arg.inspect}"
       end
-    }
+    }.compact
+
+    args   = args.join(", ").strip
+    shadow = shadow.join(", ").strip
+    shadow = "; #{shadow}" unless shadow.empty?
 
-    "(#{args.join ', '})"
+    "(%s%s)" % [args, shadow]
   end
 
   def process_array exp # :nodoc:
@@ -180,7 +191,7 @@ class Ruby2Ruby < SexpProcessor
 
     code = rest.map { |sexp|
       src = process sexp
-      src = indent src unless src =~  /(^|\n)(rescue|ensure)/ # ensure no level 0 rescues
+      src = indent src unless src =~ /(^|\n)(rescue|ensure)/ # ensure no level 0 rescues
       src
     }
     code.unshift "begin"
@@ -238,7 +249,7 @@ class Ruby2Ruby < SexpProcessor
     @calls.push name
 
     in_context :arglist do
-      max = args.size-1
+      max = args.size - 1
       args = args.map.with_index { |arg, i|
         arg_type = arg.sexp_type
         is_empty_hash = arg == s(:hash)
@@ -249,7 +260,7 @@ class Ruby2Ruby < SexpProcessor
         strip_hash = (arg_type == :hash and
                       not BINARY.include? name and
                       not is_empty_hash and
-                      (i == max or args[i+1].sexp_type == :splat))
+                      (i == max or args[i + 1].sexp_type == :splat))
         wrap_arg = Ruby2Ruby::ASSIGN_NODES.include? arg_type
 
         arg = arg[2..-3] if strip_hash
@@ -262,19 +273,19 @@ class Ruby2Ruby < SexpProcessor
     case name
     when *BINARY then
       if safe_call
-        "#{receiver}&.#{name}(#{args.join(', ')})"
+        "#{receiver}&.#{name}(#{args.join(", ")})"
       elsif args.length > 1
-        "#{receiver}.#{name}(#{args.join(', ')})"
+        "#{receiver}.#{name}(#{args.join(", ")})"
       else
-        "(#{receiver} #{name} #{args.join(', ')})"
+        "(#{receiver} #{name} #{args.join(", ")})"
       end
     when :[] then
       receiver ||= "self"
-      "#{receiver}[#{args.join(', ')}]"
+      "#{receiver}[#{args.join(", ")}]"
     when :[]= then
       receiver ||= "self"
       rhs = args.pop
-      "#{receiver}[#{args.join(', ')}] = #{rhs}"
+      "#{receiver}[#{args.join(", ")}] = #{rhs}"
     when :"!" then
       "(not #{receiver})"
     when :"-@" then
@@ -283,7 +294,7 @@ class Ruby2Ruby < SexpProcessor
       "+#{receiver}"
     else
       args     = nil                    if args.empty?
-      args     = "(#{args.join(', ')})" if args
+      args     = "(#{args.join(", ")})" if args
       receiver = "#{receiver}."         if receiver and not safe_call
       receiver = "#{receiver}&."        if receiver and safe_call
 
@@ -304,11 +315,11 @@ class Ruby2Ruby < SexpProcessor
 
     expr = process expr
 
-    if expr then
-      result << "case #{expr}"
-    else
-      result << "case"
-    end
+    result << if expr then
+                "case #{expr}"
+              else
+                "case"
+              end
 
     result.concat rest.map { |pt|
       if pt and pt.sexp_type == :when
@@ -416,7 +427,7 @@ class Ruby2Ruby < SexpProcessor
       simple && body =~ /^\Abegin/ && body =~ /^end\z/
     body = indent(body) unless simple && body =~ /(^|\n)rescue/
 
-    return "#{comm}def #{name}#{args}\n#{body}\nend".gsub(/\n\s*\n+/, "\n")
+    "#{comm}def #{name}#{args}\n#{body}\nend".gsub(/\n\s*\n+/, "\n")
   end
 
   def process_defs exp # :nodoc:
@@ -475,10 +486,10 @@ class Ruby2Ruby < SexpProcessor
     ens  = process(ens) || "# do nothing"
     ens = "begin\n#{ens}\nend\n" if ens =~ /(^|\n)rescue/
 
-    body.sub!(/\n\s*end\z/, '')
+    body.sub!(/\n\s*end\z/, "")
     body = indent(body) unless body =~ /(^|\n)rescue/
 
-    return "#{body}\nensure\n#{indent ens}"
+    "#{body}\nensure\n#{indent ens}"
   end
 
   def process_evstr exp # :nodoc:
@@ -530,8 +541,6 @@ class Ruby2Ruby < SexpProcessor
   def process_hash(exp) # :nodoc:
     _, *pairs = exp
 
-    result = []
-
     result = pairs.each_slice(2).map { |k, v|
       if k.sexp_type == :kwsplat then
         "%s" % process(k)
@@ -546,7 +555,7 @@ class Ruby2Ruby < SexpProcessor
       end
     }
 
-    return result.empty? ? "{}" : "{ #{result.join(', ')} }"
+    result.empty? ? "{}" : "{ #{result.join(", ")} }"
   end
 
   def process_iasgn(exp) # :nodoc:
@@ -577,7 +586,7 @@ class Ruby2Ruby < SexpProcessor
         else
           r = "#{t} if #{c}"
         end
-        return r if r and (@indent+r).size < LINE_LENGTH and r !~ /\n/
+        return r if r and (@indent + r).size < LINE_LENGTH and r !~ /\n/
       end
 
       r = "if #{c} then\n#{indent(t)}\n"
@@ -588,52 +597,74 @@ class Ruby2Ruby < SexpProcessor
     elsif f
       unless expand then
         r = "#{f} unless #{c}"
-        return r if (@indent+r).size < LINE_LENGTH and r !~ /\n/
+        return r if (@indent + r).size < LINE_LENGTH and r !~ /\n/
       end
       "unless #{c} then\n#{indent(f)}\nend"
     else
       # empty if statement, just do it in case of side effects from condition
-      "if #{c} then\n#{indent '# do nothing'}\nend"
+      "if #{c} then\n#{indent "# do nothing"}\nend"
     end
   end
 
+  def process_lambda exp # :nodoc:
+    "->"
+  end
+
   def process_iter(exp) # :nodoc:
     _, iter, args, body = exp
 
+    is_lambda = iter.sexp_type == :lambda
+
     iter = process iter
     body = process body if body
 
-    args = case args
-           when 0 then
+    args = case
+           when args == 0 then
              ""
+           when is_lambda then
+             " (#{process(args)[1..-2]})"
            else
              " |#{process(args)[1..-2]}|"
            end
 
     b, e = if iter == "END" then
-             [ "{", "}" ]
+             %w[ { } ]
            else
-             [ "do", "end" ]
+             %w[ do end ]
            end
 
-    iter.sub!(/\(\)$/, '')
+    iter.sub!(/\(\)$/, "")
 
     # REFACTOR: ugh
     result = []
-    result << "#{iter} {"
-    result << args
-    if body then
-      result << " #{body.strip} "
+    if is_lambda then
+      result << iter
+      result << args
+      result << " {"
     else
-      result << ' '
+      result << "#{iter} {"
+      result << args
     end
+    result << if body then
+                " #{body.strip} "
+              else
+                " "
+              end
     result << "}"
     result = result.join
     return result if result !~ /\n/ and result.size < LINE_LENGTH
 
     result = []
-    result << "#{iter} #{b}"
-    result << args
+
+    if is_lambda then
+      result << iter
+      result << args
+      result << " #{b}"
+    else
+      result << "#{iter} #{b}"
+      result << args
+    end
+
     result << "\n"
     if body then
       result << indent(body.strip)
@@ -677,43 +708,28 @@ class Ruby2Ruby < SexpProcessor
   end
 
   def process_masgn(exp) # :nodoc:
-    _, (type, *), * = exp # ugly, but STRICT_SEXP=1+ requires this
-
-    if type == :array then
-      _, lhs, rhs = exp
-
-      case exp.length
-      when 3 then               # a, b = c, d
-        lhs = lhs.sexp_body.map { |e|
-          process e
-        }
-
-        rhs = case rhs && rhs.sexp_type
-              when :array then  # a, b = [c, d]
-                process(rhs)[1..-2]
-              else              # a, b = c
-                process rhs
-              end
-        "%s = %s" % [lhs.join(", "), rhs]
-      when 2 then               # a, (b, c) = ...
-        "(%s)" % [process(lhs)[1..-2]]
-      else
-        raise "unknown masgn length: %p" % [exp]
-      end
-    else                        # a { |(b, c)| ... }
-      lhs = exp.sexp_body.map { |e|
-        case e
-        when Symbol then
-          e
-        when Sexp then
-          process e
+    # s(:masgn, s(:array, s(:lasgn, :var), ...), s(:to_ary, <val>, ...))
+    # s(:iter, <call>, s(:args, s(:masgn, :a, :b)), <body>)
+    parenthesize = true
+
+    result = exp.sexp_body.map { |sexp|
+      case sexp
+      when Sexp then
+        if sexp.sexp_type == :array then
+          parenthesize = context.grep(:masgn).size > 1
+          res = process sexp
+
+          res[1..-2]
         else
-          raise "unknown masgn type: %p" % [e]
+          process sexp
         end
-      }
-
-      "(%s)" % [lhs.join(", ")]
-    end
+      when Symbol then
+        sexp
+      else
+        raise "unknown masgn: #{sexp.inspect}"
+      end
+    }
+    parenthesize ? "(#{result.join ", "})" : result.join(" = ")
   end
 
   def process_match exp # :nodoc:
@@ -811,14 +827,14 @@ class Ruby2Ruby < SexpProcessor
     # a &&= 1
     # [[:lvar, :a], [:lasgn, :a, [:lit, 1]]]
     _, _lhs, rhs = exp
-    process(rhs).sub(/\=/, '&&=')
+    process(rhs).sub(/\=/, "&&=")
   end
 
   def process_op_asgn_or(exp) # :nodoc:
     # a ||= 1
     # [[:lvar, :a], [:lasgn, :a, [:lit, 1]]]
     _, _lhs, rhs = exp
-    process(rhs).sub(/\=/, '||=')
+    process(rhs).sub(/\=/, "||=")
   end
 
   def process_or(exp) # :nodoc:
@@ -856,10 +872,9 @@ class Ruby2Ruby < SexpProcessor
 
   def process_rescue exp # :nodoc:
     _, *rest = exp
-    exp = nil
 
     body = process rest.shift unless rest.first.sexp_type == :resbody
-    els  = process rest.pop   unless rest.last && rest.last.sexp_type  == :resbody
+    els  = process rest.pop   unless rest.last && rest.last.sexp_type == :resbody
 
     body ||= "# do nothing"
 
@@ -878,7 +893,7 @@ class Ruby2Ruby < SexpProcessor
     if els then
       "#{indent body}\n#{resbodies.join("\n")}\nelse\n#{indent els}"
     elsif simple then
-      resbody = resbodies.first.sub(/\n\s*/, ' ')
+      resbody = resbodies.first.sub(/\n\s*/, " ")
       "#{body} #{resbody}"
     else
       "#{indent body}\n#{resbodies.join("\n")}"
@@ -911,7 +926,7 @@ class Ruby2Ruby < SexpProcessor
 
     raise "dunno what to do: #{args.inspect}" if args
 
-    name = name.to_s.sub(/=$/, '')
+    name = name.to_s.sub(/=$/, "")
 
     if rhs && rhs != s(:arglist) then
       "#{receiver}&.#{name} = #{process rhs}"
@@ -1004,7 +1019,7 @@ class Ruby2Ruby < SexpProcessor
   end
 
   def process_until(exp) # :nodoc:
-    cond_loop(exp, 'until')
+    cond_loop(exp, "until")
   end
 
   def process_valias exp # :nodoc:
@@ -1048,7 +1063,7 @@ class Ruby2Ruby < SexpProcessor
     }
 
     unless args.empty? then
-      "yield(#{args.join(', ')})"
+      "yield(#{args.join(", ")})"
     else
       "yield"
     end
@@ -1209,7 +1224,7 @@ class Ruby2Ruby < SexpProcessor
   # Wrap appropriate expressions in matching parens.
 
   def parenthesize exp
-    case self.context[1]
+    case context[1]
     when nil, :defn, :defs, :class, :sclass, :if, :iter, :resbody, :when, :while then
       exp
     else
@@ -1243,18 +1258,13 @@ class Ruby2Ruby < SexpProcessor
     str = dthing_escape(type, str)
 
     rest = rest.map { |pt|
-      case pt
-      when Sexp then # TODO: what the fuck? why??
-        case pt.sexp_type
-        when :str then
-          dthing_escape(type, pt.last)
-        when :evstr then
-          '#{%s}' % [process(pt)]
-        else
-          raise "unknown type: #{pt.inspect}"
-        end
+      case pt.sexp_type
+      when :str then
+        dthing_escape(type, pt.last)
+      when :evstr then
+        '#{%s}' % [process(pt)]
       else
-        raise "unhandled value in d-thing: #{pt.inspect}"
+        raise "unknown type: #{pt.inspect}"
       end
     }
 
@@ -1264,7 +1274,7 @@ class Ruby2Ruby < SexpProcessor
   ##
   # Utility method to generate ether a module or class.
 
-  def util_module_or_class(exp, is_class=false)
+  def util_module_or_class exp, is_class = false
     result = []
 
     _, name, *body = exp
@@ -1285,11 +1295,11 @@ class Ruby2Ruby < SexpProcessor
       process(sexp).chomp
     }
 
-    unless body.empty? then
-      body = indent(body.join("\n\n")) + "\n"
-    else
-      body = ""
-    end
+    body = unless body.empty? then
+             indent(body.join("\n\n")) + "\n"
+           else
+             ""
+           end
 
     result << body
     result << "end"