brakeman 4.5.1 → 5.4.0

data/lib/brakeman/scanner.rb

@@ -7,6 +7,7 @@ begin
   require 'brakeman/app_tree'
   require 'brakeman/file_parser'
   require 'brakeman/parsers/template_parser'
+  require 'brakeman/processors/lib/file_type_detector'
 rescue LoadError => e
   $stderr.puts e.message
   $stderr.puts "Please install the appropriate dependency."
@@ -23,7 +24,10 @@ class Brakeman::Scanner
     @app_tree = Brakeman::AppTree.from_options(options)
 
     if (!@app_tree.root || !@app_tree.exists?("app")) && !options[:force_scan]
-      raise Brakeman::NoApplication, "Please supply the path to a Rails application (looking in #{@app_tree.root})."
+      message = "Please supply the path to a Rails application (looking in #{@app_tree.root}).\n" <<
+                "  Use `--force` to run a scan anyway."
+
+      raise Brakeman::NoApplication, message
     end
 
     @processor = processor || Brakeman::Processor.new(@app_tree, options)
@@ -36,69 +40,92 @@ class Brakeman::Scanner
 
   #Process everything in the Rails application
   def process
-    Brakeman.notify "Processing gems..."
+    Brakeman.notify "Processing gems...                    "
     process_gems
     guess_rails_version
-    Brakeman.notify "Processing configuration..."
+    Brakeman.notify "Processing configuration...           "
     process_config
-    Brakeman.notify "Parsing files..."
+    Brakeman.notify "Parsing files...                      "
     parse_files
-    Brakeman.notify "Processing initializers..."
+    Brakeman.notify "Detecting file types...               "
+    detect_file_types
+    Brakeman.notify "Processing initializers...            "
     process_initializers
-    Brakeman.notify "Processing libs..."
+    Brakeman.notify "Processing libs...                    "
     process_libs
-    Brakeman.notify "Processing routes...          "
+    Brakeman.notify "Processing routes...                  "
     process_routes
-    Brakeman.notify "Processing templates...       "
+    Brakeman.notify "Processing templates...               "
     process_templates
-    Brakeman.notify "Processing data flow in templates..."
+    Brakeman.notify "Processing data flow in templates...  "
     process_template_data_flows
-    Brakeman.notify "Processing models...          "
+    Brakeman.notify "Processing models...                  "
     process_models
-    Brakeman.notify "Processing controllers...     "
+    Brakeman.notify "Processing controllers...             "
     process_controllers
     Brakeman.notify "Processing data flow in controllers..."
     process_controller_data_flows
-    Brakeman.notify "Indexing call sites...        "
+    Brakeman.notify "Indexing call sites...                "
     index_call_sites
     tracker
   end
 
   def parse_files
-    fp = Brakeman::FileParser.new tracker
+    fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout], tracker.options[:parallel_checks])
 
-    files = {
-      :initializers => @app_tree.initializer_paths,
-      :controllers => @app_tree.controller_paths,
-      :models => @app_tree.model_paths
-    }
-
-    unless options[:skip_libs]
-      files[:libs] = @app_tree.lib_paths
-    end
-
-    files.each do |name, paths|
-      fp.parse_files paths, name
-    end
+    fp.parse_files tracker.app_tree.ruby_file_paths
 
     template_parser = Brakeman::TemplateParser.new(tracker, fp)
 
-    fp.read_files(@app_tree.template_paths, :templates) do |path, contents|
+    fp.read_files(@app_tree.template_paths) do |path, contents|
       template_parser.parse_template path, contents
     end
 
-    @file_list = fp.file_list
+    # Collect errors raised during parsing
+    tracker.add_errors(fp.errors)
+
+    @parsed_files = fp.file_list
+  end
+
+  def detect_file_types
+    @file_list = {
+      controllers: [],
+      initializers: [],
+      libs: [],
+      models: [],
+      templates: [],
+    }
+
+    detector = Brakeman::FileTypeDetector.new
+
+    @parsed_files.each do |file|
+      if file.is_a? Brakeman::TemplateParser::TemplateFile
+        @file_list[:templates] << file
+      else
+        type = detector.detect_type(file)
+        unless type == :skip
+          if @file_list[type].nil?
+            raise type.to_s
+          else
+            @file_list[type] << file
+          end
+        end
+      end
+    end
   end
 
   #Process config/environment.rb and config/gems.rb
   #
   #Stores parsed information in tracker.config
   def process_config
+    # Sometimes folks like to put constants in environment.rb
+    # so let's always process it even for newer Rails versions
+    process_config_file "environment.rb"
+
     if options[:rails3] or options[:rails4] or options[:rails5] or options[:rails6]
       process_config_file "application.rb"
       process_config_file "environments/production.rb"
     else
-      process_config_file "environment.rb"
       process_config_file "gems.rb"
     end
 
@@ -110,8 +137,12 @@ class Brakeman::Scanner
     end
 
     if @app_tree.exists? ".ruby-version"
-      tracker.config.set_ruby_version @app_tree.file_path(".ruby-version").read
+      if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/]
+        tracker.config.set_ruby_version version
+      end
     end
+
+    tracker.config.load_rails_defaults
   end
 
   def process_config_file file
@@ -322,8 +353,11 @@ class Brakeman::Scanner
   end
 
   def parse_ruby_file file
-    fp = Brakeman::FileParser.new(self.tracker)
+    fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
     fp.parse_ruby(file.read, file)
+  rescue Exception => e
+    tracker.error(e)
+    nil
   end
 end
 

data/lib/brakeman/tracker/collection.rb

@@ -1,4 +1,5 @@
 require 'brakeman/util'
+require 'brakeman/tracker/method_info'
 
 module Brakeman
   class Collection
@@ -13,6 +14,8 @@ module Brakeman
       @src = {}
       @includes = []
       @methods = { :public => {}, :private => {}, :protected => {} }
+      @class_methods = {}
+      @simple_methods = { :class => {}, instance: {} }
       @options = {}
       @tracker = tracker
 
@@ -22,7 +25,7 @@ module Brakeman
     def ancestor? parent, seen={}
       seen[self.name] = true
 
-      if self.parent == parent or seen[self.parent]
+      if self.parent == parent or self.name == parent or seen[self.parent]
         true
       elsif parent_model = collection[self.parent]
         parent_model.ancestor? parent, seen
@@ -37,7 +40,7 @@ module Brakeman
     end
 
     def add_include class_name
-      @includes << class_name
+      @includes << class_name unless ancestor?(class_name)
     end
 
     def add_option name, exp
@@ -46,11 +49,17 @@ module Brakeman
     end
 
     def add_method visibility, name, src, file_name
+      meth_info = Brakeman::MethodInfo.new(name, src, self, file_name)
+      add_simple_method_maybe meth_info
+
       if src.node_type == :defs
+        @class_methods[name] = meth_info
+
+        # TODO fix this weirdness
         name = :"#{src[1]}.#{name}"
       end
 
-      @methods[visibility][name] = { :src => src, :file => file_name }
+      @methods[visibility][name] = meth_info
     end
 
     def each_method
@@ -61,16 +70,31 @@ module Brakeman
       end
     end
 
-    def get_method name
-      each_method do |n, info|
-        if n == name
-          return info
+    def get_method name, type = :instance
+      case type
+      when :class
+        get_class_method name
+      when :instance
+        get_instance_method name
+      else
+        raise "Unexpected method type: #{type.inspect}"
+      end
+    end
+
+    def get_instance_method name
+      @methods.each do |_vis, meths|
+        if meths[name]
+          return meths[name]
         end
       end
 
       nil
     end
 
+    def get_class_method name
+      @class_methods[name]
+    end
+
     def file
       @files.first
     end
@@ -90,5 +114,31 @@ module Brakeman
     def methods_public
       @methods[:public]
     end
+
+    def get_simple_method_return_value type, name
+      @simple_methods[type][name]
+    end
+
+    private
+
+    def add_simple_method_maybe meth_info
+      if meth_info.very_simple_method?
+        add_simple_method meth_info
+      end
+    end
+
+    def add_simple_method meth_info
+      name = meth_info.name
+      value = meth_info.return_value
+
+      case meth_info.src.node_type
+      when :defn
+        @simple_methods[:instance][name] = value
+      when :defs
+        @simple_methods[:class][name] = value
+      else
+        raise "Expected sexp type: #{src.node_type}"
+      end
+    end
   end
 end

data/lib/brakeman/tracker/config.rb

@@ -4,10 +4,8 @@ module Brakeman
   class Config
     include Util
 
-    attr_reader :rails, :tracker
-    attr_accessor :rails_version, :ruby_version
+    attr_reader :gems, :rails, :ruby_version, :tracker
     attr_writer :erubis, :escape_html
-    attr_reader :gems
 
     def initialize tracker
       @tracker = tracker
@@ -16,19 +14,13 @@ module Brakeman
       @settings = {}
       @escape_html = nil
       @erubis = nil
-      @ruby_version = ""
-    end
-
-    def allow_forgery_protection?
-      @rails[:action_controller] and
-        @rails[:action_controller][:allow_forgery_protection] == Sexp.new(:false)
+      @ruby_version = nil
+      @rails_version = nil
     end
 
     def default_protect_from_forgery?
-      if version_between? "5.2.0", "9.9.9"
-        if @rails[:action_controller] and
-            @rails[:action_controller][:default_protect_from_forgery] == Sexp.new(:false)
-
+      if version_between? "5.2.0.beta1", "9.9.9"
+        if @rails.dig(:action_controller, :default_protect_from_forgery) == Sexp.new(:false)
           return false
         else
           return true
@@ -48,17 +40,21 @@ module Brakeman
 
     def escape_html_entities_in_json?
       #TODO add version-specific information here
-      @rails[:active_support] and
-        true? @rails[:active_support][:escape_html_entities_in_json]
+      true? @rails.dig(:active_support, :escape_html_entities_in_json)
+    end
+
+    def escape_filter_interpolations?
+      # TODO see if app is actually turning this off itself
+      has_gem?(:haml) and
+        version_between? "5.0.0", "5.99", gem_version(:haml)
     end
 
     def whitelist_attributes?
-      @rails[:active_record] and
-        @rails[:active_record][:whitelist_attributes] == Sexp.new(:true)
+      @rails.dig(:active_record, :whitelist_attributes) == Sexp.new(:true)
     end
 
     def gem_version name
-      @gems[name] and @gems[name][:version]
+      extract_version @gems.dig(name.to_sym, :version)
     end
 
     def add_gem name, version, file, line
@@ -71,18 +67,25 @@ module Brakeman
     end
 
     def has_gem? name
-      !!@gems[name]
+      !!@gems[name.to_sym]
     end
 
     def get_gem name
-      @gems[name]
+      @gems[name.to_sym]
     end
 
-    def set_rails_version
-      # Ignore ~>, etc. when using values from Gemfile
-      version = gem_version(:rails) || gem_version(:railties)
-      if version and version.match(/(\d+\.\d+(\.\d+.*)?)/)
-        @rails_version = $1
+    def set_rails_version version = nil
+      version = if version
+                  # Only used by Rails2ConfigProcessor right now
+                  extract_version(version)
+                else
+                  gem_version(:rails) ||
+                    gem_version(:railties) ||
+                    gem_version(:activerecord)
+                end
+
+      if version
+        @rails_version = version
 
         if tracker.options[:rails3].nil? and tracker.options[:rails4].nil?
           if @rails_version.start_with? "3"
@@ -103,6 +106,13 @@ module Brakeman
             tracker.options[:rails5] = true
             tracker.options[:rails6] = true
             Brakeman.notify "[Notice] Detected Rails 6 application"
+          elsif @rails_version.start_with? "7"
+            tracker.options[:rails3] = true
+            tracker.options[:rails4] = true
+            tracker.options[:rails5] = true
+            tracker.options[:rails6] = true
+            tracker.options[:rails7] = true
+            Brakeman.notify "[Notice] Detected Rails 7 application"
           end
         end
       end
@@ -113,12 +123,20 @@ module Brakeman
       end
     end
 
+    def rails_version
+      # This needs to be here because Util#rails_version calls Tracker::Config#rails_version
+      # but Tracker::Config includes Util...
+      @rails_version
+    end
+
     def set_ruby_version version
+      @ruby_version = extract_version(version)
+    end
+
+    def extract_version version
       return unless version.is_a? String
 
-      if version =~ /(\d+\.\d+\.\d+)/
-        self.ruby_version = $1
-      end
+      version[/\d+\.\d+(\.\d+.*)?/]
     end
 
     #Returns true if low_version <= RAILS_VERSION <= high_version
@@ -128,57 +146,89 @@ module Brakeman
       current_version ||= rails_version
       return false unless current_version
 
-      version = current_version.split(".").map! { |v| convert_version_number v }
-      low_version = low_version.split(".").map! { |v| convert_version_number v }
-      high_version = high_version.split(".").map! { |v| convert_version_number v }
+      low = Gem::Version.new(low_version)
+      high = Gem::Version.new(high_version)
+      current = Gem::Version.new(current_version)
 
-      version.each_with_index do |v, i|
-        if lower? v, low_version.fetch(i, 0)
-          return false
-        elsif higher? v, low_version.fetch(i, 0)
-          break
-        end
-      end
+      current.between?(low, high)
+    end
 
-      version.each_with_index do |v, i|
-        if higher? v, high_version.fetch(i, 0)
-          return false
-        elsif lower? v, high_version.fetch(i, 0)
-          break
+    def session_settings
+      @rails.dig(:action_controller, :session)
+    end
+
+
+    # Set Rails config option value
+    # where path is an array of attributes, e.g.
+    #
+    #   :action_controller, :perform_caching
+    #
+    # then this will set
+    #
+    #   rails[:action_controller][:perform_caching] = value
+    def set_rails_config value:, path:, overwrite: false
+      config = self.rails
+
+      path[0..-2].each do |o|
+        config[o] ||= {}
+
+        option = config[o]
+
+        if not option.is_a? Hash
+          Brakeman.debug "[Notice] Skipping config setting: #{path.map(&:to_s).join(".")}"
+          return
         end
+
+        config = option
       end
 
-      true
+      if overwrite || config[path.last].nil?
+        config[path.last] = value
+      end
     end
 
-    def session_settings
-      @rails[:action_controller] &&
-        @rails[:action_controller][:session]
-    end
+    # Load defaults based on config.load_defaults value
+    # as documented here: https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults
+    def load_rails_defaults
+      return unless number? tracker.config.rails[:load_defaults]
 
-    private
+      version = tracker.config.rails[:load_defaults].value
+      true_value = Sexp.new(:true)
+      false_value = Sexp.new(:false)
 
-    def convert_version_number value
-      if value.match(/\A\d+\z/)
-        value.to_i
-      else
-        value
+      if version >= 5.0
+        set_rails_config(value: true_value, path: [:action_controller, :per_form_csrf_tokens])
+        set_rails_config(value: true_value, path: [:action_controller, :forgery_protection_origin_check])
+        set_rails_config(value: true_value, path: [:active_record, :belongs_to_required_by_default])
+        # Note: this may need to be changed, because ssl_options is a Hash
+        set_rails_config(value: true_value, path: [:ssl_options, :hsts, :subdomains])
       end
-    end
 
-    def lower? lhs, rhs
-      if lhs.class == rhs.class
-        lhs < rhs
-      else
-        false
+      if version >= 5.1
+        set_rails_config(value: false_value, path: [:assets, :unknown_asset_fallback])
+        set_rails_config(value: true_value, path: [:action_view, :form_with_generates_remote_forms])
+      end
+
+      if version >= 5.2
+        set_rails_config(value: true_value, path: [:active_record, :cache_versioning])
+        set_rails_config(value: true_value, path: [:action_dispatch, :use_authenticated_cookie_encryption])
+        set_rails_config(value: true_value, path: [:active_support, :use_authenticated_message_encryption])
+        set_rails_config(value: true_value, path: [:active_support, :use_sha1_digests])
+        set_rails_config(value: true_value, path: [:action_controller, :default_protect_from_forgery])
+        set_rails_config(value: true_value, path: [:action_view, :form_with_generates_ids])
       end
-    end
 
-    def higher? lhs, rhs
-      if lhs.class == rhs.class
-        lhs > rhs
-      else
-        false
+      if version >= 6.0
+        set_rails_config(value: Sexp.new(:lit, :zeitwerk), path: [:autoloader])
+        set_rails_config(value: false_value, path: [:action_view, :default_enforce_utf8])
+        set_rails_config(value: true_value, path: [:action_dispatch, :use_cookies_with_metadata])
+        set_rails_config(value: false_value, path: [:action_dispatch, :return_only_media_type_on_content_type])
+        set_rails_config(value: Sexp.new(:str, 'ActionMailer::MailDeliveryJob'), path: [:action_mailer, :delivery_job])
+        set_rails_config(value: true_value, path: [:active_job, :return_false_on_aborted_enqueue])
+        set_rails_config(value: Sexp.new(:lit, :active_storage_analysis), path: [:active_storage, :queues, :analysis])
+        set_rails_config(value: Sexp.new(:lit, :active_storage_purge), path: [:active_storage, :queues, :purge])
+        set_rails_config(value: true_value, path: [:active_storage, :replace_on_assign_to_many])
+        set_rails_config(value: true_value, path: [:active_record, :collection_cache_versioning])
       end
     end
   end

data/lib/brakeman/tracker/constants.rb

@@ -1,7 +1,10 @@
 require 'brakeman/processors/output_processor'
+require 'brakeman/util'
 
 module Brakeman
   class Constant
+    include Brakeman::Util
+
     attr_reader :name, :name_array, :file, :value, :context
 
     def initialize name, value, context = {}
@@ -49,7 +52,7 @@ module Brakeman
     include Brakeman::Util
 
     def initialize
-      @constants = Hash.new { |h, k| h[k] = [] }
+      @constants = {}
     end
 
     def size
@@ -103,16 +106,15 @@ module Brakeman
       end
 
       base_name = Constants.get_constant_base_name(name)
+      @constants[base_name] ||= []
       @constants[base_name] << Constant.new(name, value, context)
     end
 
-    LITERALS = [:lit, :false, :str, :true, :array, :hash]
-    def literal? exp
-      exp.is_a? Sexp and LITERALS.include? exp.node_type
-    end
-
-    def get_literal name
-      if x = self[name] and literal? x
+    # Returns constant values that are not too complicated.
+    # Right now that means literal values (string, array, etc.)
+    # or calls on Dir.glob(..).whatever.
+    def get_simple_value name
+      if x = self[name] and (literal? x or dir_glob? x)
         x
       else
         nil

data/lib/brakeman/tracker/controller.rb

@@ -125,7 +125,7 @@ module Brakeman
         value = args[-1][2]
         case value.node_type
         when :array
-          filter[option] = value[1..-1].map {|v| v[1] }
+          filter[option] = value.sexp_body.map {|v| v[1] }
         when :lit, :str
           filter[option] = value[1]
         else

data/lib/brakeman/tracker/method_info.rb

@@ -0,0 +1,70 @@
+require 'brakeman/util'
+
+module Brakeman
+  class MethodInfo
+    include Brakeman::Util
+
+    attr_reader :name, :src, :owner, :file, :type
+
+    def initialize name, src, owner, file
+      @name = name
+      @src = src
+      @owner = owner
+      @file = file
+      @type = case src.node_type
+              when :defn
+                :instance
+              when :defs
+                :class
+              else
+                raise "Expected sexp type: #{src.node_type}"
+              end
+
+      @simple_method = nil
+    end
+
+    # To support legacy code that expected a Hash
+    def [] attr
+      self.send(attr)
+    end
+
+    def very_simple_method?
+      return @simple_method == :very unless @simple_method.nil?
+
+      # Very simple methods have one (simple) expression in the body and
+      # no arguments
+      if src.formal_args.length == 1 # no args
+        if src.method_length == 1 # Single expression in body
+          value = first_body # First expression in body
+
+          if simple_literal? value or
+              (array? value and all_literals? value) or
+              (hash? value and all_literals? value, :hash)
+
+            @return_value = value
+            @simple_method = :very
+          end
+        end
+      end
+
+      @simple_method ||= false
+    end
+
+    def return_value env = nil
+      if very_simple_method?
+        return @return_value
+      else
+        nil
+      end
+    end
+
+    def first_body
+      case @type
+      when :class
+        src[4]
+      when :instance
+        src[3]
+      end
+    end
+  end
+end