brakeman 4.7.2 → 4.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 411fde4f85ce3e35551ea8e0e289bad38213583166118db0740ac4677076e55f
-  data.tar.gz: 99a14d0668d883d1def0280df61ec2f40ad669505f7d70d1fc7b9350de5b9176
+  metadata.gz: 0e74c091d971966f1da9c247651b9d7250c33ddb826d1932c6d0a67e4bdc7642
+  data.tar.gz: bf1253b2db22fc51df78cec8610589e05598e3dbf7228f83753acdf3078920f7
 SHA512:
-  metadata.gz: 78243e7cec614d4e75530fb1a09c6057773fe0955759e60f7117a40fbfd56282ab0a4c89a3d5349063ba2786562722598b1e6206ecacabcba5ed1619c5e789a0
-  data.tar.gz: fd2ea9beed747478786d9f33ff5fe0f4fc6d2f4b9c7bffad1081cac802d2bbb31ef8bfe99974fd81d8cb8b81ee65ec933f62d13fdc346bd0d03b3b1078843f57
+  metadata.gz: db82e3110b5b4b64abeb931f08bccd391eb5e061909cf9bd2e57663fcdc4fcf8d6bc77b848ebe16908480a82e1cb7f5558b74557b920a8e793a2dfc9fab4d099
+  data.tar.gz: 75f4ecea562306868dfe682228d109a8991c57beca83a7222085561d74fd8a3d4338fd79d058a18ddeb7f8a4beb33ebca6b6fe732250cb9d44fd75da197d951c

data/CHANGES.md

@@ -1,3 +1,49 @@
+# 4.9.1 - 2020-09-04
+
+* Check `chomp`ed strings for SQL injection
+* Use version from `active_record` for non-Rails apps (Ulysse Buonomo)
+* Always set line number for joined arrays
+* Avoid warning about missing `attr_accessible` if `protected_attributes` gem is used
+
+# 4.9.0 - 2020-08-04
+
+* Add check for CVE-2020-8166 (Jamie Finnigan)
+* Avoid warning when `safe_yaml` is used via `YAML.load(..., safe: true)`
+* Add check for user input in `ERB.new` (Matt Hickman)
+* Add `--ensure-ignore-notes` (Eli Block)
+* Remove whitelist/blacklist language, add clarifications
+* Do not warn about mass assignment with `params.permit!.slice`
+* Add "full call" information to call index results
+* Ignore `params.permit!` in path helpers
+* Treat `Dir.glob` as safe source of values in guards
+* Always scan `environment.rb`
+
+# 4.8.2 - 2020-05-12
+
+* Add check for CVE-2020-8159
+* Fix `authenticate_or_request_with_http_basic` check for passed blocks (Hugo Corbucci)
+* Add `--text-fields` option
+* Add check for escaping HTML entities in JSON configuration
+
+# 4.8.1 - 2020-04-06
+
+* Check SQL query strings using `String#strip` or `String.squish`
+* Handle non-symbol keys in locals hash for render()
+* Warn about global(!) mass assignment
+* Index calls in render arguments
+
+# 4.8.0 - 2020-02-18 
+
+* Add JUnit-XML report format (Naoki Kimura)
+* Sort ignore files by fingerprint and line (Ngan Pham)
+* Freeze call index results
+* Fix output test when using newer Minitest
+* Properly render confidence in Markdown report
+* Report old warnings as fixed if zero warnings reported
+* Catch dangerous concatenation in `CheckExecute` (Jacob Evelyn)
+* Show user-friendly message when ignore config file has invalid JSON (D. Hicks)
+* Initialize Rails version with `nil` (Carsten Wirth)
+
 # 4.7.2 - 2019-11-25
 
 * Remove version guard for `named_scope` vs. `scope`

data/README.md

@@ -16,9 +16,11 @@ Using RubyGems:
 
 Using Bundler:
 
-    group :development do
-      gem 'brakeman'
-    end
+```ruby
+group :development do
+  gem 'brakeman'
+end
+```
 
 Using Docker:
 
@@ -74,12 +76,16 @@ To specify an output file for the results:
 
     brakeman -o output_file
 
-The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `tabs`, `json`, `markdown`, `csv`, and `codeclimate`.
+The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `tabs`, `json`, `junit`, `markdown`, `csv`, and `codeclimate`.
 
 Multiple output files can be specified:
 
     brakeman -o output.html -o output.json
 
+To output to both a file and to the console, with color:
+
+    brakeman --color -o /dev/stdout -o output.json
+
 To suppress informational warnings and just output the report:
 
     brakeman -q
@@ -167,6 +173,8 @@ There is a [plugin available](http://brakemanscanner.org/docs/jenkins/) for Jenk
 
 For even more continuous testing, try the [Guard plugin](https://github.com/guard/guard-brakeman).
 
+There are a couple [Github Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
+
 # Building
 
     git clone git://github.com/presidentbeef/brakeman.git

data/bundle/load.rb

@@ -1,14 +1,14 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/temple-0.8.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/slim-4.0.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/tilt-2.0.10/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/highline-2.0.3/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/ruby2ruby-2.4.4/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/sexp_processor-4.13.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/haml-5.1.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/ruby_parser-3.14.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/ruby_parser-legacy-1.0.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/unicode-display_width-1.6.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.6.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-3.15.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/temple-0.8.2/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/unicode-display_width-1.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/sexp_processor-4.15.1/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/tilt-2.0.10/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/slim-4.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/highline-2.0.3/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/haml-5.1.2/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib"

data/bundle/ruby/{2.6.0/gems/ruby_parser-3.14.1 → 2.7.0/gems/ruby_parser-3.15.0}/History.rdoc

@@ -1,3 +1,44 @@
+=== 3.15.0 / 2020-08-31
+
+* 1 major enhancement:
+
+  * Added tentative 2.7 support.
+
+* 1 minor enhancement:
+
+  * Improved ruby_parse_extract_error's handling of moving slow files out.
+
+* 22 bug fixes:
+
+  * Bumped ruby version to include 3.0 (trunk).
+  * Fix an error related to empty ensure bodies. (presidentbeef)
+  * Fix handling of bad magic encoding comment.
+  * Fixed SystemStackError when parsing a huoooge hash, caused by a splat arg.
+  * Fixed a number of errors parsing do blocks in strange edge cases.
+  * Fixed a string backslash lexing bug when the string is an invalid encoding. (nijikon, gmcgibbon)
+  * Fixed bug assigning line number to some arg nodes.
+  * Fixed bug concatinating string literals with differing encodings.
+  * Fixed bug lexing heredoc w/ nasty mix of \r\n and \n.
+  * Fixed bug lexing multiple codepoints in \u{0000 1111 2222} forms.
+  * Fixed bug setting line numbers in empty xstrings in some contexts.
+  * Fixed edge case on call w/ begin + do block as an arg.
+  * Fixed handling of UTF BOM.
+  * Fixed handling of lexer state across string interpolation braces.
+  * Fixed infinite loop when lexing backslash+cr+newline (aka dos-files)
+  * Fixed lambda + do block edge case.
+  * Fixed lexing of some ?\M... and ?\C... edge cases.
+  * Fixed more do/brace block edge case failures.
+  * Fixed parsing bug where splat was used in the middle of a list.
+  * Fixed parsing of interpolation in heredoc-like strings. (presidentbeef)
+  * Fixed parsing some esoteric edge cases in op_asgn.
+  * Fixed unicode processing in ident chars so now they better mix.
+
+=== 3.14.2 / 2020-02-06
+
+* 1 minor enhancement:
+
+  * Cleaned up call_args and removed arg_blk_pass from ruby_parser_extras.rb! Yay!
+
 === 3.14.1 / 2019-10-29
 
 * 1 minor enhancement:

data/bundle/ruby/{2.6.0/gems/ruby_parser-3.14.1 → 2.7.0/gems/ruby_parser-3.15.0}/Manifest.txt

@@ -24,6 +24,8 @@ lib/ruby25_parser.rb
 lib/ruby25_parser.y
 lib/ruby26_parser.rb
 lib/ruby26_parser.y
+lib/ruby27_parser.rb
+lib/ruby27_parser.y
 lib/ruby_lexer.rb
 lib/ruby_lexer.rex
 lib/ruby_lexer.rex.rb

data/bundle/ruby/{2.6.0/gems/ruby_parser-3.14.1 → 2.7.0/gems/ruby_parser-3.15.0}/compare/normalize.rb

@@ -8,6 +8,10 @@ order = []
 
 def munge s
   renames = [
+             # unquote... wtf?
+             /`(.+?)'/,          proc { $1 },
+             /"'(.+?)'"/,        proc { "\"#{$1}\"" },
+
              "'='",             "tEQL",
              "'!'",             "tBANG",
              "'%'",             "tPERCENT",
@@ -100,6 +104,43 @@ def munge s
 
              "kVARIABLE",       "keyword_variable", # ugh: this is a rule name
 
+             # 2.7 changes:
+
+             '"global variable"',          "tGVAR",
+             '"operator-assignment"',      "tOP_ASGN",
+             '"back reference"',           "tBACK_REF",
+             '"numbered reference"',       "tNTH_REF",
+             '"local variable or method"', "tIDENTIFIER",
+             '"constant"',                 "tCONSTANT",
+
+             '"(.."',                  "tBDOT2",
+             '"(..."',                 "tBDOT3",
+             '"char literal"',         "tCHAR",
+             '"literal content"',      "tSTRING_CONTENT",
+             '"string literal"',       "tSTRING_BEG",
+             '"symbol literal"',       "tSYMBEG",
+             '"backtick literal"',     "tXSTRING_BEG",
+             '"regexp literal"',       "tREGEXP_BEG",
+             '"word list"',            "tWORDS_BEG",
+             '"verbatim word list"',   "tQWORDS_BEG",
+             '"symbol list"',          "tSYMBOLS_BEG",
+             '"verbatim symbol list"', "tQSYMBOLS_BEG",
+
+             '"float literal"',        "tFLOAT",
+             '"imaginary literal"',    "tIMAGINARY",
+             '"integer literal"',      "tINTEGER",
+             '"rational literal"',     "tRATIONAL",
+
+             '"instance variable"',  "tIVAR",
+             '"class variable"',     "tCVAR",
+             '"terminator"',         "tSTRING_END", # TODO: switch this?
+             '"method"',             "tFID",
+             '"}"',                  "tSTRING_DEND",
+
+             '"do for block"',     "kDO_BLOCK",
+             '"do for condition"', "kDO_COND",
+             '"do for lambda"',    "kDO_LAMBDA",
+
              # UGH
              "k_LINE__",       "k__LINE__",
              "k_FILE__",       "k__FILE__",
@@ -107,13 +148,12 @@ def munge s
 
              '"defined?"',     "kDEFINED",
 
-
              '"do (for condition)"', "kDO_COND",
              '"do (for lambda)"',    "kDO_LAMBDA",
              '"do (for block)"',     "kDO_BLOCK",
 
-             /\"(\w+) \(modifier\)\"/, proc { |x| "k#{$1.upcase}_MOD" },
-             /\"(\w+)\"/,              proc { |x| "k#{$1.upcase}" },
+             /\"(\w+) \(?modifier\)?\"/, proc { |x| "k#{$1.upcase}_MOD" },
+             /\"(\w+)\"/,                proc { |x| "k#{$1.upcase}" },
 
              /@(\d+)(\s+|$)/,       "",
             ]