brakeman 4.8.0 → 5.2.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (273) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +144 -2
  3. data/README.md +23 -6
  4. data/bundle/load.rb +7 -5
  5. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/CHANGELOG.md +24 -0
  6. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/FAQ.md +0 -0
  7. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/Gemfile +1 -4
  8. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/MIT-LICENSE +0 -0
  9. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/README.md +21 -16
  10. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/REFERENCE.md +39 -10
  11. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/TODO +0 -0
  12. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/haml.gemspec +2 -1
  13. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_builder.rb +58 -3
  14. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_compiler.rb +45 -32
  15. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_parser.rb +0 -0
  16. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/buffer.rb +0 -56
  17. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/compiler.rb +0 -0
  18. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/engine.rb +0 -0
  19. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/error.rb +0 -0
  20. data/bundle/ruby/2.7.0/gems/haml-5.2.2/lib/haml/escapable.rb +77 -0
  21. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/exec.rb +0 -0
  22. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/filters.rb +0 -0
  23. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/generator.rb +0 -0
  24. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_extensions.rb +0 -0
  25. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_mods.rb +0 -0
  26. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
  27. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/safe_erubi_template.rb +0 -0
  28. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/safe_erubis_template.rb +0 -0
  29. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/xss_mods.rb +6 -3
  30. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers.rb +7 -1
  31. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/options.rb +0 -0
  32. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/parser.rb +32 -4
  33. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/plugin.rb +18 -1
  34. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/railtie.rb +5 -0
  35. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/sass_rails_filter.rb +0 -0
  36. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/template/options.rb +0 -0
  37. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/template.rb +0 -0
  38. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/temple_engine.rb +2 -1
  39. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/temple_line_counter.rb +0 -0
  40. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/util.rb +1 -1
  41. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/version.rb +1 -1
  42. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml.rb +0 -0
  43. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/yard/default/fulldoc/html/css/common.sass +0 -0
  44. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/yard/default/layout/html/footer.erb +0 -0
  45. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/MIT-LICENSE.txt +20 -0
  46. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/processor_count.rb +45 -0
  47. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb +4 -0
  48. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel.rb +532 -0
  49. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt +22 -0
  50. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md +178 -0
  51. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md +48 -0
  52. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attlistdecl.rb +63 -0
  53. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attribute.rb +205 -0
  54. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/cdata.rb +68 -0
  55. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/child.rb +97 -0
  56. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/comment.rb +80 -0
  57. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/doctype.rb +311 -0
  58. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/document.rb +451 -0
  59. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/attlistdecl.rb +11 -0
  60. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/dtd.rb +47 -0
  61. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/elementdecl.rb +18 -0
  62. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/entitydecl.rb +57 -0
  63. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/notationdecl.rb +40 -0
  64. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/element.rb +2599 -0
  65. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/encoding.rb +51 -0
  66. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/entity.rb +171 -0
  67. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/default.rb +116 -0
  68. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/pretty.rb +142 -0
  69. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/transitive.rb +58 -0
  70. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/functions.rb +447 -0
  71. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/instruction.rb +79 -0
  72. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/light/node.rb +188 -0
  73. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/namespace.rb +59 -0
  74. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/node.rb +76 -0
  75. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/output.rb +30 -0
  76. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parent.rb +166 -0
  77. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parseexception.rb +52 -0
  78. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb +694 -0
  79. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/lightparser.rb +59 -0
  80. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb +197 -0
  81. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb +273 -0
  82. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/streamparser.rb +61 -0
  83. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb +101 -0
  84. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/ultralightparser.rb +57 -0
  85. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/xpathparser.rb +689 -0
  86. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/quickpath.rb +266 -0
  87. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/rexml.rb +37 -0
  88. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/sax2listener.rb +98 -0
  89. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/security.rb +28 -0
  90. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/source.rb +298 -0
  91. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/streamlistener.rb +93 -0
  92. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/text.rb +424 -0
  93. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/undefinednamespaceexception.rb +9 -0
  94. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/relaxng.rb +539 -0
  95. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validation.rb +144 -0
  96. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validationexception.rb +10 -0
  97. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmldecl.rb +130 -0
  98. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmltokens.rb +85 -0
  99. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath.rb +81 -0
  100. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath_parser.rb +974 -0
  101. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml.rb +3 -0
  102. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/History.rdoc +148 -0
  103. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/Manifest.txt +7 -0
  104. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/README.rdoc +1 -0
  105. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/compare/normalize.rb +51 -6
  106. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/debugging.md +190 -0
  107. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/gauntlet.md +106 -0
  108. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/rp_extensions.rb +15 -36
  109. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/rp_stringscanner.rb +33 -0
  110. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.rb +7128 -0
  111. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby20_parser.y +420 -296
  112. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.rb +7182 -0
  113. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby21_parser.y +415 -293
  114. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.rb +7228 -0
  115. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby22_parser.y +419 -295
  116. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.rb +7237 -0
  117. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby23_parser.y +419 -295
  118. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.rb +7268 -0
  119. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby24_parser.y +419 -295
  120. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.rb +7268 -0
  121. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby26_parser.y → ruby_parser-3.18.1/lib/ruby25_parser.y} +418 -308
  122. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.rb +7287 -0
  123. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby_parser.yy → ruby_parser-3.18.1/lib/ruby26_parser.y} +419 -399
  124. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.rb +8517 -0
  125. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby25_parser.y → ruby_parser-3.18.1/lib/ruby27_parser.y} +1030 -294
  126. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.rb +8751 -0
  127. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.y +3472 -0
  128. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby3_parser.yy +3476 -0
  129. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rb +308 -605
  130. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rex +33 -27
  131. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rex.rb +65 -31
  132. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer_strings.rb +638 -0
  133. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_parser.rb +4 -0
  134. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_parser.yy +3487 -0
  135. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_parser_extras.rb +341 -127
  136. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/tools/munge.rb +43 -10
  137. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/tools/ripper.rb +15 -10
  138. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/History.rdoc +39 -0
  139. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/Manifest.txt +0 -0
  140. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/README.rdoc +0 -0
  141. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/composite_sexp_processor.rb +0 -0
  142. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/pt_testcase.rb +9 -4
  143. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp.rb +19 -9
  144. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp_matcher.rb +4 -7
  145. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp_processor.rb +1 -1
  146. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/strict_sexp.rb +25 -3
  147. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/unique.rb +0 -0
  148. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/CHANGES +4 -0
  149. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/Gemfile +12 -13
  150. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/LICENSE +0 -0
  151. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/README.jp.md +0 -0
  152. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/README.md +0 -0
  153. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/code_attributes.rb +0 -0
  154. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/command.rb +13 -13
  155. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/controls.rb +0 -0
  156. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/do_inserter.rb +0 -0
  157. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/embedded.rb +0 -0
  158. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/end_inserter.rb +0 -0
  159. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/engine.rb +0 -0
  160. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/erb_converter.rb +0 -0
  161. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/filter.rb +0 -0
  162. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/grammar.rb +0 -0
  163. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/include.rb +0 -0
  164. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/interpolation.rb +0 -0
  165. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less/context.rb +0 -0
  166. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less/filter.rb +0 -0
  167. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less.rb +0 -0
  168. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/parser.rb +1 -1
  169. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/escaper.rb +0 -0
  170. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/filter.rb +0 -0
  171. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/parser.rb +0 -0
  172. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart.rb +0 -0
  173. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/splat/builder.rb +0 -0
  174. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/splat/filter.rb +0 -0
  175. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/template.rb +0 -0
  176. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/translator.rb +0 -0
  177. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/version.rb +1 -1
  178. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim.rb +0 -0
  179. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/slim.gemspec +0 -0
  180. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/CHANGELOG.md +8 -0
  181. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/MIT-LICENSE.txt +0 -0
  182. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/README.md +1 -1
  183. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/data/display_width.marshal.gz +0 -0
  184. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/constants.rb +2 -2
  185. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/index.rb +0 -0
  186. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/no_string_ext.rb +0 -0
  187. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/string_ext.rb +0 -0
  188. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width.rb +0 -0
  189. data/lib/brakeman/app_tree.rb +37 -4
  190. data/lib/brakeman/checks/base_check.rb +18 -2
  191. data/lib/brakeman/checks/check_basic_auth.rb +2 -0
  192. data/lib/brakeman/checks/check_csrf_token_forgery_cve.rb +28 -0
  193. data/lib/brakeman/checks/check_deserialize.rb +21 -1
  194. data/lib/brakeman/checks/check_detailed_exceptions.rb +1 -1
  195. data/lib/brakeman/checks/check_eol_rails.rb +23 -0
  196. data/lib/brakeman/checks/check_eol_ruby.rb +26 -0
  197. data/lib/brakeman/checks/check_evaluation.rb +1 -1
  198. data/lib/brakeman/checks/check_execute.rb +12 -1
  199. data/lib/brakeman/checks/check_json_entity_escape.rb +38 -0
  200. data/lib/brakeman/checks/check_json_parsing.rb +1 -1
  201. data/lib/brakeman/checks/check_mass_assignment.rb +37 -9
  202. data/lib/brakeman/checks/check_model_attr_accessible.rb +1 -1
  203. data/lib/brakeman/checks/check_model_attributes.rb +1 -1
  204. data/lib/brakeman/checks/check_page_caching_cve.rb +37 -0
  205. data/lib/brakeman/checks/check_permit_attributes.rb +1 -1
  206. data/lib/brakeman/checks/check_regex_dos.rb +1 -1
  207. data/lib/brakeman/checks/check_render.rb +15 -1
  208. data/lib/brakeman/checks/check_sanitize_methods.rb +2 -1
  209. data/lib/brakeman/checks/check_skip_before_filter.rb +4 -4
  210. data/lib/brakeman/checks/check_sql.rb +60 -9
  211. data/lib/brakeman/checks/check_symbol_dos.rb +1 -1
  212. data/lib/brakeman/checks/check_template_injection.rb +32 -0
  213. data/lib/brakeman/checks/check_unsafe_reflection_methods.rb +68 -0
  214. data/lib/brakeman/checks/check_verb_confusion.rb +75 -0
  215. data/lib/brakeman/checks/eol_check.rb +47 -0
  216. data/lib/brakeman/commandline.rb +25 -1
  217. data/lib/brakeman/file_parser.rb +58 -22
  218. data/lib/brakeman/options.rb +39 -2
  219. data/lib/brakeman/parsers/template_parser.rb +26 -3
  220. data/lib/brakeman/processors/alias_processor.rb +132 -24
  221. data/lib/brakeman/processors/base_processor.rb +4 -4
  222. data/lib/brakeman/processors/controller_alias_processor.rb +6 -43
  223. data/lib/brakeman/processors/controller_processor.rb +1 -1
  224. data/lib/brakeman/processors/gem_processor.rb +3 -0
  225. data/lib/brakeman/processors/haml_template_processor.rb +17 -1
  226. data/lib/brakeman/processors/lib/call_conversion_helper.rb +13 -7
  227. data/lib/brakeman/processors/lib/file_type_detector.rb +64 -0
  228. data/lib/brakeman/processors/lib/find_all_calls.rb +28 -13
  229. data/lib/brakeman/processors/lib/rails3_config_processor.rb +16 -16
  230. data/lib/brakeman/processors/lib/rails3_route_processor.rb +2 -0
  231. data/lib/brakeman/processors/lib/rails4_config_processor.rb +2 -1
  232. data/lib/brakeman/processors/lib/render_helper.rb +3 -1
  233. data/lib/brakeman/processors/library_processor.rb +9 -0
  234. data/lib/brakeman/processors/model_processor.rb +32 -0
  235. data/lib/brakeman/processors/output_processor.rb +1 -1
  236. data/lib/brakeman/processors/template_alias_processor.rb +5 -0
  237. data/lib/brakeman/report/ignore/config.rb +5 -1
  238. data/lib/brakeman/report/ignore/interactive.rb +1 -1
  239. data/lib/brakeman/report/report_base.rb +0 -2
  240. data/lib/brakeman/report/report_csv.rb +37 -60
  241. data/lib/brakeman/report/report_github.rb +31 -0
  242. data/lib/brakeman/report/report_junit.rb +2 -2
  243. data/lib/brakeman/report/report_sarif.rb +133 -0
  244. data/lib/brakeman/report/report_sonar.rb +38 -0
  245. data/lib/brakeman/report/report_tabs.rb +1 -1
  246. data/lib/brakeman/report/report_text.rb +38 -17
  247. data/lib/brakeman/report.rb +19 -1
  248. data/lib/brakeman/rescanner.rb +7 -5
  249. data/lib/brakeman/scanner.rb +65 -31
  250. data/lib/brakeman/tracker/collection.rb +57 -7
  251. data/lib/brakeman/tracker/config.rb +87 -5
  252. data/lib/brakeman/tracker/constants.rb +8 -7
  253. data/lib/brakeman/tracker/controller.rb +1 -1
  254. data/lib/brakeman/tracker/method_info.rb +70 -0
  255. data/lib/brakeman/tracker.rb +42 -5
  256. data/lib/brakeman/util.rb +58 -21
  257. data/lib/brakeman/version.rb +1 -1
  258. data/lib/brakeman/warning.rb +10 -2
  259. data/lib/brakeman/warning_codes.rb +13 -0
  260. data/lib/brakeman.rb +45 -6
  261. data/lib/ruby_parser/bm_sexp.rb +33 -9
  262. metadata +201 -123
  263. data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb +0 -50
  264. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/debugging.md +0 -18
  265. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/rp_stringscanner.rb +0 -64
  266. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby20_parser.rb +0 -7042
  267. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby21_parser.rb +0 -7113
  268. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby22_parser.rb +0 -7146
  269. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby23_parser.rb +0 -7163
  270. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby24_parser.rb +0 -7175
  271. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby25_parser.rb +0 -7175
  272. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby26_parser.rb +0 -7195
  273. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.6.1/data/display_width.marshal.gz +0 -0
@@ -22,7 +22,19 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
22
22
  :find_by_sql, :maximum, :minimum, :pluck, :sum, :update_all]
23
23
  @sql_targets.concat [:from, :group, :having, :joins, :lock, :order, :reorder, :where] if tracker.options[:rails3]
24
24
  @sql_targets.concat [:find_by, :find_by!, :find_or_create_by, :find_or_create_by!, :find_or_initialize_by, :not] if tracker.options[:rails4]
25
- @sql_targets << :delete_by << :destroy_by if tracker.options[:rails6]
25
+
26
+ if tracker.options[:rails6]
27
+ @sql_targets.concat [:delete_by, :destroy_by, :rewhere, :reselect]
28
+
29
+ @sql_targets.delete :delete_all
30
+ @sql_targets.delete :destroy_all
31
+ end
32
+
33
+ if version_between?("6.1.0", "9.9.9")
34
+ @sql_targets.delete :order
35
+ @sql_targets.delete :reorder
36
+ @sql_targets.delete :pluck
37
+ end
26
38
 
27
39
  if version_between?("2.0.0", "3.9.9") or tracker.config.rails_version.nil?
28
40
  @sql_targets << :first << :last << :all
@@ -185,7 +197,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
185
197
  else
186
198
  check_find_arguments call.last_arg
187
199
  end
188
- when :where, :having, :find_by, :find_by!, :find_or_create_by, :find_or_create_by!, :find_or_initialize_by,:not, :delete_by, :destroy_by
200
+ when :where, :rewhere, :having, :find_by, :find_by!, :find_or_create_by, :find_or_create_by!, :find_or_initialize_by,:not, :delete_by, :destroy_by
189
201
  check_query_arguments call.arglist
190
202
  when :order, :group, :reorder
191
203
  check_order_arguments call.arglist
@@ -199,7 +211,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
199
211
  unsafe_sql? call.first_arg
200
212
  when :sql
201
213
  unsafe_sql? call.first_arg
202
- when :update_all, :select
214
+ when :update_all, :select, :reselect
203
215
  check_update_all_arguments call.args
204
216
  when *@connection_calls
205
217
  check_by_sql_arguments call.first_arg
@@ -393,7 +405,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
393
405
  nil
394
406
  end
395
407
 
396
- TO_STRING_METHODS = [:to_s, :strip_heredoc]
408
+ TO_STRING_METHODS = [:chomp, :to_s, :squish, :strip, :strip_heredoc]
397
409
 
398
410
  #Returns value if interpolated value is not something safe
399
411
  def unsafe_string_interp? exp
@@ -576,9 +588,13 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
576
588
  :sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
577
589
  :sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
578
590
  :to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
579
- :where_values_hash, :foreign_key
591
+ :where_values_hash, :foreign_key, :uuid
580
592
  ]
581
593
 
594
+ def ignore_methods_in_sql
595
+ @ignore_methods_in_sql ||= IGNORE_METHODS_IN_SQL + (tracker.options[:sql_safe_methods] || [])
596
+ end
597
+
582
598
  def safe_value? exp
583
599
  return true unless sexp? exp
584
600
 
@@ -589,10 +605,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
589
605
  if exp.method == :to_s or exp.method == :to_sym
590
606
  safe_value? exp.target
591
607
  else
592
- IGNORE_METHODS_IN_SQL.include? exp.method or
593
- quote_call? exp or
594
- arel? exp or
595
- exp.method.to_s.end_with? "_id"
608
+ ignore_call? exp
596
609
  end
597
610
  when :if
598
611
  safe_value? exp.then_clause and safe_value? exp.else_clause
@@ -607,6 +620,18 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
607
620
  end
608
621
  end
609
622
 
623
+ def ignore_call? exp
624
+ return unless call? exp
625
+
626
+ ignore_methods_in_sql.include? exp.method or
627
+ quote_call? exp or
628
+ arel? exp or
629
+ exp.method.to_s.end_with? "_id" or
630
+ number_target? exp or
631
+ date_target? exp or
632
+ locale_call? exp
633
+ end
634
+
610
635
  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
611
636
 
612
637
  def quote_call? exp
@@ -695,4 +720,30 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
695
720
  active_record_models.include? klass
696
721
  end
697
722
  end
723
+
724
+ def number_target? exp
725
+ return unless call? exp
726
+
727
+ if number? exp.target
728
+ true
729
+ elsif call? exp.target
730
+ number_target? exp.target
731
+ else
732
+ false
733
+ end
734
+ end
735
+
736
+ DATE_CLASS = s(:const, :Date)
737
+
738
+ def date_target? exp
739
+ return unless call? exp
740
+
741
+ if exp.target == DATE_CLASS
742
+ true
743
+ elsif call? exp.target
744
+ date_target? exp.target
745
+ else
746
+ false
747
+ end
748
+ end
698
749
  end
@@ -9,7 +9,7 @@ class Brakeman::CheckSymbolDoS < Brakeman::BaseCheck
9
9
 
10
10
  def run_check
11
11
  return if rails_version and rails_version >= "5.0.0"
12
- return if tracker.config.ruby_version >= "2.2"
12
+ return if tracker.config.ruby_version and tracker.config.ruby_version >= "2.2"
13
13
 
14
14
  tracker.find_call(:methods => UNSAFE_METHODS, :nested => true).each do |result|
15
15
  check_unsafe_symbol_creation(result)
@@ -0,0 +1,32 @@
1
+ require 'brakeman/checks/base_check'
2
+
3
+ class Brakeman::CheckTemplateInjection < Brakeman::BaseCheck
4
+ Brakeman::Checks.add self
5
+
6
+ @description = "Searches for evaluation of user input through template injection"
7
+
8
+ #Process calls
9
+ def run_check
10
+ Brakeman.debug "Finding ERB.new calls"
11
+ erb_calls = tracker.find_call :target => :ERB, :method => :new, :nested => true
12
+
13
+ Brakeman.debug "Processing ERB.new calls"
14
+ erb_calls.each do |call|
15
+ process_result call
16
+ end
17
+ end
18
+
19
+ #Warns if eval includes user input
20
+ def process_result result
21
+ return unless original? result
22
+
23
+ if input = include_user_input?(result[:call].arglist)
24
+ warn :result => result,
25
+ :warning_type => "Template Injection",
26
+ :warning_code => :erb_template_injection,
27
+ :message => msg(msg_input(input), " used directly in ", msg_code("ERB"), " template, which might enable remote code execution"),
28
+ :user_input => input,
29
+ :confidence => :high
30
+ end
31
+ end
32
+ end
@@ -0,0 +1,68 @@
1
+ require 'brakeman/checks/base_check'
2
+
3
+ class Brakeman::CheckUnsafeReflectionMethods < Brakeman::BaseCheck
4
+ Brakeman::Checks.add self
5
+
6
+ @description = "Checks for unsafe reflection to access methods"
7
+
8
+ def run_check
9
+ check_method
10
+ check_tap
11
+ check_to_proc
12
+ end
13
+
14
+ def check_method
15
+ tracker.find_call(method: :method, nested: true).each do |result|
16
+ argument = result[:call].first_arg
17
+
18
+ if user_input = include_user_input?(argument)
19
+ warn_unsafe_reflection(result, user_input)
20
+ end
21
+ end
22
+ end
23
+
24
+ def check_tap
25
+ tracker.find_call(method: :tap, nested: true).each do |result|
26
+ argument = result[:call].first_arg
27
+
28
+ # Argument is passed like a.tap(&argument)
29
+ if node_type? argument, :block_pass
30
+ argument = argument.value
31
+ end
32
+
33
+ if user_input = include_user_input?(argument)
34
+ warn_unsafe_reflection(result, user_input)
35
+ end
36
+ end
37
+ end
38
+
39
+ def check_to_proc
40
+ tracker.find_call(method: :to_proc, nested: true).each do |result|
41
+ target = result[:call].target
42
+
43
+ if user_input = include_user_input?(target)
44
+ warn_unsafe_reflection(result, user_input)
45
+ end
46
+ end
47
+ end
48
+
49
+ def warn_unsafe_reflection result, input
50
+ return unless original? result
51
+ method = result[:call].method
52
+
53
+ confidence = if input.type == :params
54
+ :high
55
+ else
56
+ :medium
57
+ end
58
+
59
+ message = msg("Unsafe reflection method ", msg_code(method), " called with ", msg_input(input))
60
+
61
+ warn :result => result,
62
+ :warning_type => "Remote Code Execution",
63
+ :warning_code => :unsafe_method_reflection,
64
+ :message => message,
65
+ :user_input => input,
66
+ :confidence => confidence
67
+ end
68
+ end
@@ -0,0 +1,75 @@
1
+ require 'brakeman/checks/base_check'
2
+
3
+ class Brakeman::CheckVerbConfusion < Brakeman::BaseCheck
4
+ Brakeman::Checks.add self
5
+
6
+ @description = "Check for uses of `request.get?` that might have unintentional behavior"
7
+
8
+ #Process calls
9
+ def run_check
10
+ calls = tracker.find_call(target: :request, methods: [:get?])
11
+
12
+ calls.each do |call|
13
+ process_result call
14
+ end
15
+ end
16
+
17
+ def process_result result
18
+ @current_result = result
19
+ @matched_call = result[:call]
20
+ klass = tracker.find_class(result[:location][:class])
21
+
22
+ # TODO: abstract into tracker.find_location ?
23
+ if klass.nil?
24
+ Brakeman.debug "No class found: #{result[:location][:class]}"
25
+ return
26
+ end
27
+
28
+ method = klass.get_method(result[:location][:method])
29
+
30
+ if method.nil?
31
+ Brakeman.debug "No method found: #{result[:location][:method]}"
32
+ return
33
+ end
34
+
35
+ process method.src
36
+ end
37
+
38
+ def process_if exp
39
+ if exp.condition == @matched_call
40
+ # Found `if request.get?`
41
+
42
+ # Do not warn if there is an `elsif` clause
43
+ if node_type? exp.else_clause, :if
44
+ return exp
45
+ end
46
+
47
+ warn_about_result @current_result, exp
48
+ end
49
+
50
+ exp
51
+ end
52
+
53
+ def warn_about_result result, code
54
+ return unless original? result
55
+
56
+ confidence = :weak
57
+ message = msg('Potential HTTP verb confusion. ',
58
+ msg_code('HEAD'),
59
+ ' is routed like ',
60
+ msg_code('GET'),
61
+ ' but ',
62
+ msg_code('request.get?'),
63
+ ' will return ',
64
+ msg_code('false')
65
+ )
66
+
67
+ warn :result => result,
68
+ :warning_type => "HTTP Verb Confusion",
69
+ :warning_code => :http_verb_confusion,
70
+ :message => message,
71
+ :code => code,
72
+ :user_input => result[:call],
73
+ :confidence => confidence
74
+ end
75
+ end
@@ -0,0 +1,47 @@
1
+ require 'date'
2
+ require 'brakeman/checks/base_check'
3
+
4
+ # Not used directly - base check for EOLRails and EOLRuby
5
+ class Brakeman::EOLCheck < Brakeman::BaseCheck
6
+ def check_eol_version library, eol_dates
7
+ version = case library
8
+ when :rails
9
+ tracker.config.rails_version
10
+ when :ruby
11
+ tracker.config.ruby_version
12
+ else
13
+ raise 'Implement using tracker.config.gem_version'
14
+ end
15
+
16
+ eol_dates.each do |(start_version, end_version), eol_date|
17
+ if version_between? start_version, end_version, version
18
+ case
19
+ when Date.today >= eol_date
20
+ warn_about_unsupported_version library, eol_date, version
21
+ when (Date.today + 30) >= eol_date
22
+ warn_about_soon_unsupported_version library, eol_date, version, :medium
23
+ when (Date.today + 60) >= eol_date
24
+ warn_about_soon_unsupported_version library, eol_date, version, :low
25
+ end
26
+
27
+ break
28
+ end
29
+ end
30
+ end
31
+
32
+ def warn_about_soon_unsupported_version library, eol_date, version, confidence
33
+ warn warning_type: 'Unmaintained Dependency',
34
+ warning_code: :"pending_eol_#{library}",
35
+ message: msg("Support for ", msg_version(version, library.capitalize), " ends on #{eol_date}"),
36
+ confidence: confidence,
37
+ gem_info: gemfile_or_environment
38
+ end
39
+
40
+ def warn_about_unsupported_version library, eol_date, version
41
+ warn warning_type: 'Unmaintained Dependency',
42
+ warning_code: :"eol_#{library}",
43
+ message: msg("Support for ", msg_version(version, library.capitalize), " ended on #{eol_date}"),
44
+ confidence: :high,
45
+ gem_info: gemfile_or_environment
46
+ end
47
+ end
@@ -102,6 +102,13 @@ module Brakeman
102
102
  app_path = "."
103
103
  end
104
104
 
105
+ if options[:ensure_ignore_notes] and options[:previous_results_json]
106
+ warn '[Notice] --ensure-ignore-notes may not be used at the same ' \
107
+ 'time as --compare. Deactivating --ensure-ignore-notes. ' \
108
+ 'Please see `brakeman --help` for valid options'
109
+ options[:ensure_ignore_notes] = false
110
+ end
111
+
105
112
  return options, app_path
106
113
  end
107
114
 
@@ -115,7 +122,20 @@ module Brakeman
115
122
 
116
123
  # Runs a regular report based on the options provided.
117
124
  def regular_report options
118
- tracker = run_brakeman options
125
+ tracker = run_brakeman options
126
+
127
+ ensure_ignore_notes_failed = false
128
+ if tracker.options[:ensure_ignore_notes]
129
+ fingerprints = Brakeman::ignore_file_entries_with_empty_notes tracker.ignored_filter&.file
130
+
131
+ unless fingerprints.empty?
132
+ ensure_ignore_notes_failed = true
133
+ warn '[Error] Notes required for all ignored warnings when ' \
134
+ '--ensure-ignore-notes is set. No notes provided for these ' \
135
+ 'warnings: '
136
+ fingerprints.each { |f| warn f }
137
+ end
138
+ end
119
139
 
120
140
  if tracker.options[:exit_on_warn] and not tracker.filtered_warnings.empty?
121
141
  quit Brakeman::Warnings_Found_Exit_Code
@@ -124,6 +144,10 @@ module Brakeman
124
144
  if tracker.options[:exit_on_error] and tracker.errors.any?
125
145
  quit Brakeman::Errors_Found_Exit_Code
126
146
  end
147
+
148
+ if ensure_ignore_notes_failed
149
+ quit Brakeman::Empty_Ignore_Note_Exit_Code
150
+ end
127
151
  end
128
152
 
129
153
  # Actually run Brakeman.
@@ -1,51 +1,87 @@
1
+ require 'parallel'
2
+
1
3
  module Brakeman
2
4
  ASTFile = Struct.new(:path, :ast)
3
5
 
4
6
  # This class handles reading and parsing files.
5
7
  class FileParser
6
- attr_reader :file_list
8
+ attr_reader :file_list, :errors
7
9
 
8
- def initialize tracker
9
- @tracker = tracker
10
- @timeout = @tracker.options[:parser_timeout]
11
- @app_tree = @tracker.app_tree
12
- @file_list = {}
10
+ def initialize app_tree, timeout, parallel = true
11
+ @app_tree = app_tree
12
+ @timeout = timeout
13
+ @file_list = []
14
+ @errors = []
15
+ @parallel = parallel
13
16
  end
14
17
 
15
- def parse_files list, type
16
- read_files list, type do |path, contents|
17
- if ast = parse_ruby(contents, path.relative)
18
- ASTFile.new(path, ast)
18
+ def parse_files list
19
+ if @parallel
20
+ parallel_options = {}
21
+ else
22
+ # Disable parallelism
23
+ parallel_options = { in_threads: 0 }
24
+ end
25
+
26
+ # Parse the files in parallel.
27
+ # By default, the parsing will be in separate processes.
28
+ # So we map the result to ASTFiles and/or Exceptions
29
+ # then partition them into ASTFiles and Exceptions
30
+ # and add the Exceptions to @errors
31
+ #
32
+ # Basically just a funky way to deal with two possible
33
+ # return types that are returned from isolated processes.
34
+ #
35
+ # Note this method no longer uses read_files
36
+ @file_list, new_errors = Parallel.map(list, parallel_options) do |file_name|
37
+ file_path = @app_tree.file_path(file_name)
38
+ contents = file_path.read
39
+
40
+ begin
41
+ if ast = parse_ruby(contents, file_path.relative)
42
+ ASTFile.new(file_name, ast)
43
+ end
44
+ rescue Exception => e
45
+ e
19
46
  end
47
+ end.compact.partition do |result|
48
+ result.is_a? ASTFile
20
49
  end
21
- end
22
50
 
23
- def read_files list, type
24
- @file_list[type] ||= []
51
+ errors.concat new_errors
52
+ end
25
53
 
54
+ def read_files list
26
55
  list.each do |path|
27
56
  file = @app_tree.file_path(path)
28
57
 
29
- result = yield file, file.read
30
- if result
31
- @file_list[type] << result
58
+ begin
59
+ result = yield file, file.read
60
+
61
+ if result
62
+ @file_list << result
63
+ end
64
+ rescue Exception => e
65
+ @errors << e
32
66
  end
33
67
  end
34
68
  end
35
69
 
70
+ # _path_ can be a string or a Brakeman::FilePath
36
71
  def parse_ruby input, path
72
+ if path.is_a? Brakeman::FilePath
73
+ path = path.relative
74
+ end
75
+
37
76
  begin
38
77
  Brakeman.debug "Parsing #{path}"
39
78
  RubyParser.new.parse input, path, @timeout
40
79
  rescue Racc::ParseError => e
41
- @tracker.error e, "Could not parse #{path}"
42
- nil
80
+ raise e.exception(e.message + "\nCould not parse #{path}")
43
81
  rescue Timeout::Error => e
44
- @tracker.error Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout"), caller
45
- nil
82
+ raise Exception.new("Parsing #{path} took too long (> #{@timeout} seconds). Try increasing the limit with --parser-timeout")
46
83
  rescue => e
47
- @tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
48
- nil
84
+ raise e.exception(e.message + "\nWhile processing #{path}")
49
85
  end
50
86
  end
51
87
  end
@@ -39,7 +39,7 @@ module Brakeman::Options
39
39
  OptionParser.new do |opts|
40
40
  opts.banner = "Usage: brakeman [options] rails/root/path"
41
41
 
42
- opts.on "-n", "--no-threads", "Run checks sequentially" do
42
+ opts.on "-n", "--no-threads", "Run checks and file parsing sequentially" do
43
43
  options[:parallel_checks] = false
44
44
  end
45
45
 
@@ -67,6 +67,10 @@ module Brakeman::Options
67
67
  options[:ensure_latest] = true
68
68
  end
69
69
 
70
+ opts.on "--ensure-ignore-notes", "Fail when an ignored warnings does not include a note" do
71
+ options[:ensure_ignore_notes] = true
72
+ end
73
+
70
74
  opts.on "-3", "--rails3", "Force Rails 3 mode" do
71
75
  options[:rails3] = true
72
76
  end
@@ -89,6 +93,14 @@ module Brakeman::Options
89
93
  options[:rails6] = true
90
94
  end
91
95
 
96
+ opts.on "-7", "--rails7", "Force Rails 7 mode" do
97
+ options[:rails3] = true
98
+ options[:rails4] = true
99
+ options[:rails5] = true
100
+ options[:rails6] = true
101
+ options[:rails7] = true
102
+ end
103
+
92
104
  opts.separator ""
93
105
  opts.separator "Scanning options:"
94
106
 
@@ -147,6 +159,11 @@ module Brakeman::Options
147
159
  options[:safe_methods].merge methods.map {|e| e.to_sym }
148
160
  end
149
161
 
162
+ opts.on "--sql-safe-methods meth1,meth2,etc", Array, "Do not warn of SQL if the input is wrapped in a safe method" do |methods|
163
+ options[:sql_safe_methods] ||= Set.new
164
+ options[:sql_safe_methods].merge methods.map {|e| e.to_sym }
165
+ end
166
+
150
167
  opts.on "--url-safe-methods method1,method2,etc", Array, "Do not warn of XSS if the link_to href parameter is wrapped in a safe method" do |methods|
151
168
  options[:url_safe_methods] ||= Set.new
152
169
  options[:url_safe_methods].merge methods.map {|e| e.to_sym }
@@ -162,6 +179,10 @@ module Brakeman::Options
162
179
  options[:only_files].merge files
163
180
  end
164
181
 
182
+ opts.on "--[no-]skip-vendor", "Skip processing vendor directory (Default)" do |skip|
183
+ options[:skip_vendor] = skip
184
+ end
185
+
165
186
  opts.on "--skip-libs", "Skip processing lib directory" do
166
187
  options[:skip_libs] = true
167
188
  end
@@ -225,7 +246,7 @@ module Brakeman::Options
225
246
 
226
247
  opts.on "-f",
227
248
  "--format TYPE",
228
- [:pdf, :text, :html, :csv, :tabs, :json, :markdown, :codeclimate, :cc, :plain, :table, :junit],
249
+ [:pdf, :text, :html, :csv, :tabs, :json, :markdown, :codeclimate, :cc, :plain, :table, :junit, :sarif, :sonar, :github],
229
250
  "Specify output formats. Default is text" do |type|
230
251
 
231
252
  type = "s" if type == :text
@@ -301,6 +322,22 @@ module Brakeman::Options
301
322
  options[:github_repo] = repo
302
323
  end
303
324
 
325
+ opts.on "--text-fields field1,field2,etc.", Array, "Specify fields for text report format" do |format|
326
+ valid_options = [:category, :category_id, :check, :code, :confidence, :file, :fingerprint, :line, :link, :message, :render_path]
327
+
328
+ options[:text_fields] = format.map(&:to_sym)
329
+
330
+ if options[:text_fields] == [:all]
331
+ options[:text_fields] = valid_options
332
+ else
333
+ invalid_options = (options[:text_fields] - valid_options)
334
+
335
+ unless invalid_options.empty?
336
+ raise OptionParser::ParseError, "\nInvalid format options: #{invalid_options.inspect}"
337
+ end
338
+ end
339
+ end
340
+
304
341
  opts.on "-w",
305
342
  "--confidence-level LEVEL",
306
343
  ["1", "2", "3"],
@@ -9,7 +9,7 @@ module Brakeman
9
9
  def initialize tracker, file_parser
10
10
  @tracker = tracker
11
11
  @file_parser = file_parser
12
- @file_parser.file_list[:templates] ||= []
12
+ @slim_smart = nil # Load slim/smart ?
13
13
  end
14
14
 
15
15
  def parse_template path, text
@@ -33,7 +33,7 @@ module Brakeman
33
33
  end
34
34
 
35
35
  if src and ast = @file_parser.parse_ruby(src, path)
36
- @file_parser.file_list[:templates] << TemplateFile.new(path, ast, name, type)
36
+ @file_parser.file_list << TemplateFile.new(path, ast, name, type)
37
37
  end
38
38
  rescue Racc::ParseError => e
39
39
  tracker.error e, "Could not parse #{path}"
@@ -89,6 +89,14 @@ module Brakeman
89
89
 
90
90
  def parse_slim path, text
91
91
  Brakeman.load_brakeman_dependency 'slim'
92
+
93
+ if @slim_smart.nil? and load_slim_smart?
94
+ @slim_smart = true
95
+ Brakeman.load_brakeman_dependency 'slim/smart'
96
+ else
97
+ @slim_smart = false
98
+ end
99
+
92
100
  require_relative 'slim_embedded'
93
101
 
94
102
  Slim::Template.new(path,
@@ -96,8 +104,23 @@ module Brakeman
96
104
  :generator => Temple::Generators::RailsOutputBuffer) { text }.precompiled_template
97
105
  end
98
106
 
107
+ def load_slim_smart?
108
+ return !@slim_smart unless @slim_smart.nil?
109
+
110
+ # Terrible hack to find
111
+ # gem "slim", "~> 3.0.1", require: ["slim", "slim/smart"]
112
+ if tracker.app_tree.exists? 'Gemfile'
113
+ gemfile_contents = tracker.app_tree.file_path('Gemfile').read
114
+ if gemfile_contents.include? 'slim/smart'
115
+ return true
116
+ end
117
+ end
118
+
119
+ false
120
+ end
121
+
99
122
  def self.parse_inline_erb tracker, text
100
- fp = Brakeman::FileParser.new(tracker)
123
+ fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
101
124
  tp = self.new(tracker, fp)
102
125
  src = tp.parse_erb '_inline_', text
103
126
  type = tp.erubis? ? :erubis : :erb