brakeman 4.8.0 → 5.2.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (273) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +144 -2
  3. data/README.md +23 -6
  4. data/bundle/load.rb +7 -5
  5. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/CHANGELOG.md +24 -0
  6. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/FAQ.md +0 -0
  7. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/Gemfile +1 -4
  8. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/MIT-LICENSE +0 -0
  9. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/README.md +21 -16
  10. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/REFERENCE.md +39 -10
  11. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/TODO +0 -0
  12. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/haml.gemspec +2 -1
  13. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_builder.rb +58 -3
  14. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_compiler.rb +45 -32
  15. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_parser.rb +0 -0
  16. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/buffer.rb +0 -56
  17. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/compiler.rb +0 -0
  18. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/engine.rb +0 -0
  19. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/error.rb +0 -0
  20. data/bundle/ruby/2.7.0/gems/haml-5.2.2/lib/haml/escapable.rb +77 -0
  21. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/exec.rb +0 -0
  22. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/filters.rb +0 -0
  23. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/generator.rb +0 -0
  24. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_extensions.rb +0 -0
  25. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_mods.rb +0 -0
  26. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
  27. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/safe_erubi_template.rb +0 -0
  28. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/safe_erubis_template.rb +0 -0
  29. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/xss_mods.rb +6 -3
  30. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers.rb +7 -1
  31. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/options.rb +0 -0
  32. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/parser.rb +32 -4
  33. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/plugin.rb +18 -1
  34. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/railtie.rb +5 -0
  35. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/sass_rails_filter.rb +0 -0
  36. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/template/options.rb +0 -0
  37. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/template.rb +0 -0
  38. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/temple_engine.rb +2 -1
  39. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/temple_line_counter.rb +0 -0
  40. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/util.rb +1 -1
  41. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/version.rb +1 -1
  42. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml.rb +0 -0
  43. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/yard/default/fulldoc/html/css/common.sass +0 -0
  44. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/yard/default/layout/html/footer.erb +0 -0
  45. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/MIT-LICENSE.txt +20 -0
  46. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/processor_count.rb +45 -0
  47. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb +4 -0
  48. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel.rb +532 -0
  49. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt +22 -0
  50. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md +178 -0
  51. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md +48 -0
  52. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attlistdecl.rb +63 -0
  53. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attribute.rb +205 -0
  54. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/cdata.rb +68 -0
  55. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/child.rb +97 -0
  56. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/comment.rb +80 -0
  57. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/doctype.rb +311 -0
  58. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/document.rb +451 -0
  59. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/attlistdecl.rb +11 -0
  60. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/dtd.rb +47 -0
  61. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/elementdecl.rb +18 -0
  62. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/entitydecl.rb +57 -0
  63. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/notationdecl.rb +40 -0
  64. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/element.rb +2599 -0
  65. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/encoding.rb +51 -0
  66. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/entity.rb +171 -0
  67. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/default.rb +116 -0
  68. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/pretty.rb +142 -0
  69. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/transitive.rb +58 -0
  70. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/functions.rb +447 -0
  71. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/instruction.rb +79 -0
  72. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/light/node.rb +188 -0
  73. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/namespace.rb +59 -0
  74. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/node.rb +76 -0
  75. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/output.rb +30 -0
  76. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parent.rb +166 -0
  77. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parseexception.rb +52 -0
  78. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb +694 -0
  79. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/lightparser.rb +59 -0
  80. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb +197 -0
  81. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb +273 -0
  82. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/streamparser.rb +61 -0
  83. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb +101 -0
  84. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/ultralightparser.rb +57 -0
  85. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/xpathparser.rb +689 -0
  86. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/quickpath.rb +266 -0
  87. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/rexml.rb +37 -0
  88. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/sax2listener.rb +98 -0
  89. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/security.rb +28 -0
  90. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/source.rb +298 -0
  91. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/streamlistener.rb +93 -0
  92. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/text.rb +424 -0
  93. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/undefinednamespaceexception.rb +9 -0
  94. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/relaxng.rb +539 -0
  95. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validation.rb +144 -0
  96. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validationexception.rb +10 -0
  97. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmldecl.rb +130 -0
  98. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmltokens.rb +85 -0
  99. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath.rb +81 -0
  100. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath_parser.rb +974 -0
  101. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml.rb +3 -0
  102. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/History.rdoc +148 -0
  103. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/Manifest.txt +7 -0
  104. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/README.rdoc +1 -0
  105. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/compare/normalize.rb +51 -6
  106. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/debugging.md +190 -0
  107. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/gauntlet.md +106 -0
  108. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/rp_extensions.rb +15 -36
  109. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/rp_stringscanner.rb +33 -0
  110. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.rb +7128 -0
  111. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby20_parser.y +420 -296
  112. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.rb +7182 -0
  113. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby21_parser.y +415 -293
  114. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.rb +7228 -0
  115. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby22_parser.y +419 -295
  116. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.rb +7237 -0
  117. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby23_parser.y +419 -295
  118. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.rb +7268 -0
  119. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby24_parser.y +419 -295
  120. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.rb +7268 -0
  121. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby26_parser.y → ruby_parser-3.18.1/lib/ruby25_parser.y} +418 -308
  122. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.rb +7287 -0
  123. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby_parser.yy → ruby_parser-3.18.1/lib/ruby26_parser.y} +419 -399
  124. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.rb +8517 -0
  125. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby25_parser.y → ruby_parser-3.18.1/lib/ruby27_parser.y} +1030 -294
  126. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.rb +8751 -0
  127. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.y +3472 -0
  128. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby3_parser.yy +3476 -0
  129. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rb +308 -605
  130. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rex +33 -27
  131. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rex.rb +65 -31
  132. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer_strings.rb +638 -0
  133. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_parser.rb +4 -0
  134. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_parser.yy +3487 -0
  135. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_parser_extras.rb +341 -127
  136. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/tools/munge.rb +43 -10
  137. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/tools/ripper.rb +15 -10
  138. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/History.rdoc +39 -0
  139. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/Manifest.txt +0 -0
  140. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/README.rdoc +0 -0
  141. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/composite_sexp_processor.rb +0 -0
  142. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/pt_testcase.rb +9 -4
  143. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp.rb +19 -9
  144. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp_matcher.rb +4 -7
  145. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp_processor.rb +1 -1
  146. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/strict_sexp.rb +25 -3
  147. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/unique.rb +0 -0
  148. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/CHANGES +4 -0
  149. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/Gemfile +12 -13
  150. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/LICENSE +0 -0
  151. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/README.jp.md +0 -0
  152. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/README.md +0 -0
  153. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/code_attributes.rb +0 -0
  154. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/command.rb +13 -13
  155. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/controls.rb +0 -0
  156. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/do_inserter.rb +0 -0
  157. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/embedded.rb +0 -0
  158. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/end_inserter.rb +0 -0
  159. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/engine.rb +0 -0
  160. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/erb_converter.rb +0 -0
  161. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/filter.rb +0 -0
  162. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/grammar.rb +0 -0
  163. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/include.rb +0 -0
  164. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/interpolation.rb +0 -0
  165. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less/context.rb +0 -0
  166. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less/filter.rb +0 -0
  167. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less.rb +0 -0
  168. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/parser.rb +1 -1
  169. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/escaper.rb +0 -0
  170. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/filter.rb +0 -0
  171. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/parser.rb +0 -0
  172. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart.rb +0 -0
  173. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/splat/builder.rb +0 -0
  174. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/splat/filter.rb +0 -0
  175. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/template.rb +0 -0
  176. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/translator.rb +0 -0
  177. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/version.rb +1 -1
  178. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim.rb +0 -0
  179. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/slim.gemspec +0 -0
  180. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/CHANGELOG.md +8 -0
  181. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/MIT-LICENSE.txt +0 -0
  182. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/README.md +1 -1
  183. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/data/display_width.marshal.gz +0 -0
  184. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/constants.rb +2 -2
  185. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/index.rb +0 -0
  186. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/no_string_ext.rb +0 -0
  187. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/string_ext.rb +0 -0
  188. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width.rb +0 -0
  189. data/lib/brakeman/app_tree.rb +37 -4
  190. data/lib/brakeman/checks/base_check.rb +18 -2
  191. data/lib/brakeman/checks/check_basic_auth.rb +2 -0
  192. data/lib/brakeman/checks/check_csrf_token_forgery_cve.rb +28 -0
  193. data/lib/brakeman/checks/check_deserialize.rb +21 -1
  194. data/lib/brakeman/checks/check_detailed_exceptions.rb +1 -1
  195. data/lib/brakeman/checks/check_eol_rails.rb +23 -0
  196. data/lib/brakeman/checks/check_eol_ruby.rb +26 -0
  197. data/lib/brakeman/checks/check_evaluation.rb +1 -1
  198. data/lib/brakeman/checks/check_execute.rb +12 -1
  199. data/lib/brakeman/checks/check_json_entity_escape.rb +38 -0
  200. data/lib/brakeman/checks/check_json_parsing.rb +1 -1
  201. data/lib/brakeman/checks/check_mass_assignment.rb +37 -9
  202. data/lib/brakeman/checks/check_model_attr_accessible.rb +1 -1
  203. data/lib/brakeman/checks/check_model_attributes.rb +1 -1
  204. data/lib/brakeman/checks/check_page_caching_cve.rb +37 -0
  205. data/lib/brakeman/checks/check_permit_attributes.rb +1 -1
  206. data/lib/brakeman/checks/check_regex_dos.rb +1 -1
  207. data/lib/brakeman/checks/check_render.rb +15 -1
  208. data/lib/brakeman/checks/check_sanitize_methods.rb +2 -1
  209. data/lib/brakeman/checks/check_skip_before_filter.rb +4 -4
  210. data/lib/brakeman/checks/check_sql.rb +60 -9
  211. data/lib/brakeman/checks/check_symbol_dos.rb +1 -1
  212. data/lib/brakeman/checks/check_template_injection.rb +32 -0
  213. data/lib/brakeman/checks/check_unsafe_reflection_methods.rb +68 -0
  214. data/lib/brakeman/checks/check_verb_confusion.rb +75 -0
  215. data/lib/brakeman/checks/eol_check.rb +47 -0
  216. data/lib/brakeman/commandline.rb +25 -1
  217. data/lib/brakeman/file_parser.rb +58 -22
  218. data/lib/brakeman/options.rb +39 -2
  219. data/lib/brakeman/parsers/template_parser.rb +26 -3
  220. data/lib/brakeman/processors/alias_processor.rb +132 -24
  221. data/lib/brakeman/processors/base_processor.rb +4 -4
  222. data/lib/brakeman/processors/controller_alias_processor.rb +6 -43
  223. data/lib/brakeman/processors/controller_processor.rb +1 -1
  224. data/lib/brakeman/processors/gem_processor.rb +3 -0
  225. data/lib/brakeman/processors/haml_template_processor.rb +17 -1
  226. data/lib/brakeman/processors/lib/call_conversion_helper.rb +13 -7
  227. data/lib/brakeman/processors/lib/file_type_detector.rb +64 -0
  228. data/lib/brakeman/processors/lib/find_all_calls.rb +28 -13
  229. data/lib/brakeman/processors/lib/rails3_config_processor.rb +16 -16
  230. data/lib/brakeman/processors/lib/rails3_route_processor.rb +2 -0
  231. data/lib/brakeman/processors/lib/rails4_config_processor.rb +2 -1
  232. data/lib/brakeman/processors/lib/render_helper.rb +3 -1
  233. data/lib/brakeman/processors/library_processor.rb +9 -0
  234. data/lib/brakeman/processors/model_processor.rb +32 -0
  235. data/lib/brakeman/processors/output_processor.rb +1 -1
  236. data/lib/brakeman/processors/template_alias_processor.rb +5 -0
  237. data/lib/brakeman/report/ignore/config.rb +5 -1
  238. data/lib/brakeman/report/ignore/interactive.rb +1 -1
  239. data/lib/brakeman/report/report_base.rb +0 -2
  240. data/lib/brakeman/report/report_csv.rb +37 -60
  241. data/lib/brakeman/report/report_github.rb +31 -0
  242. data/lib/brakeman/report/report_junit.rb +2 -2
  243. data/lib/brakeman/report/report_sarif.rb +133 -0
  244. data/lib/brakeman/report/report_sonar.rb +38 -0
  245. data/lib/brakeman/report/report_tabs.rb +1 -1
  246. data/lib/brakeman/report/report_text.rb +38 -17
  247. data/lib/brakeman/report.rb +19 -1
  248. data/lib/brakeman/rescanner.rb +7 -5
  249. data/lib/brakeman/scanner.rb +65 -31
  250. data/lib/brakeman/tracker/collection.rb +57 -7
  251. data/lib/brakeman/tracker/config.rb +87 -5
  252. data/lib/brakeman/tracker/constants.rb +8 -7
  253. data/lib/brakeman/tracker/controller.rb +1 -1
  254. data/lib/brakeman/tracker/method_info.rb +70 -0
  255. data/lib/brakeman/tracker.rb +42 -5
  256. data/lib/brakeman/util.rb +58 -21
  257. data/lib/brakeman/version.rb +1 -1
  258. data/lib/brakeman/warning.rb +10 -2
  259. data/lib/brakeman/warning_codes.rb +13 -0
  260. data/lib/brakeman.rb +45 -6
  261. data/lib/ruby_parser/bm_sexp.rb +33 -9
  262. metadata +201 -123
  263. data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb +0 -50
  264. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/debugging.md +0 -18
  265. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/rp_stringscanner.rb +0 -64
  266. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby20_parser.rb +0 -7042
  267. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby21_parser.rb +0 -7113
  268. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby22_parser.rb +0 -7146
  269. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby23_parser.rb +0 -7163
  270. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby24_parser.rb +0 -7175
  271. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby25_parser.rb +0 -7175
  272. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby26_parser.rb +0 -7195
  273. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.6.1/data/display_width.marshal.gz +0 -0
@@ -82,7 +82,6 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
82
82
  def replace exp, int = 0
83
83
  return exp if int > 3
84
84
 
85
-
86
85
  if replacement = env[exp] and not duplicate? replacement
87
86
  replace(replacement.deep_clone(exp.line), int + 1)
88
87
  elsif tracker and replacement = tracker.constant_lookup(exp) and not duplicate? replacement
@@ -162,6 +161,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
162
161
  ARRAY_CONST = s(:const, :Array)
163
162
  HASH_CONST = s(:const, :Hash)
164
163
  RAILS_TEST = s(:call, s(:call, s(:const, :Rails), :env), :test?)
164
+ RAILS_DEV = s(:call, s(:call, s(:const, :Rails), :env), :development?)
165
165
 
166
166
  #Process a method call.
167
167
  def process_call exp
@@ -183,11 +183,17 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
183
183
  return exp
184
184
  end
185
185
 
186
+ # If x(*[1,2,3]) change to x(1,2,3)
187
+ # if that's the only argument
188
+ if splat_array? exp.first_arg and exp.second_arg.nil?
189
+ exp.arglist = exp.first_arg[1].sexp_body
190
+ end
191
+
186
192
  target = exp.target
187
193
  method = exp.method
188
194
  first_arg = exp.first_arg
189
195
 
190
- if method == :send or method == :try
196
+ if method == :send or method == :__send__ or method == :try
191
197
  collapse_send_call exp, first_arg
192
198
  end
193
199
 
@@ -195,11 +201,20 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
195
201
  res = process_or_simple_operation(exp)
196
202
  return res if res
197
203
  elsif target == ARRAY_CONST and method == :new
198
- return Sexp.new(:array, *exp.args)
204
+ return Sexp.new(:array, *exp.args).line(exp.line)
199
205
  elsif target == HASH_CONST and method == :new and first_arg.nil? and !node_type?(@exp_context.last, :iter)
200
- return Sexp.new(:hash)
201
- elsif exp == RAILS_TEST
202
- return Sexp.new(:false)
206
+ return Sexp.new(:hash).line(exp.line)
207
+ elsif exp == RAILS_TEST or exp == RAILS_DEV
208
+ return Sexp.new(:false).line(exp.line)
209
+ end
210
+
211
+ # For the simplest case of `Foo.thing`
212
+ if node_type? target, :const and first_arg.nil?
213
+ if tracker and (klass = tracker.find_class(class_name(target.value)))
214
+ if return_value = klass.get_simple_method_return_value(:class, method)
215
+ return return_value.deep_clone(exp.line)
216
+ end
217
+ end
203
218
  end
204
219
 
205
220
  #See if it is possible to simplify some basic cases
@@ -214,13 +229,28 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
214
229
  exp = math_op(:+, target, first_arg, exp)
215
230
  end
216
231
  when :-, :*, :/
217
- exp = math_op(method, target, first_arg, exp)
232
+ if method == :* and array? target
233
+ if string? first_arg
234
+ exp = process_array_join(target, first_arg)
235
+ end
236
+ else
237
+ exp = math_op(method, target, first_arg, exp)
238
+ end
218
239
  when :[]
219
240
  if array? target
220
241
  exp = process_array_access(target, exp.args, exp)
221
242
  elsif hash? target
222
243
  exp = process_hash_access(target, first_arg, exp)
223
244
  end
245
+ when :fetch
246
+ if array? target
247
+ # Not dealing with default value
248
+ # so just pass in first argument, but process_array_access expects
249
+ # an array of arguments.
250
+ exp = process_array_access(target, [first_arg], exp)
251
+ elsif hash? target
252
+ exp = process_hash_access(target, first_arg, exp)
253
+ end
224
254
  when :merge!, :update
225
255
  if hash? target and hash? first_arg
226
256
  target = process_hash_merge! target, first_arg
@@ -237,7 +267,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
237
267
  env[target_var] = target
238
268
  return target
239
269
  elsif string? target and string_interp? first_arg
240
- exp = Sexp.new(:dstr, target.value + first_arg[1]).concat(first_arg[2..-1])
270
+ exp = Sexp.new(:dstr, target.value + first_arg[1]).concat(first_arg.sexp_body(2)).line(exp.line)
241
271
  env[target_var] = exp
242
272
  elsif string? first_arg and string_interp? target
243
273
  if string? target.last
@@ -260,6 +290,12 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
260
290
  target = find_push_target(target_var)
261
291
  env[target] = exp unless target.nil? # Happens in TemplateAliasProcessor
262
292
  end
293
+ when :push
294
+ if array? target
295
+ target << first_arg
296
+ env[target_var] = target
297
+ return target
298
+ end
263
299
  when :first
264
300
  if array? target and first_arg.nil? and sexp? target[1]
265
301
  exp = target[1]
@@ -273,7 +309,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
273
309
  exp = target
274
310
  end
275
311
  when :join
276
- if array? target and target.length > 2 and (string? first_arg or first_arg.nil?)
312
+ if array? target and (string? first_arg or first_arg.nil?)
277
313
  exp = process_array_join(target, first_arg)
278
314
  end
279
315
  when :!
@@ -281,6 +317,21 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
281
317
  if call? target and target.method == :!
282
318
  exp = s(:or, s(:true).line(exp.line), s(:false).line(exp.line)).line(exp.line)
283
319
  end
320
+ when :values
321
+ # Hash literal
322
+ if node_type? target, :hash
323
+ exp = hash_values(target)
324
+ end
325
+ when :values_at
326
+ if node_type? target, :hash
327
+ res = hash_values_at target, exp.args
328
+
329
+ # Only convert to array of values if _all_ keys
330
+ # are present in the hash.
331
+ unless res.any?(&:nil?)
332
+ exp = res
333
+ end
334
+ end
284
335
  end
285
336
 
286
337
  exp
@@ -288,7 +339,12 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
288
339
 
289
340
  # Painful conversion of Array#join into string interpolation
290
341
  def process_array_join array, join_str
291
- result = s()
342
+ # Empty array
343
+ if array.length == 1
344
+ return s(:str, '').line(array.line)
345
+ end
346
+
347
+ result = s().line(array.line)
292
348
 
293
349
  join_value = if string? join_str
294
350
  join_str.value
@@ -296,8 +352,10 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
296
352
  nil
297
353
  end
298
354
 
299
- array[1..-2].each do |e|
300
- result << join_item(e, join_value)
355
+ if array.length > 2
356
+ array[1..-2].each do |e|
357
+ result << join_item(e, join_value)
358
+ end
301
359
  end
302
360
 
303
361
  result << join_item(array.last, nil)
@@ -326,27 +384,52 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
326
384
  result.unshift combined_first
327
385
 
328
386
  # Have to fix up strings that follow interpolation
329
- result.reduce(s(:dstr)) do |memo, e|
387
+ string = result.reduce(s(:dstr).line(array.line)) do |memo, e|
330
388
  if string? e and node_type? memo.last, :evstr
331
389
  e.value = "#{join_value}#{e.value}"
332
390
  elsif join_value and node_type? memo.last, :evstr and node_type? e, :evstr
333
- memo << s(:str, join_value)
391
+ memo << s(:str, join_value).line(e.line)
334
392
  end
335
393
 
336
394
  memo << e
337
395
  end
396
+
397
+ # Convert (:dstr, "hello world")
398
+ # to (:str, "hello world")
399
+ if string.length == 2 and string.last.is_a? String
400
+ string[0] = :str
401
+ end
402
+
403
+ string
338
404
  end
339
405
 
340
406
  def join_item item, join_value
341
407
  if item.is_a? String
342
408
  "#{item}#{join_value}"
343
409
  elsif string? item or symbol? item or number? item
344
- s(:str, "#{item.value}#{join_value}")
410
+ s(:str, "#{item.value}#{join_value}").line(item.line)
345
411
  else
346
- s(:evstr, item)
412
+ s(:evstr, item).line(item.line)
347
413
  end
348
414
  end
349
415
 
416
+ TEMP_FILE_CLASS = s(:const, :Tempfile)
417
+
418
+ def temp_file_open? exp
419
+ call? exp and
420
+ exp.target == TEMP_FILE_CLASS and
421
+ exp.method == :open
422
+ end
423
+
424
+ def temp_file_new line
425
+ s(:call, TEMP_FILE_CLASS, :new).line(line)
426
+ end
427
+
428
+ def splat_array? exp
429
+ node_type? exp, :splat and
430
+ node_type? exp[1], :array
431
+ end
432
+
350
433
  def process_iter exp
351
434
  @exp_context.push exp
352
435
  exp[1] = process exp.block_call
@@ -364,6 +447,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
364
447
  # Iterating over an array of all literal values
365
448
  local = Sexp.new(:lvar, block_args.last)
366
449
  env.current[local] = safe_literal(exp.line)
450
+ elsif temp_file_open? call
451
+ local = Sexp.new(:lvar, block_args.last)
452
+ env.current[local] = temp_file_new(exp.line)
367
453
  else
368
454
  block_args.each do |e|
369
455
  #Force block arg(s) to be local
@@ -664,7 +750,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
664
750
  end
665
751
  end
666
752
  else
667
- new_value = process s(:call, s(:call, target_var, :[], index), exp[3], value)
753
+ new_value = process s(:call, s(:call, target_var, :[], index), exp[3], value).line(exp.line)
668
754
 
669
755
  env[match] = new_value
670
756
  end
@@ -723,6 +809,18 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
723
809
  exp
724
810
  end
725
811
 
812
+ def hash_or_array_include_all_literals? exp
813
+ return unless call? exp and sexp? exp.target
814
+ target = exp.target
815
+
816
+ case target.node_type
817
+ when :hash
818
+ hash_include_all_literals? exp
819
+ else
820
+ array_include_all_literals? exp
821
+ end
822
+ end
823
+
726
824
  # Check if exp is a call to Array#include? on an array literal
727
825
  # that contains all literal values. For example:
728
826
  #
@@ -731,14 +829,24 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
731
829
  def array_include_all_literals? exp
732
830
  call? exp and
733
831
  exp.method == :include? and
734
- all_literals? exp.target
832
+ (all_literals? exp.target or dir_glob? exp.target)
735
833
  end
736
834
 
737
835
  def array_detect_all_literals? exp
738
836
  call? exp and
739
837
  [:detect, :find].include? exp.method and
740
838
  exp.first_arg.nil? and
741
- all_literals? exp.target
839
+ (all_literals? exp.target or dir_glob? exp.target)
840
+ end
841
+
842
+ # Check if exp is a call to Hash#include? on a hash literal
843
+ # that contains all literal values. For example:
844
+ #
845
+ # {x: 1}.include? x
846
+ def hash_include_all_literals? exp
847
+ call? exp and
848
+ exp.method == :include? and
849
+ all_literals? exp.target, :hash
742
850
  end
743
851
 
744
852
  #Sets @inside_if = true
@@ -781,7 +889,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
781
889
  scope do
782
890
  @branch_env = env.current
783
891
  branch_index = 2 + i # s(:if, condition, then_branch, else_branch)
784
- if i == 0 and array_include_all_literals? condition
892
+ if i == 0 and hash_or_array_include_all_literals? condition
785
893
  # If the condition is ["a", "b"].include? x
786
894
  # set x to "a" inside the true branch
787
895
  var = condition.first_arg
@@ -789,7 +897,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
789
897
  env.current[var] = safe_literal(var.line)
790
898
  exp[branch_index] = process_if_branch branch
791
899
  env.current[var] = previous_value
792
- elsif i == 1 and array_include_all_literals? condition and early_return? branch
900
+ elsif i == 1 and hash_or_array_include_all_literals? condition and early_return? branch
793
901
  var = condition.first_arg
794
902
  env.current[var] = safe_literal(var.line)
795
903
  exp[branch_index] = process_if_branch branch
@@ -942,7 +1050,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
942
1050
  args = exp.args
943
1051
  exp.pop # remove last arg
944
1052
  if args.length > 1
945
- exp.arglist = args[1..-1]
1053
+ exp.arglist = args.sexp_body
946
1054
  end
947
1055
  end
948
1056
 
@@ -987,8 +1095,8 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
987
1095
  method_name = call.method
988
1096
 
989
1097
  #Look for helper methods and see if we can get a return value
990
- if found_method = find_method(method_name, @current_class)
991
- helper = found_method[:method]
1098
+ if found_method = tracker.find_method(method_name, @current_class)
1099
+ helper = found_method.src
992
1100
 
993
1101
  if sexp? helper
994
1102
  value = process_helper_method helper, call.args
@@ -8,7 +8,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
8
8
  include Brakeman::SafeCallHelper
9
9
  include Brakeman::Util
10
10
 
11
- IGNORE = Sexp.new :ignore
11
+ IGNORE = Sexp.new(:ignore).line(0)
12
12
 
13
13
  #Return a new Processor.
14
14
  def initialize tracker
@@ -216,7 +216,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
216
216
  #
217
217
  #And also :layout for inside templates
218
218
  def find_render_type call, in_view = false
219
- rest = Sexp.new(:hash)
219
+ rest = Sexp.new(:hash).line(call.line)
220
220
  type = nil
221
221
  value = nil
222
222
  first_arg = call.first_arg
@@ -236,7 +236,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
236
236
  end
237
237
  elsif first_arg.is_a? Symbol or first_arg.is_a? String
238
238
  type = :action
239
- value = Sexp.new(:lit, first_arg.to_sym)
239
+ value = Sexp.new(:lit, first_arg.to_sym).line(call.line)
240
240
  elsif first_arg.nil?
241
241
  type = :default
242
242
  elsif not hash? first_arg
@@ -293,6 +293,6 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
293
293
  @tracker.processor.process_template(template_name, ast, type, nil, @current_file)
294
294
  @tracker.processor.process_template_alias(@tracker.templates[template_name])
295
295
 
296
- return s(:lit, template_name), options
296
+ return s(:lit, template_name).line(value.line), options
297
297
  end
298
298
  end
@@ -51,7 +51,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
51
51
  #Need to process the method like it was in a controller in order
52
52
  #to get the renders set
53
53
  processor = Brakeman::ControllerProcessor.new(@tracker, mixin.file)
54
- method = mixin.get_method(name)[:src].deep_clone
54
+ method = mixin.get_method(name).src.deep_clone
55
55
 
56
56
  if node_type? method, :defn
57
57
  method = processor.process_defn method
@@ -143,16 +143,16 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
143
143
  #Basically, adds any instance variable assignments to the environment.
144
144
  #TODO: method arguments?
145
145
  def process_before_filter name
146
- filter = find_method name, @current_class
146
+ filter = tracker.find_method name, @current_class
147
147
 
148
148
  if filter.nil?
149
149
  Brakeman.debug "[Notice] Could not find filter #{name}"
150
150
  return
151
151
  end
152
152
 
153
- method = filter[:method]
153
+ method = filter.src
154
154
 
155
- if ivars = @tracker.filter_cache[[filter[:controller], name]]
155
+ if ivars = @tracker.filter_cache[[filter.owner, name]]
156
156
  ivars.each do |variable, value|
157
157
  env[variable] = value
158
158
  end
@@ -162,7 +162,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
162
162
 
163
163
  ivars = processor.only_ivars(:include_request_vars).all
164
164
 
165
- @tracker.filter_cache[[filter[:controller], name]] = ivars
165
+ @tracker.filter_cache[[filter.owner, name]] = ivars
166
166
 
167
167
  ivars.each do |variable, value|
168
168
  env[variable] = value
@@ -182,7 +182,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
182
182
  # method as the line number
183
183
  if line.nil? and controller = @tracker.controllers[@current_class]
184
184
  if meth = controller.get_method(@current_method)
185
- if line = meth[:src] && meth[:src].last && meth[:src].last.line
185
+ if line = meth.src && meth.src.last && meth.src.last.line
186
186
  line += 1
187
187
  else
188
188
  line = 1
@@ -241,41 +241,4 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
241
241
  []
242
242
  end
243
243
  end
244
-
245
- #Finds a method in the given class or a parent class
246
- #
247
- #Returns nil if the method could not be found.
248
- #
249
- #If found, returns hash table with controller name and method sexp.
250
- def find_method method_name, klass
251
- return nil if sexp? method_name
252
- method_name = method_name.to_sym
253
-
254
- if method = @method_cache[method_name]
255
- return method
256
- end
257
-
258
- controller = @tracker.controllers[klass]
259
- controller ||= @tracker.libs[klass]
260
-
261
- if klass and controller
262
- method = controller.get_method method_name
263
-
264
- if method.nil?
265
- controller.includes.each do |included|
266
- method = find_method method_name, included
267
- if method
268
- @method_cache[method_name] = method
269
- return method
270
- end
271
- end
272
-
273
- @method_cache[method_name] = find_method method_name, controller.parent
274
- else
275
- @method_cache[method_name] = { :controller => controller.name, :method => method[:src] }
276
- end
277
- else
278
- nil
279
- end
280
- end
281
244
  end
@@ -202,7 +202,7 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
202
202
  end
203
203
 
204
204
  if node_type? exp.block, :block
205
- block_inner = exp.block[1..-1]
205
+ block_inner = exp.block.sexp_body
206
206
  else
207
207
  block_inner = [exp.block]
208
208
  end
@@ -6,6 +6,7 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
6
6
  def initialize *args
7
7
  super
8
8
  @gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
9
+ @ruby_version = /^\s+ruby (\d\.\d.\d+)/
9
10
  end
10
11
 
11
12
  def process_gems gem_files
@@ -95,6 +96,8 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
95
96
  def set_gem_version_and_file line, file, line_num
96
97
  if line =~ @gem_name_version
97
98
  @tracker.config.add_gem $1, $2, file, line_num
99
+ elsif line =~ @ruby_version
100
+ @tracker.config.set_ruby_version $1
98
101
  end
99
102
  end
100
103
  end
@@ -8,6 +8,7 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
8
8
  HAML_HELPERS2 = s(:colon2, s(:colon3, :Haml), :Helpers)
9
9
  JAVASCRIPT_FILTER = s(:colon2, s(:colon2, s(:const, :Haml), :Filters), :Javascript)
10
10
  COFFEE_FILTER = s(:colon2, s(:colon2, s(:const, :Haml), :Filters), :Coffee)
11
+ ATTRIBUTE_BUILDER = s(:colon2, s(:colon3, :Haml), :AttributeBuilder)
11
12
 
12
13
  def initialize *args
13
14
  super
@@ -76,6 +77,13 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
76
77
  end
77
78
  end
78
79
 
80
+ ESCAPE_METHODS = [
81
+ :html_escape,
82
+ :html_escape_without_haml_xss,
83
+ :escape_once,
84
+ :escape_once_without_haml_xss
85
+ ]
86
+
79
87
  def get_pushed_value exp, default = :output
80
88
  return exp unless sexp? exp
81
89
 
@@ -105,7 +113,7 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
105
113
  when :call
106
114
  if exp.method == :to_s or exp.method == :strip
107
115
  get_pushed_value(exp.target, default)
108
- elsif haml_helpers? exp.target and exp.method == :html_escape
116
+ elsif haml_helpers? exp.target and ESCAPE_METHODS.include? exp.method
109
117
  get_pushed_value(exp.first_arg, :escaped_output)
110
118
  elsif @javascript and (exp.method == :j or exp.method == :escape_javascript) # TODO: Remove - this is not safe
111
119
  get_pushed_value(exp.first_arg, :escaped_output)
@@ -126,6 +134,8 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
126
134
 
127
135
  get_pushed_value(exp.first_arg, default)
128
136
  @javascript = false
137
+ elsif haml_attribute_builder? exp
138
+ ignore # probably safe... seems escaped by default?
129
139
  else
130
140
  add_output exp, default
131
141
  end
@@ -147,6 +157,12 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
147
157
  exp.method == :attributes
148
158
  end
149
159
 
160
+ def haml_attribute_builder? exp
161
+ call? exp and
162
+ exp.target == ATTRIBUTE_BUILDER and
163
+ exp.method == :build
164
+ end
165
+
150
166
  def fix_textareas? exp
151
167
  call? exp and
152
168
  exp.target == HAMLOUT and
@@ -1,16 +1,10 @@
1
1
  module Brakeman
2
2
  module CallConversionHelper
3
- def all_literals? exp, expected_type = :array
4
- node_type? exp, expected_type and
5
- exp.length > 1 and
6
- exp.all? { |e| e.is_a? Symbol or node_type? e, :lit, :str }
7
- end
8
-
9
3
  # Join two array literals into one.
10
4
  def join_arrays lhs, rhs, original_exp = nil
11
5
  if array? lhs and array? rhs
12
6
  result = Sexp.new(:array)
13
- result.line(lhs.line || rhs.line)
7
+ result.line(lhs.line || rhs.line || 1)
14
8
  result.concat lhs[1..-1]
15
9
  result.concat rhs[1..-1]
16
10
  result
@@ -76,6 +70,8 @@ module Brakeman
76
70
 
77
71
  #Have to do this because first element is :array and we have to skip it
78
72
  array[1..-1][index] or original_exp
73
+ elsif all_literals? array
74
+ safe_literal(array.line)
79
75
  else
80
76
  original_exp
81
77
  end
@@ -92,5 +88,15 @@ module Brakeman
92
88
  original_exp
93
89
  end
94
90
  end
91
+
92
+ # You must check the return value for `nil`s -
93
+ # which indicate a key could not be found.
94
+ def hash_values_at hash, keys
95
+ values = keys.map do |key|
96
+ process_hash_access hash, key
97
+ end
98
+
99
+ Sexp.new(:array).concat(values).line(hash.line)
100
+ end
95
101
  end
96
102
  end
@@ -0,0 +1,64 @@
1
+ module Brakeman
2
+ class FileTypeDetector < BaseProcessor
3
+ def initialize
4
+ super(nil)
5
+ reset
6
+ end
7
+
8
+ def detect_type(file)
9
+ reset
10
+ process(file.ast)
11
+
12
+ if @file_type.nil?
13
+ @file_type = guess_from_path(file.path.relative)
14
+ end
15
+
16
+ @file_type || :libs
17
+ end
18
+
19
+ MODEL_CLASSES = [
20
+ :'ActiveRecord::Base',
21
+ :ApplicationRecord
22
+ ]
23
+
24
+ def process_class exp
25
+ name = class_name(exp.class_name)
26
+ parent = class_name(exp.parent_name)
27
+
28
+ if name.match(/Controller$/)
29
+ @file_type = :controllers
30
+ return exp
31
+ elsif MODEL_CLASSES.include? parent
32
+ @file_type = :models
33
+ return exp
34
+ end
35
+
36
+ super
37
+ end
38
+
39
+ def guess_from_path path
40
+ case
41
+ when path.include?('app/models')
42
+ :models
43
+ when path.include?('app/controllers')
44
+ :controllers
45
+ when path.include?('config/initializers')
46
+ :initializers
47
+ when path.include?('lib/')
48
+ :libs
49
+ when path.match?(%r{config/environments/(?!production\.rb)$})
50
+ :skip
51
+ when path.match?(%r{environments/production\.rb$})
52
+ :skip
53
+ when path.match?(%r{application\.rb$})
54
+ :skip
55
+ end
56
+ end
57
+
58
+ private
59
+
60
+ def reset
61
+ @file_type = nil
62
+ end
63
+ end
64
+ end